# Healthchecks - Self-hosted cron/backup monitoring with dead man's switch
# Dashboard: https://status.felhom.eu
# Ping endpoint: https://status.felhom.eu/ping/<uuid>
#
# Customer servers ping this after successful backup.
# If a ping is missed, Healthchecks sends email alerts.
#
# After deploying, create superuser:
#   kubectl exec -it -n felhom-system deploy/healthchecks -- python manage.py createsuperuser
#
# SMTP: Configure the Secret below with your email provider credentials.
#   Recommended free options:
#   - Resend.com (3000 emails/month free, easy setup)
#   - Brevo/Sendinblue (300 emails/day free)
#   - SMTP2GO (1000 emails/month free)
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: healthchecks-data
  namespace: felhom-system
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: longhorn
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: healthchecks
  namespace: felhom-system
  labels:
    app: healthchecks
spec:
  replicas: 1
  selector:
    matchLabels:
      app: healthchecks
  template:
    metadata:
      labels:
        app: healthchecks
    spec:
      securityContext:
        fsGroup: 999
      containers:
        - name: healthchecks
          image: healthchecks/healthchecks:v4.2
          ports:
            - containerPort: 8000
          env:
            # --- Site settings ---
            - name: SITE_ROOT
              value: "https://status.felhom.eu"
            - name: SITE_NAME
              value: "Felhom Monitoring"
            - name: ALLOWED_HOSTS
              value: "status.felhom.eu"
            - name: PING_ENDPOINT
              value: "https://status.felhom.eu/ping/"
            - name: DEBUG
              value: "False"
            - name: REGISTRATION_OPEN
              value: "False"
            - name: DB
              value: "sqlite"
            - name: DB_NAME
              value: "/data/hc.sqlite"
            - name: TZ
              value: "Europe/Budapest"

            # --- Secrets (from Secret) ---
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: SECRET_KEY
            - name: SUPERUSER_EMAIL
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: SUPERUSER_EMAIL
            - name: SUPERUSER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: SUPERUSER_PASSWORD
            - name: EMAIL_HOST
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: EMAIL_HOST
            - name: EMAIL_PORT
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: EMAIL_PORT
            - name: EMAIL_HOST_USER
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: EMAIL_HOST_USER
            - name: EMAIL_HOST_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: EMAIL_HOST_PASSWORD
            - name: EMAIL_USE_TLS
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: EMAIL_USE_TLS
            - name: EMAIL_USE_VERIFICATION
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: EMAIL_USE_VERIFICATION
            - name: DEFAULT_FROM_EMAIL
              valueFrom:
                secretKeyRef:
                  name: healthchecks-config
                  key: DEFAULT_FROM_EMAIL
          volumeMounts:
            - name: data
              mountPath: /data
          resources:
            requests:
              memory: "128Mi"
              cpu: "50m"
            limits:
              memory: "512Mi"
              cpu: "500m"
          livenessProbe:
            httpGet:
              path: /api/v3/status/
              port: 8000
              httpHeaders:
                - name: Host
                  value: status.felhom.eu
            initialDelaySeconds: 30
            periodSeconds: 60
          readinessProbe:
            httpGet:
              path: /api/v3/status/
              port: 8000
              httpHeaders:
                - name: Host
                  value: status.felhom.eu
            initialDelaySeconds: 10
            periodSeconds: 10
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: healthchecks-data
---
apiVersion: v1
kind: Service
metadata:
  name: healthchecks
  namespace: felhom-system
spec:
  selector:
    app: healthchecks
  ports:
    - port: 80
      targetPort: 8000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: healthchecks
  namespace: felhom-system
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx-internal
  tls:
    - hosts:
        - status.felhom.eu
      secretName: healthchecks-tls
  rules:
    - host: status.felhom.eu
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: healthchecks
                port:
                  number: 80