mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
1f04831a97
ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces. immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver. Also removes the Longhorn test-port redirect URI and updates comments that still described nginx.
116 lines
3.0 KiB
YAML
116 lines
3.0 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: mbgwp-official-helm
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
destination:
|
|
namespace: mbgwp
|
|
server: https://kubernetes.default.svc
|
|
project: default
|
|
source:
|
|
repoURL: https://groundhog2k.github.io/helm-charts/
|
|
targetRevision: 0.15.0
|
|
chart: wordpress
|
|
helm:
|
|
values: |
|
|
# Official WordPress image configuration. WordPress core lives on the
|
|
# volume, so the tag only sets PHP and Apache; 7.1.3-php8.3-apache
|
|
# ships PHP 8.3.36, which fixes CVE-2026-109618 and CVE-2026-109619.
|
|
image:
|
|
registry: docker.io
|
|
repository: wordpress
|
|
tag: "7.1.3-php8.3-apache"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Disable embedded MariaDB
|
|
mariadb:
|
|
enabled: false
|
|
|
|
# Database configuration via environment variables
|
|
# Using external MariaDB (operator-managed)
|
|
env:
|
|
- name: WORDPRESS_DB_HOST
|
|
value: "mbgwp-mariadb:3306"
|
|
- name: WORDPRESS_DB_USER
|
|
value: "bn_wordpress"
|
|
- name: WORDPRESS_DB_NAME
|
|
value: "bitnami_wordpress"
|
|
- name: WORDPRESS_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mbgwp-mariadb-credentials
|
|
key: password
|
|
- name: WF_ENCRYPTION_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: wordpress-credentials
|
|
key: wf-encryption-key
|
|
|
|
# WordPress specific settings
|
|
settings:
|
|
tablePrefix: "wp_"
|
|
maxFileUploadSize: "64M"
|
|
memoryLimit: "128M"
|
|
|
|
# Persistence configuration
|
|
storage:
|
|
className: longhorn
|
|
requestedSize: 10Gi
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
keepPvc: true
|
|
|
|
# Service configuration
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
|
|
# Resource limits (matching Bitnami "small" preset)
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "300m"
|
|
limits:
|
|
memory: "1024Mi"
|
|
cpu: "2000m"
|
|
|
|
# Health probes
|
|
livenessProbe:
|
|
enabled: false
|
|
|
|
readinessProbe:
|
|
enabled: true
|
|
httpGet:
|
|
path: /wp-login.php
|
|
port: 80
|
|
initialDelaySeconds: 120
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
failureThreshold: 6
|
|
|
|
startupProbe:
|
|
enabled: true
|
|
httpGet:
|
|
path: /wp-login.php
|
|
port: 80
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
|
|
# Custom PHP configuration
|
|
customPhpConfig: |
|
|
upload_max_filesize = 64M
|
|
post_max_size = 64M
|
|
max_execution_time = 600
|
|
memory_limit = 128M
|
|
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
selfHeal: true
|