# Bot + scheduler en un pod (PLAN §Fase 6). El Secret roswell-secrets se crea
# imperativamente (nunca en git):
#   kubectl create secret generic roswell-secrets -n roswell \
#     --from-literal=telegram-bot-token=... \
#     --from-literal=telegram-allowed-users=... \
#     --from-literal=anthropic-api-key=... \
#     --from-literal=database-url=postgresql://roswell:<pass>@postgres.roswell.svc.cluster.local:5432/roswell \
#     --from-literal=podcastindex-key=... \
#     --from-literal=podcastindex-secret=...
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    # ArgoCD no debe podar este PVC: guarda la caché del modelo Whisper (~3GB)
    # y los PDFs subidos por Telegram.
    argocd.argoproj.io/sync-options: Prune=false
  name: roswell-data
  namespace: roswell
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 10Gi

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: roswell
  namespace: roswell
  labels:
    app: roswell
spec:
  replicas: 1
  # Dos pods haciendo polling del mismo token de Telegram entran en conflicto:
  # Recreate garantiza que el viejo muere antes de arrancar el nuevo.
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: roswell
  template:
    metadata:
      labels:
        app: roswell
    spec:
      containers:
        - name: roswell
          # Tag placeholder: el workflow de Gitea Actions lo sustituye por el
          # sha8 real en cada build (ver .gitea/workflows/build.yml del repo).
          image: git.chemavx.xyz/chemavx/roswell-corpus:79a0a396
          imagePullPolicy: Always
          env:
            - name: TELEGRAM_BOT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: roswell-secrets
                  key: telegram-bot-token
            - name: TELEGRAM_ALLOWED_USERS
              valueFrom:
                secretKeyRef:
                  name: roswell-secrets
                  key: telegram-allowed-users
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: roswell-secrets
                  key: anthropic-api-key
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: roswell-secrets
                  key: database-url
            - name: PODCASTINDEX_KEY
              valueFrom:
                secretKeyRef:
                  name: roswell-secrets
                  key: podcastindex-key
            - name: PODCASTINDEX_SECRET
              valueFrom:
                secretKeyRef:
                  name: roswell-secrets
                  key: podcastindex-secret
            - name: OLLAMA_URL
              value: "http://ollama.ollama.svc.cluster.local:11434"
            - name: SEARXNG_URL
              value: "http://searxng-svc.researchowl.svc.cluster.local:8080"
            - name: WHISPER_MODEL
              value: "large-v3"
            - name: WHISPER_DEVICE
              value: "cpu"
            - name: DATA_DIR
              value: "/data"
            - name: FEED_CHECK_HOURS
              value: "24"
            # Caché de modelos Whisper en el PVC: la descarga (~3GB) sobrevive
            # a los redeploys.
            - name: HF_HOME
              value: "/data/hf-cache"
          volumeMounts:
            - name: data
              mountPath: /data
          resources:
            requests:
              memory: "512Mi"
              cpu: "500m"
            limits:
              # Whisper large-v3 en CPU ≈ 3-4 GB (PLAN §10). Sin límite de CPU:
              # la transcripción aprovecha los cores libres del nodo.
              memory: "4Gi"
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: roswell-data
      imagePullSecrets:
        - name: gitea-registry