apiVersion: apps/v1
kind: Deployment
metadata:
  name: tts-gateway
  namespace: home-services
  labels:
    app: tts-gateway
spec:
  replicas: 1
  # nik-gpu only has 1 nvidia.com/gpu allocatable - the default RollingUpdate
  # strategy tries to schedule the new pod before killing the old one, which
  # deadlocks forever waiting for a GPU that's still held by the pod it's
  # replacing. Recreate kills the old pod first instead.
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: tts-gateway
  template:
    metadata:
      labels:
        app: tts-gateway
    spec:
      runtimeClassName: nvidia
      nodeSelector:
        nik4nao.com/gpu: "true"
      tolerations:
        - key: spot
          operator: Equal
          value: "true"
          effect: NoSchedule
      imagePullSecrets:
        - name: gitea-registry-secret
      # Populates the shared `models` emptyDir from the tts-model image before tts-sidecar
      # starts - see tts-gateway/model/Dockerfile in the home-service repo (the checkpoint/
      # hparams are committed there directly and CI builds+pushes this image like the other
      # four). Mounted at /dest, not /models: the model image already has the files baked in
      # at /models in its own layer, so mounting the shared volume there would shadow the
      # very files this container needs to copy from.
      initContainers:
        - name: model-init
          image: gitea.nik4nao.com/nik/tts-model:latest
          command: ["cp", "-a", "/models/.", "/dest/"]
          volumeMounts:
            - name: models
              mountPath: /dest
          resources:
            requests:
              cpu: 10m
              memory: 16Mi
            limits:
              cpu: 100m
              memory: 64Mi
      containers:
        - name: tts-gateway
          image: gitea.nik4nao.com/nik/tts-gateway:latest
          ports:
            - containerPort: 50053
              name: grpc
          env:
            - name: GRPC_PORT
              value: "50053"
            - name: INFERENCE_SIDECAR_ADDR
              value: "localhost:50054"
            - name: OTEL_ENDPOINT
              value: "otel-collector-opentelemetry-collector.monitoring.svc.cluster.local:4317"
            - name: LOG_LEVEL
              value: "info"
            - name: LOG_FORMAT
              value: "json"
            # TODO: uncomment to re-enable mTLS - temporarily disabled for
            # direct grpcurl -plaintext testing from outside the cluster.
            # - name: TLS_DIR
            #   value: /tls
          readinessProbe:
            tcpSocket:
              port: 50053
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: 50053
            initialDelaySeconds: 10
            periodSeconds: 30
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
          volumeMounts:
            - name: tls
              mountPath: /tls
              readOnly: true
        # Needs an Nvidia GPU for net_g.infer() - only meaningfully runs on
        # nik-gpu. Shares the pod network with tts-gateway so the Go side can
        # reach it over localhost, mirroring the --network host setup used
        # for local docker testing (see tts-gateway/README.md).
        - name: tts-sidecar
          image: gitea.nik4nao.com/nik/tts-sidecar:latest
          ports:
            - containerPort: 50054
              name: http
          env:
            - name: PORT
              value: "50054"
            - name: CONFIG_PATH
              value: /models/uma.json
            - name: CHECKPOINT_PATH
              value: /models/G_790000.pth
          readinessProbe:
            httpGet:
              path: /health
              port: 50054
            initialDelaySeconds: 15
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: 50054
            initialDelaySeconds: 30
            periodSeconds: 30
          resources:
            requests:
              cpu: 500m
              memory: 3Gi
              nvidia.com/gpu: 1
            limits:
              cpu: "2"
              memory: 6Gi
              nvidia.com/gpu: 1
          volumeMounts:
            - name: models
              mountPath: /models
              readOnly: true
      volumes:
        - name: tls
          secret:
            secretName: tts-gateway-tls
        # Populated at pod start by the model-init init container above, copying from the
        # versioned gitea.nik4nao.com/nik/tts-model image - not a hostPath into nik-gpu's raw
        # disk, so this survives node reprovisioning and isn't tied to manual file placement.
        - name: models
          emptyDir:
            sizeLimit: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: tts-gateway
  namespace: home-services
  labels:
    app: tts-gateway
spec:
  selector:
    app: tts-gateway
  ports:
    - name: grpc
      port: 50053
      targetPort: 50053
  type: ClusterIP