argoyle
b6812b9d55
Moves the production deploy from AWS to the Frostmoln production cluster (namespace `schemas`), with unboundsoftware/schemas. - `deploy-prod` (AWS, failing since CI left AWS) → `deploy-prod-frostmoln`: `deploy prod-frostmoln -n schemas`. - Restricted Pod Security: `nginxinc/nginx-unprivileged` (uid 101, port 8080; 1.31.7 isn't published for it yet, so 1.31.6). `nginx.conf`: no `user`, pid and temp paths under `/tmp`, `listen 8080`. Configs copied with `--chmod=644`. Service is ClusterIP. - `autoscale-prod`/`pdb-prod` → `-prod-frostmoln`; the ALB ingress → a Traefik one for `/` on `schemas.unbound.se` (the API's `/query` ingress wins on the longer path). Checked locally (amd64): as uid 101 with all capabilities dropped, `/health`, `/` and SPA routes 200, security headers present. **Merge with** the schemas PR, after infra#1878 is applied. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu Reviewed-on: #391
22 lines
586 B
YAML
22 lines
586 B
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: schemas-app
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: "schemas.unbound.se"
|
|
http:
|
|
paths:
|
|
# Everything but /query, which the schemas API's longer path takes.
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: schemas-app
|
|
port:
|
|
number: 80
|