Sienna Meridian Satterwhite
cdddc334ff
Ingress: - Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder - HTTPS termination with mkcert (local) / rustls-acme (production) - Host-prefix routing with path-based sub-routing for auth virtual host: /oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui - HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub - cert-manager HTTP-01 ACME challenge routing via Ingress watcher - RBAC for Ingress watcher (pingora-watcher ClusterRole) - local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict Infrastructure: - socket_vmnet shared network for host↔VM reachability (192.168.105.2) - local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution - Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods - Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25 - Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# Production overlay — targets Scaleway Elastic Metal (Paris)
|
|
#
|
|
# Deploy (DOMAIN_SUFFIX and ACME_EMAIL are substituted by sed):
|
|
# DOMAIN="yourdomain.com" EMAIL="ops@yourdomain.com"
|
|
# kustomize build overlays/production/ \
|
|
# | sed -e "s/DOMAIN_SUFFIX/${DOMAIN}/g" -e "s/ACME_EMAIL/${EMAIL}/g" \
|
|
# | kubectl apply --server-side --force-conflicts -f -
|
|
|
|
resources:
|
|
- ../../base/mesh
|
|
- ../../base/ingress
|
|
- ../../base/ory
|
|
- ../../base/data
|
|
- ../../base/storage
|
|
- ../../base/lasuite
|
|
- ../../base/media
|
|
- ../../base/devtools
|
|
# cert-manager ClusterIssuer + Certificate (requires cert-manager to be installed)
|
|
- cert-manager.yaml
|
|
|
|
images:
|
|
# Set to your container registry. DOMAIN_SUFFIX is substituted by sed.
|
|
- name: sunbeam-proxy
|
|
newName: src.DOMAIN_SUFFIX/sunbeam/sunbeam-proxy
|
|
newTag: latest
|
|
|
|
patches:
|
|
- path: values-pingora.yaml
|
|
|
|
# TODO: set OIDC redirect URIs to https://*.sunbeam.pt/...
|
|
# - path: values-ory.yaml
|
|
|
|
# TODO: set production resource limits (64 GB server)
|
|
# - path: values-resources.yaml
|