Prod hardening and K8s drafts: auth fail-close, DB pool, init/schema split, prod init guard

k8s/app.yaml

@@ -1,105 +1,89 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ${NAMESPACE}
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: la-huasca-nextjs
-  namespace: ${NAMESPACE}
+  name: la-huasca-ts
+  namespace: la-huasca-ts
 spec:
-  replicas: 2
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
+  replicas: 1
   selector:
     matchLabels:
-      app: la-huasca-nextjs
+      app: la-huasca-ts
   template:
     metadata:
       labels:
-        app: la-huasca-nextjs
+        app: la-huasca-ts
     spec:
       imagePullSecrets:
         - name: la-huasca-registry
       containers:
-        - name: nextjs
-          image: gitea.ajavasoft.com/muken/la-huasca-ts:${TAG}
+        - name: la-huasca-ts
+          image: gitea.ajavasoft.com/muken/la-huasca-ts:latest
           ports:
             - containerPort: 3000
+              name: http
           env:
+            - name: NODE_ENV
+              value: production
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: la-huasca-db-secrets
-                  key: DATABASE_URL
-            - name: JWT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: la-huasca-app-secrets
-                  key: JWT_SECRET
+                  name: calendar-db-secrets
+                  key: url
           readinessProbe:
             httpGet:
-              path: /
-              port: 3000
-            initialDelaySeconds: 5
-            periodSeconds: 5
+              path: /api/health
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 15
           livenessProbe:
             httpGet:
-              path: /
-              port: 3000
-            initialDelaySeconds: 15
-            periodSeconds: 10
+              path: /api/health
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
           resources:
             requests:
-              memory: "256Mi"
-              cpu: "100m"
+              cpu: 200m
+              memory: 256Mi
             limits:
-              memory: "512Mi"
-              cpu: "500m"
+              cpu: 500m
+              memory: 512Mi
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: la-huasca-nextjs
-  namespace: ${NAMESPACE}
+  name: la-huasca-ts
+  namespace: la-huasca-ts
 spec:
-  selector:
-    app: la-huasca-nextjs
   ports:
     - port: 80
-      targetPort: 3000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: la-huasca-ts
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: la-huasca-nextjs
-  namespace: ${NAMESPACE}
+  name: la-huasca-ts
+  namespace: la-huasca-ts
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
 spec:
   ingressClassName: traefik
+  tls:
+    - hosts:
+        - la-huasca.ajavasoft.com
+      secretName: la-huasca-ts-tls
   rules:
-    - host: lahuasca.com
+    - host: la-huasca.ajavasoft.com
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: la-huasca-nextjs
-                port:
-                  number: 80
-    - host: www.lahuasca.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: la-huasca-nextjs
+                name: la-huasca-ts
                 port:
                   number: 80