first commit

k8s/overlays/production/ingress.yaml

@@ -0,0 +1,64 @@
+# Ingress fuer Traefik mit cert-manager.
+# Anpassen: Host (auch in APP_URL, kustomization.yaml), ingressClassName
+# ("kubectl get ingressclass"), ClusterIssuer, TLS-Secret-Name.
+#
+# X-Forwarded-For/X-Real-Ip: Rate Limits verlassen sich darauf, dass Traefik
+# vom Client mitgeschickte Werte verwirft. Dafuer im Traefik-EntryPoint
+# forwardedHeaders.trustedIPs nur auf echte vorgelagerte Proxys setzen.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: artista
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - modelcamp.example.org
+      secretName: artista-tls
+  rules:
+    - host: modelcamp.example.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: artista-app
+                port:
+                  name: http
+---
+# HTTP -> HTTPS. Entfaellt, wenn Traefik das bereits EntryPoint-weit tut
+# (Helm: ports.web.redirections.entryPoint.to=websecure).
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: artista-http-redirect
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: artista-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: modelcamp.example.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: artista-app
+                port:
+                  name: http
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true

k8s/overlays/production/kustomization.yaml

@@ -0,0 +1,27 @@
+# Produktions-Overlay. Anpassen: Images/Tags, Domain, IngressClass,
+# ClusterIssuer und TLS-Secret-Name. Anwenden:
+#   kubectl apply -k k8s/overlays/production
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: artista
+resources:
+  - ../../base
+  - ingress.yaml
+
+images:
+  # Gebaut von .gitea/workflows/docker-build.yml: Git-Tag "v0.1.0" pushen
+  # ergibt Image-Tag "0.1.0" (Alternativen: "sha-<kurz>", "latest").
+  # Beide Images immer mit identischem Tag ausrollen.
+  - name: artista-modelcamp
+    newName: git.encry.de/nick.rosenloecher/artista-filmcamp
+    newTag: "0.1.0"
+  - name: artista-modelcamp-tools
+    newName: git.encry.de/nick.rosenloecher/artista-filmcamp-tools
+    newTag: "0.1.0"
+
+patches:
+  - target: { kind: ConfigMap, name: artista-config }
+    patch: |-
+      - op: replace
+        path: /data/APP_URL
+        value: https://modelcamp.example.org