# MQTT Broker - Eclipse Mosquitto
# Used by Frigate, Home Assistant, and other IoT apps for event messaging
apiVersion: v1
kind: Namespace
metadata:
  name: mqtt
  labels:
    app.kubernetes.io/name: mosquitto
    app.kubernetes.io/managed-by: Helm
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: mosquitto
  namespace: mqtt
  labels:
    app.kubernetes.io/name: mosquitto
data:
  mosquitto.conf: |
    listener 1883
    listener 9001
    protocol websockets
    allow_anonymous true
    persistence true
    persistence_location /mosquitto/data/
    log_dest file /mosquitto/log/mosquitto.log
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mosquitto-data
  namespace: mqtt
  labels:
    app.kubernetes.io/name: mosquitto
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: rook-ceph-block
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mosquitto
  namespace: mqtt
  labels:
    app.kubernetes.io/name: mosquitto
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: mosquitto
  template:
    metadata:
      labels:
        app.kubernetes.io/name: mosquitto
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsUser: 1883
        runAsGroup: 1883
        fsGroup: 1883
      containers:
        - name: mosquitto
          image: eclipse-mosquitto:2.0.18
          securityContext:
            runAsUser: 1883
            runAsGroup: 1883
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          ports:
          - containerPort: 1883
            name: mqtt
          - containerPort: 9001
            name: websocket
          volumeMounts:
          - name: mosquitto-data-persistent
            mountPath: /mosquitto/data
          - name: mosquitto-log
            mountPath: /mosquitto/log
          - name: mosquitto-config
            mountPath: /mosquitto/config
            readOnly: true
          - name: tmp
            mountPath: /tmp
          resources:
            requests:
              cpu: 25m
              memory: 64Mi
            limits:
              cpu: 100m
              memory: 256Mi
          livenessProbe:
            tcpSocket:
              port: 1883
            initialDelaySeconds: 10
            periodSeconds: 30
          readinessProbe:
            tcpSocket:
              port: 1883
            initialDelaySeconds: 5
            periodSeconds: 10
      volumes:
      - name: mosquitto-data-persistent
        persistentVolumeClaim:
          claimName: mosquitto-data
      - name: mosquitto-log
        emptyDir: {}
      - name: mosquitto-config
        configMap:
          name: mosquitto
      - name: tmp
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: mosquitto
  namespace: mqtt
  labels:
    app.kubernetes.io/name: mosquitto
spec:
  ports:
  - name: mqtt
    port: 1883
    targetPort: 1883
  - name: websocket
    port: 9001
    targetPort: 9001
  selector:
    app.kubernetes.io/name: mosquitto