apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: syncthing
  namespace: syncthing
spec:
  interval: 10m
  chartRef:
    kind: OCIRepository
    name: syncthing
  driftDetection:
    mode: enabled
  values:
    controllers:
      app:
        containers:
          app:
            image:
              repository: syncthing/syncthing
              tag: "2.1.3"
            env:
              TZ: Europe/Moscow
            probes:
              liveness:
                enabled: true
              readiness:
                enabled: true

    service:
      app:
        controller: app
        ports:
          http:
            port: 8384

    ingress:
      app:
        className: traefik
        # the GUI has no auth of its own out of the box, so it's gated
        # behind Authelia the same way fava/zigbee2mqtt are.
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
          traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
        hosts:
          - host: sync.aggtaa.com
            paths:
              - path: /
                pathType: Prefix
                service:
                  identifier: app
                  port: http
        tls:
          - secretName: syncthing-tls
            hosts:
              - sync.aggtaa.com

    persistence:
      data:
        type: persistentVolumeClaim
        accessMode: ReadWriteOnce
        size: 1Gi
        storageClass: longhorn
        retain: true
        globalMounts:
          - path: /var/syncthing
      # same nfs-ganesha export webdav and markdown-vault-mcp use
      # (10.0.64.5:/export); mounted at the same container path (/data)
      # as webdav so the layout matches (/data/shared/documents/...).
      shared:
        type: persistentVolumeClaim
        existingClaim: syncthing-shared
        globalMounts:
          - path: /data