apiVersion: apps/v1
kind: Deployment
metadata:
  name: evcc
  namespace: evcc
  labels:
    app.kubernetes.io/name: evcc
  annotations:
    # The MQTT client certificate reaches evcc as env (below), which does not
    # follow a renewal. cert-manager renews it every ~60 days; Reloader then
    # restarts evcc so it picks up the new PEMs before the old ones expire.
    secret.reloader.stakater.com/reload: mqtt-evcc-client-tls
spec:
  replicas: 1
  # RWO PVC (`evcc-data`, ceph-block) can't be mounted twice, so the
  # RollingUpdate surge pod would hang in ContainerCreating. Recreate
  # releases the volume from the old pod first (same rationale as gatus).
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: evcc
  template:
    metadata:
      labels:
        app.kubernetes.io/name: evcc
    spec:
      enableServiceLinks: false
      containers:
        - name: evcc
          image: evcc/evcc:0.317.1@sha256:c50cd4f83c22b39722a76a76b8d428b69bf8ab3334209ed9ed24ec0e3c48dde5
          # evcc auto-discovers /etc/evcc.yaml on its default search path;
          # the file is delivered (with the MQTT password) via the
          # sops-encrypted evcc-config Secret mounted below.
          env:
            - name: TZ
              value: Europe/Berlin
            # MQTT by client certificate (register account evcc-client,
            # REN-953) on the mTLS listener. These override the mqtt block of
            # evcc.yaml (viper AutomaticEnv, checked against 0.316.2); the
            # file's user/password are ignored there, as the broker takes the
            # username from the certificate CN. evcc wants the PEM text, not
            # a path.
            - name: EVCC_MQTT_BROKER
              value: tls://mosquitto.home-assistant.svc.cluster.local:8884
            - name: EVCC_MQTT_CACERT
              valueFrom:
                secretKeyRef:
                  name: mqtt-evcc-client-tls
                  key: ca.crt
            - name: EVCC_MQTT_CLIENTCERT
              valueFrom:
                secretKeyRef:
                  name: mqtt-evcc-client-tls
                  key: tls.crt
            - name: EVCC_MQTT_CLIENTKEY
              valueFrom:
                secretKeyRef:
                  name: mqtt-evcc-client-tls
                  key: tls.key
          ports:
            - name: http
              containerPort: 7070
          volumeMounts:
            - name: config
              mountPath: /etc/evcc.yaml
              subPath: evcc.yaml
              readOnly: true
            - name: data
              mountPath: /root/.evcc
          livenessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 15
            periodSeconds: 30
          readinessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              memory: 512Mi
      volumes:
        - name: config
          secret:
            secretName: evcc-config
        - name: data
          persistentVolumeClaim:
            claimName: evcc-data
---
apiVersion: v1
kind: Service
metadata:
  name: evcc
  namespace: evcc
  labels:
    app.kubernetes.io/name: evcc
spec:
  selector:
    app.kubernetes.io/name: evcc
  ports:
    - name: http
      port: 7070
      targetPort: http
      protocol: TCP