vikingowl
31ce937f55
Adds a batch/v1 CronJob that POSTs to /api/v1/admin/discovery/tick on a configurable schedule (default every 4h). Wires DISCOVERY_TOKEN into the ci-secrets Secret and projects discovery/AI env vars into the backend Deployment.
158 lines
3.2 KiB
YAML
158 lines
3.2 KiB
YAML
image:
|
|
repository: registry.itsh.dev/vikingowl/marktvogt.de/backend
|
|
tag: "latest"
|
|
pullPolicy: IfNotPresent
|
|
|
|
imagePullSecrets:
|
|
- name: itsh-registry
|
|
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
replicaCount: 1
|
|
|
|
service:
|
|
port: 80
|
|
targetPort: 8080
|
|
|
|
httpRoute:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hostname: api.marktvogt.de
|
|
gatewayName: default
|
|
gatewayNamespace: nginx-gateway
|
|
sectionName: https-api-marktvogt-de
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 3
|
|
targetCPUUtilizationPercentage: 80
|
|
|
|
# Only meaningful with replicaCount >= 2
|
|
pdb:
|
|
enabled: false
|
|
minAvailable: 1
|
|
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
fsGroup: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
# Non-sensitive configuration — rendered into a ConfigMap
|
|
config:
|
|
APP_ENV: production
|
|
APP_PORT: "8080"
|
|
APP_HOST: "0.0.0.0"
|
|
CORS_ORIGINS: "https://marktvogt.de"
|
|
DB_SSLMODE: "require"
|
|
DB_MAX_CONNS: "25"
|
|
DB_MIN_CONNS: "5"
|
|
VALKEY_DB: "0"
|
|
RATE_LIMIT_RPS: "10"
|
|
RATE_LIMIT_BURST: "20"
|
|
JWT_ACCESS_TTL: "15m"
|
|
JWT_SESSION_TTL: "720h"
|
|
MAGIC_LINK_TTL: "15m"
|
|
MAGIC_LINK_BASE_URL: "https://marktvogt.de/auth/magic-link/verify"
|
|
OAUTH_REDIRECT_BASE_URL: "https://api.marktvogt.de"
|
|
SMTP_PORT: "587"
|
|
SMTP_FROM: "noreply@marktvogt.de"
|
|
ADMIN_EMAIL: "christian@nachtigall.dev"
|
|
FRONTEND_URL: "https://marktvogt.de"
|
|
AI_MODEL_COMPLEX: "mistral-large-latest"
|
|
|
|
# Name of the manually-created Secret containing:
|
|
# JWT_SECRET, SENTRY_DSN,
|
|
# OAUTH_{GOOGLE,APPLE,FACEBOOK,GITHUB}_{CLIENT_ID,CLIENT_SECRET}
|
|
secretName: marktvogt-backend-secrets
|
|
|
|
# SMTP credentials — passed via Woodpecker secrets during deploy.
|
|
# Rendered into a Helm-managed K8s Secret.
|
|
smtp:
|
|
host: ""
|
|
user: ""
|
|
password: ""
|
|
|
|
# AI research credentials — passed via Woodpecker secrets during deploy.
|
|
ai:
|
|
apiKey: ""
|
|
agentSimple: ""
|
|
agentDiscovery: "" # ag_019d9ec1702675dbbd80e526c8957ce2 in production
|
|
rateLimitRps: 1
|
|
|
|
# Discovery cron — token passed via CI secrets during deploy.
|
|
discovery:
|
|
enabled: true
|
|
schedule: "0 */4 * * *"
|
|
token: ""
|
|
batchSize: 4
|
|
forwardMonths: 12
|
|
|
|
# Cloudflare Turnstile — passed via Woodpecker secrets during deploy.
|
|
turnstile:
|
|
secretKey: ""
|
|
|
|
# CloudNativePG Postgres cluster
|
|
postgres:
|
|
enabled: false
|
|
name: marktvogt-pg
|
|
instances: 1
|
|
# PostGIS-enabled CNPG image — verify tag at ghcr.io/cloudnative-pg/postgis
|
|
image: ghcr.io/cloudnative-pg/postgis:17-3.5
|
|
storageSize: 5Gi
|
|
resources:
|
|
requests:
|
|
cpu: 15m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
|
|
# DragonflyDB (Redis-compatible) — managed by the DragonflyDB operator
|
|
dragonfly:
|
|
enabled: true
|
|
name: marktvogt-cache
|
|
replicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 72Mi
|
|
limits:
|
|
cpu: 150m
|
|
memory: 128Mi
|
|
|
|
# Migration job (Helm pre-install/pre-upgrade hook)
|
|
migrate:
|
|
enabled: true
|
|
|
|
networkPolicy:
|
|
enabled: false
|
|
|
|
serviceAccount:
|
|
create: true
|
|
name: ""
|
|
annotations: {}
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|