2026-02-28 13:42:27 +00:00
|
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
|
|
|
kind: Kustomization
|
|
|
|
|
|
|
|
|
|
# Production overlay — targets Scaleway Elastic Metal (Paris)
|
feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA
Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
/oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict
Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
2026-03-01 16:25:11 +00:00
|
|
|
#
|
feat(infra): production bootstrap — cert-manager, longhorn, monitoring
Add new bases for cert-manager (Let's Encrypt + wildcard cert), Longhorn
distributed storage, and monitoring (kube-prometheus-stack + Loki + Tempo
+ Grafana OIDC). Add cloud-init for Scaleway Elastic Metal provisioning.
Production overlay: add patches for postgres sizing, SeaweedFS volume,
OpenSearch storage, LiveKit service, Pingora host ports, resource limits,
and CNPG daily barman backups. Update cert-manager.yaml with full dnsNames
for all *.sunbeam.pt subdomains.
2026-03-06 12:06:27 +00:00
|
|
|
# Deploy (DOMAIN_SUFFIX and ACME_EMAIL are substituted by sunbeam apply):
|
|
|
|
|
# sunbeam apply --env production --domain yourdomain.com
|
2026-02-28 13:42:27 +00:00
|
|
|
|
|
|
|
|
resources:
|
2026-03-10 18:52:47 +00:00
|
|
|
- ../../base/build
|
feat(infra): production bootstrap — cert-manager, longhorn, monitoring
Add new bases for cert-manager (Let's Encrypt + wildcard cert), Longhorn
distributed storage, and monitoring (kube-prometheus-stack + Loki + Tempo
+ Grafana OIDC). Add cloud-init for Scaleway Elastic Metal provisioning.
Production overlay: add patches for postgres sizing, SeaweedFS volume,
OpenSearch storage, LiveKit service, Pingora host ports, resource limits,
and CNPG daily barman backups. Update cert-manager.yaml with full dnsNames
for all *.sunbeam.pt subdomains.
2026-03-06 12:06:27 +00:00
|
|
|
- ../../base/longhorn
|
|
|
|
|
- ../../base/cert-manager
|
2026-02-28 13:42:27 +00:00
|
|
|
- ../../base/ingress
|
|
|
|
|
- ../../base/ory
|
|
|
|
|
- ../../base/data
|
|
|
|
|
- ../../base/storage
|
|
|
|
|
- ../../base/lasuite
|
|
|
|
|
- ../../base/media
|
|
|
|
|
- ../../base/devtools
|
feat(infra): production bootstrap — cert-manager, longhorn, monitoring
Add new bases for cert-manager (Let's Encrypt + wildcard cert), Longhorn
distributed storage, and monitoring (kube-prometheus-stack + Loki + Tempo
+ Grafana OIDC). Add cloud-init for Scaleway Elastic Metal provisioning.
Production overlay: add patches for postgres sizing, SeaweedFS volume,
OpenSearch storage, LiveKit service, Pingora host ports, resource limits,
and CNPG daily barman backups. Update cert-manager.yaml with full dnsNames
for all *.sunbeam.pt subdomains.
2026-03-06 12:06:27 +00:00
|
|
|
- ../../base/vso
|
|
|
|
|
- ../../base/monitoring
|
2026-03-10 18:52:47 +00:00
|
|
|
- ../../base/matrix
|
feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA
Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
/oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict
Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
2026-03-01 16:25:11 +00:00
|
|
|
# cert-manager ClusterIssuer + Certificate (requires cert-manager to be installed)
|
|
|
|
|
- cert-manager.yaml
|
feat(infra): production bootstrap — cert-manager, longhorn, monitoring
Add new bases for cert-manager (Let's Encrypt + wildcard cert), Longhorn
distributed storage, and monitoring (kube-prometheus-stack + Loki + Tempo
+ Grafana OIDC). Add cloud-init for Scaleway Elastic Metal provisioning.
Production overlay: add patches for postgres sizing, SeaweedFS volume,
OpenSearch storage, LiveKit service, Pingora host ports, resource limits,
and CNPG daily barman backups. Update cert-manager.yaml with full dnsNames
for all *.sunbeam.pt subdomains.
2026-03-06 12:06:27 +00:00
|
|
|
# CNPG daily backup schedule
|
|
|
|
|
- postgres-scheduled-backup.yaml
|
2026-02-28 13:42:27 +00:00
|
|
|
|
feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA
Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
/oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict
Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
2026-03-01 16:25:11 +00:00
|
|
|
images:
|
feat(infra): production bootstrap — cert-manager, longhorn, monitoring
Add new bases for cert-manager (Let's Encrypt + wildcard cert), Longhorn
distributed storage, and monitoring (kube-prometheus-stack + Loki + Tempo
+ Grafana OIDC). Add cloud-init for Scaleway Elastic Metal provisioning.
Production overlay: add patches for postgres sizing, SeaweedFS volume,
OpenSearch storage, LiveKit service, Pingora host ports, resource limits,
and CNPG daily barman backups. Update cert-manager.yaml with full dnsNames
for all *.sunbeam.pt subdomains.
2026-03-06 12:06:27 +00:00
|
|
|
# La Gaufre integration service — built and pushed by `sunbeam build integration`
|
|
|
|
|
- name: integration
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/integration
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
|
|
|
|
# Meet — built from source and pushed to Gitea registry.
|
|
|
|
|
- name: meet-backend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/meet-backend
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: meet-frontend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/meet-frontend
|
feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA
Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
/oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict
Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
2026-03-01 16:25:11 +00:00
|
|
|
newTag: latest
|
2026-02-28 13:42:27 +00:00
|
|
|
|
2026-03-10 18:52:47 +00:00
|
|
|
# people-frontend — built from source with estudio theme baked in.
|
|
|
|
|
- name: lasuite/people-frontend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/people-frontend
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
|
|
|
|
# Messages — built from source and pushed to Gitea registry.
|
|
|
|
|
- name: messages-backend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/messages-backend
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: messages-frontend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/messages-frontend
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: messages-mta-in
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/messages-mta-in
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: messages-mta-out
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/messages-mta-out
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: messages-mpa
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/messages-mpa
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: messages-socks-proxy
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/messages-socks-proxy
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
2026-03-18 18:36:05 +00:00
|
|
|
# Calendars — built from source and pushed to Gitea registry.
|
|
|
|
|
- name: calendars-backend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/calendars-backend
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: calendars-caldav
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/calendars-caldav
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: calendars-frontend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/calendars-frontend
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
2026-03-20 13:41:54 +00:00
|
|
|
# Projects (Kanban) — built and pushed by `sunbeam build projects`
|
|
|
|
|
- name: projects
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/projects
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
2026-03-10 18:52:47 +00:00
|
|
|
# Tuwunel Matrix homeserver — built and pushed by `sunbeam build tuwunel`
|
|
|
|
|
- name: tuwunel
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/tuwunel
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
2026-03-20 21:38:48 +00:00
|
|
|
# Sol virtual librarian — built and pushed by `sunbeam build sol`
|
|
|
|
|
- name: sol
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/sol
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA
Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
/oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict
Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
2026-03-01 16:25:11 +00:00
|
|
|
patches:
|
feat(infra): production bootstrap — cert-manager, longhorn, monitoring
Add new bases for cert-manager (Let's Encrypt + wildcard cert), Longhorn
distributed storage, and monitoring (kube-prometheus-stack + Loki + Tempo
+ Grafana OIDC). Add cloud-init for Scaleway Elastic Metal provisioning.
Production overlay: add patches for postgres sizing, SeaweedFS volume,
OpenSearch storage, LiveKit service, Pingora host ports, resource limits,
and CNPG daily barman backups. Update cert-manager.yaml with full dnsNames
for all *.sunbeam.pt subdomains.
2026-03-06 12:06:27 +00:00
|
|
|
# Pingora host ports — bind :80/:443 to the host network
|
|
|
|
|
- path: patch-pingora-hostport.yaml
|
|
|
|
|
|
|
|
|
|
# Production resource limits for 64 GiB server
|
|
|
|
|
- path: values-resources.yaml
|
|
|
|
|
|
|
|
|
|
# LiveKit TURN service: ClusterIP (Pingora routes TURN traffic on :443)
|
|
|
|
|
- path: patch-livekit-service.yaml
|
|
|
|
|
|
|
|
|
|
# CNPG: production sizing (500 Gi, 8 Gi RAM) + barman S3 backup config
|
|
|
|
|
- path: patch-postgres-production.yaml
|
2026-02-28 13:42:27 +00:00
|
|
|
|
feat(infra): production bootstrap — cert-manager, longhorn, monitoring
Add new bases for cert-manager (Let's Encrypt + wildcard cert), Longhorn
distributed storage, and monitoring (kube-prometheus-stack + Loki + Tempo
+ Grafana OIDC). Add cloud-init for Scaleway Elastic Metal provisioning.
Production overlay: add patches for postgres sizing, SeaweedFS volume,
OpenSearch storage, LiveKit service, Pingora host ports, resource limits,
and CNPG daily barman backups. Update cert-manager.yaml with full dnsNames
for all *.sunbeam.pt subdomains.
2026-03-06 12:06:27 +00:00
|
|
|
# OpenSearch: expand PVC to 50 Gi
|
|
|
|
|
- path: patch-opensearch-storage.yaml
|
2026-02-28 13:42:27 +00:00
|
|
|
|
2026-03-10 18:52:47 +00:00
|
|
|
# Tuwunel: production resource limits and PVC sizing
|
|
|
|
|
- path: patch-tuwunel.yaml
|
|
|
|
|
|
feat(infra): production bootstrap — cert-manager, longhorn, monitoring
Add new bases for cert-manager (Let's Encrypt + wildcard cert), Longhorn
distributed storage, and monitoring (kube-prometheus-stack + Loki + Tempo
+ Grafana OIDC). Add cloud-init for Scaleway Elastic Metal provisioning.
Production overlay: add patches for postgres sizing, SeaweedFS volume,
OpenSearch storage, LiveKit service, Pingora host ports, resource limits,
and CNPG daily barman backups. Update cert-manager.yaml with full dnsNames
for all *.sunbeam.pt subdomains.
2026-03-06 12:06:27 +00:00
|
|
|
# SeaweedFS volume: expand PVC to 600 Gi
|
|
|
|
|
- path: patch-seaweedfs-volume-size.yaml
|
2026-03-10 18:52:47 +00:00
|
|
|
|
|
|
|
|
# MTA-in: bind port 25 to the host for inbound email delivery
|
|
|
|
|
- patch: |
|
|
|
|
|
- op: add
|
|
|
|
|
path: /spec/template/spec/containers/0/ports/0/hostPort
|
|
|
|
|
value: 25
|
|
|
|
|
target:
|
|
|
|
|
kind: Deployment
|
|
|
|
|
name: messages-mta-in
|
|
|
|
|
namespace: lasuite
|