tegwick
959eba637f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
82 lines
2.1 KiB
YAML
82 lines
2.1 KiB
YAML
image:
|
|
repository: forgejo.coulomb.social/coulomb/vergabe-teilnahme
|
|
tag: "" # required; pinned via helm/vergabe-teilnahme-values.yaml
|
|
digest: "" # preferred; takes precedence over tag
|
|
pullPolicy: IfNotPresent
|
|
|
|
replicaCount: 1 # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes)
|
|
|
|
# An invited company pilot requires an immutable image and both data volumes.
|
|
pilot:
|
|
enabled: false
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
targetPort: 8000
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
|
|
# Env from the K8s Secret created out-of-band (vergabe-teilnahme-env).
|
|
# Holds SECRET_KEY + DATABASE_URL. Deliver via the admitted platform custody lane.
|
|
envSecretName: vergabe-teilnahme-env
|
|
|
|
# Non-secret env injected directly into the Deployment.
|
|
env:
|
|
DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
|
|
ALLOWED_HOSTS: vergabe-teilnahme.whywhynot.de,localhost
|
|
CSRF_TRUSTED_ORIGINS: https://vergabe-teilnahme.whywhynot.de
|
|
|
|
probes:
|
|
enabled: true
|
|
path: /health/
|
|
port: 8000
|
|
hostHeader: vergabe-teilnahme.whywhynot.de # must be in ALLOWED_HOSTS
|
|
liveness:
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readiness:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
# Existing installations remain opt-in. Pilot mode refuses ephemeral state.
|
|
# PVCs are retained on Helm uninstall; a verified off-host backup is still required.
|
|
persistence:
|
|
media:
|
|
enabled: false
|
|
storageClass: local-path
|
|
size: 5Gi
|
|
accessMode: ReadWriteOnce
|
|
existingClaim: ""
|
|
appState:
|
|
enabled: false
|
|
storageClass: local-path
|
|
size: 1Gi
|
|
accessMode: ReadWriteOnce
|
|
existingClaim: ""
|
|
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 999 # matches the 'app' user in the Dockerfile
|
|
runAsGroup: 999
|
|
fsGroup: 999
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false # whitenoise + collectstatic write to /app
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|