keyhan
3d773a4a62
Build and Deploy Platform / build-and-deploy (push) Successful in 32m19s
Enable backend.sms in the chart so MizbanSMS credentials from the platform Secret are injected into the backend deployment for production OTP delivery. Co-authored-by: Cursor <cursoragent@cursor.com>
175 lines
4.9 KiB
YAML
175 lines
4.9 KiB
YAML
# ────────────────────────────────────────────────────────────
|
|
# CloudHost Platform — Helm values
|
|
# Deploy: helm upgrade --install cloudhost ./backend/helm/cloudhost-platform -n cloudhost --create-namespace
|
|
# ────────────────────────────────────────────────────────────
|
|
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
namespace: cloudhost
|
|
createNamespace: true
|
|
|
|
global:
|
|
storageClass: ""
|
|
|
|
# For clusters without direct docker.io access, point these at your mirror,
|
|
# e.g. registry.abrban.com/abrban/postgres:16-alpine, and set
|
|
# postgres.imagePullSecrets / redis.imagePullSecrets accordingly.
|
|
images:
|
|
postgres: postgres:16-alpine
|
|
redis: redis:7-alpine
|
|
busybox: busybox:1.36
|
|
backend:
|
|
repository: cloudhost-backend
|
|
tag: "1.0.0"
|
|
pullPolicy: IfNotPresent
|
|
frontend:
|
|
repository: cloudhost-frontend
|
|
tag: "1.0.0"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Kaniko job images — defaults pull from Harbor proxy-cache.
|
|
# Override any line for a different registry/tag.
|
|
build:
|
|
images:
|
|
kaniko: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
|
|
alpine: registry.abrban.com/proxy-dockerhub/library/alpine:3.19
|
|
alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
|
|
# Prefix for Docker Hub images in generated user-app Dockerfiles (node, php, …)
|
|
baseImageRegistry: registry.abrban.com/proxy-dockerhub/library
|
|
|
|
postgres:
|
|
enabled: true
|
|
database: cloudhost
|
|
username: cloudhost
|
|
# Leave empty to auto-generate on first install (stored in Secret)
|
|
password: ""
|
|
storage: 10Gi
|
|
# Needed when images.postgres points at a private mirror
|
|
imagePullSecrets: []
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
|
|
redis:
|
|
enabled: true
|
|
storage: 1Gi
|
|
# Leave empty to auto-generate on first install (stored in Secret as redis-password).
|
|
# With secrets.existingSecret, that Secret must also contain a redis-password key.
|
|
password: ""
|
|
# Needed when images.redis points at a private mirror
|
|
imagePullSecrets: []
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
backend:
|
|
enabled: true
|
|
replicas: 1
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
uploads:
|
|
size: 20Gi
|
|
sourceStorage:
|
|
enabled: false
|
|
existingSecret: ceph-app-sources-credentials
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
extraEnv: {}
|
|
# OTP SMS — credentials live in the platform Secret (mizbansms-username/password).
|
|
sms:
|
|
enabled: false
|
|
provider: mizbansms
|
|
from: "5000467254"
|
|
api: "2016"
|
|
userType: "2"
|
|
env:
|
|
NODE_ENV: production
|
|
PORT: "4000"
|
|
JWT_EXPIRES_IN: 15m
|
|
JWT_REFRESH_EXPIRES_IN: 7d
|
|
PLATFORM_DOMAIN: apps.cloudhost.local
|
|
REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
|
|
REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
|
|
BUILD_NAMESPACE: cloudhost-builds
|
|
BUILD_SERVICE_ACCOUNT: kaniko-builder
|
|
UPLOAD_DIR: /app/uploads
|
|
PLATFORM_CREATE_STORAGE_CLASS: "true"
|
|
PLATFORM_STORAGE_CLASS: cloudhost-expandable
|
|
PLATFORM_STORAGE_PROVISIONER: rancher.io/local-path
|
|
ELASTICSEARCH_HOST: elasticsearch.logging.svc.cluster.local
|
|
ELASTICSEARCH_AUTO_PORT_FORWARD: "false"
|
|
|
|
frontend:
|
|
enabled: true
|
|
replicas: 1
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
|
|
# JWT secrets — set in production (values-production.example.yaml)
|
|
secrets:
|
|
# Use a pre-created Secret instead of chart-managed one. Required for GitOps
|
|
# (Argo CD renders with `helm template`, so lookup/randAlphaNum regenerate on
|
|
# every sync). Secret must contain keys: postgres-password, jwt-secret,
|
|
# jwt-refresh-secret, cluster-kubeconfig-key, redis-password, elastic-password.
|
|
existingSecret: ""
|
|
jwtSecret: ""
|
|
jwtRefreshSecret: ""
|
|
# AES key for encrypting stored kubeconfigs (64 hex chars or any passphrase)
|
|
clusterKubeconfigKey: ""
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
frontend:
|
|
host: platform.cloudhost.local
|
|
# Optional dedicated host for the authenticated panel. Empty = disabled
|
|
# (single-origin, dev). Production (abrban): panel.abrban.com
|
|
panel:
|
|
host: ""
|
|
api:
|
|
host: api.cloudhost.local
|
|
singleHost:
|
|
enabled: false
|
|
host: platform.cloudhost.local
|
|
apiPath: /api
|
|
annotations: {}
|
|
tls:
|
|
enabled: true
|
|
clusterIssuer: letsencrypt-prod
|
|
secretName: ""
|
|
|
|
migrations:
|
|
enabled: true
|
|
image: postgres:16-alpine
|
|
|
|
monitoring:
|
|
enabled: false
|
|
|
|
backups:
|
|
postgres:
|
|
enabled: true
|
|
schedule: "0 3 * * *"
|
|
storageSize: 10Gi
|
|
retentionDays: 7
|