Sienna Meridian Satterwhite
424db43ccf
Meet: add backend/frontend/celery deployments and services, meet-config ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS, meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client. La Suite overlay discipline: move people/docs frontend nginx ConfigMaps and patches from overlays/local to base so both environments share them. Remove values-ory.yaml (folded into base). Add docs-frontend nginx config with sub_filter theming. Add local gitea mkcert CA patch. Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and split meet route into frontend default + backend paths for /api/, /admin/, /oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production overlay (host ports moved to patch-pingora-hostport.yaml). Update both overlay kustomizations to reference all new resources and add meet-backend/meet-frontend image entries.
81 lines
2.6 KiB
YAML
81 lines
2.6 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# Local dev overlay — targets Lima VM running k3s on macOS
|
|
# Deploy with: kubectl apply -k overlays/local/
|
|
#
|
|
# NOTE: base/mesh (Linkerd) is excluded here. Linkerd is bootstrapped
|
|
# separately by scripts/local-up.sh via the Linkerd CLI, which avoids
|
|
# the identity cert bootstrapping problem at kustomize render time.
|
|
#
|
|
# DOMAIN_SUFFIX substitution: local-up.sh pipes `kustomize build | sed` to
|
|
# replace DOMAIN_SUFFIX with <LIMA_IP>.sslip.io before kubectl apply.
|
|
|
|
resources:
|
|
- ../../base/ingress
|
|
- ../../base/ory
|
|
- ../../base/data
|
|
- ../../base/storage
|
|
- ../../base/lasuite
|
|
- ../../base/media
|
|
- ../../base/devtools
|
|
- ../../base/vso
|
|
|
|
images:
|
|
# La Gaufre v2 integration service — lagaufre.js widget + SVG logos + nginx
|
|
- name: integration
|
|
newName: src.DOMAIN_SUFFIX/studio/integration
|
|
newTag: latest
|
|
|
|
# amd64-only La Suite images — mirrored to our Gitea registry with a patched
|
|
# OCI index that adds an arm64 alias so Rosetta can run them on the Lima VM.
|
|
# DOMAIN_SUFFIX is substituted by local-up.py at deploy time (sed replacement).
|
|
- name: lasuite/people-backend
|
|
newName: src.DOMAIN_SUFFIX/studio/people-backend
|
|
- name: lasuite/people-frontend
|
|
newName: src.DOMAIN_SUFFIX/studio/people-frontend
|
|
|
|
# amd64-only impress (Docs) images — same mirror pattern.
|
|
- name: lasuite/impress-backend
|
|
newName: src.DOMAIN_SUFFIX/studio/impress-backend
|
|
- name: lasuite/impress-frontend
|
|
newName: src.DOMAIN_SUFFIX/studio/impress-frontend
|
|
- name: lasuite/impress-y-provider
|
|
newName: src.DOMAIN_SUFFIX/studio/impress-y-provider
|
|
|
|
# Meet — built from source and pushed to Gitea registry.
|
|
- name: meet-backend
|
|
newName: src.DOMAIN_SUFFIX/studio/meet-backend
|
|
newTag: latest
|
|
- name: meet-frontend
|
|
newName: src.DOMAIN_SUFFIX/studio/meet-frontend
|
|
newTag: latest
|
|
|
|
patches:
|
|
# Disable SSL verification for OIDC server-side calls — mkcert CA not trusted in pods
|
|
- path: patch-oidc-verify-ssl.yaml
|
|
target:
|
|
kind: ConfigMap
|
|
name: lasuite-oidc-provider
|
|
|
|
# Add hostPort for TURN relay range + bind :80/:443 on Lima VM
|
|
- path: values-pingora.yaml
|
|
target:
|
|
kind: Deployment
|
|
name: pingora
|
|
|
|
# Downgrade LiveKit TURN service from LoadBalancer → ClusterIP (klipper would take hostPort 443)
|
|
- path: values-livekit.yaml
|
|
target:
|
|
kind: Service
|
|
name: livekit-server-turn
|
|
|
|
# Set SSL_CERT_FILE so Gitea's Go TLS trusts the mkcert wildcard CA for OIDC calls
|
|
- path: patch-gitea-mkcert-ca.yaml
|
|
target:
|
|
kind: Deployment
|
|
name: gitea
|
|
|
|
# Apply §10.7 memory limits to all Deployments
|
|
- path: values-resources.yaml
|