wallet/apps/web/k8s/overlays/lux/fallback.yaml

# wallet-web — LUX brand, PLAIN-MANIFEST deploy (operational fallback).
#
# The declarative desired state is the lux.cloud/v1 Service CR (k8s/base/
# wallet-web.yaml + this overlay's kustomization.yaml), reconciled by
# lux-system/lux-operator. On lux-k8s that operator is currently scaled to 0,
# so the CR does not materialize. These manifests reproduce EXACTLY what the
# operator would generate — Deployment + Service + Ingress (+ cert-manager
# auto-issued Certificate) — so wallet.lux.network goes live WITHOUT scaling the
# operator (which would risk reconciling other drifted CRs / the luxd validators
# that also live in lux-mainnet).
#
# Ingress + TLS follow the exact proven lux-k8s pattern (cf. safe.lux.network):
# ingressClassName `ingress` (hanzoai/ingress — NOT nginx/caddy) + the
# cert-manager.io/cluster-issuer annotation, which the ingress-shim turns into a
# Certificate issued by letsencrypt-prod over DNS-01 (Cloudflare) — so the cert
# issues even before DNS is repointed.
#
# The wallet-web-brand ConfigMap (the Lux brand.json mounted at
# /public/brand.json) is generated by this overlay's configMapGenerator.
#
#   kubectl --context do-sfo3-lux-k8s apply -f fallback.yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wallet-web
  namespace: lux-mainnet
  labels:
    app: wallet-web
    component: web
    brand: lux
    app.kubernetes.io/part-of: wallet-web
spec:
  replicas: 2
  selector:
    matchLabels:
      app: wallet-web
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: wallet-web
        component: web
        brand: lux
        app.kubernetes.io/part-of: wallet-web
    spec:
      imagePullSecrets:
        - name: ghcr-luxfi
      containers:
        - name: web
          image: ghcr.io/luxfi/wallet-web:032e091d9
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 3000
          volumeMounts:
            - name: brand
              mountPath: /public/brand.json
              subPath: brand.json
              readOnly: true
          resources:
            requests:
              cpu: "50m"
              memory: "64Mi"
            limits:
              cpu: "250m"
              memory: "256Mi"
          livenessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 15
          readinessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
        - name: brand
          configMap:
            name: wallet-web-brand
---
apiVersion: v1
kind: Service
metadata:
  name: wallet-web
  namespace: lux-mainnet
  labels:
    app: wallet-web
    brand: lux
    app.kubernetes.io/part-of: wallet-web
spec:
  selector:
    app: wallet-web
  ports:
    - name: http
      port: 80
      targetPort: 3000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: wallet-web
  namespace: lux-mainnet
  labels:
    app: wallet-web
    brand: lux
    app.kubernetes.io/part-of: wallet-web
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: ingress
  rules:
    - host: wallet.lux.network
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: wallet-web
                port:
                  number: 80
  tls:
    - hosts:
        - wallet.lux.network
      secretName: wallet-web-tls