mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-17 02:12:55 +02:00
Ruben Hensen
ec5405fc29
Adds the VAPID keypair for web push and raises the ingress body limit to 25m to match the app's BODY_SIZE_LIMIT, since a bulk route import posts every GPX in one request. The VAPID env refs are optional:true on purpose — a missing key in a secretKeyRef puts the pod in CreateContainerConfigError, and the app already handles absent keys by sending no notifications.
37 lines
1.0 KiB
YAML
37 lines
1.0 KiB
YAML
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: bolletjestrui-secrets
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: bolletjestrui-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: site_password
|
|
remoteRef:
|
|
key: kv/bolletjestrui
|
|
property: site_password
|
|
- secretKey: admin_password
|
|
remoteRef:
|
|
key: kv/bolletjestrui
|
|
property: admin_password
|
|
- secretKey: key_secret
|
|
remoteRef:
|
|
key: kv/bolletjestrui
|
|
property: key_secret
|
|
# web-push keypair for the "de route is gekozen" notification.
|
|
# Generate once with `npx web-push generate-vapid-keys` and never rotate it:
|
|
# a new key invalidates every subscription on everyone's phone.
|
|
- secretKey: vapid_public_key
|
|
remoteRef:
|
|
key: kv/bolletjestrui
|
|
property: vapid_public_key
|
|
- secretKey: vapid_private_key
|
|
remoteRef:
|
|
key: kv/bolletjestrui
|
|
property: vapid_private_key
|