Add cloudhost-platform Helm chart and registry ingress manifests.

Deploy backend, frontend, PostgreSQL, and Redis on Kubernetes with optional Ingress/TLS, SQL migration hooks, and public registry exposure at repo.3fase.ir.

Co-authored-by: Cursor <cursoragent@cursor.com>

k8s/registry-ingress/cluster-issuer.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: admin@3fase.ir
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik

k8s/registry-ingress/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: registry-public
+  namespace: cloudhost-builds
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/service.serverstransport: cloudhost-builds-registry-transport@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - repo.3fase.ir
+      secretName: repo-3fase-ir-tls
+  rules:
+    - host: repo.3fase.ir
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: registry
+                port:
+                  number: 5000

k8s/registry-ingress/registry-proxy-env.yaml

@@ -0,0 +1,22 @@
+# Patch registry Deployment for reverse-proxy (Traefik + HTTPS)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: registry
+  namespace: cloudhost-builds
+spec:
+  template:
+    spec:
+      containers:
+        - name: registry
+          env:
+            - name: REGISTRY_STORAGE_DELETE_ENABLED
+              value: "true"
+            - name: REGISTRY_HTTP_RELATIVEURLS
+              value: "true"
+            - name: REGISTRY_HTTP_HEADERS_Access-Control-Allow-Origin
+              value: '["*"]'
+            - name: REGISTRY_HTTP_HEADERS_Access-Control-Allow-Methods
+              value: '["HEAD","GET","OPTIONS","DELETE"]'
+            - name: REGISTRY_HTTP_HEADERS_Access-Control-Allow-Headers
+              value: '["Authorization","Accept","Cache-Control"]'

k8s/registry-ingress/traefik-middleware.yaml

@@ -0,0 +1,23 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: registry-transport
+  namespace: cloudhost-builds
+spec:
+  forwardingTimeouts:
+    dialTimeout: 30s
+    responseHeaderTimeout: 600s
+    idleConnTimeout: 600s
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: registry-buffering
+  namespace: cloudhost-builds
+spec:
+  buffering:
+    maxRequestBodyBytes: 0
+    memRequestBodyBytes: 20971520
+    maxResponseBodyBytes: 0
+    memResponseBodyBytes: 20971520
+    retryExpression: "IsNetworkError() && Attempts() < 2"

k8s/registry-ingress/traefik-timeout-values.yaml

@@ -0,0 +1,14 @@
+# Merge with existing traefik helm values (helm upgrade traefik -f traefik-timeout-values.yaml)
+ports:
+  web:
+    transport:
+      respondingTimeouts:
+        readTimeout: "0s"
+        writeTimeout: "0s"
+        idleTimeout: "1800s"
+  websecure:
+    transport:
+      respondingTimeouts:
+        readTimeout: "0s"
+        writeTimeout: "0s"
+        idleTimeout: "1800s"