Sienna Meridian Satterwhite
2e89854f86
Adds the impress Helm chart (suitenumerique/docs, v4.5.0) to the lasuite
namespace with full Pingora routing, VSO secrets, and local overlay
resource tuning.
Routing (pingora-config.yaml):
- docs.* frontend -> docs-frontend:80 (nginx, static Next.js export)
- /api/* and /admin/* -> docs-backend:80 (Django/uvicorn)
- /collaboration/ws/* -> docs-y-provider:4444 (Hocuspocus WebSocket)
- integration.* -> integration:80 (La Gaufre hub, same file)
Secrets (vault-secrets.yaml):
- VaultDynamicSecret docs-db-credentials (DB engine, static role)
- VaultStaticSecret docs-django-secret (DJANGO_SECRET_KEY)
- VaultStaticSecret docs-collaboration-secret (y-provider shared secret)
OIDC client (oidc-clients.yaml):
- Fix redirect_uri from /oidc/callback/ to /api/v1.0/callback/ -- impress
mounts all OIDC URLs under api/{API_VERSION}/ via lasuite.oidc_login,
same pattern as people.
Local overlay (values-resources.yaml):
- docs-backend: 512Mi limit, WEB_CONCURRENCY=2 (4 uvicorn workers
exceeded 384Mi at startup on the arm64 Lima VM)
- docs-celery-worker: 384Mi limit, CELERY_WORKER_CONCURRENCY=2
- docs-y-provider: 256Mi limit
- seaweedfs-filer: raised from 256Mi to 512Mi (OOMKilled during 188MB
multipart S3 upload of impress-y-provider image layer)
Local overlay (kustomization.yaml):
- Image mirrors for impress-backend, impress-frontend, impress-y-provider
(amd64-only images retagged to Gitea via cmd_mirror before deploy)
137 lines
4.3 KiB
YAML
137 lines
4.3 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: pingora-config
|
|
namespace: ingress
|
|
data:
|
|
config.toml: |
|
|
# Sunbeam proxy config.
|
|
#
|
|
# Substitution placeholders (replaced by sed at deploy time):
|
|
# DOMAIN_SUFFIX — e.g. <LIMA_IP>.sslip.io (local) or yourdomain.com (production)
|
|
|
|
[listen]
|
|
http = "0.0.0.0:80"
|
|
https = "0.0.0.0:443"
|
|
|
|
[tls]
|
|
# Cert files are written here by the proxy on startup and on cert renewal
|
|
# via the K8s API. The /etc/tls directory is an emptyDir volume.
|
|
cert_path = "/etc/tls/tls.crt"
|
|
key_path = "/etc/tls/tls.key"
|
|
|
|
[telemetry]
|
|
# Empty = OTEL disabled. Set to http://otel-collector.data.svc:4318 when ready.
|
|
otlp_endpoint = ""
|
|
|
|
# Host-prefix → backend routing table.
|
|
# The prefix is the subdomain before the first dot, so these routes work
|
|
# identically for yourdomain.com and *.sslip.io.
|
|
# Edit to match your own service names and namespaces.
|
|
#
|
|
# Per-route options:
|
|
# host_prefix — subdomain to match (required)
|
|
# backend — upstream URL, e.g. "http://svc.ns.svc.cluster.local:8000" (required)
|
|
# websocket — proxy WebSocket upgrades (default: false)
|
|
# disable_secure_redirection — when true, plain-HTTP requests are forwarded
|
|
# as-is instead of being 301-redirected to HTTPS.
|
|
# Default: false (all HTTP → HTTPS redirect enforced).
|
|
|
|
[[routes]]
|
|
host_prefix = "docs"
|
|
backend = "http://docs-frontend.lasuite.svc.cluster.local:80"
|
|
|
|
# API and admin go to the backend.
|
|
[[routes.paths]]
|
|
prefix = "/api/"
|
|
backend = "http://docs-backend.lasuite.svc.cluster.local:80"
|
|
|
|
[[routes.paths]]
|
|
prefix = "/admin/"
|
|
backend = "http://docs-backend.lasuite.svc.cluster.local:80"
|
|
|
|
# Real-time collaboration WebSocket (y-provider / Hocuspocus).
|
|
[[routes.paths]]
|
|
prefix = "/collaboration/ws/"
|
|
backend = "http://docs-y-provider.lasuite.svc.cluster.local:4444"
|
|
websocket = true
|
|
|
|
[[routes]]
|
|
host_prefix = "meet"
|
|
backend = "http://meet.lasuite.svc.cluster.local:8000"
|
|
websocket = true
|
|
|
|
[[routes]]
|
|
host_prefix = "drive"
|
|
backend = "http://drive.lasuite.svc.cluster.local:8000"
|
|
|
|
[[routes]]
|
|
host_prefix = "mail"
|
|
backend = "http://messages.lasuite.svc.cluster.local:8000"
|
|
|
|
[[routes]]
|
|
host_prefix = "chat"
|
|
backend = "http://conversations.lasuite.svc.cluster.local:8000"
|
|
websocket = true
|
|
|
|
[[routes]]
|
|
host_prefix = "people"
|
|
backend = "http://people-frontend.lasuite.svc.cluster.local:80"
|
|
|
|
# Backend handles the API, Django admin, and OAuth2 provider.
|
|
[[routes.paths]]
|
|
prefix = "/api/"
|
|
backend = "http://people-backend.lasuite.svc.cluster.local:80"
|
|
|
|
[[routes.paths]]
|
|
prefix = "/admin/"
|
|
backend = "http://people-backend.lasuite.svc.cluster.local:80"
|
|
|
|
[[routes.paths]]
|
|
prefix = "/o/"
|
|
backend = "http://people-backend.lasuite.svc.cluster.local:80"
|
|
|
|
[[routes]]
|
|
host_prefix = "find"
|
|
backend = "http://find-backend.lasuite.svc.cluster.local:8000"
|
|
|
|
[[routes]]
|
|
host_prefix = "src"
|
|
backend = "http://gitea-http.devtools.svc.cluster.local:3000"
|
|
websocket = true
|
|
|
|
# auth: login-ui handles browser UI; Hydra handles OAuth2/OIDC; Kratos handles self-service flows.
|
|
[[routes]]
|
|
host_prefix = "auth"
|
|
backend = "http://login-ui.ory.svc.cluster.local:3000"
|
|
|
|
[[routes.paths]]
|
|
prefix = "/oauth2"
|
|
backend = "http://hydra-public.ory.svc.cluster.local:4444"
|
|
|
|
[[routes.paths]]
|
|
prefix = "/.well-known"
|
|
backend = "http://hydra-public.ory.svc.cluster.local:4444"
|
|
|
|
[[routes.paths]]
|
|
prefix = "/userinfo"
|
|
backend = "http://hydra-public.ory.svc.cluster.local:4444"
|
|
|
|
# /kratos prefix is stripped before forwarding so Kratos sees its native paths.
|
|
[[routes.paths]]
|
|
prefix = "/kratos"
|
|
backend = "http://kratos-public.ory.svc.cluster.local:80"
|
|
strip_prefix = true
|
|
|
|
[[routes]]
|
|
host_prefix = "admin"
|
|
backend = "http://kratos-admin-ui.ory.svc.cluster.local:3000"
|
|
|
|
[[routes]]
|
|
host_prefix = "integration"
|
|
backend = "http://integration.lasuite.svc.cluster.local:80"
|
|
|
|
[[routes]]
|
|
host_prefix = "s3"
|
|
backend = "http://seaweedfs-filer.storage.svc.cluster.local:8333"
|