Trey t
15359401fa
The Next.js 16 webapp in sibling repo honeyDueAPI-Web now runs alongside api/worker/admin on the cluster. Uses a server-side proxy pattern: browser hits app.myhoneydue.com, Next.js route handlers forward to the Go API with an httpOnly cookie, so no CORS entry or Allowed-Hosts change is needed on the API side. Availability mirrors api (3 replicas, PDB minAvailable:2, topologySpreadConstraints across nodes). Changes: - deploy-k3s/manifests/web/deployment.yaml: 3 replicas, readOnly root FS, drops all caps, mounts emptyDir for /app/.next/cache and /tmp, reads API_URL from honeydue-config. - deploy-k3s/manifests/web/service.yaml: ClusterIP :3000. - deploy-k3s/manifests/rbac.yaml: ServiceAccount web with automountServiceAccountToken: false. - deploy-k3s/manifests/pod-disruption-budgets.yaml: web-pdb minAvailable: 2. - deploy-k3s/manifests/ingress/ingress-simple.yaml: route app.myhoneydue.com → web:3000. - deploy-k3s/scripts/_config.sh: emit API_URL into the ConfigMap. - deploy-k3s/scripts/03-deploy.sh: build + push + apply the web image alongside api/worker/admin. Reads NEXT_PUBLIC_POSTHOG_KEY and NEXT_PUBLIC_POSTHOG_HOST from the operator shell env (not committed). Also adds the --build-arg NEXT_PUBLIC_API_URL wiring for the admin image that was previously only done manually. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
108 lines
3.0 KiB
YAML
108 lines
3.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: web
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/name: web
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
replicas: 3
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: web
|
|
app.kubernetes.io/part-of: honeydue
|
|
spec:
|
|
serviceAccountName: web
|
|
imagePullSecrets:
|
|
- name: ghcr-credentials
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
# Spread pods across nodes so one node loss drops at most one replica.
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: web
|
|
containers:
|
|
- name: web
|
|
image: IMAGE_PLACEHOLDER # Replaced by 03-deploy.sh or manual sed
|
|
ports:
|
|
- containerPort: 3000
|
|
protocol: TCP
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
env:
|
|
- name: PORT
|
|
value: "3000"
|
|
- name: HOSTNAME
|
|
value: "0.0.0.0"
|
|
# Server-side proxy target (src/app/api/proxy/[...path]/route.ts,
|
|
# src/app/api/auth/*/route.ts). Browser never sees this URL.
|
|
- name: API_URL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: honeydue-config
|
|
key: API_URL
|
|
volumeMounts:
|
|
# Next.js writes its build cache here; readOnlyRootFilesystem blocks
|
|
# writing to /app/.next/cache otherwise.
|
|
- name: nextjs-cache
|
|
mountPath: /app/.next/cache
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|
|
# Next.js standalone serves at `/`. `/login` also 200s pre-auth.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
failureThreshold: 24
|
|
periodSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
volumes:
|
|
- name: nextjs-cache
|
|
emptyDir:
|
|
sizeLimit: 256Mi
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 64Mi
|