34553f3bec
Mirrors the prod deploy-k3s/ setup but runs all services in-cluster on a single node: PostgreSQL (replaces Neon), MinIO S3-compatible storage (replaces B2), Redis, API, worker, and admin. Includes fully automated setup scripts (00-init through 04-verify), server hardening (SSH, fail2ban, ufw), Let's Encrypt TLS via Traefik, network policies, RBAC, and security contexts matching prod. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
57 lines
1.5 KiB
YAML
57 lines
1.5 KiB
YAML
# API Ingress — TLS via Let's Encrypt (default) or Cloudflare origin cert
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-api
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
annotations:
|
|
# TLS_ANNOTATIONS_PLACEHOLDER — replaced by 03-deploy.sh based on tls.mode
|
|
traefik.ingress.kubernetes.io/router.middlewares: honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- API_DOMAIN_PLACEHOLDER
|
|
secretName: TLS_SECRET_PLACEHOLDER
|
|
rules:
|
|
- host: API_DOMAIN_PLACEHOLDER
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api
|
|
port:
|
|
number: 8000
|
|
|
|
---
|
|
# Admin Ingress
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-admin
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
annotations:
|
|
# TLS_ANNOTATIONS_PLACEHOLDER — replaced by 03-deploy.sh based on tls.mode
|
|
traefik.ingress.kubernetes.io/router.middlewares: honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd,honeydue-admin-auth@kubernetescrd
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- ADMIN_DOMAIN_PLACEHOLDER
|
|
secretName: TLS_SECRET_PLACEHOLDER
|
|
rules:
|
|
- host: ADMIN_DOMAIN_PLACEHOLDER
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: admin
|
|
port:
|
|
number: 3000
|