74 lines
2.2 KiB
Text
74 lines
2.2 KiB
Text
|
let mp = import "schemas/lib/manifest_plan.ncl" in
|
||
|
|
|
||
|
|
{
|
||
|
|
manifest_plan | mp.ManifestPlan = {
|
||
|
|
init = [
|
||
|
|
# Namespace first — all subsequent resources land here.
|
||
|
|
{ file = "namespace", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
# PVC for static content — always provisioned, skip_if_exists preserves data on reinstall.
|
||
|
|
{ file = "pvc", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
# CF API token secret in cert-manager namespace — required by ClusterIssuer.
|
||
|
|
{ action = 'create-cf-secret },
|
||
|
|
|
||
|
|
# ClusterIssuer and Certificate — DNS-01 via Cloudflare.
|
||
|
|
{ file = "clusterissuer", action = 'apply, skip_if_exists = true },
|
||
|
|
{ file = "certificate", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
# ConfigMap carrying the nginx.conf server block.
|
||
|
|
{ file = "configmap", action = 'apply },
|
||
|
|
|
||
|
|
# htpasswd Secret — created from SOPS credentials; no-op if auth_paths is empty.
|
||
|
|
{ action = 'create-htpasswd },
|
||
|
|
|
||
|
|
{ file = "deployment", action = 'apply },
|
||
|
|
{ file = "service", action = 'apply },
|
||
|
|
{ file = "httproute", action = 'apply },
|
||
|
|
|
||
|
|
{
|
||
|
|
action = 'wait-ready,
|
||
|
|
post = [
|
||
|
|
# Lock the data PVC against accidental deletion via the ops controller.
|
||
|
|
{ action = 'protect-volume },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
update = [
|
||
|
|
# Re-apply cert for domain changes; skip existing to avoid rotation.
|
||
|
|
{ file = "certificate", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
{ file = "configmap", action = 'apply },
|
||
|
|
{ action = 'create-htpasswd },
|
||
|
|
{ file = "httproute", action = 'apply },
|
||
|
|
{
|
||
|
|
file = "deployment",
|
||
|
|
action = 'rollout-restart,
|
||
|
|
delay = 3,
|
||
|
|
post = [
|
||
|
|
{ action = 'wait-ready },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
delete = [
|
||
|
|
{ file = "httproute", action = 'delete },
|
||
|
|
{ file = "deployment", action = 'delete },
|
||
|
|
{ action = 'delete-htpasswd },
|
||
|
|
{ file = "service", action = 'delete },
|
||
|
|
{ file = "configmap", action = 'delete },
|
||
|
|
],
|
||
|
|
|
||
|
|
restart = [
|
||
|
|
{
|
||
|
|
file = "deployment",
|
||
|
|
action = 'rollout-restart,
|
||
|
|
post = [
|
||
|
|
{ action = 'wait-ready },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
},
|
||
|
|
}
|