apiVersion: v1
kind: Service
metadata:
  name: wrnexus
spec:
  selector: { app: wrnexus }
  ports: [{ name: http, port: 80, targetPort: 3000 }]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wrnexus
spec:
  replicas: 2
  selector: { matchLabels: { app: wrnexus } }
  template:
    metadata: { labels: { app: wrnexus } }
    spec:
      containers:
        - name: app
          image: ghcr.io/OWNER/APP:latest
          ports: [{ containerPort: 3000 }]
          envFrom: [{ secretRef: { name: wrnexus-secrets } }]
          livenessProbe: { httpGet: { path: /healthz, port: 3000 }, initialDelaySeconds: 5 }
          readinessProbe: { httpGet: { path: /readyz, port: 3000 }, initialDelaySeconds: 5 }
          resources:
            requests: { cpu: 250m, memory: 256Mi }
            limits: { cpu: "1", memory: 512Mi }
          lifecycle: { preStop: { exec: { command: ["sh", "-c", "sleep 5"] } } }
      terminationGracePeriodSeconds: 30
---
apiVersion: batch/v1
kind: Job
metadata:
  name: wrnexus-migrate
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: migrate
          image: ghcr.io/OWNER/APP:latest
          command: ["bunx", "wrnexus", "db", "migrate", "--profile=production"]
          envFrom: [{ secretRef: { name: wrnexus-secrets } }]