apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: nfs-photo
  namespace: nfs
spec:
  interval: 30m
  chartRef:
    kind: OCIRepository
    name: nfs-photo
  driftDetection:
    mode: enabled
  values:
    controllers:
      app:
        strategy: Recreate
        podDisruptionBudget:
          maxUnavailable: "0"
        initContainers:
          fix-permissions:
            image:
              repository: hectorm/nfs-ganesha
              tag: v10
            command:
              - sh
              - -c
              - chmod -R a+rwX /disks/base /disks/sub1
          mtab-setup:
            image:
              repository: hectorm/nfs-ganesha
              tag: v10
            command:
              - sh
              - -c
              - cat /proc/self/mounts > /mtab-vol/mtab
        containers:
          # mounts the two disks and exposes their union at /disks/merged via FUSE;
          # bidirectional propagation makes that mount visible to the "app"
          # (ganesha) container so it can export it over NFS.
          mergerfs:
            image:
              repository: ghcr.io/hotio/mergerfs
              tag: release-v2.42.0
            args:
              - "-o"
              - "allow_other,use_ino,func.create=ff,category.action=all,category.create=ff,category.search=ff"
              - "/disks/base:/disks/sub1"
              - "/disks/merged"
            securityContext:
              privileged: true
            resources:
              requests:
                cpu: 50m
                memory: 64Mi
              limits:
                memory: 512Mi
          app:
            image:
              repository: hectorm/nfs-ganesha
              tag: v10
            securityContext:
              readOnlyRootFilesystem: true
              capabilities:
                drop:
                  - ALL
                add:
                  - CHOWN
                  - DAC_OVERRIDE
                  - DAC_READ_SEARCH
                  - FOWNER
                  - FSETID
                  - SETGID
                  - SETUID
                  - SYS_RESOURCE
            probes:
              liveness:
                enabled: true
                spec:
                  initialDelaySeconds: 2
                  periodSeconds: 10
                  timeoutSeconds: 2
                  failureThreshold: 3
              readiness:
                enabled: true
                spec:
                  initialDelaySeconds: 1
                  periodSeconds: 2
                  timeoutSeconds: 1
                  failureThreshold: 2
            resources:
              requests:
                cpu: 50m
                memory: 128Mi
              limits:
                memory: 512Mi

    service:
      app:
        controller: app
        # cluster-internal only, consumed by webdav via
        # nfs-photo.nfs.svc.cluster.local
        type: ClusterIP
        ports:
          nfs:
            port: 2049
            protocol: TCP

    persistence:
      config:
        type: configMap
        name: nfs-photo-config
        globalMounts:
          - path: /etc/ganesha/ganesha.conf
            subPath: ganesha.conf
            readOnly: true
      base:
        type: persistentVolumeClaim
        accessMode: ReadWriteOnce
        size: 100Gi
        storageClass: longhorn
        retain: true
        advancedMounts:
          app:
            mergerfs:
              - path: /disks/base
            fix-permissions:
              - path: /disks/base
      sub1:
        type: persistentVolumeClaim
        accessMode: ReadWriteOnce
        size: 100Gi
        storageClass: longhorn
        retain: true
        advancedMounts:
          app:
            mergerfs:
              - path: /disks/sub1
            fix-permissions:
              - path: /disks/sub1
      merged:
        type: emptyDir
        advancedMounts:
          app:
            mergerfs:
              - path: /disks/merged
                mountPropagation: Bidirectional
            app:
              - path: /export
                mountPropagation: HostToContainer
      dev-fuse:
        type: hostPath
        hostPath: /dev/fuse
        advancedMounts:
          app:
            mergerfs:
              - path: /dev/fuse
      run:
        type: emptyDir
        globalMounts:
          - path: /run
      tmp:
        type: emptyDir
        globalMounts:
          - path: /tmp
      recovery:
        type: emptyDir
        globalMounts:
          - path: /recovery
      etc-mtab:
        type: emptyDir
        advancedMounts:
          app:
            app:
              - path: /etc/mtab
                subPath: mtab
            mtab-setup:
              - path: /mtab-vol