Add k3s deployment scaffolding for dist/ on Vultr

Ships the static landing page to the existing k3s cluster at 65.20.110.165, served at www.apexturf.es (apexturf.es redirects to it), using a self-hosted Gitea instance as the container registry. - deploy/Dockerfile + nginx.conf: nginx:alpine image serving dist/ (SPA-safe fallback, gzip, cache headers). Build-tested locally against the real dist/ output. - deploy/k8s/apex-turf/: Namespace, Deployment, Service, and two Ingresses (www.apexturf.es + a Traefik Middleware redirect from the bare domain). - deploy/k8s/cert-manager/: Let's Encrypt ClusterIssuers (prod + staging) for HTTP-01 via the cluster's bundled Traefik. - deploy/k8s/gitea/: Helm values for a lightweight, SQLite-backed Gitea at git.apexturf.es with its container registry enabled. - docs/DEPLOYMENT.md: full phased runbook with exact commands, troubleshooting, and a redeploy cheat sheet. - docs/README.md: point at the new deploy/ tree and runbook. Nothing here touches the remote cluster — these are local manifests and docs for the user to apply themselves. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-24 20:38:03 +02:00
parent db45efcfd2
commit 661a7e060c
12 changed files with 493 additions and 1 deletions
@@ -0,0 +1,11 @@
+# Build context is the project root (see docs/DEPLOYMENT.md), not deploy/, so
+# COPY paths below are relative to the repo root:
+#   docker build -f deploy/Dockerfile -t <image> .
+FROM nginx:1.27-alpine
+
+COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
+COPY dist/ /usr/share/nginx/html/
+
+EXPOSE 80
+
+HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO- http://localhost/ >/dev/null || exit 1
@@ -0,0 +1,46 @@
+# CHANGE ME: replace GITEA_OWNER with your Gitea username/org (see
+# docs/DEPLOYMENT.md Phase 5) before applying, e.g.:
+#   sed -i '' 's/GITEA_OWNER/apexadmin/' deploy/k8s/apex-turf/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: apex-turf-web
+  namespace: apex-turf
+  labels:
+    app: apex-turf-web
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: apex-turf-web
+  template:
+    metadata:
+      labels:
+        app: apex-turf-web
+    spec:
+      containers:
+        - name: web
+          image: git.apexturf.es/GITEA_OWNER/apex-turf-web:latest
+          ports:
+            - containerPort: 80
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+      imagePullSecrets:
+        - name: gitea-registry
@@ -0,0 +1,26 @@
+# Serves the site at https://www.apexturf.es (this is the canonical host —
+# see redirect-ingress.yaml for the bare apexturf.es -> www redirect).
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: apex-turf-web
+  namespace: apex-turf
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - www.apexturf.es
+      secretName: apex-turf-web-tls
+  rules:
+    - host: www.apexturf.es
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: apex-turf-web
+                port:
+                  number: 80
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: apex-turf
@@ -0,0 +1,42 @@
+# Redirects bare https://apexturf.es/* -> https://www.apexturf.es/* (301).
+# Needs cert-manager to issue a cert for the bare domain too (browsers hit
+# TLS on apexturf.es *before* any HTTP-level redirect can happen), so this
+# still requests its own certificate even though all traffic bounces onward.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-to-www
+  namespace: apex-turf
+spec:
+  redirectRegex:
+    regex: ^https?://apexturf\.es/(.*)
+    replacement: https://www.apexturf.es/${1}
+    permanent: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: apex-turf-redirect
+  namespace: apex-turf
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: apex-turf-redirect-to-www@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - apexturf.es
+      secretName: apex-turf-root-tls
+  rules:
+    - host: apexturf.es
+      http:
+        paths:
+          # Backend is never actually reached — the middleware above redirects
+          # first — but Ingress requires a rule to attach the middleware to.
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: apex-turf-web
+                port:
+                  number: 80
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: apex-turf-web
+  namespace: apex-turf
+spec:
+  selector:
+    app: apex-turf-web
+  ports:
+    - port: 80
+      targetPort: 80
@@ -0,0 +1,39 @@
+# Requires cert-manager to already be installed (see docs/DEPLOYMENT.md Phase 3).
+# k3s ships Traefik as its ingress controller by default, which is what the
+# http01 solver below targets. If you disabled Traefik at k3s install time,
+# swap `class: traefik` for whatever ingress controller you're running.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    # CHANGE ME if you'd rather Let's Encrypt expiry/abuse notices go elsewhere.
+    email: hello@albertabril.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+# Optional but recommended while testing: Let's Encrypt's staging environment
+# has much higher rate limits and issues untrusted (but structurally identical)
+# certs, so you can validate the whole chain without risking the production
+# rate limit (5 certs/domain/week). Point an Ingress at this issuer first,
+# confirm it works, then switch to letsencrypt-prod.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: hello@albertabril.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
@@ -0,0 +1,85 @@
+# Helm values for the official Gitea chart (https://gitea.com/gitea/helm-chart).
+# Tuned for a single small Vultr node: SQLite instead of a bundled Postgres,
+# no Redis/cache dependency, modest resource requests.
+#
+# Install with (see docs/DEPLOYMENT.md Phase 4):
+#   helm repo add gitea-charts https://dl.gitea.com/charts/
+#   helm upgrade --install gitea gitea-charts/gitea \
+#     --namespace gitea --create-namespace \
+#     -f deploy/k8s/gitea/values.yaml
+
+replicaCount: 1
+
+# SQLite keeps this to a single pod with no extra database dependency.
+# Fine for a personal/small-team instance; migrate to Postgres later if this
+# ever needs to scale beyond one node.
+postgresql:
+  enabled: false
+postgresql-ha:
+  enabled: false
+redis-cluster:
+  enabled: false
+
+persistence:
+  enabled: true
+  size: 10Gi
+  # CHANGE ME if your Vultr node's disk is smaller than ~15-20Gi free, or if
+  # you know you'll host many/large repos and images.
+  # storageClassName defaults to k3s's built-in "local-path" provisioner.
+
+gitea:
+  admin:
+    # Change this password after first login; it's only the seed value used
+    # on first boot. Better yet, override it at install time with
+    # `--set gitea.admin.password=...` instead of committing a real one here.
+    existingSecret: ""
+    username: apexadmin
+    password: "changeme-before-first-boot"
+    email: "hello@albertabril.com"
+
+  config:
+    server:
+      DOMAIN: git.apexturf.es
+      ROOT_URL: https://git.apexturf.es/
+      HTTP_PORT: 3000
+    database:
+      DB_TYPE: sqlite3
+    session:
+      PROVIDER: memory
+    cache:
+      ADAPTER: memory
+    queue:
+      TYPE: level
+    # Package registry (incl. the Docker/OCI container registry) is enabled
+    # by default on modern Gitea, but set explicitly so this doesn't silently
+    # depend on the chart's/Gitea's current default.
+    packages:
+      ENABLED: true
+
+service:
+  http:
+    type: ClusterIP
+    port: 3000
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+    - host: git.apexturf.es
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: gitea-tls
+      hosts:
+        - git.apexturf.es
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
@@ -0,0 +1,30 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Gzip static text assets
+    gzip on;
+    gzip_vary on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+
+    # Long cache for fingerprint-free static assets; short cache for HTML so
+    # deploys show up without needing a hard-refresh.
+    location ~* \.(?:css|js|png|jpg|jpeg|svg|ico|woff2?)$ {
+        expires 7d;
+        add_header Cache-Control "public, max-age=604800, immutable";
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache";
+    }
+
+    # Basic hardening headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    error_page 404 /index.html;
+}