Andrew
1c1cc0681d
Local: in-cluster MariaDB + Valkey, port-forward instead of ingress, chart-generated APP_KEY (dev only). Prod: external MariaDB (ezscale ns), Longhorn-backed Valkey, Traefik IngressRoute with cloudflarewarp + cert-manager TLS, image.tag set at deploy time, secret pre-created out-of-band. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
99 lines
2.2 KiB
YAML
99 lines
2.2 KiB
YAML
# ===========================================================================
|
|
# Production: ezs-us-east-prod-01.node.ezscale.tech
|
|
# Namespace: ezscale (shared with mariadb instance + ezscale_api)
|
|
# ===========================================================================
|
|
|
|
image:
|
|
registry: git.ezscale.cloud
|
|
repository: ezscale/website
|
|
tag: "" # SET via --set image.tag=v0.1.0 at deploy time
|
|
pullPolicy: IfNotPresent
|
|
|
|
imagePullSecrets:
|
|
- name: gitea-registry
|
|
|
|
app:
|
|
replicaCount: 2
|
|
autoscaling:
|
|
enabled: true
|
|
minReplicas: 2
|
|
maxReplicas: 8
|
|
targetCPU: 70
|
|
resources:
|
|
requests: { cpu: 200m, memory: 512Mi }
|
|
limits: { cpu: 1500m, memory: 1536Mi }
|
|
|
|
horizon:
|
|
replicaCount: 1
|
|
resources:
|
|
requests: { cpu: 200m, memory: 512Mi }
|
|
limits: { cpu: 1000m, memory: 1Gi }
|
|
|
|
scheduler:
|
|
replicaCount: 1
|
|
resources:
|
|
requests: { cpu: 50m, memory: 128Mi }
|
|
|
|
# Reuse the cluster's existing replicated MariaDB.
|
|
mariadb:
|
|
enabled: false
|
|
externalRef:
|
|
name: mariadb
|
|
namespace: ezscale
|
|
database: ezscale_billing
|
|
username: ezscale_billing_app
|
|
|
|
# Per-app Valkey for sessions/cache/queue.
|
|
valkey:
|
|
enabled: true
|
|
storage:
|
|
size: 10Gi
|
|
storageClassName: longhorn
|
|
|
|
migrate:
|
|
enabled: true
|
|
seed: false
|
|
|
|
ingressRoute:
|
|
enabled: true
|
|
hosts:
|
|
- ezscale.cloud
|
|
- account.ezscale.cloud
|
|
- admin.ezscale.cloud
|
|
tls:
|
|
secretName: ezscale-website-tls
|
|
issuerName: letsencrypt
|
|
middlewares:
|
|
cloudflarewarp:
|
|
enabled: true
|
|
namespace: kube-system
|
|
name: cloudflarewarp
|
|
httpToHttps:
|
|
enabled: true
|
|
namespace: kube-system
|
|
name: http-to-https
|
|
|
|
# Production NEVER lets the chart generate APP_KEY. Bootstrap procedure
|
|
# in helm/ezscale-website/README.md.
|
|
secret:
|
|
create: false
|
|
existingSecretName: ezscale-website-secrets
|
|
|
|
env:
|
|
APP_NAME: "EZSCALE Billing"
|
|
APP_ENV: production
|
|
APP_DEBUG: "false"
|
|
APP_URL: https://ezscale.cloud
|
|
LOG_LEVEL: warning
|
|
FILESYSTEM_DISK: s3
|
|
AWS_BUCKET: ezscale-website-prod
|
|
AWS_DEFAULT_REGION: us-east-1
|
|
AWS_ENDPOINT: https://gateway.storjshare.io
|
|
AWS_USE_PATH_STYLE_ENDPOINT: "true"
|
|
SESSION_DRIVER: redis
|
|
SESSION_DOMAIN: .ezscale.cloud
|
|
CACHE_STORE: redis
|
|
QUEUE_CONNECTION: redis
|
|
MAIL_MAILER: smtp
|
|
TRUSTED_PROXIES: "*"
|