apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: luxd
spec:
  serviceName: luxd-headless
  replicas: 5
  updateStrategy:
    type: OnDelete    # operator drains one pod at a time, never rolls simultaneously
  podManagementPolicy: Parallel  # validators can start in any order; bootstrap-ips handles ordering
  selector:
    matchLabels:
      app: luxd
  template:
    metadata:
      labels:
        app: luxd
    spec:
      serviceAccountName: luxd
      automountServiceAccountToken: false  # locked down; no API server access
      securityContext:
        fsGroup: 1000
        runAsUser: 1000
        runAsNonRoot: true
      terminationGracePeriodSeconds: 120
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: luxd
              topologyKey: kubernetes.io/hostname    # spread across nodes
      containers:
      - name: luxd
        image: ghcr.io/luxfi/node:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 9630
          name: http
          protocol: TCP
        - containerPort: 9631
          name: staking
          protocol: TCP
        env:
        - name: LUXD_HTTP_HOST
          value: "0.0.0.0"
        - name: LUXD_HTTP_PORT
          value: "9630"
        - name: LUXD_STAKING_PORT
          value: "9631"
        - name: LUXD_LOG_LEVEL
          value: "info"
        - name: LUXD_DB_DIR
          value: "/data/db"
        - name: LUXD_LOG_DIR
          value: "/data/logs"
        - name: LUXD_STAKING_TLS_KEY_FILE
          value: "/keys/staking/staker.key"
        - name: LUXD_STAKING_TLS_CERT_FILE
          value: "/keys/staking/staker.crt"
        # Network-specific env vars are patched per overlay
        envFrom:
        - configMapRef:
            name: luxd-config
        volumeMounts:
        - name: data
          mountPath: /data
        - name: staking-keys
          mountPath: /keys/staking
          readOnly: true
        resources:
          requests:
            memory: "4Gi"
            cpu: "2"
          limits:
            memory: "8Gi"
            cpu: "4"
        livenessProbe:
          httpGet:
            path: /ext/health
            port: 9630
          initialDelaySeconds: 120
          periodSeconds: 30
          failureThreshold: 5
          timeoutSeconds: 10
        readinessProbe:
          httpGet:
            path: /ext/health
            port: 9630
          initialDelaySeconds: 30
          periodSeconds: 10
          failureThreshold: 3
          timeoutSeconds: 5
        startupProbe:
          httpGet:
            path: /ext/health
            port: 9630
          initialDelaySeconds: 10
          periodSeconds: 10
          failureThreshold: 30
          timeoutSeconds: 5
      volumes:
      - name: staking-keys
        secret:
          secretName: luxd-staking-keys
          defaultMode: 0400
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 100Gi
