Ronni Baslund
c60937c5cb
ci / build (map[dir:apps/booking name:booking]) (push) Has been cancelled
ci / build (map[dir:apps/operator name:operator]) (push) Has been cancelled
ci / build (map[dir:apps/portal name:portal]) (push) Has been cancelled
ci / build (map[dir:services/platform-api name:platform-api]) (push) Has been cancelled
ci / deploy (push) Has been cancelled
ci / typecheck (map[dir:apps/booking name:booking]) (push) Has been cancelled
ci / typecheck (map[dir:apps/operator name:operator]) (push) Has been cancelled
ci / typecheck (map[dir:apps/portal name:portal]) (push) Has been cancelled
ci / typecheck (map[dir:apps/website name:website]) (push) Has been cancelled
ci / typecheck (map[dir:services/platform-api name:platform-api]) (push) Has been cancelled
ci / test (push) Has been cancelled
Push to main = release: after build, a deploy job pins each app image to the commit SHA (kustomize edit set image), kubectl-applies fleet/apps and waits for the rollouts. The runner already runs in-cluster, so it reaches the API server on the in-cluster service IP with a kubeconfig for the new ci-deployer ServiceAccount (namespace-scoped admin, KUBECONFIG_B64 repo secret). The drafted Flux sync/image-automation layer is removed — a GitOps controller plus bot tag-bump commits is more machinery than a single-node cluster needs. Sortable image tags and $imagepolicy markers go with it. Also: per-router ACME-safe HTTP->HTTPS redirects for the app ingresses, platform-api prod config completed (Authentik JWT/JWKS + admin API, Stalwart via the cni0 gateway IP, OCIS/cold-storage placeholders until those tiers exist) and the secrets template/README updated to match.
25 lines
1.1 KiB
YAML
25 lines
1.1 KiB
YAML
# Customise the k3s-bundled Traefik.
|
|
#
|
|
# k3s manages Traefik via a HelmChart named 'traefik' in kube-system; a
|
|
# HelmChartConfig of the same name MERGES these values into it (k3s re-runs the
|
|
# install).
|
|
#
|
|
# HTTP→HTTPS redirect is deliberately NOT done here at the entrypoint level.
|
|
# A global `entrypoints.web.http.redirections` is a catch-all that runs BEFORE
|
|
# any router, so it 301s the ACME HTTP-01 challenge (:80 /.well-known/
|
|
# acme-challenge/...) to HTTPS before cert-manager's solver can answer — and the
|
|
# solver isn't served on the websecure-only app ingresses, so the challenge
|
|
# 404s and Let's Encrypt issuance fails. Instead each app Ingress carries a
|
|
# `redirectScheme` Middleware (see apps/redirect-middleware.yaml +
|
|
# authentik/redirect-middleware.yaml): real traffic still gets 301'd to HTTPS,
|
|
# but port 80 stays open so the cert-manager solver (a separate, more-specific
|
|
# router with no middleware) can complete the challenge.
|
|
apiVersion: helm.cattle.io/v1
|
|
kind: HelmChartConfig
|
|
metadata:
|
|
name: traefik
|
|
namespace: kube-system
|
|
spec:
|
|
valuesContent: |-
|
|
additionalArguments: []
|