Add cloudhost-platform Helm chart and registry ingress manifests.

Deploy backend, frontend, PostgreSQL, and Redis on Kubernetes with optional Ingress/TLS, SQL migration hooks, and public registry exposure at repo.3fase.ir. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-24 19:01:05 +03:30
parent abbe821d91
commit bf9e827f85
50 changed files with 1649 additions and 2 deletions
@@ -0,0 +1,40 @@
+-- Temporary external access grants (Redis, RabbitMQ, database)
+CREATE TYPE service_access_target AS ENUM (
+  'database',
+  'redis',
+  'rabbitmq_amqp',
+  'rabbitmq_management'
+);
+
+CREATE TYPE service_access_grant_status AS ENUM (
+  'active',
+  'expired',
+  'revoked'
+);
+
+CREATE TABLE IF NOT EXISTS service_access_grants (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  "applicationId" UUID NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+  "userId" UUID NOT NULL,
+  "clusterId" UUID NOT NULL,
+  namespace VARCHAR(255) NOT NULL,
+  target service_access_target NOT NULL,
+  "nodePort" INTEGER NOT NULL,
+  "targetPort" INTEGER NOT NULL,
+  host VARCHAR(255) NOT NULL,
+  "k8sServiceName" VARCHAR(255) NOT NULL,
+  status service_access_grant_status NOT NULL DEFAULT 'active',
+  "expiresAt" TIMESTAMPTZ NOT NULL,
+  "createdAt" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_service_access_grants_app_target_status
+  ON service_access_grants ("applicationId", target, status);
+
+INSERT INTO platform_settings (id, key, value, description, "createdAt", "updatedAt")
+SELECT gen_random_uuid(), 'access_max_duration_minutes', '240',
+  'Maximum duration (minutes) for temporary external service access',
+  NOW(), NOW()
+WHERE NOT EXISTS (
+  SELECT 1 FROM platform_settings WHERE key = 'access_max_duration_minutes'
+);