cce2ce55dc
- Database deployment script (scripts/deploy-database.sh) - Kubernetes manifests for CNPG PostgreSQL cluster (k8s/base/) - Documentation (docs/DEPLOYMENT_GUIDE.md, DATASTORE_SPEC.md, INTEGRATION_SPEC.md) - README with architecture overview and operations guide
170 lines
3.8 KiB
YAML
170 lines
3.8 KiB
YAML
# Copyright 2026 Umbra Tools (umbratools.com)
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
---
|
|
# Ingress for web UI and API
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: umbratrans-web
|
|
namespace: umbratrans
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "50m"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
|
|
nginx.ingress.kubernetes.io/client-body-timeout: "300"
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
nginx.ingress.kubernetes.io/hsts: "true"
|
|
nginx.ingress.kubernetes.io/hsts-max-age: "31536000"
|
|
nginx.ingress.kubernetes.io/hsts-include-subdomains: "true"
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- umbratrans.bdmurphy.me
|
|
secretName: umbratrans-tls
|
|
rules:
|
|
- host: umbratrans.bdmurphy.me
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: umbratrans-web
|
|
port:
|
|
number: 80
|
|
|
|
---
|
|
# NetworkPolicy for web - allow ingress from nginx, egress to DB
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: umbratrans-web
|
|
namespace: umbratrans
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: umbratrans-web
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: ingress-nginx
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8442
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: monitoring
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8442
|
|
egress:
|
|
- to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: umbratrans-db
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
- protocol: TCP
|
|
port: 6432 # PgBouncer
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 53
|
|
- protocol: UDP
|
|
port: 53
|
|
- to: []
|
|
ports:
|
|
- protocol: TCP
|
|
port: 443 # External APIs (Ollama, SMTP, etc.)
|
|
|
|
---
|
|
# NetworkPolicy for workers - egress to DB and NFS
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: umbratrans-worker
|
|
namespace: umbratrans
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
component: worker
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: umbratrans-db
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
- protocol: TCP
|
|
port: 6432
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 53
|
|
- protocol: UDP
|
|
port: 53
|
|
- to: []
|
|
ports:
|
|
- protocol: TCP
|
|
port: 443
|
|
- protocol: TCP
|
|
port: 11434 # Ollama
|
|
- protocol: TCP
|
|
port: 2049 # NFS
|
|
|
|
---
|
|
# NetworkPolicy for database - allow from web and workers only
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: umbratrans-db
|
|
namespace: umbratrans
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: umbratrans-db
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: umbratrans-web
|
|
- podSelector:
|
|
matchLabels:
|
|
component: worker
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
name: monitoring
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
- protocol: TCP
|
|
port: 6432
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: umbratrans-db
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|