Add k3s deployment scaffolding for dist/ on Vultr
Ships the static landing page to the existing k3s cluster at 65.20.110.165, served at www.apexturf.es (apexturf.es redirects to it), using a self-hosted Gitea instance as the container registry. - deploy/Dockerfile + nginx.conf: nginx:alpine image serving dist/ (SPA-safe fallback, gzip, cache headers). Build-tested locally against the real dist/ output. - deploy/k8s/apex-turf/: Namespace, Deployment, Service, and two Ingresses (www.apexturf.es + a Traefik Middleware redirect from the bare domain). - deploy/k8s/cert-manager/: Let's Encrypt ClusterIssuers (prod + staging) for HTTP-01 via the cluster's bundled Traefik. - deploy/k8s/gitea/: Helm values for a lightweight, SQLite-backed Gitea at git.apexturf.es with its container registry enabled. - docs/DEPLOYMENT.md: full phased runbook with exact commands, troubleshooting, and a redeploy cheat sheet. - docs/README.md: point at the new deploy/ tree and runbook. Nothing here touches the remote cluster — these are local manifests and docs for the user to apply themselves. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
albert
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
db45efcfd2
commit
661a7e060c
@@ -0,0 +1,46 @@
|
||||
# CHANGE ME: replace GITEA_OWNER with your Gitea username/org (see
|
||||
# docs/DEPLOYMENT.md Phase 5) before applying, e.g.:
|
||||
# sed -i '' 's/GITEA_OWNER/apexadmin/' deploy/k8s/apex-turf/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: apex-turf-web
|
||||
namespace: apex-turf
|
||||
labels:
|
||||
app: apex-turf-web
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: apex-turf-web
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: apex-turf-web
|
||||
spec:
|
||||
containers:
|
||||
- name: web
|
||||
image: git.apexturf.es/GITEA_OWNER/apex-turf-web:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 64Mi
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 80
|
||||
initialDelaySeconds: 2
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 80
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
imagePullSecrets:
|
||||
- name: gitea-registry
|
||||
@@ -0,0 +1,26 @@
|
||||
# Serves the site at https://www.apexturf.es (this is the canonical host —
|
||||
# see redirect-ingress.yaml for the bare apexturf.es -> www redirect).
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: apex-turf-web
|
||||
namespace: apex-turf
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- www.apexturf.es
|
||||
secretName: apex-turf-web-tls
|
||||
rules:
|
||||
- host: www.apexturf.es
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: apex-turf-web
|
||||
port:
|
||||
number: 80
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: apex-turf
|
||||
@@ -0,0 +1,42 @@
|
||||
# Redirects bare https://apexturf.es/* -> https://www.apexturf.es/* (301).
|
||||
# Needs cert-manager to issue a cert for the bare domain too (browsers hit
|
||||
# TLS on apexturf.es *before* any HTTP-level redirect can happen), so this
|
||||
# still requests its own certificate even though all traffic bounces onward.
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-to-www
|
||||
namespace: apex-turf
|
||||
spec:
|
||||
redirectRegex:
|
||||
regex: ^https?://apexturf\.es/(.*)
|
||||
replacement: https://www.apexturf.es/${1}
|
||||
permanent: true
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: apex-turf-redirect
|
||||
namespace: apex-turf
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
traefik.ingress.kubernetes.io/router.middlewares: apex-turf-redirect-to-www@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- apexturf.es
|
||||
secretName: apex-turf-root-tls
|
||||
rules:
|
||||
- host: apexturf.es
|
||||
http:
|
||||
paths:
|
||||
# Backend is never actually reached — the middleware above redirects
|
||||
# first — but Ingress requires a rule to attach the middleware to.
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: apex-turf-web
|
||||
port:
|
||||
number: 80
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: apex-turf-web
|
||||
namespace: apex-turf
|
||||
spec:
|
||||
selector:
|
||||
app: apex-turf-web
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
@@ -0,0 +1,39 @@
|
||||
# Requires cert-manager to already be installed (see docs/DEPLOYMENT.md Phase 3).
|
||||
# k3s ships Traefik as its ingress controller by default, which is what the
|
||||
# http01 solver below targets. If you disabled Traefik at k3s install time,
|
||||
# swap `class: traefik` for whatever ingress controller you're running.
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
# CHANGE ME if you'd rather Let's Encrypt expiry/abuse notices go elsewhere.
|
||||
email: hello@albertabril.com
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod-key
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: traefik
|
||||
---
|
||||
# Optional but recommended while testing: Let's Encrypt's staging environment
|
||||
# has much higher rate limits and issues untrusted (but structurally identical)
|
||||
# certs, so you can validate the whole chain without risking the production
|
||||
# rate limit (5 certs/domain/week). Point an Ingress at this issuer first,
|
||||
# confirm it works, then switch to letsencrypt-prod.
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
email: hello@albertabril.com
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging-key
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: traefik
|
||||
@@ -0,0 +1,85 @@
|
||||
# Helm values for the official Gitea chart (https://gitea.com/gitea/helm-chart).
|
||||
# Tuned for a single small Vultr node: SQLite instead of a bundled Postgres,
|
||||
# no Redis/cache dependency, modest resource requests.
|
||||
#
|
||||
# Install with (see docs/DEPLOYMENT.md Phase 4):
|
||||
# helm repo add gitea-charts https://dl.gitea.com/charts/
|
||||
# helm upgrade --install gitea gitea-charts/gitea \
|
||||
# --namespace gitea --create-namespace \
|
||||
# -f deploy/k8s/gitea/values.yaml
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
# SQLite keeps this to a single pod with no extra database dependency.
|
||||
# Fine for a personal/small-team instance; migrate to Postgres later if this
|
||||
# ever needs to scale beyond one node.
|
||||
postgresql:
|
||||
enabled: false
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
redis-cluster:
|
||||
enabled: false
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 10Gi
|
||||
# CHANGE ME if your Vultr node's disk is smaller than ~15-20Gi free, or if
|
||||
# you know you'll host many/large repos and images.
|
||||
# storageClassName defaults to k3s's built-in "local-path" provisioner.
|
||||
|
||||
gitea:
|
||||
admin:
|
||||
# Change this password after first login; it's only the seed value used
|
||||
# on first boot. Better yet, override it at install time with
|
||||
# `--set gitea.admin.password=...` instead of committing a real one here.
|
||||
existingSecret: ""
|
||||
username: apexadmin
|
||||
password: "changeme-before-first-boot"
|
||||
email: "hello@albertabril.com"
|
||||
|
||||
config:
|
||||
server:
|
||||
DOMAIN: git.apexturf.es
|
||||
ROOT_URL: https://git.apexturf.es/
|
||||
HTTP_PORT: 3000
|
||||
database:
|
||||
DB_TYPE: sqlite3
|
||||
session:
|
||||
PROVIDER: memory
|
||||
cache:
|
||||
ADAPTER: memory
|
||||
queue:
|
||||
TYPE: level
|
||||
# Package registry (incl. the Docker/OCI container registry) is enabled
|
||||
# by default on modern Gitea, but set explicitly so this doesn't silently
|
||||
# depend on the chart's/Gitea's current default.
|
||||
packages:
|
||||
ENABLED: true
|
||||
|
||||
service:
|
||||
http:
|
||||
type: ClusterIP
|
||||
port: 3000
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
hosts:
|
||||
- host: git.apexturf.es
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: gitea-tls
|
||||
hosts:
|
||||
- git.apexturf.es
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
Reference in New Issue
Block a user