keyhan
22359be40e
Close billing, tenancy, migration, build, and CI/CD gaps identified in the audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with base schema, stateful service stability, safer Dockerfiles/git builds, and platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off). Co-authored-by: Cursor <cursoragent@cursor.com>
78 lines
2.3 KiB
YAML
78 lines
2.3 KiB
YAML
# Example production overrides for cloudhost-platform
|
|
# cp values-production.example.yaml values-production.yaml && edit secrets/hosts
|
|
|
|
namespace: cloudhost
|
|
createNamespace: true
|
|
|
|
global:
|
|
storageClass: local-path # k3s example
|
|
|
|
images:
|
|
# Mirror Docker Hub images through your private registry so cluster nodes
|
|
# never pull from docker.io directly (matches the kaniko/Harbor setup).
|
|
postgres: registry.example.com/mirror/postgres:16-alpine
|
|
redis: registry.example.com/mirror/redis:7-alpine
|
|
busybox: registry.example.com/mirror/busybox:1.36
|
|
backend:
|
|
repository: registry.example.com/cloudhost-backend
|
|
tag: "1.0.0"
|
|
pullPolicy: Always
|
|
frontend:
|
|
repository: registry.example.com/cloudhost-frontend
|
|
tag: "1.0.0"
|
|
pullPolicy: Always
|
|
|
|
postgres:
|
|
password: "CHANGE_ME_STRONG_POSTGRES_PASSWORD"
|
|
# Pull secret for the mirrored postgres image
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
|
|
redis:
|
|
# Auto-generated and persisted in the platform Secret when left empty.
|
|
password: ""
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
|
|
secrets:
|
|
jwtSecret: "CHANGE_ME_LONG_JWT_SECRET"
|
|
jwtRefreshSecret: "CHANGE_ME_LONG_REFRESH_SECRET"
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
frontend:
|
|
host: platform.example.com
|
|
api:
|
|
host: api.platform.example.com
|
|
tls:
|
|
enabled: true
|
|
clusterIssuer: letsencrypt-prod
|
|
|
|
backend:
|
|
# Enable after copying ceph-app-sources-credentials secret into the cloudhost namespace
|
|
sourceStorage:
|
|
enabled: false
|
|
existingSecret: ceph-app-sources-credentials
|
|
env:
|
|
PLATFORM_DOMAIN: apps.example.com
|
|
REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
|
|
REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
|
|
# Mirror prefix for base images in generated Dockerfiles + managed services
|
|
BASE_IMAGE_REGISTRY: registry.example.com/mirror
|
|
# Elastic log-stack credentials (must match the logging namespace Secret)
|
|
ELASTIC_PASSWORD: "CHANGE_ME_ELASTIC_PASSWORD"
|
|
FLUENTBIT_PASSWORD: "CHANGE_ME_FLUENTBIT_PASSWORD"
|
|
KIBANA_SYSTEM_PASSWORD: "CHANGE_ME_KIBANA_PASSWORD"
|
|
# Swagger stays off in production; set SWAGGER_ENABLED: "true" to expose it
|
|
|
|
migrations:
|
|
enabled: true
|
|
|
|
backups:
|
|
postgres:
|
|
enabled: true
|
|
schedule: "0 3 * * *"
|
|
storageSize: 10Gi
|
|
retentionDays: 7
|