Skip to content

Commit a45ddd6

Browse files
JeromeBuJeromeBu
committed
feat: show case kube and helm config
1 parent 5fd8f91 commit a45ddd6

20 files changed

+587
-242
lines changed

‎README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@ Documentation is available [here](https://codegouvfr.github.io/catalogi/)
2121

2222
This monorepo is made of several directories:
2323

24-
- `api/`: Application API (also includes jobs, that can be run periodically)
25-
- `web/`: Web frontend
26-
- `docs/`: Documentation, as deployed [here](https://codegouvfr.github.io/catalogi/)
27-
- `deploy-examples/`: Deployment examples. For now only a Docker Compose example.
24+
- api: Application API (also includes jobs, that can be run periodically)
25+
- web: Web frontend
26+
- docs: Documentation, as deployed [here](https://codegouvfr.github.io/catalogi/)
27+
- deploy-examples: Examples of deployment, including [Docker Compose](deploy-examples/docker-compose) and [Kubernetes with Helm](docs/5-deploying-with-kubernetes.md).
2828

2929
## Governance and contributions
3030

‎deployment-examples/helm/ingress-api.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: catalogi-api
5+
namespace: catalogi
6+
annotations:
7+
nginx.ingress.kubernetes.io/rewrite-target: /$2
8+
nginx.ingress.kubernetes.io/enable-modsecurity: "false"
9+
nginx.ingress.kubernetes.io/enable-owasp-core-rules: "false"
10+
spec:
11+
ingressClassName: nginx
12+
rules:
13+
- host: catalogi.127.0.0.1.nip.io
14+
http:
15+
paths:
16+
- path: /api(/|$)(.*)
17+
pathType: ImplementationSpecific
18+
backend:
19+
service:
20+
name: catalogi-api
21+
port:
22+
number: 3000
23+
- host: localhost
24+
http:
25+
paths:
26+
- path: /api(/|$)(.*)
27+
pathType: ImplementationSpecific
28+
backend:
29+
service:
30+
name: catalogi-api
31+
port:
32+
number: 3000

‎deployment-examples/helm/ingress-web.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: catalogi-web
5+
namespace: catalogi
6+
annotations:
7+
nginx.ingress.kubernetes.io/enable-modsecurity: "false"
8+
nginx.ingress.kubernetes.io/enable-owasp-core-rules: "false"
9+
spec:
10+
ingressClassName: nginx
11+
rules:
12+
- host: catalogi.127.0.0.1.nip.io
13+
http:
14+
paths:
15+
- path: /
16+
pathType: Prefix
17+
backend:
18+
service:
19+
name: catalogi-web
20+
port:
21+
number: 80
22+
- host: localhost
23+
http:
24+
paths:
25+
- path: /
26+
pathType: Prefix
27+
backend:
28+
service:
29+
name: catalogi-web
30+
port:
31+
number: 80

‎deployment-examples/helm/values-local-dev.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
api:
2+
image:
3+
tag: "latest"
4+
pullPolicy: IfNotPresent
5+
env:
6+
OIDC_ISSUER_URI: "https://auth.code.gouv.fr/auth/realms/codegouv"
7+
OIDC_CLIENT_ID: "sill"
8+
9+
update:
10+
image:
11+
tag: "latest"
12+
pullPolicy: IfNotPresent
13+
14+
ingress:
15+
enabled: false
16+
17+
database:
18+
password: "change-this-in-production"
19+
20+
postgresql:
21+
enabled: true
22+
auth:
23+
postgresPassword: "postgres"
24+
username: "catalogi_user"
25+
password: "change-this-in-production"
26+
database: "catalogi_db"
27+
28+
# Web container configuration
29+
web:
30+
replicaCount: 1
31+
image:
32+
repository: codegouvfr/catalogi-web
33+
tag: "latest"
34+
pullPolicy: IfNotPresent
35+
customNginxConfig: |
36+
server {
37+
listen 8080;
38+
39+
gzip on;
40+
gzip_vary on;
41+
gzip_min_length 1024;
42+
gzip_proxied expired no-cache no-store private auth;
43+
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/javascript application/xml;
44+
gzip_disable "MSIE [1-6]\.";
45+
46+
# Add comprehensive CSP for Vite dynamic imports
47+
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://auth.code.gouv.fr; frame-src 'self' https://auth.code.gouv.fr; object-src 'none';" always;
48+
49+
root /usr/share/nginx/html;
50+
index index.html;
51+
52+
# Static assets with caching
53+
location ~* \.(js|css|woff2?|eot|ttf|xml|md)$ {
54+
try_files $uri =404;
55+
expires 1y;
56+
access_log off;
57+
add_header Cache-Control "public";
58+
}
59+
60+
# Images and other assets
61+
location ~* \.(png|jpg|jpeg|gif|ico|svg)$ {
62+
try_files $uri =404;
63+
expires 1y;
64+
add_header Cache-Control "public";
65+
}
66+
67+
# HTML, JSON, TXT files
68+
location ~* \.(html|json|txt)$ {
69+
try_files $uri =404;
70+
expires -1;
71+
}
72+
73+
# SPA fallback for everything else (routes)
74+
location / {
75+
try_files $uri $uri/ /index.html;
76+
}
77+
}

‎deployment-examples/helm/values-temp.yaml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Temporary local development configuration for testing
2+
web:
3+
image:
4+
tag: "latest"
5+
pullPolicy: IfNotPresent
6+
api:
7+
image:
8+
tag: "latest"
9+
pullPolicy: IfNotPresent
10+
env:
11+
OIDC_ISSUER_URI: "https://auth.code.gouv.fr/auth/realms/codegouv"
12+
OIDC_CLIENT_ID: "sill"
13+
update:
14+
image:
15+
tag: "latest"
16+
pullPolicy: IfNotPresent
17+
18+
ingress:
19+
enabled: true
20+
className: "nginx"
21+
annotations:
22+
nginx.ingress.kubernetes.io/rewrite-target: /$1
23+
nginx.ingress.kubernetes.io/enable-modsecurity: "false"
24+
nginx.ingress.kubernetes.io/enable-owasp-core-rules: "false"
25+
hosts:
26+
- host: catalogi-test.local
27+
paths:
28+
- path: /
29+
pathType: Prefix
30+
service:
31+
name: web
32+
port: 80
33+
- path: /api/(.*)
34+
pathType: ImplementationSpecific
35+
service:
36+
name: api
37+
port: 3000
38+
39+
database:
40+
password: "change-this-in-production"
41+
42+
postgresql:
43+
enabled: true
44+
auth:
45+
postgresPassword: "postgres"
46+
password: "catalogi123"
47+
48+
customization:
49+
enabled: false
50+
51+
# Custom nginx configuration for web container
52+
web:
53+
replicaCount: 1
54+
image:
55+
repository: codegouvfr/catalogi-web
56+
tag: "latest"
57+
pullPolicy: IfNotPresent
58+
customNginxConfig: |
59+
server {
60+
listen 8080;
61+
62+
gzip on;
63+
gzip_vary on;
64+
gzip_min_length 1024;
65+
gzip_proxied expired no-cache no-store private auth;
66+
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/javascript application/xml;
67+
gzip_disable "MSIE [1-6]\.";
68+
69+
add_header Content-Security-Policy "script-src 'self' 'unsafe-eval' 'unsafe-inline'; object-src 'none'; base-uri 'self';" always;
70+
71+
root /usr/share/nginx/html;
72+
index index.html;
73+
74+
try_files $uri $uri/ /index.html;
75+
76+
location ~ ^.+\..+$ {
77+
try_files $uri =404;
78+
79+
location ~* \.(?:html|json|txt)$ {
80+
expires -1;
81+
}
82+
83+
location ~* \.(?:css|js|woff2?|eot|ttf|xml|md)$ {
84+
expires 1y;
85+
access_log off;
86+
add_header Cache-Control "public";
87+
88+
location ~* \.(?:woff2?|eot|ttf|xml|md)$ {
89+
add_header Access-Control-Allow-Origin *;
90+
}
91+
}
92+
}
93+
}
94+
95+
# Override OIDC settings for local development
96+
oidc:
97+
issuerUri: "https://auth.code.gouv.fr/auth/realms/codegouv"
98+
clientId: "sill"

0 commit comments

Comments
 (0)