albertandClaude Sonnet 5
661a7e060c
Ships the static landing page to the existing k3s cluster at 65.20.110.165, served at www.apexturf.es (apexturf.es redirects to it), using a self-hosted Gitea instance as the container registry. - deploy/Dockerfile + nginx.conf: nginx:alpine image serving dist/ (SPA-safe fallback, gzip, cache headers). Build-tested locally against the real dist/ output. - deploy/k8s/apex-turf/: Namespace, Deployment, Service, and two Ingresses (www.apexturf.es + a Traefik Middleware redirect from the bare domain). - deploy/k8s/cert-manager/: Let's Encrypt ClusterIssuers (prod + staging) for HTTP-01 via the cluster's bundled Traefik. - deploy/k8s/gitea/: Helm values for a lightweight, SQLite-backed Gitea at git.apexturf.es with its container registry enabled. - docs/DEPLOYMENT.md: full phased runbook with exact commands, troubleshooting, and a redeploy cheat sheet. - docs/README.md: point at the new deploy/ tree and runbook. Nothing here touches the remote cluster — these are local manifests and docs for the user to apply themselves. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
40 lines
1.4 KiB
YAML
40 lines
1.4 KiB
YAML
# Requires cert-manager to already be installed (see docs/DEPLOYMENT.md Phase 3).
|
|
# k3s ships Traefik as its ingress controller by default, which is what the
|
|
# http01 solver below targets. If you disabled Traefik at k3s install time,
|
|
# swap `class: traefik` for whatever ingress controller you're running.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
# CHANGE ME if you'd rather Let's Encrypt expiry/abuse notices go elsewhere.
|
|
email: hello@albertabril.com
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod-key
|
|
solvers:
|
|
- http01:
|
|
ingress:
|
|
class: traefik
|
|
---
|
|
# Optional but recommended while testing: Let's Encrypt's staging environment
|
|
# has much higher rate limits and issues untrusted (but structurally identical)
|
|
# certs, so you can validate the whole chain without risking the production
|
|
# rate limit (5 certs/domain/week). Point an Ingress at this issuer first,
|
|
# confirm it works, then switch to letsencrypt-prod.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-staging
|
|
spec:
|
|
acme:
|
|
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
email: hello@albertabril.com
|
|
privateKeySecretRef:
|
|
name: letsencrypt-staging-key
|
|
solvers:
|
|
- http01:
|
|
ingress:
|
|
class: traefik
|