Nick Szaunig
147417d7d4
Verified each finding against the real codebase first, since the review's diff was polluted by a stale leftover agent-worktree copy under .claude/worktrees/ (now removed) that made several already-fixed or never-broken issues look current (CORS, missing typecheck script, PWA icons, font CSS, Helmet/Swagger CSP - all confirmed fine live, not touched). Real fixes: - main.ts: fail-fast on missing DATABASE_URL/JWT_ACCESS_SECRET at boot, call enableShutdownHooks() so PrismaService.onModuleDestroy() actually runs on SIGTERM during k8s rolling deploys, PORT fallback 3000 -> 3001 to match every other place that documents the port. - health.controller.ts: log the real underlying DB error instead of discarding it, add a 5s timeout to the readiness query so a hung DB fails the probe fast instead of blocking indefinitely. - Frontend Dockerfile: declare ARG/ENV NEXT_PUBLIC_API_URL before the build step, since Next.js inlines NEXT_PUBLIC_* vars at build time and a runtime-only ConfigMap value never reaches the compiled bundle. - Backend ingress.yaml: drop the no-op rewrite-target regex for a plain prefix path (identical behavior, less confusing).
26 lines
678 B
YAML
26 lines
678 B
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: apicore-backend
|
|
annotations:
|
|
# Requires cert-manager with a ClusterIssuer named "letsencrypt-prod"
|
|
# (or swap for whatever issuer/cert mechanism the cluster already uses).
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- api.apicore.example.com
|
|
secretName: apicore-backend-tls
|
|
rules:
|
|
- host: api.apicore.example.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: apicore-backend
|
|
port:
|
|
number: 80
|