81 lines
2.8 KiB
YAML
81 lines
2.8 KiB
YAML
---
|
|
# api.zoo.exchange — white-label of api.lux.network. Same Lux Gateway
|
|
# gateway (lux-mainnet/api-gateway-gateway:8080) backs both. SPA hits
|
|
# api.zoo.exchange for /v1/chain/zoo/rpc, /api/indexer/indexer-zoo, etc.
|
|
# Zero third-party traffic visible to user.
|
|
#
|
|
# Rate limit matches the upstream Lux apex (50 rps sustained, 100 burst,
|
|
# ~1000 rpm) — same Gateway backend, same capacity envelope. Replaces the
|
|
# Cloudflare grey-cloud WAF that previously sat in front.
|
|
apiVersion: hanzo.ai/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: api-zoo-exchange-rate-limit
|
|
namespace: lux-mainnet
|
|
spec:
|
|
rateLimit:
|
|
average: 50
|
|
burst: 100
|
|
period: 1s
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: api-zoo-exchange
|
|
namespace: lux-mainnet
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
# Allow all origins for browser SDK calls from zoo.exchange
|
|
hanzo.ai/ingress.cors-allow-origin: "https://zoo.exchange,https://www.zoo.exchange"
|
|
# Bind rateLimit Middleware. hanzoai/ingress parses the
|
|
# ingress.kubernetes.io/ prefix; traefik.ingress.kubernetes.io/ is ignored.
|
|
ingress.kubernetes.io/router.middlewares: lux-mainnet-api-zoo-exchange-rate-limit@kubernetescrd
|
|
spec:
|
|
ingressClassName: ingress
|
|
tls:
|
|
- hosts: [api.zoo.exchange]
|
|
secretName: api-zoo-exchange-tls
|
|
rules:
|
|
- host: api.zoo.exchange
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
# Gateway service (`api-gateway-gateway`) only exposes port 80;
|
|
# earlier `8080` was a paste-typo that caused Traefik to log
|
|
# "service port not found" and serve 404 with no upstream.
|
|
name: api-gateway-gateway
|
|
port: { number: 80 }
|
|
---
|
|
# *.api.zoo.exchange — per-tenant API subdomains, same Lux Gateway backend as
|
|
# the apex. Cloudflare wildcard DNS (*.api.zoo.exchange) is already live; this
|
|
# codifies the previously live-only (un-sourced) wildcard ingress into GitOps
|
|
# and points it at the real DNS-01 issuer. Wildcard TLS requires DNS-01, which
|
|
# letsencrypt-prod provides via Cloudflare (zoo.exchange zone is in-account).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: api-zoo-exchange-wildcard
|
|
namespace: lux-mainnet
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hanzo.ai/ingress.cors-allow-origin: "https://zoo.exchange,https://www.zoo.exchange"
|
|
ingress.kubernetes.io/router.middlewares: lux-mainnet-api-zoo-exchange-rate-limit@kubernetescrd
|
|
spec:
|
|
ingressClassName: ingress
|
|
tls:
|
|
- hosts: ["*.api.zoo.exchange"]
|
|
secretName: api-zoo-exchange-wildcard-tls
|
|
rules:
|
|
- host: "*.api.zoo.exchange"
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api-gateway-gateway
|
|
port: { number: 80 }
|