NG: web-petting app

Co-Authored-By: Claude <noreply@anthropic.com>

k8s-ng/apps/web-petting/deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web-petting
+  labels:
+    app: web-petting
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: web-petting
+  template:
+    metadata:
+      labels:
+        app: web-petting
+      annotations:
+        reloader.stakater.com/auto: "true"
+    spec:
+      containers:
+        - name: web-petting
+          image: ultradesu/web-petting:latest
+          imagePullPolicy: Always
+          args:
+            - web-petting
+            - -l
+            - 0.0.0.0:3000
+          ports:
+            - name: http
+              containerPort: 3000
+          env:
+            - name: RUST_LOG
+              value: info
+            - name: WEB_PETTING_DEBUG
+              value: "false"
+            - name: WEB_PETTING_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: web-petting-secrets
+                  key: WEB_PETTING_DATABASE_URL
+          # Everything persistent is in PostgreSQL and R2; /data is scratch space only.
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+      volumes:
+        - name: data
+          emptyDir: {}

k8s-ng/apps/web-petting/ingress.yaml

@@ -0,0 +1,37 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: web-petting
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: pet.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: web-petting
+                port:
+                  number: 80
+    - host: xn--l1acako8eb.xn--p1ai
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: web-petting
+                port:
+                  number: 80
+  tls:
+    - secretName: web-petting-tls
+      hosts:
+        - pet.hexor.cy
+    - secretName: web-petting-murnyanya-tls
+      hosts:
+        - xn--l1acako8eb.xn--p1ai

k8s-ng/apps/web-petting/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - secrets.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

k8s-ng/apps/web-petting/secrets.yaml

@@ -0,0 +1,47 @@
+# Read-only access to the web-petting-db Secret in the psql namespace
+# (see postgresql/databases/web-petting.yaml for the other half).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: db-credentials-reader
+---
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: psql-credentials
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: psql
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: db-credentials-reader
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: web-petting-secrets
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: SecretStore
+    name: psql-credentials
+  target:
+    name: web-petting-secrets
+    template:
+      data:
+        WEB_PETTING_DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@main-rw.psql.svc:5432/web_petting"
+  data:
+    - secretKey: username
+      remoteRef:
+        key: web-petting-db
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: web-petting-db
+        property: password

k8s-ng/apps/web-petting/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-petting
+  labels:
+    app: web-petting
+spec:
+  type: ClusterIP
+  selector:
+    app: web-petting
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3000
+      protocol: TCP

k8s-ng/core-state/values.yaml

@@ -60,6 +60,12 @@ apps:
     namespace: furumi
     wave: 5 # pinned to the music node; must not hold back the other waves
     skipDryRunOnMissingResource: true
+  - name: web-petting
+    project: apps
+    path: k8s-ng/apps/web-petting
+    namespace: web-petting
+    wave: 5
+    skipDryRunOnMissingResource: true
   - name: secret-stores
     path: k8s-ng/core/secret-stores
     namespace: external-secrets