apiVersion: v1
kind: Pod

metadata:
  name: domino12
  namespace: default

  labels:
    app: hcl-domino

spec:
  imagePullSecrets:
  - name: regcred

  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    fsGroupChangePolicy: "OnRootMismatch"

  containers:

  - env:
    - name: LANG
      value: "en_US.UTF-8"

    - name: DOMINO_DOCKER_STDOUT
      value: "yes"

    - name: SetupAutoConfigure
      value: "1"

    - name: SERVERSETUP_SERVER_TYPE
      value: first

    - name: SERVERSETUP_ADMIN_FIRSTNAME
      value: "Martin"

    - name: SERVERSETUP_ADMIN_LASTNAME
      value: "Bishop"

    - name: SERVERSETUP_ADMIN_PASSWORD
      value: "2manysecrets"

    - name: SERVERSETUP_ADMIN_IDFILEPATH
      value: "/local/notesdata/domino/html/admin.id"

    - name: SERVERSETUP_NETWORK_HOSTNAME
      value: "master.domino-lab.net"

    - name: SERVERSETUP_ORG_CERTIFIERPASSWORD
      value: "2manysecrets"

    - name: SERVERSETUP_SERVER_DOMAINNAME
      value: "DominoLab"

    - name: SERVERSETUP_ORG_ORGNAME
      value: "DominoLab"

    - name: SERVERSETUP_SERVER_NAME
      value: "master.domino.lab"

    - name: SERVERSETUP_SERVER_SERVERTASKS
      value: "replica,router,update,amgr,adminp,http,certmgr -ACCEPT_TOU_AUTO_CONFIG"

    - name: SERVERSETUP_SECURITY_ACL_PROHIBITANONYMOUSACCESS
      value: "true"

    - name: SERVERSETUP_SECURITY_ACL_ADDLOCALDOMAINADMINS
      value: "true"

    name: domino12
    image: registry.domino-lab.net:5000/hclcom/domino:latest

    securityContext:
      capabilities:
        add: ["SYS_PTRACE"]
      runAsNonRoot: true
      runAsUser: 1000

    volumeMounts:
    - name: domino-data
      mountPath: /local

    ports:
    - containerPort: 1352
      protocol: TCP
    - containerPort: 80
      protocol: TCP
    - containerPort: 443
      protocol: TCP

    livenessProbe:
      exec:
        command:
        - /domino_docker_healthcheck.sh

      initialDelaySeconds: 60
      periodSeconds: 20

    readinessProbe:
      exec:
        command:
        - /domino_docker_healthcheck.sh
        - ready

      initialDelaySeconds: 60
      periodSeconds: 20


  # this init container is a work-around to change file-system permissions for some local stoarge providers
  initContainers:
  - name: domino-startup
    image: busybox:latest

    command: [ 'sh', '-c', 'chmod 777 /local' ]

    securityContext:
      privileged: true
      runAsNonRoot: false
      runAsUser: 0

    volumeMounts:
    - name: domino-data
      mountPath: /local


  volumes:
  - name: domino-data
    persistentVolumeClaim:
      claimName: local-path-pvc

