tegwick
32610e9090
Chart mirrors vergabe-teilnahme Django probe/secret pattern. Non-secret values pin KeyCape OIDC and user-engine URL; env Secret holds secrets. Makefile: dry-run, deploy, ingress, status, logs.
73 lines
1.6 KiB
YAML
73 lines
1.6 KiB
YAML
image:
|
|
repository: forgejo.coulomb.social/coulomb/coulomb-social
|
|
tag: ""
|
|
pullPolicy: IfNotPresent
|
|
|
|
replicaCount: 1
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
targetPort: 8000
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
# Secrets (SECRET_KEY, DATABASE_URL, OIDC_*, USER_ENGINE_PROXY_SECRET, …)
|
|
envSecretName: coulomb-social-env
|
|
|
|
env:
|
|
DJANGO_SETTINGS_MODULE: coulomb_social.settings.prod
|
|
ALLOWED_HOSTS: coulomb.social,localhost
|
|
CSRF_TRUSTED_ORIGINS: https://coulomb.social
|
|
DEFAULT_TENANT_ID: "tenant:coulomb"
|
|
OIDC_ENABLED: "true"
|
|
OIDC_ISSUER: https://kc.coulomb.social
|
|
OIDC_CLIENT_ID: coulomb-social
|
|
OIDC_REDIRECT_URI: https://coulomb.social/auth/callback/
|
|
OIDC_SCOPES: "openid profile email groups"
|
|
USER_ENGINE_APPLICATION_ID: coulomb-social
|
|
USER_ENGINE_EXPECTED_AUDIENCE: user-engine-portal
|
|
# USER_ENGINE_BASE_URL set via secret or here when stable
|
|
USER_ENGINE_BASE_URL: https://users.92-205-62-239.nip.io
|
|
|
|
probes:
|
|
enabled: true
|
|
path: /healthz
|
|
port: 8000
|
|
hostHeader: coulomb.social
|
|
liveness:
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readiness:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
persistence:
|
|
media:
|
|
enabled: false
|
|
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|