feat: configure dedicated server proxy
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Daniel Noulet
parent
e787359c54
commit
a86a0cb539
8 changed files with 91 additions and 91 deletions
|
|
@ -3,7 +3,8 @@ Go Guess has been installed in namespace {{ .Release.Namespace }}.
|
|||
{{- if .Values.ingress.enabled }}
|
||||
Open {{ .Values.app.frontendURL }}
|
||||
{{- else if eq .Values.service.type "NodePort" }}
|
||||
Open a cluster node on port {{ .Values.service.nodePort }}.
|
||||
The application is exposed on cluster node port {{ .Values.service.nodePort }}.
|
||||
Open {{ .Values.app.frontendURL }} through the external reverse proxy.
|
||||
{{- else }}
|
||||
Run:
|
||||
kubectl -n {{ .Release.Namespace }} port-forward service/{{ include "go-guess.fullname" . }} 8080:{{ .Values.service.port }}
|
||||
|
|
|
|||
|
|
@ -4,23 +4,14 @@ image:
|
|||
|
||||
app:
|
||||
environment: production
|
||||
frontendURL: https://go-guess.example.com
|
||||
frontendURL: https://goguess.urpi.be
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
type: NodePort
|
||||
nodePort: 31374
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 10m
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
||||
hosts:
|
||||
- host: go-guess.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
enabled: false
|
||||
|
||||
resources:
|
||||
requests:
|
||||
|
|
|
|||
|
|
@ -1,55 +0,0 @@
|
|||
# Generated by Rancher
|
||||
# name: kubeconfig-ldfvp
|
||||
# createdTimestamp: 2026-09-20T09:13:04Z
|
||||
# ttl: 2592000
|
||||
apiVersion: v1
|
||||
kind: Config
|
||||
clusters:
|
||||
- name: "rancher"
|
||||
cluster:
|
||||
server: "https://rancher.urpi.be"
|
||||
certificate-authority-data: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ2VENDQ\
|
||||
VdPZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQkdNUnd3R2dZRFZRUUtFeE5rZVc1aGJXbGoKY\
|
||||
kdsemRHVnVaWEl0YjNKbk1TWXdKQVlEVlFRRERCMWtlVzVoYldsamJHbHpkR1Z1WlhJdFkyRkFNV\
|
||||
GM0T1RnNQpNVGczTURBZUZ3MHlOakE1TWpBd056RXhNVEJhRncwek5qQTVNVGN3TnpFeE1UQmFNR\
|
||||
Vl4SERBYUJnTlZCQW9UCkUyUjVibUZ0YVdOc2FYTjBaVzVsY2kxdmNtY3hKakFrQmdOVkJBTU1IV\
|
||||
1I1Ym1GdGFXTnNhWE4wWlc1bGNpMWoKWVVBeE56ZzVPRGt4T0Rjd01Ga3dFd1lIS29aSXpqMENBU\
|
||||
VlJS29aSXpqMERBUWNEUWdBRXNIVEFSdUJJcjNZQQo0NlVzRmM5N1lkRHd1eGtnNHNSU21ML3ZCS\
|
||||
Th3dWh5Z2M4Wm1jVUI4VWhWbUZvdEd4UnFqR3dWNG1GYXlxdGdQCmNnQVZmdkJ4bUtOQ01FQXdEZ\
|
||||
1lEVlIwUEFRSC9CQVFEQWdLa01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGT\
|
||||
kNyVndRcjFXeWFpdnJMS1BLZ0hmbUVjRUFyTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFERAorU\
|
||||
2lMaXdOODFNU2FEOWEzaStUNkJGOHVjdXNKQm5xM2pJdHV4WGpFMlFJZ1Z5L3FNaEtRSFRIa3pzV\
|
||||
jIwWThBCll5SWdTWWZ1czZkaFdwNEI5TFl2eEVzPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t"
|
||||
- name: "local"
|
||||
cluster:
|
||||
server: "https://rancher.urpi.be/k8s/clusters/local"
|
||||
certificate-authority-data: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ2VENDQ\
|
||||
VdPZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQkdNUnd3R2dZRFZRUUtFeE5rZVc1aGJXbGoKY\
|
||||
kdsemRHVnVaWEl0YjNKbk1TWXdKQVlEVlFRRERCMWtlVzVoYldsamJHbHpkR1Z1WlhJdFkyRkFNV\
|
||||
GM0T1RnNQpNVGczTURBZUZ3MHlOakE1TWpBd056RXhNVEJhRncwek5qQTVNVGN3TnpFeE1UQmFNR\
|
||||
Vl4SERBYUJnTlZCQW9UCkUyUjVibUZ0YVdOc2FYTjBaVzVsY2kxdmNtY3hKakFrQmdOVkJBTU1IV\
|
||||
1I1Ym1GdGFXTnNhWE4wWlc1bGNpMWoKWVVBeE56ZzVPRGt4T0Rjd01Ga3dFd1lIS29aSXpqMENBU\
|
||||
VlJS29aSXpqMERBUWNEUWdBRXNIVEFSdUJJcjNZQQo0NlVzRmM5N1lkRHd1eGtnNHNSU21ML3ZCS\
|
||||
Th3dWh5Z2M4Wm1jVUI4VWhWbUZvdEd4UnFqR3dWNG1GYXlxdGdQCmNnQVZmdkJ4bUtOQ01FQXdEZ\
|
||||
1lEVlIwUEFRSC9CQVFEQWdLa01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWUQKVlIwT0JCWUVGT\
|
||||
kNyVndRcjFXeWFpdnJMS1BLZ0hmbUVjRUFyTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFERAorU\
|
||||
2lMaXdOODFNU2FEOWEzaStUNkJGOHVjdXNKQm5xM2pJdHV4WGpFMlFJZ1Z5L3FNaEtRSFRIa3pzV\
|
||||
jIwWThBCll5SWdTWWZ1czZkaFdwNEI5TFl2eEVzPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t"
|
||||
|
||||
users:
|
||||
- name: "rancher"
|
||||
user:
|
||||
token: "ext/token-9fzp2:d729wqhv4gbjhd9qjghs74f7h6wqcmml9c79stw8bw5nj2w9p752nw"
|
||||
|
||||
|
||||
contexts:
|
||||
- name: "rancher"
|
||||
context:
|
||||
user: "rancher"
|
||||
cluster: "rancher"
|
||||
- name: "local"
|
||||
context:
|
||||
user: "rancher"
|
||||
cluster: "local"
|
||||
|
||||
current-context: "local"
|
||||
55
deploy/nginx/README.md
Normal file
55
deploy/nginx/README.md
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
# Dedicated-server reverse proxy
|
||||
|
||||
Production exposes only the Go Guess application through Kubernetes NodePort
|
||||
`31374`. PostgreSQL and RabbitMQ remain available only through their
|
||||
cluster-internal services.
|
||||
|
||||
## DNS
|
||||
|
||||
In one.com, create an `A` record for `goguess.urpi.be` pointing to the dedicated
|
||||
server's public IPv4 address. Add an `AAAA` record only when the server and its
|
||||
firewall are configured for public IPv6. Wait for:
|
||||
|
||||
```bash
|
||||
dig +short goguess.urpi.be
|
||||
```
|
||||
|
||||
to return the dedicated server address before requesting a certificate.
|
||||
|
||||
## Nginx and Certbot
|
||||
|
||||
The included virtual host assumes Nginx runs on the Kubernetes node and can
|
||||
reach the NodePort at `127.0.0.1:31374`.
|
||||
|
||||
```bash
|
||||
sudo install -m 0644 deploy/nginx/goguess.urpi.be.conf \
|
||||
/etc/nginx/sites-available/goguess.urpi.be.conf
|
||||
sudo ln -s /etc/nginx/sites-available/goguess.urpi.be.conf \
|
||||
/etc/nginx/sites-enabled/goguess.urpi.be.conf
|
||||
sudo nginx -t
|
||||
sudo systemctl reload nginx
|
||||
sudo certbot --nginx -d goguess.urpi.be
|
||||
sudo certbot renew --dry-run
|
||||
```
|
||||
|
||||
Certbot adds the HTTPS listener, certificate paths, and HTTP-to-HTTPS redirect
|
||||
to this virtual host. Allow inbound TCP ports `80` and `443`. Do not expose
|
||||
NodePort `31374`, PostgreSQL `5432`, RabbitMQ `5672`, or RabbitMQ management
|
||||
ports to the public internet. If Nginx is not on a Kubernetes node, replace
|
||||
`127.0.0.1` in `proxy_pass` with a private cluster-node address and allow
|
||||
`31374` only from the Nginx server.
|
||||
|
||||
## Deploy and verify
|
||||
|
||||
Deploy the production profile:
|
||||
|
||||
```bash
|
||||
make helm-deploy-production
|
||||
kubectl -n go-guess-production get pods
|
||||
kubectl -n go-guess-production get service go-guess
|
||||
curl --fail http://127.0.0.1:31374/api/health
|
||||
curl --fail https://goguess.urpi.be/api/health
|
||||
```
|
||||
|
||||
The `go-guess` service should show `80:31374/TCP`. The PostgreSQL and RabbitMQ
|
||||
services should remain `ClusterIP` services without NodePorts.
|
||||
21
deploy/nginx/goguess.urpi.be.conf
Normal file
21
deploy/nginx/goguess.urpi.be.conf
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name goguess.urpi.be;
|
||||
|
||||
client_max_body_size 10m;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:31374;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Connection "";
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue