sascha.dodenhoeft/expertfab-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gongme: k8s Manifeste fuer initialen Cluster-Deploy

Browse Source 
Namespace, StorageClass (Longhorn), Postgres, API, Web,
OAuth2-Proxy (Zitadel OIDC) und Traefik-Ingress fuer
https://gongme.expertfab.de.

Images: git.expertfab.de/expertfab/ef-gongme-{api,web}:latest
Auth: Zitadel hinter OAuth2-Proxy v7.7.1
TLS: cert-manager letsencrypt-ClusterIssuer

secret-oauth2.yaml enthaelt Platzhalter — CLIENT_ID/SECRET
muessen nach Zitadel-App-Anlage eingetragen werden.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Sascha Dodenhöft
2026-06-07 13:19:46 +02:00
parent 0baab66010
commit 00c7ec292f
10 changed files with 426 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/k3s.md
View File

@@ -56,6 +56,7 @@
| docs.expertfab.de | paperless | ✓ | | docs.expertfab.de | paperless | ✓ |
| auth.expertfab.de | zitadel | ✓ | | auth.expertfab.de | zitadel | ✓ |
| api.expertfab.de | rabbitmq | ✓ | | api.expertfab.de | rabbitmq | ✓ |
| gongme.expertfab.de | gongme | ✓ |
| coworkbase.de | coworkbase | ✓ | | coworkbase.de | coworkbase | ✓ |
| www.coworkbase.de | coworkbase | ✓ | | www.coworkbase.de | coworkbase | ✓ |
| qubicticker.qchief.io | qubicticker | ✓ | | qubicticker.qchief.io | qubicticker | ✓ |

65
k8s/gongme/api.yaml Normal file
View File

@@ -0,0 +1,65 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: gongme-api
namespace: gongme
spec:
replicas: 1
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
selector:
matchLabels:
app: gongme-api
template:
metadata:
labels:
app: gongme-api
spec:
imagePullSecrets:
- name: gitea-registry
containers:
- name: api
image: git.expertfab.de/expertfab/ef-gongme-api:latest
imagePullPolicy: Always
ports:
- containerPort: 3001
envFrom:
- secretRef:
name: gongme-env
readinessProbe:
httpGet:
path: /api/v1/health
port: 3001
initialDelaySeconds: 30
periodSeconds: 10
failureThreshold: 6
livenessProbe:
httpGet:
path: /api/v1/health
port: 3001
initialDelaySeconds: 60
periodSeconds: 30
failureThreshold: 5
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 1000m
memory: 768Mi
---
apiVersion: v1
kind: Service
metadata:
name: gongme-api
namespace: gongme
spec:
selector:
app: gongme-api
ports:
- port: 3001
targetPort: 3001

40
k8s/gongme/ingress.yaml Normal file
View File

@@ -0,0 +1,40 @@
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: redirect-https
namespace: gongme
spec:
redirectScheme:
scheme: https
permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: gongme
namespace: gongme
annotations:
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.middlewares: gongme-redirect-https@kubernetescrd
# SSE-Verbindungen (EventSource) bleiben lange offen — Timeouts hochsetzen.
ingress.kubernetes.io/proxy-read-timeout: "3600"
ingress.kubernetes.io/proxy-send-timeout: "3600"
spec:
ingressClassName: traefik
rules:
- host: gongme.expertfab.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 4180
tls:
- hosts:
- gongme.expertfab.de
secretName: gongme-tls

19
k8s/gongme/namespace.yaml Normal file
View File

@@ -0,0 +1,19 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: gongme
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: longhorn-gongme
provisioner: driver.longhorn.io
reclaimPolicy: Retain
allowVolumeExpansion: true
volumeBindingMode: Immediate
parameters:
numberOfReplicas: "2"
staleReplicaTimeout: "30"
fromBackup: ""
fsType: "ext4"

70
k8s/gongme/oauth2-proxy.yaml Normal file
View File

@@ -0,0 +1,70 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: oauth2-proxy
namespace: gongme
spec:
replicas: 1
selector:
matchLabels:
app: oauth2-proxy
template:
metadata:
labels:
app: oauth2-proxy
spec:
containers:
- name: oauth2-proxy
image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
args:
- --provider=oidc
- --oidc-issuer-url=https://auth.expertfab.de
- --redirect-url=https://gongme.expertfab.de/oauth2/callback
- --upstream=http://gongme-web:3000
- --http-address=0.0.0.0:4180
- --email-domain=expertfab.de
- --scope=openid profile email
- --skip-provider-button=true
- --cookie-secure=true
- --cookie-samesite=lax
- --reverse-proxy=true
- --pass-access-token=true
- --set-xauthrequest=true
env:
- name: OAUTH2_PROXY_CLIENT_ID
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_CLIENT_ID
- name: OAUTH2_PROXY_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_CLIENT_SECRET
- name: OAUTH2_PROXY_COOKIE_SECRET
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_COOKIE_SECRET
ports:
- containerPort: 4180
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 100m
memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
name: oauth2-proxy
namespace: gongme
spec:
selector:
app: oauth2-proxy
ports:
- port: 4180
targetPort: 4180

93
k8s/gongme/postgres.yaml Normal file
View File

@@ -0,0 +1,93 @@
---
apiVersion: v1
kind: Secret
metadata:
name: gongme-postgres
namespace: gongme
type: Opaque
stringData:
POSTGRES_DB: gongme
POSTGRES_USER: gongme
POSTGRES_PASSWORD: "gongme-prod-pw-change-me"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: gongme-postgres-data
namespace: gongme
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn-gongme
resources:
requests:
storage: 5Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: gongme-postgres
namespace: gongme
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: gongme-postgres
template:
metadata:
labels:
app: gongme-postgres
spec:
containers:
- name: postgres
image: postgres:16-alpine
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: gongme-postgres
env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts:
- name: data
mountPath: /var/lib/postgresql/data
startupProbe:
exec:
command: ["pg_isready", "-U", "gongme", "-d", "gongme"]
initialDelaySeconds: 10
periodSeconds: 10
failureThreshold: 30
readinessProbe:
exec:
command: ["pg_isready", "-U", "gongme", "-d", "gongme"]
periodSeconds: 10
livenessProbe:
exec:
command: ["pg_isready", "-U", "gongme", "-d", "gongme"]
periodSeconds: 30
failureThreshold: 5
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
volumes:
- name: data
persistentVolumeClaim:
claimName: gongme-postgres-data
---
apiVersion: v1
kind: Service
metadata:
name: gongme-postgres
namespace: gongme
spec:
selector:
app: gongme-postgres
ports:
- port: 5432
targetPort: 5432

22
k8s/gongme/secret-oauth2.yaml Normal file
View File

@@ -0,0 +1,22 @@
---
# OAuth2-Proxy Credentials — Werte kommen aus Zitadel (siehe README-Schritt unten).
#
# ANLEITUNG zum Befüllen:
# 1. https://auth.expertfab.de öffnen → Projekte → Neu → "gongme"
# 2. Im Projekt: Applikationen → Neu → Typ: Web, Methode: PKCE
# 3. Redirect URI: https://gongme.expertfab.de/oauth2/callback
# 4. Post-Logout URI: https://gongme.expertfab.de
# 5. CLIENT_ID und CLIENT_SECRET kopieren → unten eintragen
# 6. Cookie-Secret generieren: openssl rand -base64 32
# 7. kubectl apply -f k8s/gongme/secret-oauth2.yaml -n gongme
#
apiVersion: v1
kind: Secret
metadata:
name: oauth2-proxy-secrets
namespace: gongme
type: Opaque
stringData:
OAUTH2_PROXY_CLIENT_ID: "ZITADEL_CLIENT_ID_HIER_EINTRAGEN"
OAUTH2_PROXY_CLIENT_SECRET: "ZITADEL_CLIENT_SECRET_HIER_EINTRAGEN"
OAUTH2_PROXY_COOKIE_SECRET: "COOKIE_SECRET_HIER_EINTRAGEN"

19
k8s/gongme/secret-registry.yaml Normal file
View File

@@ -0,0 +1,19 @@
---
# ImagePullSecret für die Gitea Container Registry.
# Analog zum gitea-registry-Secret im erpnext-Namespace.
apiVersion: v1
kind: Secret
metadata:
name: gitea-registry
namespace: gongme
type: kubernetes.io/dockerconfigjson
stringData:
.dockerconfigjson: |
{
"auths": {
"git.expertfab.de": {
"username": "sascha.dodenhoeft",
"password": "3f7b20874ec2f8a1ff3c3669b0483dcae3cfd76c"
}
}
}

32
k8s/gongme/secret.yaml Normal file
View File

@@ -0,0 +1,32 @@
---
# Application Secret — wird von api-Pod und web-Pod per envFrom geladen.
apiVersion: v1
kind: Secret
metadata:
name: gongme-env
namespace: gongme
type: Opaque
stringData:
# --- Postgres ---
DATABASE_URL: "postgresql://gongme:gongme-prod-pw-change-me@gongme-postgres:5432/gongme?schema=public"
# --- NestJS ---
NODE_ENV: "production"
PORT: "3001"
JWT_SECRET: "change-me-random-32-chars-minimum"
PUBLIC_BASE_URL: "https://gongme.expertfab.de"
# --- SMTP (bestehendes Relay) ---
SMTP_HOST: "smtprelay.expertfab.de"
SMTP_PORT: "587"
SMTP_USER: "it-admin@expertfab.de"
SMTP_PASS: "Relay22$$"
SMTP_FROM: "gongme@expertfab.de"
# --- Web Push (VAPID) ---
VAPID_PUBLIC_KEY: "BMFgG85di4U9X-YtbvGxvuwpIS2nNjZCyPzfwMewYs9N38NTQvvDixCHzj2JGe-rCW4jyaO2ZW0DgggB5lH8NI8"
VAPID_PRIVATE_KEY: "LNd_q9vqUbH5RQUf_tgO_hJWbI3--zuaNaGyjUqfTy8"
VAPID_SUBJECT: "mailto:it-admin@expertfab.de"
# --- Next.js (web-Pod) ---
API_INTERNAL_URL: "http://gongme-api:3001"

65
k8s/gongme/web.yaml Normal file
View File

@@ -0,0 +1,65 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: gongme-web
namespace: gongme
spec:
replicas: 1
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
selector:
matchLabels:
app: gongme-web
template:
metadata:
labels:
app: gongme-web
spec:
imagePullSecrets:
- name: gitea-registry
containers:
- name: web
image: git.expertfab.de/expertfab/ef-gongme-web:latest
imagePullPolicy: Always
ports:
- containerPort: 3000
envFrom:
- secretRef:
name: gongme-env
readinessProbe:
httpGet:
path: /
port: 3000
initialDelaySeconds: 15
periodSeconds: 10
failureThreshold: 6
livenessProbe:
httpGet:
path: /
port: 3000
initialDelaySeconds: 30
periodSeconds: 30
failureThreshold: 5
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
---
apiVersion: v1
kind: Service
metadata:
name: gongme-web
namespace: gongme
spec:
selector:
app: gongme-web
ports:
- port: 3000
targetPort: 3000