apiVersion: v1
kind: Pod
metadata:
  name: golink
  labels:
    traefik.enable: false
spec:
  imagePullPolicy: Always
  restartPolicy: Never
  dnsPolicy: Default
  securityContext:
    # NOTE: required unless mounted directory is owned by 65532
    runAsUser: 0
  containers:
    - name: golink
      image: ghcr.io/tailscale/golink:main
      args:
        - --sqlitedb=/home/nonroot/golink.db
        - --snapshot=/home/nonroot/snapshot.json
        - --https=true
        - --readonly=true
      volumeMounts:
      - name: golink-data
        mountPath: /home/nonroot
      resources:
        limits:
          cpu: 20m
          memory: 100Mi
  volumes:
  - name: golink-data
    hostPath:
      path: /var/lib/golink
      type: DirectoryOrCreate