2026-02-28 13:42:27 +00:00
|
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
|
|
|
kind: Kustomization
|
|
|
|
|
|
|
|
|
|
# Local dev overlay — targets Lima VM running k3s on macOS
|
|
|
|
|
# Deploy with: kubectl apply -k overlays/local/
|
2026-02-28 14:00:31 +00:00
|
|
|
#
|
|
|
|
|
# NOTE: base/mesh (Linkerd) is excluded here. Linkerd is bootstrapped
|
|
|
|
|
# separately by scripts/local-up.sh via the Linkerd CLI, which avoids
|
|
|
|
|
# the identity cert bootstrapping problem at kustomize render time.
|
|
|
|
|
#
|
|
|
|
|
# DOMAIN_SUFFIX substitution: local-up.sh pipes `kustomize build | sed` to
|
|
|
|
|
# replace DOMAIN_SUFFIX with <LIMA_IP>.sslip.io before kubectl apply.
|
2026-02-28 13:42:27 +00:00
|
|
|
|
|
|
|
|
resources:
|
feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates
- Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS
proxy, worker, DKIM config, and theme customization
- Add Collabora deployment for document collaboration
- Add Drive frontend nginx config and values
- Add buildkitd namespace for in-cluster container builds
- Add SeaweedFS remote sync and additional S3 buckets
- Update vault secrets across namespaces (devtools, lasuite, media,
monitoring, ory, storage) with expanded credential management
- Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus
remote write and additional scrape configs
- Update local/production overlays with resource patches
- Remove stale login-ui resource patch from production overlay
2026-03-10 19:00:57 +00:00
|
|
|
- ../../base/build
|
2026-02-28 13:42:27 +00:00
|
|
|
- ../../base/ingress
|
|
|
|
|
- ../../base/ory
|
|
|
|
|
- ../../base/data
|
|
|
|
|
- ../../base/storage
|
|
|
|
|
- ../../base/lasuite
|
|
|
|
|
- ../../base/media
|
|
|
|
|
- ../../base/devtools
|
2026-03-02 18:31:50 +00:00
|
|
|
- ../../base/vso
|
2026-02-28 13:42:27 +00:00
|
|
|
|
feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA
Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
/oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict
Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
2026-03-01 16:25:11 +00:00
|
|
|
images:
|
2026-03-03 16:08:48 +00:00
|
|
|
# La Gaufre v2 integration service — lagaufre.js widget + SVG logos + nginx
|
|
|
|
|
- name: integration
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/integration
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
2026-03-02 18:31:50 +00:00
|
|
|
# amd64-only La Suite images — mirrored to our Gitea registry with a patched
|
|
|
|
|
# OCI index that adds an arm64 alias so Rosetta can run them on the Lima VM.
|
|
|
|
|
# DOMAIN_SUFFIX is substituted by local-up.py at deploy time (sed replacement).
|
|
|
|
|
- name: lasuite/people-backend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/people-backend
|
|
|
|
|
- name: lasuite/people-frontend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/people-frontend
|
feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates
- Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS
proxy, worker, DKIM config, and theme customization
- Add Collabora deployment for document collaboration
- Add Drive frontend nginx config and values
- Add buildkitd namespace for in-cluster container builds
- Add SeaweedFS remote sync and additional S3 buckets
- Update vault secrets across namespaces (devtools, lasuite, media,
monitoring, ory, storage) with expanded credential management
- Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus
remote write and additional scrape configs
- Update local/production overlays with resource patches
- Remove stale login-ui resource patch from production overlay
2026-03-10 19:00:57 +00:00
|
|
|
newTag: latest
|
2026-03-02 18:31:50 +00:00
|
|
|
|
feat(lasuite): deploy La Suite Docs (impress)
Adds the impress Helm chart (suitenumerique/docs, v4.5.0) to the lasuite
namespace with full Pingora routing, VSO secrets, and local overlay
resource tuning.
Routing (pingora-config.yaml):
- docs.* frontend -> docs-frontend:80 (nginx, static Next.js export)
- /api/* and /admin/* -> docs-backend:80 (Django/uvicorn)
- /collaboration/ws/* -> docs-y-provider:4444 (Hocuspocus WebSocket)
- integration.* -> integration:80 (La Gaufre hub, same file)
Secrets (vault-secrets.yaml):
- VaultDynamicSecret docs-db-credentials (DB engine, static role)
- VaultStaticSecret docs-django-secret (DJANGO_SECRET_KEY)
- VaultStaticSecret docs-collaboration-secret (y-provider shared secret)
OIDC client (oidc-clients.yaml):
- Fix redirect_uri from /oidc/callback/ to /api/v1.0/callback/ -- impress
mounts all OIDC URLs under api/{API_VERSION}/ via lasuite.oidc_login,
same pattern as people.
Local overlay (values-resources.yaml):
- docs-backend: 512Mi limit, WEB_CONCURRENCY=2 (4 uvicorn workers
exceeded 384Mi at startup on the arm64 Lima VM)
- docs-celery-worker: 384Mi limit, CELERY_WORKER_CONCURRENCY=2
- docs-y-provider: 256Mi limit
- seaweedfs-filer: raised from 256Mi to 512Mi (OOMKilled during 188MB
multipart S3 upload of impress-y-provider image layer)
Local overlay (kustomization.yaml):
- Image mirrors for impress-backend, impress-frontend, impress-y-provider
(amd64-only images retagged to Gitea via cmd_mirror before deploy)
2026-03-03 14:30:45 +00:00
|
|
|
# amd64-only impress (Docs) images — same mirror pattern.
|
|
|
|
|
- name: lasuite/impress-backend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/impress-backend
|
|
|
|
|
- name: lasuite/impress-frontend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/impress-frontend
|
|
|
|
|
- name: lasuite/impress-y-provider
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/impress-y-provider
|
|
|
|
|
|
feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes
Meet: add backend/frontend/celery deployments and services, meet-config
ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS,
meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client.
La Suite overlay discipline: move people/docs frontend nginx ConfigMaps
and patches from overlays/local to base so both environments share them.
Remove values-ory.yaml (folded into base). Add docs-frontend nginx config
with sub_filter theming. Add local gitea mkcert CA patch.
Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and
split meet route into frontend default + backend paths for /api/, /admin/,
/oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production
overlay (host ports moved to patch-pingora-hostport.yaml).
Update both overlay kustomizations to reference all new resources and
add meet-backend/meet-frontend image entries.
2026-03-06 12:08:21 +00:00
|
|
|
# Meet — built from source and pushed to Gitea registry.
|
|
|
|
|
- name: meet-backend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/meet-backend
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: meet-frontend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/meet-frontend
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
2026-03-20 13:41:54 +00:00
|
|
|
# Projects (Kanban) — built and pushed by `sunbeam build projects`
|
|
|
|
|
- name: projects
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/projects
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
2026-03-18 18:36:05 +00:00
|
|
|
# Calendars — built from source and pushed to Gitea registry.
|
|
|
|
|
- name: calendars-backend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/calendars-backend
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: calendars-caldav
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/calendars-caldav
|
|
|
|
|
newTag: latest
|
|
|
|
|
- name: calendars-frontend
|
|
|
|
|
newName: src.DOMAIN_SUFFIX/studio/calendars-frontend
|
|
|
|
|
newTag: latest
|
|
|
|
|
|
2026-02-28 13:42:27 +00:00
|
|
|
patches:
|
2026-03-03 11:31:28 +00:00
|
|
|
# Disable SSL verification for OIDC server-side calls — mkcert CA not trusted in pods
|
|
|
|
|
- path: patch-oidc-verify-ssl.yaml
|
|
|
|
|
target:
|
|
|
|
|
kind: ConfigMap
|
|
|
|
|
name: lasuite-oidc-provider
|
|
|
|
|
|
feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes
Meet: add backend/frontend/celery deployments and services, meet-config
ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS,
meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client.
La Suite overlay discipline: move people/docs frontend nginx ConfigMaps
and patches from overlays/local to base so both environments share them.
Remove values-ory.yaml (folded into base). Add docs-frontend nginx config
with sub_filter theming. Add local gitea mkcert CA patch.
Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and
split meet route into frontend default + backend paths for /api/, /admin/,
/oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production
overlay (host ports moved to patch-pingora-hostport.yaml).
Update both overlay kustomizations to reference all new resources and
add meet-backend/meet-frontend image entries.
2026-03-06 12:08:21 +00:00
|
|
|
# Add hostPort for TURN relay range + bind :80/:443 on Lima VM
|
2026-02-28 13:42:27 +00:00
|
|
|
- path: values-pingora.yaml
|
|
|
|
|
target:
|
|
|
|
|
kind: Deployment
|
|
|
|
|
name: pingora
|
|
|
|
|
|
feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA
Ingress:
- Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder
- HTTPS termination with mkcert (local) / rustls-acme (production)
- Host-prefix routing with path-based sub-routing for auth virtual host:
/oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui
- HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub
- cert-manager HTTP-01 ACME challenge routing via Ingress watcher
- RBAC for Ingress watcher (pingora-watcher ClusterRole)
- local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict
Infrastructure:
- socket_vmnet shared network for host↔VM reachability (192.168.105.2)
- local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution
- Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods
- Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25
- Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
2026-03-01 16:25:11 +00:00
|
|
|
# Downgrade LiveKit TURN service from LoadBalancer → ClusterIP (klipper would take hostPort 443)
|
|
|
|
|
- path: values-livekit.yaml
|
|
|
|
|
target:
|
|
|
|
|
kind: Service
|
|
|
|
|
name: livekit-server-turn
|
|
|
|
|
|
feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes
Meet: add backend/frontend/celery deployments and services, meet-config
ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS,
meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client.
La Suite overlay discipline: move people/docs frontend nginx ConfigMaps
and patches from overlays/local to base so both environments share them.
Remove values-ory.yaml (folded into base). Add docs-frontend nginx config
with sub_filter theming. Add local gitea mkcert CA patch.
Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and
split meet route into frontend default + backend paths for /api/, /admin/,
/oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production
overlay (host ports moved to patch-pingora-hostport.yaml).
Update both overlay kustomizations to reference all new resources and
add meet-backend/meet-frontend image entries.
2026-03-06 12:08:21 +00:00
|
|
|
# Set SSL_CERT_FILE so Gitea's Go TLS trusts the mkcert wildcard CA for OIDC calls
|
|
|
|
|
- path: patch-gitea-mkcert-ca.yaml
|
|
|
|
|
target:
|
|
|
|
|
kind: Deployment
|
|
|
|
|
name: gitea
|
2026-03-03 16:08:48 +00:00
|
|
|
|
2026-02-28 14:00:31 +00:00
|
|
|
# Apply §10.7 memory limits to all Deployments
|
2026-02-28 13:42:27 +00:00
|
|
|
- path: values-resources.yaml
|