changed deployment

deploy/helm/go-guess/values-dev.yaml

@@ -10,7 +10,8 @@ tenants:
   - nmbs
   - ypto
 
-imagePullSecrets: []
+imagePullSecrets:
+  - name: nexus-registry
 
 api:
   podSecurityContext:
@@ -26,8 +27,8 @@ api:
     runAsGroup: 100
   replicaCount: 1
   image:
-    repository: batty1039.startdedicated.net:5000/go-guess-api
+    repository: nexus.urpi.be/docker-hosted/go-guess
-    tag: "latest"
+    tag: "0.0.1"
     pullPolicy: Always
   environment: development
   frontendURL: ""
@@ -66,8 +67,8 @@ api:
 web:
   replicaCount: 1
   image:
-    repository: batty1039.startdedicated.net:5000/go-guess-web
+    repository: nexus.urpi.be/docker-hosted/go-guess
-    tag: "latest"
+    tag: "0.0.1"
     pullPolicy: Always
   service:
     type: ClusterIP

deploy/helm/go-guess/values-lcl.yaml

@@ -0,0 +1,181 @@
+# Local (LCL) values for go-guess.
+# Tenants are served at https://<tenant>.guess-lcl.intern-urpi.be
+# (nmbs, ypto), routed by the docker TLS edge into k3s Traefik.
+nameOverride: ""
+fullnameOverride: ""
+
+# Public application domain. Every tenant is served from https://<tenant>.<domain>.
+domain: guess-lcl.intern-urpi.be
+
+# Tenant slugs. Each one gets its own ingress host and TLS SAN.
+tenants:
+  - nmbs
+  - ypto
+
+# Images live in the local registry (localhost:5000), no pull secret needed.
+imagePullSecrets: []
+
+api:
+  podSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 100
+    runAsGroup: 100
+    fsGroup: 100
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 100
+    runAsGroup: 100
+  replicaCount: 1
+  image:
+    repository: localhost:5000/go-guess
+    tag: "0.0.1"
+    pullPolicy: IfNotPresent
+  environment: development
+  frontendURL: ""
+  tokenTTL: 8h
+  maxUploadMB: 10
+  service:
+    name: api
+    type: ClusterIP
+    port: 8080
+  goLoose:
+    enabled: true
+    authDomain: auth-lcl.intern-urpi.be
+    # local-ca is the certificate authority used by the docker TLS edge
+    # (dev-infrastructure/certs/local-ca.crt).
+    ca:
+      existingSecret: "local-ca"
+      key: ca.crt
+      mountPath: /certs/local-ca.crt
+    tenants:
+      nmbs:
+        clientID: ""
+        clientSecret: ""
+      ypto:
+        clientID: ""
+        clientSecret: ""
+  resources:
+    requests:
+      cpu: 50m
+      memory: 96Mi
+    limits:
+      cpu: 300m
+      memory: 384Mi
+  podAnnotations: {}
+  podLabels: {}
+  strategy:
+    type: Recreate
+
+web:
+  replicaCount: 1
+  image:
+    repository: localhost:5000/go-guess
+    tag: "0.0.1"
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 80
+    nodePort: null
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+    limits:
+      cpu: 200m
+      memory: 96Mi
+  podAnnotations: {}
+  podLabels: {}
+  podSecurityContext: {}
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+      add:
+        - CHOWN
+        - SETGID
+        - SETUID
+        - NET_BIND_SERVICE
+    readOnlyRootFilesystem: false
+    runAsNonRoot: false
+    runAsUser: 0
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations: {}
+  path: /
+  pathType: Prefix
+  tls:
+    enabled: true
+    # local-dev-cert is signed by the local CA (dev-infrastructure/certs).
+    existingSecret: "local-dev-cert"
+    secretName: ""
+
+# No cert-manager in the local cluster.
+certManager:
+  enabled: false
+  issuerRef: null
+  duration: 8760h
+  renewBefore: 720h
+  caSecretName: ""
+
+# Empty values are generated once and preserved in the release secret.
+secrets:
+  jwtSecret: ""
+  databaseURL: ""
+  rabbitmqURL: ""
+  postgresqlPassword: ""
+  rabbitmqPassword: ""
+
+postgresql:
+  enabled: true
+  image:
+    repository: postgres
+    tag: 18-alpine
+    pullPolicy: IfNotPresent
+  auth:
+    username: go_guess
+    database: go_guess
+  persistence:
+    enabled: true
+    size: 2Gi
+    storageClass: ""
+  resources:
+    requests:
+      cpu: 50m
+      memory: 96Mi
+    limits:
+      cpu: 300m
+      memory: 384Mi
+
+rabbitmq:
+  enabled: true
+  image:
+    repository: rabbitmq
+    tag: 4-alpine
+    pullPolicy: IfNotPresent
+  auth:
+    username: go_guess
+  persistence:
+    enabled: true
+    size: 2Gi
+    storageClass: ""
+  resources:
+    requests:
+      cpu: 50m
+      memory: 96Mi
+    limits:
+      cpu: 300m
+      memory: 384Mi
+
+nodeSelector: {}
+tolerations: []
+affinity: {}

deploy/helm/go-guess/values-prd.yaml

@@ -10,7 +10,8 @@ tenants:
   - nmbs
   - ypto
 
-imagePullSecrets: []
+imagePullSecrets:
+  - name: nexus-registry
 
 api:
   podSecurityContext:
@@ -26,8 +27,8 @@ api:
     runAsGroup: 100
   replicaCount: 2
   image:
-    repository: batty1039.startdedicated.net:5000/go-guess-api
+    repository: nexus.urpi.be/docker-hosted/go-guess
-    tag: "latest"
+    tag: "0.0.1"
     pullPolicy: Always
   environment: production
   frontendURL: ""
@@ -69,8 +70,8 @@ api:
 web:
   replicaCount: 2
   image:
-    repository: batty1039.startdedicated.net:5000/go-guess-web
+    repository: nexus.urpi.be/docker-hosted/go-guess
-    tag: "latest"
+    tag: "0.0.1"
     pullPolicy: Always
   service:
     type: ClusterIP

deploy/helm/go-guess/values-tst.yaml

@@ -0,0 +1,177 @@
+# TST values for go-guess
+nameOverride: ""
+fullnameOverride: ""
+
+# Public application domain. Every tenant is served from https://<tenant>.<domain>.
+domain: guess-tst.intern-urpi.be
+
+# Tenant slugs. Each one gets its own ingress host and TLS SAN.
+tenants:
+  - nmbs
+  - ypto
+
+imagePullSecrets:
+  - name: nexus-registry
+
+api:
+  podSecurityContext:
+    runAsNonRoot: true
+    runAsUser: 100
+    runAsGroup: 100
+    fsGroup: 100
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 100
+    runAsGroup: 100
+  replicaCount: 1
+  image:
+    repository: nexus.urpi.be/docker-hosted/go-guess
+    tag: "0.0.1"
+    pullPolicy: Always
+  environment: development
+  frontendURL: ""
+  tokenTTL: 8h
+  maxUploadMB: 10
+  service:
+    name: api
+    type: ClusterIP
+    port: 8080
+  goLoose:
+    enabled: true
+    authDomain: auth-tst.intern-urpi.be
+    ca:
+      existingSecret: ""
+      key: ca.crt
+      mountPath: /certs/local-ca.crt
+    tenants:
+      nmbs:
+        clientID: ""
+        clientSecret: ""
+      ypto:
+        clientID: ""
+        clientSecret: ""
+  resources:
+    requests:
+      cpu: 50m
+      memory: 96Mi
+    limits:
+      cpu: 300m
+      memory: 384Mi
+  podAnnotations: {}
+  podLabels: {}
+  strategy:
+    type: Recreate
+
+web:
+  replicaCount: 1
+  image:
+    repository: nexus.urpi.be/docker-hosted/go-guess
+    tag: "0.0.1"
+    pullPolicy: Always
+  service:
+    type: ClusterIP
+    port: 80
+    nodePort: null
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+    limits:
+      cpu: 200m
+      memory: 96Mi
+  podAnnotations: {}
+  podLabels: {}
+  podSecurityContext: {}
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    readOnlyRootFilesystem: false
+    runAsNonRoot: false
+    runAsUser: 0
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 10m
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+  path: /
+  pathType: Prefix
+  tls:
+    enabled: true
+    existingSecret: ""
+    secretName: ""
+
+certManager:
+  enabled: true
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer
+  duration: 8760h
+  renewBefore: 720h
+  caSecretName: ""
+
+secrets:
+  jwtSecret: ""
+  databaseURL: ""
+  rabbitmqURL: ""
+  postgresqlPassword: ""
+  rabbitmqPassword: ""
+
+postgresql:
+  enabled: true
+  image:
+    repository: postgres
+    tag: 18-alpine
+    pullPolicy: IfNotPresent
+  auth:
+    username: go_guess
+    database: go_guess
+  persistence:
+    enabled: true
+    size: 5Gi
+    storageClass: ""
+  resources:
+    requests:
+      cpu: 50m
+      memory: 96Mi
+    limits:
+      cpu: 300m
+      memory: 384Mi
+
+rabbitmq:
+  enabled: true
+  image:
+    repository: rabbitmq
+    tag: 4-alpine
+    pullPolicy: IfNotPresent
+  auth:
+    username: go_guess
+  persistence:
+    enabled: true
+    size: 5Gi
+    storageClass: ""
+  resources:
+    requests:
+      cpu: 50m
+      memory: 96Mi
+    limits:
+      cpu: 300m
+      memory: 384Mi
+
+nodeSelector: {}
+tolerations: []
+affinity: {}

deploy/helm/go-guess/values.yaml

@@ -9,7 +9,8 @@ tenants:
   - nmbs
   - ypto
 
-imagePullSecrets: []
+imagePullSecrets:
+  - name: nexus-registry
 
 api:
   podSecurityContext:
@@ -25,7 +26,7 @@ api:
     runAsGroup: 100
   replicaCount: 1
   image:
-    repository: batty1039.startdedicated.net:5000/go-guess-api
+    repository: nexus.urpi.be/docker-hosted/go-guess
     tag: "0.0.1"
     pullPolicy: IfNotPresent
   environment: development
@@ -77,8 +78,8 @@ api:
 web:
   replicaCount: 2
   image:
-    repository: batty1039.startdedicated.net:5000/go-guess-web
+    repository: nexus.urpi.be/docker-hosted/go-guess
-    tag: "0.1.0"
+    tag: "0.0.1"
     pullPolicy: IfNotPresent
   # Origin of the go-bananas runtime supplying the shared styling contract, for
   # example https://bananas-dev.urpi.be. Empty keeps this application's own