109 lines
2.6 KiB
YAML
109 lines
2.6 KiB
YAML
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: sure-finance
|
|
namespace: tools
|
|
spec:
|
|
serviceName: sure-finance
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: sure-finance
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: sure-finance
|
|
spec:
|
|
containers:
|
|
- name: sure-finance
|
|
image: ghcr.io/we-promise/sure:latest
|
|
ports:
|
|
- containerPort: 3000
|
|
env:
|
|
- name: SELF_HOSTED
|
|
value: "true"
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sure-credentials
|
|
key: SECRET_KEY_BASE
|
|
- name: DB_HOST
|
|
value: postgres-core.databases.svc.cluster.local
|
|
- name: POSTGRES_HOST
|
|
value: postgres-core.databases.svc.cluster.local
|
|
- name: POSTGRES_PORT
|
|
value: "5432"
|
|
- name: POSTGRES_DB
|
|
value: sure_finance
|
|
- name: POSTGRES_USER
|
|
value: sure
|
|
- name: REDIS_URL
|
|
value: redis://redis-core.databases.svc.cluster.local:6379/1
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: sure-credentials
|
|
key: DB_PASSWORD
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: sure-finance
|
|
namespace: tools
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: 3000
|
|
targetPort: 3000
|
|
selector:
|
|
app: sure-finance
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: sure-credentials
|
|
namespace: tools
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: openbao-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: sure-credentials
|
|
data:
|
|
- secretKey: DB_PASSWORD
|
|
remoteRef:
|
|
key: secret/sure
|
|
property: DB_PASSWORD
|
|
- secretKey: SECRET_KEY_BASE
|
|
remoteRef:
|
|
key: secret/sure
|
|
property: SECRET_KEY_BASE
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: sure-finance
|
|
namespace: tools
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- finance.${ROOT_DOMAIN}
|
|
secretName: finance-tls
|
|
rules:
|
|
- host: finance.${ROOT_DOMAIN}
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: sure-finance
|
|
port:
|
|
number: 3000
|