Nick SzaunigandClaude Opus 5.5
f9349144ea
Docker-Images bauen und veroeffentlichen / build-and-push (push) Successful in 4m39s
Alle Ressourcen tragen den Praefix artista-filmcamp- (Deployment, Service, StatefulSet, CronJobs, PVCs, ConfigMap, Secret, Ingress, NetworkPolicies, Middleware) und liegen im Namespace artista. Die Images heissen wieder <owner>/artista-filmcamp und <owner>/artista-filmcamp-tools, passend zum Repo. DATABASE_URL-Host, Backup-Host und Betriebsdoku entsprechend angepasst. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
65 lines
1.9 KiB
YAML
65 lines
1.9 KiB
YAML
# Ingress fuer Traefik mit cert-manager.
|
|
# Anpassen: Host (auch in APP_URL, kustomization.yaml), ingressClassName
|
|
# ("kubectl get ingressclass"), ClusterIssuer, TLS-Secret-Name.
|
|
#
|
|
# X-Forwarded-For/X-Real-Ip: Rate Limits verlassen sich darauf, dass Traefik
|
|
# vom Client mitgeschickte Werte verwirft. Dafuer im Traefik-EntryPoint
|
|
# forwardedHeaders.trustedIPs nur auf echte vorgelagerte Proxys setzen.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: artista-filmcamp
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- modelcamp.example.org
|
|
secretName: artista-filmcamp-tls
|
|
rules:
|
|
- host: modelcamp.example.org
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: artista-filmcamp-app
|
|
port:
|
|
name: http
|
|
---
|
|
# HTTP -> HTTPS. Entfaellt, wenn Traefik das bereits EntryPoint-weit tut
|
|
# (Helm: ports.web.redirections.entryPoint.to=websecure).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: artista-filmcamp-http-redirect
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: artista-artista-filmcamp-redirect-https@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: modelcamp.example.org
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: artista-filmcamp-app
|
|
port:
|
|
name: http
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: artista-filmcamp-redirect-https
|
|
spec:
|
|
redirectScheme:
|
|
scheme: https
|
|
permanent: true
|