Trey t
15359401fa
The Next.js 16 webapp in sibling repo honeyDueAPI-Web now runs alongside api/worker/admin on the cluster. Uses a server-side proxy pattern: browser hits app.myhoneydue.com, Next.js route handlers forward to the Go API with an httpOnly cookie, so no CORS entry or Allowed-Hosts change is needed on the API side. Availability mirrors api (3 replicas, PDB minAvailable:2, topologySpreadConstraints across nodes). Changes: - deploy-k3s/manifests/web/deployment.yaml: 3 replicas, readOnly root FS, drops all caps, mounts emptyDir for /app/.next/cache and /tmp, reads API_URL from honeydue-config. - deploy-k3s/manifests/web/service.yaml: ClusterIP :3000. - deploy-k3s/manifests/rbac.yaml: ServiceAccount web with automountServiceAccountToken: false. - deploy-k3s/manifests/pod-disruption-budgets.yaml: web-pdb minAvailable: 2. - deploy-k3s/manifests/ingress/ingress-simple.yaml: route app.myhoneydue.com → web:3000. - deploy-k3s/scripts/_config.sh: emit API_URL into the ConfigMap. - deploy-k3s/scripts/03-deploy.sh: build + push + apply the web image alongside api/worker/admin. Reads NEXT_PUBLIC_POSTHOG_KEY and NEXT_PUBLIC_POSTHOG_HOST from the operator shell env (not committed). Also adds the --build-arg NEXT_PUBLIC_API_URL wiring for the admin image that was previously only done manually. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
83 lines
2.1 KiB
YAML
83 lines
2.1 KiB
YAML
# Simple hostname-based Ingress — no TLS (Cloudflare Flexible handles edge
|
|
# TLS, CF→origin is plain HTTP on 80). Upgrade to Full (strict) by
|
|
# adding back a `tls:` block with a Cloudflare Origin CA cert stored in
|
|
# secret/cloudflare-origin-cert.
|
|
#
|
|
# Middleware chain (security headers, rate limit, CF-only allowlist, admin
|
|
# basic auth) is defined in `middleware.yaml` but NOT attached here —
|
|
# annotate this ingress to turn any of them on.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-api
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: api.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api
|
|
port:
|
|
number: 8000
|
|
# Root domain serves the marketing landing page from the Go API's
|
|
# STATIC_DIR. ALLOWED_HOSTS in honeydue-config includes myhoneydue.com.
|
|
- host: myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api
|
|
port:
|
|
number: 8000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-admin
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: admin.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: admin
|
|
port:
|
|
number: 3000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-web
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: app.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: web
|
|
port:
|
|
number: 3000
|