mirror of
https://github.com/hanzoai/helpdesk.git
synced 2026-10-12 16:56:02 +00:00
zeekay
3f474066c0
- custom_base_url=1 so Frappe prepends https://hanzo.id to authorize/token/ userinfo (relative paths were resolving to the Frappe host, breaking OAuth). - login_with_email_link=0 removes the native passwordless path; IAM SSO is the ONLY login. CR mirror -> 1.26.6.
77 lines
2.2 KiB
YAML
77 lines
2.2 KiB
YAML
# Hanzo Help Center — operator-native Service CR (hanzo.ai/v1).
|
|
# Authoritative copy lives in hanzoai/universe; this is the source-side mirror.
|
|
# Deploy: kubectl -n hanzo apply -f help.service.yaml (operator reconciles it).
|
|
apiVersion: hanzo.ai/v1
|
|
kind: Service
|
|
metadata:
|
|
name: help
|
|
namespace: hanzo
|
|
spec:
|
|
component: help
|
|
partOf: platform
|
|
image:
|
|
repository: ghcr.io/hanzoai/helpdesk
|
|
tag: 1.26.6 # semver; pinned by universe, never a floating tag
|
|
pullPolicy: Always
|
|
imagePullSecrets:
|
|
- name: ghcr-secret
|
|
replicas: 1
|
|
strategy: Recreate # SQLite = single writer
|
|
fsGroup: 1000
|
|
env:
|
|
- name: SITE_NAME
|
|
value: help.hanzo.ai
|
|
- name: HANZO_ORG # primary org == tenant (IAM owner)
|
|
value: hanzo
|
|
- name: HANZO_ORGS # comma-separated org slugs -> one SQLite site each
|
|
value: hanzo
|
|
- name: IAM_BASE_URL
|
|
value: https://hanzo.id
|
|
- name: HANZO_IAM_ISSUER
|
|
value: https://hanzo.id
|
|
- name: HANZO_IAM_JWKS_URI
|
|
value: https://hanzo.id/v1/iam/.well-known/jwks
|
|
- name: ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef: { name: help-secrets, key: ADMIN_PASSWORD }
|
|
- name: ENCRYPTION_KEY
|
|
valueFrom:
|
|
secretKeyRef: { name: help-secrets, key: ENCRYPTION_KEY }
|
|
- name: IAM_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef: { name: help-secrets, key: IAM_CLIENT_ID }
|
|
- name: IAM_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef: { name: help-secrets, key: IAM_CLIENT_SECRET }
|
|
ports:
|
|
- name: http
|
|
containerPort: 8000
|
|
servicePort: 80
|
|
livenessProbe:
|
|
path: /api/method/ping
|
|
port: 8000
|
|
initialDelaySeconds: 180
|
|
periodSeconds: 30
|
|
readinessProbe:
|
|
path: /api/method/ping
|
|
port: 8000
|
|
initialDelaySeconds: 90
|
|
periodSeconds: 15
|
|
resources:
|
|
requests: { cpu: 250m, memory: 512Mi }
|
|
limits: { cpu: "1", memory: 2Gi }
|
|
pdb:
|
|
enabled: true
|
|
maxUnavailable: 1
|
|
ingress:
|
|
enabled: false # ingress managed separately (help.ingress.yaml)
|
|
hosts: [help.hanzo.ai]
|
|
tls: true
|
|
volumeMounts:
|
|
- name: app-db
|
|
mountPath: /home/frappe/frappe-bench/sites
|
|
volumes:
|
|
- name: app-db
|
|
persistentVolumeClaim:
|
|
claimName: help-app-db
|