mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-17 02:12:55 +02:00
Ruben Hensen
ec5405fc29
Adds the VAPID keypair for web push and raises the ingress body limit to 25m to match the app's BODY_SIZE_LIMIT, since a bulk route import posts every GPX in one request. The VAPID env refs are optional:true on purpose — a missing key in a secretKeyRef puts the pod in CreateContainerConfigError, and the app already handles absent keys by sending no notifications.
99 lines
3.0 KiB
YAML
99 lines
3.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app: bolletjestrui
|
|
name: bolletjestrui
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: bolletjestrui
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bolletjestrui
|
|
spec:
|
|
containers:
|
|
- image: ghcr.io/rubenhensen/bolletjestrui:main-10268f1
|
|
name: bolletjestrui
|
|
ports:
|
|
- containerPort: 3000
|
|
protocol: TCP
|
|
env:
|
|
- name: DATABASE_URL
|
|
value: /app/data/bolletjestrui.db
|
|
- name: ORIGIN
|
|
value: https://vic.rubenhensen.nl
|
|
- name: PROTOCOL_HEADER
|
|
value: x-forwarded-proto
|
|
- name: HOST_HEADER
|
|
value: x-forwarded-host
|
|
# GPX routes and profile photos (up to 20 MB); raise adapter-node's 512K default
|
|
- name: BODY_SIZE_LIMIT
|
|
value: "25M"
|
|
- name: TZ
|
|
value: Europe/Amsterdam
|
|
- name: SITE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bolletjestrui-secrets
|
|
key: site_password
|
|
- name: ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bolletjestrui-secrets
|
|
key: admin_password
|
|
- name: KEY_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bolletjestrui-secrets
|
|
key: key_secret
|
|
# Push notifications. optional:true is load-bearing: without it a missing
|
|
# key leaves the pod in CreateContainerConfigError and the site is down,
|
|
# which would make deploying this depend on the Vault entries landing
|
|
# first. The app already treats absent VAPID keys as "send nothing".
|
|
- name: VAPID_PUBLIC_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bolletjestrui-secrets
|
|
key: vapid_public_key
|
|
optional: true
|
|
- name: VAPID_PRIVATE_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bolletjestrui-secrets
|
|
key: vapid_private_key
|
|
optional: true
|
|
- name: VAPID_SUBJECT
|
|
value: mailto:ruben.hensen@protonmail.com
|
|
resources:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /login
|
|
port: 3000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /login
|
|
port: 3000
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
volumeMounts:
|
|
- mountPath: /app/data
|
|
name: data
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: bolletjestrui-data
|