34553f3bec
Mirrors the prod deploy-k3s/ setup but runs all services in-cluster on a single node: PostgreSQL (replaces Neon), MinIO S3-compatible storage (replaces B2), Redis, API, worker, and admin. Includes fully automated setup scripts (00-init through 04-verify), server hardening (SSH, fail2ban, ufw), Let's Encrypt TLS via Traefik, network policies, RBAC, and security contexts matching prod. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
# API Ingress — Cloudflare-only + security headers + rate limiting
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-api
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.middlewares: honeydue-cloudflare-only@kubernetescrd,honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- api.myhoneydue.com
|
|
secretName: cloudflare-origin-cert
|
|
rules:
|
|
- host: api.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api
|
|
port:
|
|
number: 8000
|
|
|
|
---
|
|
# Admin Ingress — Cloudflare-only + security headers + rate limiting + basic auth
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-admin
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.middlewares: honeydue-cloudflare-only@kubernetescrd,honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd,honeydue-admin-auth@kubernetescrd
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- admin.myhoneydue.com
|
|
secretName: cloudflare-origin-cert
|
|
rules:
|
|
- host: admin.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: admin
|
|
port:
|
|
number: 3000
|