86 lines
3.3 KiB
Text
86 lines
3.3 KiB
Text
{
|
|
name = "rustelo-htmx-server",
|
|
workspace_id = "example-pro",
|
|
image_base = "registry.ontoref.dev/ontoref.dev/rustelo-htmx-server",
|
|
image_tag = "latest",
|
|
ctx_type = 'leptos,
|
|
domain = "ontoref.dev",
|
|
dns_zone = "ontoref.dev",
|
|
acme_email = "jpl@ontoref.dev",
|
|
namespace = "example-pro",
|
|
port = 3000,
|
|
component_type = 'rustelo_website,
|
|
leptos_output_name = "website",
|
|
|
|
data_pvc = {
|
|
enabled = true,
|
|
size = "2Gi",
|
|
mount_path = "/var/www",
|
|
storage_class = "longhorn-retain",
|
|
},
|
|
|
|
requires = {
|
|
storage = { size = "2Gi", persistent = true },
|
|
ports = [{ port = 3000, exposure = 'public }],
|
|
credentials = ["SECRET_KEY", "DATABASE_URL"],
|
|
dns_credential = "dns-example-pro",
|
|
registry_pull_secret = "registry-pull-secret",
|
|
},
|
|
|
|
provides = {
|
|
service = "website",
|
|
port = 3000,
|
|
endpoints = ["https://ontoref.dev"],
|
|
},
|
|
|
|
operations = {
|
|
install = true,
|
|
update = true,
|
|
delete = true,
|
|
health = true,
|
|
},
|
|
|
|
context = {
|
|
how = "K8s Deployment in namespace example-pro; image registry.ontoref.dev/ontoref.dev/website (Leptos SSR, port 3000); 2Gi Longhorn-retain PVC at /var/www for content; image pulled via registry-pull-secret secret; TLS via cluster-issuer + Cloudflare DNS-01 on zone ontoref.dev; public Gateway API route via workspace FIP.",
|
|
why = "Primary personal website for ontoref.dev — portfolio, blog, CV. Rustelo/Leptos SSR.",
|
|
priority = 'standard,
|
|
security = {
|
|
posture = 'public,
|
|
tls = true,
|
|
concerns = ["secret-key-rotation", "reg-pull-secret-rotation"],
|
|
},
|
|
supervision = {
|
|
health_check = true,
|
|
metrics = false,
|
|
alerts = ["website-pod-not-ready"],
|
|
},
|
|
updates = {
|
|
policy = 'pinned,
|
|
holds = ["homepage-smoke", "health-endpoint-smoke"],
|
|
},
|
|
},
|
|
|
|
build_secrets = {
|
|
# reg.librecloud.online's credential is SOPS-encrypted for libre-wuji's age
|
|
# identity, daoreg's for libre-daoshi's — two different workspaces/keys.
|
|
# secrets_base/key_file are PATH-style (`:`-separated candidates, lian-build
|
|
# schema addition 2026-07-07): every push_credential in build_directives.ncl
|
|
# uses this SAME combined search path, so each one just finds its own file
|
|
# under whichever candidate has it and decrypts with whichever key matches
|
|
# — no per-registry field needed. Placeholders patched by the justfile from
|
|
# wuji_secrets_base:secrets_base / wuji_kage:daoshi_kage — never committed
|
|
# as literal absolute paths.
|
|
secrets_base = "SECRET_BASE_PLACEHOLDER",
|
|
key_file = "KEY_FILE_PLACEHOLDER",
|
|
|
|
# reg.librecloud.online (primary write surface) — same path sibling sites
|
|
# (jpl-website, cv-repo, libro-website) already use for this host.
|
|
registry_push = "infra/libre-wuji/secrets/registry-push.sops.yaml",
|
|
# daoreg.librecloud.online (replica) — CONFIRMED scoped to lamina/* only
|
|
# (buildadm's ACL) via a live probe 2026-07-06; NOT verified for arbitrary
|
|
# app pushes under ontoref.dev/*.
|
|
registry_push_daoreg = "infra/libre-daoshi/secrets/registry-push.sops.yaml",
|
|
sccache = "infra/libre-daoshi/secrets/sccache.sops.yaml",
|
|
cosign = "infra/libre-daoshi/secrets/cosign.sops.yaml",
|
|
},
|
|
}
|