Deploy honeyDueAPI-Web to k3s at app.myhoneydue.com

The Next.js 16 webapp in sibling repo honeyDueAPI-Web now runs
alongside api/worker/admin on the cluster. Uses a server-side proxy
pattern: browser hits app.myhoneydue.com, Next.js route handlers
forward to the Go API with an httpOnly cookie, so no CORS entry or
Allowed-Hosts change is needed on the API side.

Availability mirrors api (3 replicas, PDB minAvailable:2,
topologySpreadConstraints across nodes).

Changes:
- deploy-k3s/manifests/web/deployment.yaml: 3 replicas, readOnly root
  FS, drops all caps, mounts emptyDir for /app/.next/cache and /tmp,
  reads API_URL from honeydue-config.
- deploy-k3s/manifests/web/service.yaml: ClusterIP :3000.
- deploy-k3s/manifests/rbac.yaml: ServiceAccount web with
  automountServiceAccountToken: false.
- deploy-k3s/manifests/pod-disruption-budgets.yaml: web-pdb
  minAvailable: 2.
- deploy-k3s/manifests/ingress/ingress-simple.yaml: route
  app.myhoneydue.com → web:3000.
- deploy-k3s/scripts/_config.sh: emit API_URL into the ConfigMap.
- deploy-k3s/scripts/03-deploy.sh: build + push + apply the web image
  alongside api/worker/admin. Reads NEXT_PUBLIC_POSTHOG_KEY and
  NEXT_PUBLIC_POSTHOG_HOST from the operator shell env (not committed).
  Also adds the --build-arg NEXT_PUBLIC_API_URL wiring for the admin
  image that was previously only done manually.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy-k3s/scripts/03-deploy.sh

@@ -58,6 +58,22 @@ REGISTRY_PREFIX="${REGISTRY_SERVER%/}/${REGISTRY_NS#/}"
 API_IMAGE="${REGISTRY_PREFIX}/honeydue-api:${DEPLOY_TAG}"
 WORKER_IMAGE="${REGISTRY_PREFIX}/honeydue-worker:${DEPLOY_TAG}"
 ADMIN_IMAGE="${REGISTRY_PREFIX}/honeydue-admin:${DEPLOY_TAG}"
+WEB_IMAGE="${REGISTRY_PREFIX}/honeydue-web:${DEPLOY_TAG}"
+
+# The web client lives in a sibling repo. Resolve its path once.
+WEB_REPO_DIR="$(cd "${REPO_DIR}/../honeyDueAPI-Web" 2>/dev/null && pwd || echo "")"
+
+# NEXT_PUBLIC_* is baked into client bundles at build time, so API/PostHog
+# URLs must be passed as build-args — setting them at pod runtime has no
+# effect on already-bundled JS.
+API_DOMAIN="$(cfg_require domains.api "API domain")"
+ADMIN_API_URL="https://${API_DOMAIN}"
+WEB_API_URL="https://${API_DOMAIN}/api"
+
+# PostHog keys for the web client are optional — read from operator shell
+# env so they never land in a committed file. Empty disables analytics.
+: "${NEXT_PUBLIC_POSTHOG_KEY:=}"
+: "${NEXT_PUBLIC_POSTHOG_HOST:=}"
 
 # --- Build and push ---
 
@@ -71,13 +87,27 @@ if [[ "${SKIP_BUILD}" == "false" ]]; then
   log "Building Worker image: ${WORKER_IMAGE}"
   docker build --target worker -t "${WORKER_IMAGE}" "${REPO_DIR}"
 
-  log "Building Admin image: ${ADMIN_IMAGE}"
-  docker build --target admin -t "${ADMIN_IMAGE}" "${REPO_DIR}"
+  log "Building Admin image: ${ADMIN_IMAGE} (NEXT_PUBLIC_API_URL=${ADMIN_API_URL})"
+  docker build --target admin \
+    --build-arg "NEXT_PUBLIC_API_URL=${ADMIN_API_URL}" \
+    -t "${ADMIN_IMAGE}" "${REPO_DIR}"
+
+  if [[ -n "${WEB_REPO_DIR}" && -f "${WEB_REPO_DIR}/Dockerfile" ]]; then
+    log "Building Web image: ${WEB_IMAGE} (NEXT_PUBLIC_API_URL=${WEB_API_URL})"
+    docker build \
+      --build-arg "NEXT_PUBLIC_API_URL=${WEB_API_URL}" \
+      --build-arg "NEXT_PUBLIC_POSTHOG_KEY=${NEXT_PUBLIC_POSTHOG_KEY}" \
+      --build-arg "NEXT_PUBLIC_POSTHOG_HOST=${NEXT_PUBLIC_POSTHOG_HOST}" \
+      -t "${WEB_IMAGE}" "${WEB_REPO_DIR}"
+  else
+    warn "honeyDueAPI-Web sibling repo not found at ${WEB_REPO_DIR:-<unset>}; skipping web build"
+  fi
 
   log "Pushing images..."
   docker push "${API_IMAGE}"
   docker push "${WORKER_IMAGE}"
   docker push "${ADMIN_IMAGE}"
+  [[ -n "${WEB_REPO_DIR}" && -f "${WEB_REPO_DIR}/Dockerfile" ]] && docker push "${WEB_IMAGE}"
 
   # Also tag and push :latest
   docker tag "${API_IMAGE}" "${REGISTRY_PREFIX}/honeydue-api:latest"
@@ -86,6 +116,10 @@ if [[ "${SKIP_BUILD}" == "false" ]]; then
   docker push "${REGISTRY_PREFIX}/honeydue-api:latest"
   docker push "${REGISTRY_PREFIX}/honeydue-worker:latest"
   docker push "${REGISTRY_PREFIX}/honeydue-admin:latest"
+  if [[ -n "${WEB_REPO_DIR}" && -f "${WEB_REPO_DIR}/Dockerfile" ]]; then
+    docker tag "${WEB_IMAGE}" "${REGISTRY_PREFIX}/honeydue-web:latest"
+    docker push "${REGISTRY_PREFIX}/honeydue-web:latest"
+  fi
 else
   warn "Skipping build. Using images for tag: ${DEPLOY_TAG}"
 fi
@@ -121,6 +155,11 @@ sed "s|image: IMAGE_PLACEHOLDER|image: ${WORKER_IMAGE}|" "${MANIFESTS}/worker/de
 sed "s|image: IMAGE_PLACEHOLDER|image: ${ADMIN_IMAGE}|" "${MANIFESTS}/admin/deployment.yaml" | kubectl apply -f -
 kubectl apply -f "${MANIFESTS}/admin/service.yaml"
 
+if [[ -d "${MANIFESTS}/web" ]]; then
+  sed "s|image: IMAGE_PLACEHOLDER|image: ${WEB_IMAGE}|" "${MANIFESTS}/web/deployment.yaml" | kubectl apply -f -
+  kubectl apply -f "${MANIFESTS}/web/service.yaml"
+fi
+
 # --- Wait for rollouts ---
 
 log "Waiting for rollouts..."
@@ -129,6 +168,9 @@ kubectl rollout status deployment/redis -n "${NAMESPACE}" --timeout=120s
 kubectl rollout status deployment/api -n "${NAMESPACE}" --timeout=300s
 kubectl rollout status deployment/worker -n "${NAMESPACE}" --timeout=300s
 kubectl rollout status deployment/admin -n "${NAMESPACE}" --timeout=300s
+if [[ -d "${MANIFESTS}/web" ]]; then
+  kubectl rollout status deployment/web -n "${NAMESPACE}" --timeout=300s
+fi
 
 # --- Done ---
 
@@ -139,5 +181,6 @@ log "Images:"
 log "  API:    ${API_IMAGE}"
 log "  Worker: ${WORKER_IMAGE}"
 log "  Admin:  ${ADMIN_IMAGE}"
+[[ -d "${MANIFESTS}/web" ]] && log "  Web:    ${WEB_IMAGE}"
 log ""
 log "Run ./scripts/04-verify.sh to check cluster health."