apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: artista-modelcamp-postgres
  namespace: artista
spec:
  serviceName: artista-modelcamp-postgres
  replicas: 1
  selector:
    matchLabels:
      app: artista-modelcamp-postgres
  template:
    metadata:
      labels:
        app: artista-modelcamp-postgres
    spec:
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 120   # sauber herunterfahren vor dem Aushaengen
      securityContext:
        runAsNonRoot: true
        runAsUser: 70
        runAsGroup: 70
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: postgres
          image: postgres:18.6-alpine
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_USER
              value: artista
            - name: POSTGRES_DB
              value: artista
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef: { name: artista-modelcamp-secrets, key: DB_PASSWORD }
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql
          readinessProbe:
            exec: { command: ["pg_isready", "-U", "artista"] }
            periodSeconds: 5
          resources:
            requests: { cpu: "0", memory: "0" }
            limits: { memory: 1Gi }
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: { drop: ["ALL"] }
      volumes:
        - name: data
          persistentVolumeClaim: { claimName: artista-modelcamp-postgres }
---
apiVersion: v1
kind: Service
metadata:
  name: artista-modelcamp-postgres
  namespace: artista
spec:
  clusterIP: None
  selector:
    app: artista-modelcamp-postgres
  ports:
    - port: 5432