Serve every site from the edge as files, not from pods
Seventeen sites now declare the same three objects lux.credit does: a staticFiles Middleware, the route that names it, and the endpoint-less Service the route schema requires. No image, so no Deployment. Each was verified answering from the kubernetescrd router on this cluster, so each opts back in to automated sync. The DigitalOcean-era files that put these hosts behind a pod are gone, as are the files that declared hanzo's own services from this universe: hanzo/universe declares those, and a second declaration of one service is the drift this repo exists to prevent.
This commit is contained in:
@@ -1,88 +0,0 @@
|
||||
# Generated from the live app-lux-finance/app-lux-finance Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: app-lux-finance
|
||||
containerName: app
|
||||
image:
|
||||
repository: ghcr.io/luxfi/finance
|
||||
tag: 1.0.3-amd64
|
||||
pullPolicy: IfNotPresent
|
||||
partOf: lux-finance
|
||||
# hanzo-cd's ownership markers, carried so a chart apply re-asserts them rather
|
||||
# than pruning the app out of CD's inventory. live2values.py did not read them.
|
||||
annotations:
|
||||
apps.hanzo.ai/installation-id: hanzo-cd
|
||||
apps.hanzo.ai/tracking-id: lux-app-lux-finance-app-lux-finance:apps/Deployment:app-lux-finance/app-lux-finance
|
||||
# SPA_* env is templated into /public/config.json at boot by hanzoai/spa, which
|
||||
# is what this image runs. A build-time key cannot be rotated without a rebuild,
|
||||
# so the key is a reference to KMS and the pod is the only place it exists.
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
- name: SPA_INFURA_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: app-lux-finance-secrets
|
||||
key: INFURA_KEY
|
||||
# Org `lux` lives on the cloud-embedded KMS (kms.hanzo.ai), not on the
|
||||
# near-empty lux-kms-go store that kms.lux.cloud now resolves to.
|
||||
kms:
|
||||
hostAPI: https://kms.hanzo.ai
|
||||
credentialsSecret: lux-platform-iam-creds
|
||||
projectSlug: lux
|
||||
envSlug: prod
|
||||
kmsSecrets:
|
||||
- name: app-lux-finance-kms-sync
|
||||
secretsPath: /finance
|
||||
secretName: app-lux-finance-secrets
|
||||
keys:
|
||||
- INFURA_KEY
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- app.lux.finance
|
||||
tls: true
|
||||
className: ingress
|
||||
@@ -1,117 +0,0 @@
|
||||
# Generated from the live hanzo/cloud Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: cloud
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/cloud
|
||||
tag: v1.801.476
|
||||
pullPolicy: IfNotPresent
|
||||
partOf: lux-cloud
|
||||
env:
|
||||
- name: CLOUD_LISTEN
|
||||
value: :8000
|
||||
- name: CLOUD_HEALTH_LISTEN
|
||||
value: :9090
|
||||
- name: CLOUD_DATA_DIR
|
||||
value: /var/lib/cloud
|
||||
- name: RUNNING_IN_DOCKER
|
||||
value: 'true'
|
||||
- name: IAM_URL
|
||||
value: https://lux.id
|
||||
- name: IAM_ISSUER
|
||||
value: https://lux.id
|
||||
- name: CLOUD_IAM_ISSUER
|
||||
value: https://lux.id
|
||||
- name: AUTH_ISSUER
|
||||
value: https://lux.id
|
||||
- name: JWT_ISSUER
|
||||
value: https://lux.id
|
||||
- name: JWKS_URL
|
||||
value: https://lux.id/v1/iam/.well-known/jwks
|
||||
- name: IAM_KEYS_URL
|
||||
value: https://lux.id/v1/iam/.well-known/jwks
|
||||
- name: CLOUD_KMS_MASTER_KEY_REF
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: MASTER_KEY_B64
|
||||
name: cloud-kms-master-key
|
||||
- name: IAM_AUDIENCE
|
||||
value: lux-cloud
|
||||
- name: GATEWAY_ALLOWED_AUDIENCES
|
||||
value: lux-cloud,lux-console,lux-id,https://api.lux.cloud
|
||||
- name: AUTH_PUBLIC_PATHS
|
||||
value: /healthz,/readyz,/__stats,/.well-known/,/favicon
|
||||
- name: CLOUD_SITES_APEX
|
||||
value: lux.link
|
||||
- name: CLOUD_SITES_SELF_DOMAINS
|
||||
value: lux.link,lux.network,lux.cloud,lux.id
|
||||
- name: CLOUD_SITES_FIRSTPARTY_APEX
|
||||
value: lux.network
|
||||
- name: CLOUD_SITES_FIRSTPARTY
|
||||
- name: CLOUD_SITES_FIRSTPARTY_ORG
|
||||
value: lux
|
||||
- name: driverName
|
||||
value: sqlite
|
||||
- name: dbName
|
||||
value: hanzo_cloud
|
||||
- name: modelConfigPath
|
||||
value: /conf/models.yaml
|
||||
- name: TIKTOKEN_CACHE_DIR
|
||||
value: /var/lib/cloud/tiktoken
|
||||
resources:
|
||||
limits:
|
||||
cpu: '2'
|
||||
memory: 2Gi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/cloud
|
||||
name: cloud-data
|
||||
- mountPath: /data/cloud
|
||||
name: cloud-data
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 9090
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 9090
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http
|
||||
- containerPort: 9090
|
||||
name: ops
|
||||
volumes:
|
||||
- name: cloud-data
|
||||
persistentVolumeClaim:
|
||||
claimName: cloud-data
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
fsGroup: 1000
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
# Live runs this pod with these settings and the chart renders only fsGroup
|
||||
# unless podSecurityContext is set, so omitting them is a silent drop to uid 0
|
||||
# (or to seccomp Unconfined) on the first server-side sync.
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
@@ -1,33 +0,0 @@
|
||||
# Generated from the live hanzo/commerce-admin Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: commerce-admin
|
||||
containerName: admin
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/commerce-admin
|
||||
digest: sha256:4cca2b4ff528f97037e9bb22f664f00a80fb424570ccdd869ec07002cbce727e
|
||||
pullPolicy: Always
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
ports:
|
||||
- containerPort: 80
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
imagePullSecrets: []
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- admin.commerce.hanzo.ai
|
||||
tls: true
|
||||
className: hanzo
|
||||
@@ -1,40 +0,0 @@
|
||||
# Generated from the live hanzo/commerce-site Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: commerce-site
|
||||
containerName: site
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/commerce-site
|
||||
digest: sha256:17de0b0c143aeeda101215bdbb10c4b32098f033943e1683ffa4e590bb6f75cc
|
||||
pullPolicy: Always
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
ports:
|
||||
- containerPort: 80
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
imagePullSecrets: []
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- commerce.hanzo.ai
|
||||
tls: true
|
||||
className: hanzo
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch —
|
||||
# not by the chart. On while this Application already read Synced, so it
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: false
|
||||
@@ -1,319 +0,0 @@
|
||||
# Generated from the live hanzo/console Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: console
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/console
|
||||
tag: v8.5.22
|
||||
pullPolicy: Always
|
||||
partOf: hanzo-universe
|
||||
env:
|
||||
- name: NEXT_PUBLIC_ANALYTICS_SITE_ID
|
||||
value: 7dce54ee-41f6-4751-96bf-fe005067c7c7
|
||||
- name: NEXT_PUBLIC_ANALYTICS_URL
|
||||
value: https://analytics.hanzo.ai/script.js
|
||||
- name: NODE_ENV
|
||||
value: production
|
||||
- name: PORT
|
||||
value: '4000'
|
||||
- name: NEXTAUTH_URL
|
||||
value: https://console.lux.cloud
|
||||
- name: NEXTAUTH_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: NEXTAUTH_SECRET
|
||||
name: console-secrets
|
||||
- name: SALT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: SALT
|
||||
name: console-secrets
|
||||
- name: ENCRYPTION_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: ENCRYPTION_KEY
|
||||
name: console-secrets
|
||||
- name: AUTH_DISABLE_USERNAME_PASSWORD
|
||||
value: 'true'
|
||||
- name: AUTH_DISABLE_SIGNUP
|
||||
value: 'false'
|
||||
- name: IAM_URL
|
||||
value: https://lux.id
|
||||
- name: IAM_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: IAM_CLIENT_ID
|
||||
name: console-secrets
|
||||
- name: IAM_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: IAM_CLIENT_SECRET
|
||||
name: console-secrets
|
||||
- name: IAM_ORG
|
||||
value: hanzo
|
||||
- name: IAM_APP
|
||||
value: app-console
|
||||
- name: IAM_SERVER_URL
|
||||
value: https://lux.id
|
||||
- name: IAM_ORG_NAME
|
||||
value: hanzo
|
||||
- name: IAM_APP_NAME
|
||||
value: app-console
|
||||
- name: IAM_ALLOW_ACCOUNT_LINKING
|
||||
value: 'true'
|
||||
- name: HANZO_INIT_ORG_IDS
|
||||
value: hanzo,lux,zoo,pars
|
||||
- name: HANZO_INIT_ORG_NAMES
|
||||
value: Hanzo,Lux,Zoo,Pars
|
||||
- name: HANZO_INIT_USER_EMAIL
|
||||
value: [email protected]
|
||||
- name: HANZO_INIT_ORG_OWNERS
|
||||
value: [email protected]:lux,[email protected]:zoo,[email protected]:pars,[email protected]:pars,[email protected]:pars
|
||||
- name: DATABASE_URL
|
||||
value: file:/data/console.db
|
||||
- name: REDIS_CONNECTION_STRING
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: REDIS_CONNECTION_STRING
|
||||
name: console-secrets
|
||||
- name: DATASTORE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_URL
|
||||
name: console-secrets
|
||||
- name: DATASTORE_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_USER
|
||||
name: console-secrets
|
||||
- name: DATASTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_PASSWORD
|
||||
name: console-secrets
|
||||
- name: DATASTORE_MIGRATION_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_MIGRATION_URL
|
||||
name: console-secrets
|
||||
- name: DATASTORE_DB
|
||||
value: console
|
||||
- name: DATASTORE_CLUSTER_ENABLED
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_CLUSTER_ENABLED
|
||||
name: console-secrets
|
||||
optional: true
|
||||
- name: DATASTORE_AUTO_MIGRATION_DISABLED
|
||||
value: 'true'
|
||||
- name: CLICKHOUSE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_URL
|
||||
name: console-secrets
|
||||
- name: CLICKHOUSE_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_USER
|
||||
name: console-secrets
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_PASSWORD
|
||||
name: console-secrets
|
||||
- name: CLICKHOUSE_MIGRATION_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: DATASTORE_MIGRATION_URL
|
||||
name: console-secrets
|
||||
- name: CLICKHOUSE_DB
|
||||
value: console
|
||||
- name: S3_EVENT_UPLOAD_BUCKET
|
||||
value: hanzo-events
|
||||
- name: S3_EVENT_UPLOAD_ENDPOINT
|
||||
value: http://s3:9000
|
||||
- name: S3_EVENT_UPLOAD_REGION
|
||||
value: us-east-1
|
||||
- name: S3_EVENT_UPLOAD_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: HANZO_S3_EVENT_UPLOAD_ACCESS_KEY_ID
|
||||
name: console-secrets
|
||||
- name: S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: HANZO_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY
|
||||
name: console-secrets
|
||||
- name: S3_EVENT_UPLOAD_FORCE_PATH_STYLE
|
||||
value: 'true'
|
||||
- name: S3_MEDIA_UPLOAD_ENDPOINT
|
||||
value: http://s3:9000
|
||||
- name: S3_MEDIA_UPLOAD_REGION
|
||||
value: us-east-1
|
||||
- name: S3_MEDIA_UPLOAD_BUCKET
|
||||
value: hanzo-media
|
||||
- name: S3_MEDIA_UPLOAD_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: HANZO_S3_MEDIA_UPLOAD_ACCESS_KEY_ID
|
||||
name: console-secrets
|
||||
- name: S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: HANZO_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY
|
||||
name: console-secrets
|
||||
- name: S3_MEDIA_UPLOAD_FORCE_PATH_STYLE
|
||||
value: 'true'
|
||||
- name: CASVISOR_API_URL
|
||||
value: http://visor:19000
|
||||
- name: KMS_API_URL
|
||||
value: https://kms.hanzo.ai
|
||||
- name: KMS_PROJECT_ID
|
||||
value: 2928fb55-6b08-454a-a338-a48d99a699a4
|
||||
- name: KMS_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: KMS_CLIENT_ID
|
||||
name: kms-console-credentials
|
||||
- name: KMS_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: KMS_CLIENT_SECRET
|
||||
name: kms-console-credentials
|
||||
- name: KMS_SERVICE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: KMS_SERVICE_TOKEN
|
||||
name: kms-console-credentials
|
||||
optional: true
|
||||
- name: COMMERCE_API_URL
|
||||
value: http://commerce.hanzo.svc:8001
|
||||
- name: COMMERCE_SERVICE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: COMMERCE_TOKEN
|
||||
name: console-secrets
|
||||
optional: true
|
||||
- name: AGENTS_API_URL
|
||||
value: http://agents:8080/api
|
||||
- name: NEXT_PUBLIC_HANZO_CLOUD_REGION
|
||||
value: US
|
||||
- name: NEXT_TELEMETRY_DISABLED
|
||||
value: '1'
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: http://otel-collector.hanzo.svc:4318
|
||||
- name: OTEL_EXPORTER_OTLP_PROTOCOL
|
||||
value: http/protobuf
|
||||
- name: OTEL_SERVICE_NAME
|
||||
value: console
|
||||
- name: OTEL_RESOURCE_ATTRIBUTES
|
||||
value: service.namespace=hanzo,deployment.environment=production
|
||||
- name: OTEL_TRACE_SAMPLING_RATIO
|
||||
value: '0.1'
|
||||
- name: INSIGHTS_HOST
|
||||
value: http://insights-capture.hanzo.svc:3000
|
||||
- name: INSIGHTS_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: API_KEY
|
||||
name: insights-client-secrets
|
||||
optional: true
|
||||
- name: NEXT_PUBLIC_INSIGHTS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: INSIGHTS_KEY
|
||||
name: insights-client-secrets
|
||||
optional: true
|
||||
- name: NEXT_PUBLIC_INSIGHTS_HOST
|
||||
value: https://insights.hanzo.ai
|
||||
- name: ANALYTICS_API_URL
|
||||
value: http://analytics.hanzo.svc:3000
|
||||
- name: ANALYTICS_SERVICE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: ANALYTICS_SERVICE_TOKEN
|
||||
name: console-secrets
|
||||
optional: true
|
||||
- name: INSIGHTS_API_URL
|
||||
value: http://insights-web.hanzo.svc:8000
|
||||
- name: INSIGHTS_SERVICE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: INSIGHTS_SERVICE_TOKEN
|
||||
name: console-secrets
|
||||
optional: true
|
||||
- name: NEXT_PUBLIC_HANZO_RUN_NEXT_INIT
|
||||
value: 'false'
|
||||
resources:
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: data
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /api/public/ready
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /api/public/ready
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
startupProbe:
|
||||
failureThreshold: 60
|
||||
httpGet:
|
||||
path: /api/public/ready
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
ports:
|
||||
- containerPort: 4000
|
||||
name: http
|
||||
servicePort: 80
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: console-data
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
fsGroup: 1001
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- sleep 15
|
||||
terminationGracePeriodSeconds: 45
|
||||
# Live runs this pod with these settings and the chart renders only fsGroup
|
||||
# unless podSecurityContext is set, so omitting them is a silent drop to uid 0
|
||||
# (or to seccomp Unconfined) on the first server-side sync.
|
||||
podSecurityContext:
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
@@ -1,83 +0,0 @@
|
||||
# Generated from the live hanzo/hanzo-login Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: hanzo-login
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/login
|
||||
tag: 1.1.6
|
||||
pullPolicy: Always
|
||||
# The tag publishes ONE manifest, linux/amd64, so this states what the image is
|
||||
# rather than where we would like it to run. On an all-amd64 cluster it selects
|
||||
# every node and changes nothing; on a mixed one it is the difference between
|
||||
# scheduling and ImagePullBackOff, because a node of the other architecture
|
||||
# accepts the pod and then finds no manifest it can run.
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
partOf: hanzo-universe
|
||||
env:
|
||||
- name: IAM_ORIGIN
|
||||
value: https://iam.hanzo.ai
|
||||
- name: NEXT_PUBLIC_IAM_URL
|
||||
value: https://iam.hanzo.ai
|
||||
- name: NEXT_PUBLIC_ORG
|
||||
value: hanzo
|
||||
- name: NEXT_PUBLIC_CLIENT_ID
|
||||
value: app-hanzo
|
||||
- name: NEXT_PUBLIC_ANALYTICS_URL
|
||||
value: https://analytics.hanzo.ai/script.js
|
||||
- name: NEXT_PUBLIC_ANALYTICS_SITE_ID
|
||||
value: 9c0befac-aba7-4dcb-b350-c348f7a89b01
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /login
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /login
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- id.pars.network
|
||||
- id.lux-dev.network
|
||||
- id.lux-test.network
|
||||
- id.hanzo.network
|
||||
- id.hanzo-dev.network
|
||||
- id.hanzo-test.network
|
||||
- id.zoo-dev.network
|
||||
- id.zoo-test.network
|
||||
tls: true
|
||||
className: ingress
|
||||
@@ -1,158 +0,0 @@
|
||||
# Generated from the live hanzo/iam Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 1
|
||||
selectorLabels:
|
||||
app: iam
|
||||
image:
|
||||
repository: ghcr.io/hanzoai/iam
|
||||
# Identity for id.hanzo.network, id.lux.cloud, id.pars.network and the zoo
|
||||
# networks all resolve to this one deployment, so it is the estate's shared
|
||||
# login plane and it sat nineteen minor versions behind.
|
||||
#
|
||||
# v1.33.38 is the newest git tag and has NO image — ghcr 404s it, the same
|
||||
# tagged-but-never-built gap that left luxfi/node v1.36.38/39/41 and
|
||||
# hanzoai/git v1.26.29 without artifacts. v1.33.24 is the newest tag that
|
||||
# actually built, verified present before being written here.
|
||||
tag: v1.33.24
|
||||
pullPolicy: Always
|
||||
partOf: hanzo-universe
|
||||
component: iam
|
||||
env:
|
||||
- name: GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: GOOGLE_CLIENT_ID
|
||||
name: iam-provider-creds
|
||||
optional: true
|
||||
- name: GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: GOOGLE_CLIENT_SECRET
|
||||
name: iam-provider-creds
|
||||
optional: true
|
||||
- name: GITHUB_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: GITHUB_CLIENT_ID
|
||||
name: iam-provider-creds
|
||||
optional: true
|
||||
- name: GITHUB_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: GITHUB_CLIENT_SECRET
|
||||
name: iam-provider-creds
|
||||
optional: true
|
||||
- name: GOMEMLIMIT
|
||||
value: 3750MiB
|
||||
- name: GOMAXPROCS
|
||||
value: '2'
|
||||
- name: REGISTRY_SIGNING_KEY_FILE
|
||||
value: /etc/registry-signing/signing.key
|
||||
- name: redisEndpoint
|
||||
value: hanzo-kv:6379
|
||||
- name: INSIGHTS_HOST
|
||||
value: http://insights-capture.hanzo.svc:3000
|
||||
- name: INSIGHTS_API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: API_KEY
|
||||
name: insights-client-secrets
|
||||
optional: true
|
||||
- name: IAM_DATABASE_URL
|
||||
value: user=hanzo password=hanzo-pg-secret-6fcc8aeb host=sql-0.sql.hanzo.svc.cluster.local port=5432 dbname=iam sslmode=disable
|
||||
resources:
|
||||
limits:
|
||||
cpu: '2'
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- mountPath: /data/iam
|
||||
name: iam-data
|
||||
- mountPath: /etc/registry-signing
|
||||
name: registry-signing-key
|
||||
readOnly: true
|
||||
- mountPath: /etc/kms/auth
|
||||
name: kms-auth
|
||||
readOnly: true
|
||||
- mountPath: /etc/iam-init-data
|
||||
name: init-data
|
||||
readOnly: true
|
||||
- mountPath: /conf
|
||||
name: iam-conf
|
||||
readOnly: true
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 8000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 8000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http
|
||||
servicePort: 80
|
||||
volumes:
|
||||
- name: iam-data
|
||||
- name: registry-signing-key
|
||||
secret:
|
||||
items:
|
||||
- key: SIGNING_KEY
|
||||
path: signing.key
|
||||
secretName: registry-signing-key
|
||||
- name: kms-auth
|
||||
secret:
|
||||
items:
|
||||
- key: CLIENTID
|
||||
path: clientId
|
||||
optional: true
|
||||
secretName: iam-kms-auth
|
||||
- configMap:
|
||||
name: iam-init-data
|
||||
name: init-data
|
||||
- configMap:
|
||||
items:
|
||||
- key: app.prod.conf
|
||||
path: app.conf
|
||||
name: iam-conf
|
||||
name: iam-conf
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- iam
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
fsGroup: 1000
|
||||
strategy: Recreate
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- sleep 5
|
||||
terminationGracePeriodSeconds: 45
|
||||
imagePullSecrets: []
|
||||
@@ -1,68 +0,0 @@
|
||||
# Generated from the live hanzo/lux-bitcoin Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-bitcoin
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-bitcoin
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-bitcoin
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- bitcoin.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: false
|
||||
@@ -1,68 +0,0 @@
|
||||
# Generated from the live hanzo/lux-coin Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-coin
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-coin
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-coin
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- coin.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: false
|
||||
@@ -1,69 +0,0 @@
|
||||
# Generated from the live hanzo/lux-finance Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-finance
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-finance
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-finance
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.finance
|
||||
- www.lux.finance
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: false
|
||||
@@ -1,69 +0,0 @@
|
||||
# Generated from the live hanzo/lux-industries Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-industries
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-industries
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-industries
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.industries
|
||||
- www.lux.industries
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: false
|
||||
@@ -1,69 +0,0 @@
|
||||
# Generated from the live hanzo/lux-market Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-market
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lux-market
|
||||
tag: v2.0.0
|
||||
pullPolicy: Always
|
||||
partOf: lux-market
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.market
|
||||
- www.lux.market
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: false
|
||||
@@ -1,65 +0,0 @@
|
||||
# CD applies this file within ~90s, so THIS is the source now, not the cluster.
|
||||
# Without this the app is manual-sync: the gateway ran v0.1.2 for weeks while
|
||||
# this file said v0.1.5, and nothing was wrong except that nobody had pressed
|
||||
# sync. prune stays off (the chart is not the only owner of objects in the
|
||||
# namespace); selfHeal returns a hand-edited Deployment to what is written here.
|
||||
cd:
|
||||
automated: false
|
||||
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-safe
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/safe
|
||||
tag: v2.2.14
|
||||
pullPolicy: Always
|
||||
partOf: lux-safe
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- safe.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
@@ -1,71 +1,32 @@
|
||||
# Generated from the live lux-audio/lux-audio Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-audio
|
||||
containerName: spa
|
||||
image:
|
||||
repository: ghcr.io/luxfi/audio
|
||||
tag: latest
|
||||
pullPolicy: Always
|
||||
partOf: lux-audio
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
- name: REDIRECTS
|
||||
value: /earbuds=/,/earphones=/
|
||||
resources:
|
||||
limits:
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.audio
|
||||
- www.lux.audio
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lux.audio is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: false
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: audio
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/audio
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: audio
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.audio`) || Host(`www.lux.audio`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: audio
|
||||
services:
|
||||
- name: lux-audio
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# bitcoin.lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: bitcoin
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/bitcoin
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: bitcoin
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`bitcoin.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: bitcoin
|
||||
services:
|
||||
- name: lux-bitcoin
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.cash is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: cash
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/cash
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: cash
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.cash`) || Host(`www.lux.cash`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: cash
|
||||
services:
|
||||
- name: lux-cash
|
||||
port: 80
|
||||
tls: {}
|
||||
+31
-81
@@ -1,82 +1,32 @@
|
||||
# Generated from the live lux-cloud/cloud Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: cloud
|
||||
image:
|
||||
repository: ghcr.io/luxfi/cloud-web
|
||||
tag: v1.5.31
|
||||
# v1.5.27 and its predecessor served a bundle that was NOT built from their
|
||||
# source: apps/web/dist travelled into the build context, so whatever was
|
||||
# last built on a laptop could reach the image. v1.5.28 is the first build
|
||||
# with only the source in the context, and it carries the validator set that
|
||||
# anyone -- signed in or not -- can now see.
|
||||
#
|
||||
# v1.5.31 adds the Traffic view, which reads whether a network is building and
|
||||
# what its generator's account is doing ON the chain rather than asking the
|
||||
# generator, since a generator reports every send a success whether or not the
|
||||
# chain can ever run it.
|
||||
#
|
||||
# The tag is how a human says it; the digest is what the kubelet obeys.
|
||||
digest: sha256:e5f86356a7ee6800d65b29433b70b2fd27028a972a699cbb05f5947d314ee1c0
|
||||
pullPolicy: Always
|
||||
partOf: lux-cloud
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
imagePullSecrets:
|
||||
- name: ghcr-secret
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.cloud
|
||||
- www.lux.cloud
|
||||
tls: true
|
||||
# The live certificate lives in this Secret. The chart would default to
|
||||
# <release>-tls, and cert-manager would then issue into a NEW empty Secret
|
||||
# while the host serves no cert at all until it succeeds.
|
||||
secretName: cloud-lux-tls
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch —
|
||||
# not by the chart. On while this Application already read Synced, so it
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
# lux.cloud is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: false
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: cloud
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/cloud
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: cloud
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.cloud`) || Host(`www.lux.cloud`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: cloud
|
||||
services:
|
||||
- name: cloud
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# coin.lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: coin
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/coin
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: coin
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`coin.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: coin
|
||||
services:
|
||||
- name: lux-coin
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.exchange is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: exchange
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/exchange
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: exchange
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.exchange`) || Host(`www.lux.exchange`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: exchange
|
||||
services:
|
||||
- name: lux-exchange
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.finance is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: finance
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/finance
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: finance
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.finance`) || Host(`www.lux.finance`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: finance
|
||||
services:
|
||||
- name: lux-finance
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -1,43 +1,32 @@
|
||||
# Generated from the live lux-fund/lux-fund Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-fund
|
||||
image:
|
||||
repository: ghcr.io/lux-apps/fund
|
||||
tag: c30add1534b45dfd53167aee3de6c6a541c2a76c
|
||||
pullPolicy: Always
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources: {}
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.fund
|
||||
- www.lux.fund
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lux.fund is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: false
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: fund
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/fund
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: fund
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.fund`) || Host(`www.lux.fund`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: fund
|
||||
services:
|
||||
- name: lux-fund
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.industries is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: industries
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/industries
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: industries
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.industries`) || Host(`www.lux.industries`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: industries
|
||||
services:
|
||||
- name: lux-industries
|
||||
port: 80
|
||||
tls: {}
|
||||
+31
-54
@@ -1,55 +1,32 @@
|
||||
# Generated from the live lux-lps/lux-lps Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-lps
|
||||
image:
|
||||
repository: ghcr.io/luxfi/lps
|
||||
tag: 1.0.1
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources: {}
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lps.lux.network
|
||||
tls: true
|
||||
# The live certificate lives in this Secret. The chart would default to
|
||||
# <release>-tls, and cert-manager would then issue into a NEW empty Secret
|
||||
# while the host serves no cert at all until it succeeds.
|
||||
secretName: lps-lux-tls
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lps.lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: false
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: lps
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/lps
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: lps
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lps.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: lps
|
||||
services:
|
||||
- name: lux-lps
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.market is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: market
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/market
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: market
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.market`) || Host(`www.lux.market`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: market
|
||||
services:
|
||||
- name: lux-market
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -1,36 +1,32 @@
|
||||
# Generated from the live lux-network/lux-network Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app.kubernetes.io/name: lux-network
|
||||
image:
|
||||
repository: ghcr.io/lux-apps/network
|
||||
tag: latest
|
||||
pullPolicy: Always
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: ROOT
|
||||
value: /public
|
||||
resources: {}
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
defaultReadinessProbe: false
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
# lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: false
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: network
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/network
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: network
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.network`) || Host(`www.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: network
|
||||
services:
|
||||
- name: lux-network
|
||||
port: 80
|
||||
tls: {}
|
||||
|
||||
@@ -1,159 +0,0 @@
|
||||
# Generated from the live lux-ns/lux-exchange Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-exchange
|
||||
containerName: exchange
|
||||
image:
|
||||
repository: ghcr.io/luxfi/exchange
|
||||
# 5.149.27. Declared state had drifted far below live (5.149.16-amd64 here
|
||||
# against v5.149.25 running), so this app read OutOfSync and a sync would have
|
||||
# rolled the site BACKWARDS by nine patches. Setting the tag forward first is
|
||||
# what makes the sync safe.
|
||||
#
|
||||
# What 5.149.27 carries: every Lux token page crashed before painting, because
|
||||
# chainInfo names GraphQLApi.Chain.Lux and that enum — generated from the
|
||||
# upstream gateway schema — has no Lux, Zoo, Hanzo, Pars or Spc member. The
|
||||
# `as GqlChainId` cast made the missing member a runtime undefined instead of
|
||||
# a compile error, and TokenDetailsPage dereferenced it. Also: pool pages died
|
||||
# on an empty address, and the market endpoints now answer on lux.cloud.
|
||||
#
|
||||
# The v prefix is gone because the tag now comes from docker/metadata-action's
|
||||
# {{version}}, the same convention explorer already uses.
|
||||
#
|
||||
# 5.149.33: Explore opens on the exchange's own chain. A bare /explore/tokens
|
||||
# resolved to NO chain, which renders the upstream-gateway table — and the
|
||||
# gateway carries none of our chains, so the Lux exchange opened on a token
|
||||
# list with no LUX in it and the Transactions tab fell back to Ethereum.
|
||||
# Absence and "every network" were the same URL state; now the segment says
|
||||
# which, and `all` still reaches everything. Pool detail pages stop bouncing
|
||||
# to /explore/pools for the same reason the token pages did. Each brand reads
|
||||
# the exchange-api its own brand.json names.
|
||||
#
|
||||
# 5.149.56: a token page draws the token's mark. The header asked the upstream
|
||||
# gateway for a project logo, and the gateway carries none of our chains, so
|
||||
# every Lux and Zoo token drew three letters in a grey circle — while the swap
|
||||
# panel beside it drew the real mark. It asks buildPartialCurrencyInfo now —
|
||||
# the function the token constants themselves are built with, so every token
|
||||
# the constants know, and the native coin, draws the same mark everywhere. No
|
||||
# artwork was added; the marks were already on the CDN and already correct.
|
||||
#
|
||||
# 5.149.57: the exchange wears LX. Two letters, the Lux wordmark's own L and
|
||||
# X with the U taken out (@luxfi/logo 1.0.10) — header mark, tab icon and the
|
||||
# PNG icon slots. It replaces a triangle, which said nothing about who this
|
||||
# is; that is why the brand's name was set beside it, and why the name comes
|
||||
# out now that the mark says it. lux.exchange is the only Lux surface that
|
||||
# wears two letters; everything else keeps the full LUX.
|
||||
#
|
||||
# zoo-exchange runs this same image and stays on 5.149.56. It mounts its own
|
||||
# logo.svg, so the mark is safe either way, but its header name comes from
|
||||
# the line this drops — Zoo needs a lockup of its own before it follows.
|
||||
#
|
||||
# 5.149.83: the wallet list shows the wallets, and none of them is another
|
||||
# exchange. Binance's connector is gone — registering it opened a socket to
|
||||
# its relay on page load, for every visitor without the extension, before
|
||||
# anyone clicked anything. In its place a visitor can sign in with the wallet
|
||||
# they actually have: Ethereum, Solana, Bitcoin, TON and XRP, each its own
|
||||
# row, each chain's wallet library fetched only when its row is clicked
|
||||
# (@luxwallet/connect 0.2.0 imports its connectors dynamically).
|
||||
#
|
||||
# Those rows now render at all. They were written against a metadata path
|
||||
# with no production caller, so the single sign-in row that shipped before
|
||||
# had never once appeared on screen. The wallet icon resolves too: its
|
||||
# override was keyed on a name that does not exist, so it was undefined for
|
||||
# every consumer — and the file behind it was byte-identical to Uniswap's
|
||||
# unicorn, which is what the mark had been all along.
|
||||
#
|
||||
# Built from 411b14add, verified against the registry's own revision label
|
||||
# rather than the build's say-so.
|
||||
tag: 5.149.83
|
||||
digest: sha256:7c1bd0e9d423fc5889101fdeebb9f09750bbbdf5d57c666825f4c0fe414423be
|
||||
pullPolicy: Always
|
||||
# hanzo-cd's ownership markers, carried so a chart apply re-asserts them rather
|
||||
# than pruning the app out of CD's inventory. live2values.py did not read them.
|
||||
annotations:
|
||||
apps.hanzo.ai/installation-id: hanzo-cd
|
||||
apps.hanzo.ai/tracking-id: lux-lux-ns-lux-exchange:apps/Deployment:lux-ns/lux-exchange
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: exchange-config
|
||||
# SPA_* env is templated into /public/config.json at boot by hanzoai/spa, which
|
||||
# is what this image runs. A build-time key cannot be rotated without a rebuild,
|
||||
# so the key is a reference to KMS and the pod is the only place it exists.
|
||||
env:
|
||||
- name: SPA_INFURA_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: lux-exchange-secrets
|
||||
key: INFURA_KEY
|
||||
# Org `lux` lives on the cloud-embedded KMS (kms.hanzo.ai), not on the
|
||||
# near-empty lux-kms-go store that kms.lux.cloud now resolves to.
|
||||
kms:
|
||||
hostAPI: https://kms.hanzo.ai
|
||||
credentialsSecret: lux-platform-iam-creds
|
||||
projectSlug: lux
|
||||
envSlug: prod
|
||||
kmsSecrets:
|
||||
- name: lux-exchange-kms-sync
|
||||
secretsPath: /exchange
|
||||
secretName: lux-exchange-secrets
|
||||
keys:
|
||||
- INFURA_KEY
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
imagePullSecrets:
|
||||
- name: ghcr-luxfi-fresh
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.exchange
|
||||
- www.lux.exchange
|
||||
- app.lux.exchange
|
||||
- trade.lux.exchange
|
||||
- exchange.lux.network
|
||||
- markets.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch —
|
||||
# not by the chart. On while this Application already read Synced, so it
|
||||
# applies nothing today; what it adds is selfHeal, which returns a
|
||||
# hand-edited object to what is written here. prune stays off.
|
||||
cd:
|
||||
automated: false
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.partners is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: partners
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/partners
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: partners
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.partners`) || Host(`www.lux.partners`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: partners
|
||||
services:
|
||||
- name: lux-partners
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -0,0 +1,32 @@
|
||||
# safe.lux.network is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: safe
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/safe
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: safe
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`safe.lux.network`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: safe
|
||||
services:
|
||||
- name: lux-safe
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.shop is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: shop
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/shop
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: shop
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.shop`) || Host(`www.lux.shop`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: shop
|
||||
services:
|
||||
- name: lux-shop
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -0,0 +1,32 @@
|
||||
# lux.tel is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: tel
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/tel
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: tel
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`lux.tel`) || Host(`www.lux.tel`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: tel
|
||||
services:
|
||||
- name: lux-tel
|
||||
port: 80
|
||||
tls: {}
|
||||
@@ -1,72 +0,0 @@
|
||||
# Generated from the live lux-web/lux-network Deployment on do-sfo3-lux-k8s
|
||||
# by hack/live2values.py. Live is the source: a repo of hand-applied
|
||||
# manifests has unknown currency, the running fleet does not.
|
||||
replicas: 2
|
||||
selectorLabels:
|
||||
app: lux-network
|
||||
containerName: web
|
||||
image:
|
||||
repository: ghcr.io/lux-apps/network
|
||||
tag: 1028f82e5d8790dd960efea4bbb40ce6e5b2eb7c
|
||||
pullPolicy: IfNotPresent
|
||||
partOf: lux-web
|
||||
env:
|
||||
- name: PORT
|
||||
value: '3000'
|
||||
- name: HOSTNAME
|
||||
value: 0.0.0.0
|
||||
- name: NODE_ENV
|
||||
value: production
|
||||
resources:
|
||||
limits:
|
||||
cpu: '1'
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
servicePort: 80
|
||||
imagePullSecrets:
|
||||
- name: ghcr-pull
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
topologySpread:
|
||||
enabled: false
|
||||
lifecycle: null
|
||||
terminationGracePeriodSeconds: 30
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- lux.network
|
||||
- www.lux.network
|
||||
tls: true
|
||||
className: ingress
|
||||
|
||||
# Enforcement switch, read by the lux-fleet ApplicationSet's templatePatch --
|
||||
# not by the chart. selfHeal returns a hand-edited object to what is written
|
||||
# here; prune stays off, so nothing is ever deleted.
|
||||
cd:
|
||||
automated: false
|
||||
@@ -0,0 +1,32 @@
|
||||
# yadota.tech is files: one Middleware that serves them, one route that names it,
|
||||
# and the endpoint-less Service the route schema requires. No image, so the
|
||||
# chart renders no Deployment -- a static site is not a pod.
|
||||
cd:
|
||||
automated: true
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
middlewares:
|
||||
- name: yadota
|
||||
spec:
|
||||
staticFiles:
|
||||
root: /var/www/yadota
|
||||
spaMode: true
|
||||
spaIndex: index.html
|
||||
indexFiles:
|
||||
- index.html
|
||||
routes:
|
||||
- name: yadota
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`yadota.tech`) || Host(`www.yadota.tech`)
|
||||
kind: Rule
|
||||
priority: 100
|
||||
middlewares:
|
||||
- name: yadota
|
||||
services:
|
||||
- name: yadota
|
||||
port: 80
|
||||
tls: {}
|
||||
Reference in New Issue
Block a user