Nick.Rosenloecher/Artista-Filmcamp
1
0 Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: Kubernetes-Ressourcen und Images heissen artista-modelcamp
Docker-Images bauen und veroeffentlichen / build-and-push (push) Successful in 2m19s
Details

Browse Source 
Alle Ressourcen tragen den Praefix artista-modelcamp- im Namespace
artista; Images <owner>/artista-modelcamp und
<owner>/artista-modelcamp-tools. DATABASE_URL-Host, Backup-Host,
Traefik-Middleware-Referenz und Betriebsdoku entsprechend angepasst.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
This commit is contained in:
Nick SzaunigandClaude Opus 5.5 committed 2026-09-27 14:38:37 +02:00
1 parent f9349144ea
commit 95e3733ab8
11 files changed
+73 -73
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

k8s/base/app.yaml
+15 -15
View File
@@ -3,11 +3,11 @@
# PostgreSQL — beliebig viele Replikate moeglich.
#
# Migrationen laufen NICHT beim Start, sondern als eigener, kontrollierter
# Schritt (jobs.yaml, CronJob "artista-filmcamp-migrate", siehe docs/BETRIEB.md).
# Schritt (jobs.yaml, CronJob "artista-modelcamp-migrate", siehe docs/BETRIEB.md).
apiVersion: apps/v1
kind: Deployment
metadata:
name: artista-filmcamp-app
name: artista-modelcamp-app
spec:
replicas: 2
revisionHistoryLimit: 5
@@ -16,11 +16,11 @@ spec:
rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
selector:
matchLabels:
app.kubernetes.io/name: artista-filmcamp-app
app.kubernetes.io/name: artista-modelcamp-app
template:
metadata:
labels:
app.kubernetes.io/name: artista-filmcamp-app
app.kubernetes.io/name: artista-modelcamp-app
artista/db-client: "true"
spec:
automountServiceAccountToken: false
@@ -36,16 +36,16 @@ spec:
whenUnsatisfiable: ScheduleAnyway
labelSelector:
matchLabels:
app.kubernetes.io/name: artista-filmcamp-app
app.kubernetes.io/name: artista-modelcamp-app
containers:
- name: app
image: artista-filmcamp
image: artista-modelcamp
ports:
- name: http
containerPort: 3000
envFrom:
- configMapRef: { name: artista-filmcamp-config }
- secretRef: { name: artista-filmcamp-secrets }
- configMapRef: { name: artista-modelcamp-config }
- secretRef: { name: artista-modelcamp-secrets }
readinessProbe:
httpGet: { path: /api/health/ready, port: http }
periodSeconds: 10
@@ -76,7 +76,7 @@ spec:
mountPath: /tmp
volumes:
- name: media
persistentVolumeClaim: { claimName: artista-filmcamp-media }
persistentVolumeClaim: { claimName: artista-modelcamp-media }
- name: next-cache
emptyDir: { sizeLimit: 512Mi }
- name: tmp
@@ -85,10 +85,10 @@ spec:
apiVersion: v1
kind: Service
metadata:
name: artista-filmcamp-app
name: artista-modelcamp-app
spec:
selector:
app.kubernetes.io/name: artista-filmcamp-app
app.kubernetes.io/name: artista-modelcamp-app
ports:
- name: http
port: 80
@@ -102,11 +102,11 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: artista-filmcamp-app-ingress
name: artista-modelcamp-app-ingress
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: artista-filmcamp-app
app.kubernetes.io/name: artista-modelcamp-app
policyTypes: ["Ingress"]
ingress:
- from:
@@ -121,9 +121,9 @@ spec:
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: artista-filmcamp-app
name: artista-modelcamp-app
spec:
minAvailable: 1
selector:
matchLabels:
app.kubernetes.io/name: artista-filmcamp-app
app.kubernetes.io/name: artista-modelcamp-app
k8s/base/config.yaml
+4 -4
View File
@@ -10,7 +10,7 @@ metadata:
apiVersion: v1
kind: ConfigMap
metadata:
name: artista-filmcamp-config
name: artista-modelcamp-config
data:
APP_ENV: "production"
APP_URL: "https://modelcamp.example.org"
@@ -33,7 +33,7 @@ data:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: artista-filmcamp-media
name: artista-modelcamp-media
spec:
accessModes: ["ReadWriteMany"]
# storageClassName: longhorn
@@ -46,11 +46,11 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: artista-filmcamp-postgres-access
name: artista-modelcamp-postgres-access
spec:
podSelector:
matchLabels:
app.kubernetes.io/name: artista-filmcamp-postgres
app.kubernetes.io/name: artista-modelcamp-postgres
policyTypes: ["Ingress"]
ingress:
- from:
k8s/base/jobs.yaml
+13 -13
View File
@@ -2,12 +2,12 @@
# Als SUSPENDIERTER CronJob definiert, damit Kustomize das Image mit der
# App gleichzieht. Er laeuft nie von selbst, sondern bewusst vor jedem
# Rollout:
# kubectl -n artista create job migrate-$(date +%Y%m%d%H%M) --from=cronjob/artista-filmcamp-migrate
# kubectl -n artista create job migrate-$(date +%Y%m%d%H%M) --from=cronjob/artista-modelcamp-migrate
# kubectl -n artista wait --for=condition=complete job/migrate-… --timeout=5m
apiVersion: batch/v1
kind: CronJob
metadata:
name: artista-filmcamp-migrate
name: artista-modelcamp-migrate
spec:
suspend: true
schedule: "0 0 1 1 *"
@@ -28,10 +28,10 @@ spec:
seccompProfile: { type: RuntimeDefault }
containers:
- name: migrate
image: artista-filmcamp-tools
image: artista-modelcamp-tools
command: ["prisma", "migrate", "deploy"]
envFrom:
- secretRef: { name: artista-filmcamp-secrets }
- secretRef: { name: artista-modelcamp-secrets }
resources:
requests: { cpu: 50m, memory: 128Mi }
limits: { memory: 512Mi }
@@ -47,7 +47,7 @@ spec:
apiVersion: batch/v1
kind: CronJob
metadata:
name: artista-filmcamp-worker
name: artista-modelcamp-worker
spec:
schedule: "*/10 * * * *"
timeZone: "Europe/Berlin"
@@ -72,11 +72,11 @@ spec:
seccompProfile: { type: RuntimeDefault }
containers:
- name: worker
image: artista-filmcamp-tools
image: artista-modelcamp-tools
command: ["tsx", "scripts/worker.ts"]
envFrom:
- configMapRef: { name: artista-filmcamp-config }
- secretRef: { name: artista-filmcamp-secrets }
- configMapRef: { name: artista-modelcamp-config }
- secretRef: { name: artista-modelcamp-secrets }
resources:
requests: { cpu: 50m, memory: 192Mi }
limits: { memory: 512Mi }
@@ -91,7 +91,7 @@ spec:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: artista-filmcamp-db-backup
name: artista-modelcamp-db-backup
spec:
accessModes: ["ReadWriteOnce"]
# storageClassName: smb-backup
@@ -102,7 +102,7 @@ spec:
apiVersion: batch/v1
kind: CronJob
metadata:
name: artista-filmcamp-db-backup
name: artista-modelcamp-db-backup
spec:
schedule: "15 3 * * *"
timeZone: "Europe/Berlin"
@@ -131,7 +131,7 @@ spec:
env:
- name: PGPASSWORD
valueFrom:
secretKeyRef: { name: artista-filmcamp-secrets, key: DB_PASSWORD }
secretKeyRef: { name: artista-modelcamp-secrets, key: DB_PASSWORD }
command: ["/bin/sh", "-c"]
args:
- |
@@ -139,7 +139,7 @@ spec:
set -o pipefail
target="/backup/artista-$(date -u +%Y-%m-%d_%H%M).dump"
# Custom-Format: komprimiert, selektiv wiederherstellbar.
pg_dump --host=artista-filmcamp-postgres --username=artista --dbname=artista \
pg_dump --host=artista-modelcamp-postgres --username=artista --dbname=artista \
--format=custom --file="${target}.partial"
mv "${target}.partial" "${target}"
find /backup -name 'artista-*.dump.partial' -mtime +1 -delete
@@ -156,4 +156,4 @@ spec:
mountPath: /backup
volumes:
- name: backup
persistentVolumeClaim: { claimName: artista-filmcamp-db-backup }
persistentVolumeClaim: { claimName: artista-modelcamp-db-backup }
k8s/base/kustomization.yaml
+1 -1
View File
@@ -10,5 +10,5 @@ resources:
- jobs.yaml
labels:
- pairs:
app.kubernetes.io/part-of: artista-filmcamp
app.kubernetes.io/part-of: artista-modelcamp
includeSelectors: false
k8s/base/postgres.yaml
+7 -7
View File
@@ -12,17 +12,17 @@
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: artista-filmcamp-postgres
name: artista-modelcamp-postgres
spec:
serviceName: artista-filmcamp-postgres
serviceName: artista-modelcamp-postgres
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: artista-filmcamp-postgres
app.kubernetes.io/name: artista-modelcamp-postgres
template:
metadata:
labels:
app.kubernetes.io/name: artista-filmcamp-postgres
app.kubernetes.io/name: artista-modelcamp-postgres
spec:
securityContext:
runAsNonRoot: true
@@ -42,7 +42,7 @@ spec:
value: artista
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef: { name: artista-filmcamp-secrets, key: DB_PASSWORD }
secretKeyRef: { name: artista-modelcamp-secrets, key: DB_PASSWORD }
volumeMounts:
# Ab PostgreSQL 18 liegt PGDATA unter /var/lib/postgresql/18/docker.
- name: data
@@ -73,10 +73,10 @@ spec:
apiVersion: v1
kind: Service
metadata:
name: artista-filmcamp-postgres
name: artista-modelcamp-postgres
spec:
clusterIP: None
selector:
app.kubernetes.io/name: artista-filmcamp-postgres
app.kubernetes.io/name: artista-modelcamp-postgres
ports:
- port: 5432
k8s/overlays/production/ingress.yaml
+7 -7
View File
@@ -8,7 +8,7 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: artista-filmcamp
name: artista-modelcamp
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -18,7 +18,7 @@ spec:
tls:
- hosts:
- modelcamp.example.org
secretName: artista-filmcamp-tls
secretName: artista-modelcamp-tls
rules:
- host: modelcamp.example.org
http:
@@ -27,7 +27,7 @@ spec:
pathType: Prefix
backend:
service:
name: artista-filmcamp-app
name: artista-modelcamp-app
port:
name: http
---
@@ -36,10 +36,10 @@ spec:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: artista-filmcamp-http-redirect
name: artista-modelcamp-http-redirect
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: web
traefik.ingress.kubernetes.io/router.middlewares: artista-artista-filmcamp-redirect-https@kubernetescrd
traefik.ingress.kubernetes.io/router.middlewares: artista-artista-modelcamp-redirect-https@kubernetescrd
spec:
ingressClassName: traefik
rules:
@@ -50,14 +50,14 @@ spec:
pathType: Prefix
backend:
service:
name: artista-filmcamp-app
name: artista-modelcamp-app
port:
name: http
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: artista-filmcamp-redirect-https
name: artista-modelcamp-redirect-https
spec:
redirectScheme:
scheme: https
k8s/overlays/production/kustomization.yaml
+5 -5
View File
@@ -12,15 +12,15 @@ images:
# Gebaut von .gitea/workflows/docker-build.yml: Git-Tag "v0.1.0" pushen
# ergibt Image-Tag "0.1.0" (Alternativen: "sha-<kurz>", "latest").
# Beide Images immer mit identischem Tag ausrollen.
- name: artista-filmcamp
newName: git.encry.de/nick.rosenloecher/artista-filmcamp
- name: artista-modelcamp
newName: git.encry.de/nick.rosenloecher/artista-modelcamp
newTag: "0.1.0"
- name: artista-filmcamp-tools
newName: git.encry.de/nick.rosenloecher/artista-filmcamp-tools
- name: artista-modelcamp-tools
newName: git.encry.de/nick.rosenloecher/artista-modelcamp-tools
newTag: "0.1.0"
patches:
- target: { kind: ConfigMap, name: artista-filmcamp-config }
- target: { kind: ConfigMap, name: artista-modelcamp-config }
patch: |-
- op: replace
path: /data/APP_URL
k8s/secret.example.yaml
+4 -4
View File
@@ -1,8 +1,8 @@
# VORLAGE — nicht mit echten Werten ins Repository einchecken.
# Anlegen z. B. per:
# kubectl -n artista create secret generic artista-filmcamp-secrets \
# kubectl -n artista create secret generic artista-modelcamp-secrets \
# --from-literal=DB_PASSWORD='…' \
# --from-literal=DATABASE_URL='postgresql://artista:…@artista-filmcamp-postgres:5432/artista' \
# --from-literal=DATABASE_URL='postgresql://artista:…@artista-modelcamp-postgres:5432/artista' \
# --from-literal=APP_SECRET="$(openssl rand -base64 48)" \
# --from-literal=BETTER_AUTH_SECRET="$(openssl rand -base64 48)" \
# --from-literal=STRIPE_SECRET_KEY='sk_test_…' \
@@ -12,13 +12,13 @@
apiVersion: v1
kind: Secret
metadata:
name: artista-filmcamp-secrets
name: artista-modelcamp-secrets
namespace: artista
type: Opaque
stringData:
DB_PASSWORD: "<starkes-passwort>"
# Passwort URL-kodiert einsetzen, falls Sonderzeichen enthalten sind.
DATABASE_URL: "postgresql://artista:<starkes-passwort>@artista-filmcamp-postgres:5432/artista"
DATABASE_URL: "postgresql://artista:<starkes-passwort>@artista-modelcamp-postgres:5432/artista"
APP_SECRET: "<mind-32-zeichen-zufall>"
BETTER_AUTH_SECRET: "<anderer-mind-32-zeichen-zufall>"
STRIPE_SECRET_KEY: "<sk_test_… oder sk_live_…>"