nixos-servers/kubenix-modules/kitchenowl.nix

{
  kubernetes.resources = {
    secrets.kitchenowl.stringData.jwtSecretKey = "ref+sops://secrets/kubernetes.yaml#/kitchenowl/jwtSecretKey";

    deployments.kitchenowl = {
      metadata.labels.app = "kitchenowl";

      spec = {
        selector.matchLabels.app = "kitchenowl";

        template = {
          metadata.labels.app = "kitchenowl";

          spec = {
            volumes.data.persistentVolumeClaim.claimName = "kitchenowl";

            containers.kitchenowl = {
              image = "tombursch/kitchenowl:v0.5.1";
              ports.web.containerPort = 8080;

              env.JWT_SECRET_KEY.valueFrom.secretKeyRef = {
                name = "kitchenowl";
                key = "jwtSecretKey";
              };

              volumeMounts = [{
                name = "data";
                mountPath = "/data";
              }];
            };

            securityContext = {
              fsGroup = 0;
              fsGroupChangePolicy = "OnRootMismatch";
            };
          };
        };
      };
    };

    services.kitchenowl.spec = {
      selector.app = "kitchenowl";

      ports.web = {
        port = 80;
        targetPort = "web";
      };
    };
  };

  lab = {
    ingresses.kitchenowl = {
      host = "boodschappen.kun.is";

      service = {
        name = "kitchenowl";
        portName = "web";
      };
    };
  };
}