apiVersion: batch/v1
kind: CronJob
metadata:
  name: fxhnt-factory
  namespace: foxhunt
  labels: { app.kubernetes.io/name: fxhnt-factory, app.kubernetes.io/part-of: foxhunt }
spec:
  schedule: "0 1 * * *"            # daily 01:00 UTC — after the 23:30 forward ingest
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 1
      template:
        metadata:
          labels: { app.kubernetes.io/part-of: foxhunt, app.kubernetes.io/name: fxhnt-factory }   # part-of -> postgres ingress/dns; name -> fxhnt-factory egress netpol
        spec:
          restartPolicy: Never
          nodeSelector:
            k8s.scaleway.com/pool-name: platform
          imagePullSecrets:
            - name: gitlab-registry
          containers:
            - name: factory
              image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/fxhnt-cockpit:latest   # set by CI / Kaniko push
              command: ["sh", "-c"]
              args:
                - |
                  set -e
                  fxhnt migrate-cockpit
                  fxhnt factory-cycle --execute
              env:
                - name: FXHNT_OPERATIONAL_DSN
                  value: "postgresql+psycopg://foxhunt@postgres.foxhunt.svc.cluster.local:5432/fxhnt"
                - name: PGPASSWORD                       # libpq picks this up; password stays out of the DSN
                  valueFrom: { secretKeyRef: { name: db-credentials, key: password } }
