apiVersion: apps/v1
kind: Deployment
metadata:
  name: mediamtx
  namespace: mediamtx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mediamtx
  template:
    metadata:
      labels:
        app: mediamtx
    spec:
      hostNetwork: true
      imagePullSecrets:
        - name: forgejo-registry
      containers:
        - name: mediamtx
          image: {{ .Values.mediamtx.image }}
          command: ["/bin/sh", "-c"]
          args:
            - |
              sed "s|__PUBLISH_PASSWORD__|$PUBLISH_PASSWORD|g" /etc/mediamtx/mediamtx.yml > /tmp/mediamtx.yml
              exec /mediamtx /tmp/mediamtx.yml
          env:
            - name: HOOK_TOKEN
              valueFrom:
                secretKeyRef:
                  name: zoitestream-secrets
                  key: HOOK_TOKEN
            - name: PUBLISH_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: zoitestream-secrets
                  key: PUBLISH_PASSWORD
          ports:
            - name: rtmp
              containerPort: {{ .Values.mediamtx.rtmpPort }}
            - name: webrtc-http
              containerPort: {{ .Values.mediamtx.webrtcHttpPort }}
            - name: webrtc-udp
              containerPort: {{ .Values.mediamtx.webrtcUdpPort }}
              protocol: UDP
          volumeMounts:
            - name: config
              mountPath: /etc/mediamtx/mediamtx.yml
              subPath: mediamtx.yml
        - name: zoitestream
          image: "{{ .Values.registry.host }}/{{ .Values.registry.user }}/zoitestream:latest"
          env:
            - name: DOMAIN
              value: "stream.{{ .Values.domain }}"
            - name: RTMP_PORT
              value: "{{ .Values.mediamtx.rtmpPort }}"
            - name: PUBLISH_USER
              value: {{ .Values.publishUser }}
            - name: STATE_DB_PATH
              value: /data/zoitestream.db
          envFrom:
            - secretRef:
                name: zoitestream-secrets
          ports:
            - name: http
              containerPort: 5000
          readinessProbe:
            httpGet:
              path: /health
              port: 5000
            initialDelaySeconds: 3
          livenessProbe:
            httpGet:
              path: /health
              port: 5000
            initialDelaySeconds: 10
          volumeMounts:
            - name: data
              mountPath: /data
      volumes:
        - name: config
          configMap:
            name: mediamtx-config
        - name: data
          hostPath:
            path: /var/local/appdata/zoitestream
            type: DirectoryOrCreate
---
# HTTP-only Service (landing page + API), routed through ingress-nginx
apiVersion: v1
kind: Service
metadata:
  name: zoitestream
  namespace: mediamtx
spec:
  selector:
    app: mediamtx
  ports:
    - port: 80
      targetPort: 5000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: zoitestream
  namespace: mediamtx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - stream.{{ .Values.domain }}
      secretName: zoitestream-tls
  rules:
    - host: stream.{{ .Values.domain }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: zoitestream
                port:
                  number: 80