Prod hardening and K8s drafts: auth fail-close, DB pool, init/schema split, prod init guard

k8s/app.yaml

@@ -1,105 +1,89 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ${NAMESPACE}
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: la-huasca-nextjs
-  namespace: ${NAMESPACE}
+  name: la-huasca-ts
+  namespace: la-huasca-ts
 spec:
-  replicas: 2
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
+  replicas: 1
   selector:
     matchLabels:
-      app: la-huasca-nextjs
+      app: la-huasca-ts
   template:
     metadata:
       labels:
-        app: la-huasca-nextjs
+        app: la-huasca-ts
     spec:
       imagePullSecrets:
         - name: la-huasca-registry
       containers:
-        - name: nextjs
-          image: gitea.ajavasoft.com/muken/la-huasca-ts:${TAG}
+        - name: la-huasca-ts
+          image: gitea.ajavasoft.com/muken/la-huasca-ts:latest
           ports:
             - containerPort: 3000
+              name: http
           env:
+            - name: NODE_ENV
+              value: production
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: la-huasca-db-secrets
-                  key: DATABASE_URL
-            - name: JWT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: la-huasca-app-secrets
-                  key: JWT_SECRET
+                  name: calendar-db-secrets
+                  key: url
           readinessProbe:
             httpGet:
-              path: /
-              port: 3000
-            initialDelaySeconds: 5
-            periodSeconds: 5
+              path: /api/health
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 15
           livenessProbe:
             httpGet:
-              path: /
-              port: 3000
-            initialDelaySeconds: 15
-            periodSeconds: 10
+              path: /api/health
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
           resources:
             requests:
-              memory: "256Mi"
-              cpu: "100m"
+              cpu: 200m
+              memory: 256Mi
             limits:
-              memory: "512Mi"
-              cpu: "500m"
+              cpu: 500m
+              memory: 512Mi
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: la-huasca-nextjs
-  namespace: ${NAMESPACE}
+  name: la-huasca-ts
+  namespace: la-huasca-ts
 spec:
-  selector:
-    app: la-huasca-nextjs
   ports:
     - port: 80
-      targetPort: 3000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: la-huasca-ts
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: la-huasca-nextjs
-  namespace: ${NAMESPACE}
+  name: la-huasca-ts
+  namespace: la-huasca-ts
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
 spec:
   ingressClassName: traefik
+  tls:
+    - hosts:
+        - la-huasca.ajavasoft.com
+      secretName: la-huasca-ts-tls
   rules:
-    - host: lahuasca.com
+    - host: la-huasca.ajavasoft.com
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: la-huasca-nextjs
-                port:
-                  number: 80
-    - host: www.lahuasca.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: la-huasca-nextjs
+                name: la-huasca-ts
                 port:
                   number: 80

k8s/deployment.json

@@ -0,0 +1,83 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "name": "la-huasca-ts",
+    "namespace": "la-huasca-ts"
+  },
+  "spec": {
+    "replicas": 1,
+    "selector": {
+      "matchLabels": {
+        "app": "la-huasca-ts"
+      }
+    },
+    "template": {
+      "metadata": {
+        "labels": {
+          "app": "la-huasca-ts"
+        }
+      },
+      "spec": {
+        "imagePullSecrets": [
+          {
+            "name": "la-huasca-registry"
+          }
+        ],
+        "containers": [
+          {
+            "name": "la-huasca-ts",
+            "image": "gitea.ajavasoft.com/muken/la-huasca-ts:latest",
+            "ports": [
+              {
+                "containerPort": 3000,
+                "name": "http"
+              }
+            ],
+            "env": [
+              {
+                "name": "NODE_ENV",
+                "value": "production"
+              },
+              {
+                "name": "DATABASE_URL",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "name": "calendar-db-secrets",
+                    "key": "url"
+                  }
+                }
+              }
+            ],
+            "readinessProbe": {
+              "httpGet": {
+                "path": "/api/health",
+                "port": "http"
+              },
+              "initialDelaySeconds": 20,
+              "periodSeconds": 15
+            },
+            "livenessProbe": {
+              "httpGet": {
+                "path": "/api/health",
+                "port": "http"
+              },
+              "initialDelaySeconds": 60,
+              "periodSeconds": 30
+            },
+            "resources": {
+              "requests": {
+                "cpu": "200m",
+                "memory": "256Mi"
+              },
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              }
+            }
+          }
+        ]
+      }
+    }
+  }
+}

k8s/ingress.json

@@ -0,0 +1,43 @@
+{
+  "apiVersion": "networking.k8s.io/v1",
+  "kind": "Ingress",
+  "metadata": {
+    "name": "la-huasca-ts",
+    "namespace": "la-huasca-ts",
+    "annotations": {
+      "traefik.ingress.kubernetes.io/router.entrypoints": "web,websecure"
+    }
+  },
+  "spec": {
+    "ingressClassName": "traefik",
+    "tls": [
+      {
+        "hosts": [
+          "lahuasca.com"
+        ],
+        "secretName": "la-huasca-ts-tls"
+      }
+    ],
+    "rules": [
+      {
+        "host": "lahuasca.com",
+        "http": {
+          "paths": [
+            {
+              "path": "/",
+              "pathType": "Prefix",
+              "backend": {
+                "service": {
+                  "name": "la-huasca-ts",
+                  "port": {
+                    "number": 80
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

k8s/service.json

@@ -0,0 +1,21 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "name": "la-huasca-ts",
+    "namespace": "la-huasca-ts"
+  },
+  "spec": {
+    "ports": [
+      {
+        "port": 80,
+        "targetPort": "http",
+        "protocol": "TCP",
+        "name": "http"
+      }
+    ],
+    "selector": {
+      "app": "la-huasca-ts"
+    }
+  }
+}