Ronni Baslund
153d7053ca
ci / typecheck (map[dir:apps/website name:website]) (push) Failing after 10m58s
ci / typecheck (map[dir:apps/portal name:portal]) (push) Failing after 11m56s
ci / typecheck (map[dir:apps/booking name:booking]) (push) Failing after 14m0s
ci / typecheck (map[dir:services/platform-api name:platform-api]) (push) Has been cancelled
ci / test (push) Has been cancelled
Adds the production cluster foundation (authored + applied live on node1): - cert-manager via the k3s HelmChart controller + letsencrypt staging/prod ClusterIssuers (HTTP-01 / Traefik). - Longhorn config for single-node (values: replica=1, default StorageClass, Retain) + backup-to-Hetzner-Object-Storage credential template. - In-cluster data tier (dezky-data): Postgres 16 (with Authentik+OCIS DB init), MongoDB 7, Redis 7 as StatefulSets on Longhorn, + secret template. - bootstrap.sh: install open-iscsi/nfs-common + enable iscsid (Longhorn prereq). - RUNBOOK.md: full reproducible node1 build order. Real secrets are generated on-box and kept in Bitwarden — never in git.
fleet/cert-manager — TLS for the cluster
cert-manager + ACME ClusterIssuers. Installs via the k3s built-in Helm
controller (no Helm CLI needed), then defines letsencrypt-staging and
letsencrypt-prod (HTTP-01 through the bundled Traefik).
Apply order (matters — issuers need the CRDs first)
# 1) Install cert-manager
kubectl apply -f cert-manager.yaml
# 2) Wait until it's up (CRDs + webhook ready)
kubectl -n cert-manager rollout status deploy/cert-manager-webhook --timeout=180s
kubectl -n cert-manager get pods
# 3) Create the issuers
kubectl apply -f cluster-issuer.yaml
kubectl get clusterissuer # both should report READY=True
Notes
- ACME email is
info@dezky.eu— change incluster-issuer.yamlif needed. - Test with
letsencrypt-stagingfirst (set an Ingress annotationcert-manager.io/cluster-issuer: letsencrypt-staging) to avoid burning the strict prod rate limits, then switch the apps toletsencrypt-prod. - HTTP-01 requires each hostname's DNS A record →
46.4.78.187and port 80 open (already true). A cert won't issue until DNS resolves. - The app Ingresses (
fleet/apps/) already referenceletsencrypt-prod.