apiVersion: v1
kind: Service
metadata:
  name: adguard-lb-service
  namespace: adguard
  annotations:
    metallb.io/loadBalancerIPs: "192.168.80.3"
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app: adguard
  ports:
    - name: dns-udp
      port: 53
      targetPort: 53
      protocol: UDP
    - name: dns-tcp
      port: 53
      targetPort: 53
      protocol: TCP
    - name: dot
      port: 853
      targetPort: 853
      protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: adguard-service
  namespace: adguard
spec:
  selector:
    app: adguard
  ports:
    - port: 3000
      name: webui
      targetPort: 3000
    - port: 53
      name: dns
      targetPort: 53
      protocol: UDP
    - port: 53
      name: dns-tcp
      targetPort: 53
      protocol: TCP
    - port: 853
      name: dot
      targetPort: 853
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: adguard-deployment
  namespace: adguard
spec:
  replicas: 1
  selector:
    matchLabels:
      app: adguard
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: adguard
      annotations:
        reloader.stakater.com/auto: "true"
    spec:
      containers:
        - name: netbird
          image: netbirdio/netbird:0.80.0
          envFrom:
            - configMapRef:
                name: adguard-config
          env:
            - name: NB_SETUP_KEY
              valueFrom:
                secretKeyRef:
                  name: adguard-netbird-secrets
                  key: NB_SETUP_KEY
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
                - SYS_ADMIN
                - SYS_RESOURCE
          resources:
            requests:
              memory: "64Mi"
              cpu: "50m"
            limits:
              memory: "256Mi"
              cpu: "200m"
          volumeMounts:
            - name: netbird-state
              mountPath: /var/lib/netbird
            - name: dev-tun
              mountPath: /dev/net/tun
        - name: adguard
          image: adguard/adguardhome:v0.107.79
          resources:
            limits:
              memory: "1.5Gi"
              cpu: "300m"
            requests:
              memory: "512Mi"
              cpu: "50m"
          ports:
            - containerPort: 3000
              name: webui
            - containerPort: 53
              name: dns
            - containerPort: 853
              name: dot
          readinessProbe:
            tcpSocket:
              port: dns
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          volumeMounts:
            - name: adguard-data
              mountPath: /opt/adguardhome/work
              subPath: work
            - name: adguard-data
              mountPath: /opt/adguardhome/conf
              subPath: conf
            - name: adguard-certs
              mountPath: /certs
              readOnly: true
      volumes:
        - name: netbird-state
          emptyDir: {}
        - name: dev-tun
          hostPath:
            path: /dev/net/tun
            type: CharDevice
        - name: adguard-data
          persistentVolumeClaim:
            claimName: adguard-pvc
        - name: adguard-certs
          secret:
            secretName: adguard-certs
            items:
              - key: tls.crt
                path: fullchain.pem
              - key: tls.key
                path: privkey.pem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: adguard-pvc
  namespace: adguard
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi