added production

adskyiproger · adskyiproger · commit 967af0ce5179 · 2025-11-11T07:25:08.000+02:00
diff --git a/.github/workflows/deploy-dependencies.yml b/.github/workflows/deploy-dependencies.yml
@@ -9,9 +9,11 @@ on:
         default: "dev"
         type: choice
         options:
+          - demo-test
           - demo1
           - demo4
           - development
+          - production
 jobs:
   approve:
     environment: ${{ inputs.environment }}
diff --git a/.github/workflows/deploy-opencrvs.yml b/.github/workflows/deploy-opencrvs.yml
@@ -25,9 +25,11 @@ on:
         default: "dev"
         type: choice
         options:
+          - demo-test
           - demo1
           - demo4
           - development
+          - production
 
 jobs:
   approve:
diff --git a/.github/workflows/github-to-k8s-sync-env.yml b/.github/workflows/github-to-k8s-sync-env.yml
@@ -9,9 +9,11 @@ on:
         default: "dev"
         type: choice
         options:
+          - demo-test
           - demo1
           - demo4
           - development
+          - production
       mapping_file:
         description: "Secrets mapping template"
         default: "opencrvs"
diff --git a/.github/workflows/k8s-reindex.yml b/.github/workflows/k8s-reindex.yml
@@ -9,9 +9,11 @@ on:
         default: "dev"
         type: choice
         options:
+          - demo-test
           - demo1
           - demo4
           - development
+          - production
   workflow_call:
     inputs:
       environment:
diff --git a/.github/workflows/k8s-reset-data.yml b/.github/workflows/k8s-reset-data.yml
@@ -9,9 +9,11 @@ on:
         default: "dev"
         type: choice
         options:
+          - demo-test
           - demo1
           - demo4
           - development
+          - production
   workflow_call:
     inputs:
       environment:
diff --git a/.github/workflows/k8s-seed-data.yml b/.github/workflows/k8s-seed-data.yml
@@ -9,9 +9,11 @@ on:
         default: "dev"
         type: choice
         options:
+          - demo-test
           - demo1
           - demo4
           - development
+          - production
   workflow_call:
     inputs:
       environment:
diff --git a/.github/workflows/provision.yml b/.github/workflows/provision.yml
@@ -9,8 +9,10 @@ on:
         default: 'dev'
         type: choice
         options:
+          - production
           - development
           - demo1
+          - demo-test
       tags:
         description: 'Tags to apply to the provisioned resources'
         required: true
diff --git a/.github/workflows/reset-2fa.yml b/.github/workflows/reset-2fa.yml
@@ -13,8 +13,10 @@ on:
         default: 
         required: true
         options:
+          - production
           - development
           - demo1
+          - demo-test
 
 jobs:
   approve:
diff --git a/environments/production/dependencies/values.yaml b/environments/production/dependencies/values.yaml
@@ -0,0 +1,31 @@
+storage_type: host_path
+
+environment_type: production
+
+ingress:
+  tls_resolver: letsencrypt
+
+minio:
+  use_default_credentials: false
+
+elasticsearch:
+  use_default_credentials: false
+
+mongodb:
+  use_default_credentials: false
+
+postgres:
+  use_default_credentials: false
+
+monitoring:
+  enabled: true
+
+elastalert:
+  env:
+    HTTP_POST2_ALERT_URL: http://countryconfig.opencrvs-production.svc.cluster.local:3040
+
+# Backup configuration
+backup:
+  enabled: true
+  schedule: "0 1 * * *"
+  backup_server_dir: /home/backup/production
diff --git a/environments/production/mosip-api/values.yaml b/environments/production/mosip-api/values.yaml
@@ -0,0 +1,2 @@
+ingress:
+  ssl_enabled: true
diff --git a/environments/production/opencrvs-services/values.yaml b/environments/production/opencrvs-services/values.yaml
@@ -0,0 +1,56 @@
+########################################################################################
+# Initial configuration file for OpenCRVS installation
+########################################################################################
+# Some properties are not defined in this file and should be provided as key/value at
+# installation time:
+# - hostname: valid DNS name for opencrvs
+# - countryconfig.image.name: Countryconfig image repository
+# - countryconfig.image.tag: Countryconfig image tag
+ingress:
+  tls_resolver: letsencrypt
+
+environment_type: production
+
+hpa:
+  enabled: false
+
+env:
+  APN_SERVICE_URL: "http://apm-server.opencrvs-deps-production.svc.cluster.local:8200"
+
+influxdb:
+  host: influxdb-0.influxdb.opencrvs-deps-production.svc.cluster.local
+elasticsearch:
+  auth_mode: auto
+  host: elasticsearch.opencrvs-deps-production.svc.cluster.local
+
+
+minio:
+  auth_mode: use_secret
+  host: minio-0.minio.opencrvs-deps-production.svc.cluster.local
+  external_hostname: minio.test-k8s.opencrvs.dev
+
+mongodb:
+  auth_mode: auto
+  host: mongodb-0.mongodb.opencrvs-deps-production.svc.cluster.local
+
+redis:
+  auth_mode: acl
+  host: redis-0.redis.opencrvs-deps-production.svc.cluster.local
+
+postgres:
+  auth_mode: auto
+  host: postgres-0.postgres.opencrvs-deps-production.svc.cluster.local
+
+imagePullSecrets:
+  # Default value for credentials created while yarn environment:init
+  - name: dockerhub-credentials
+
+countryconfig:
+  smtp-config:
+    - ALERT_EMAIL
+    - SENDER_EMAIL_ADDRESS
+    - SMTP_HOST
+    - SMTP_PASSWORD
+    - SMTP_PORT
+    - SMTP_SECURE
+    - SMTP_USERNAME
diff --git a/environments/production/traefik/values.yaml b/environments/production/traefik/values.yaml
@@ -0,0 +1,72 @@
+# Overwriting https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml
+namespaceOverride: "traefik"
+logs:
+  general:
+    # "TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL", "PANIC"
+    level: "INFO"
+    # format: "common" # For local environment
+    format: "json" # For server environment
+  access:
+    # -- To enable access logs
+    enabled: true
+    format: "json"
+
+ingressRoute:
+  dashboard:
+    enabled: false
+
+# Be explicit that we only use CRDs, not ingress/gw support
+providers: 
+  kubernetesCRD:
+    enabled: true
+  kubernetesIngress:
+    enabled: false
+  kubernetesGateway:
+    enabled: false
+
+service:
+  enabled: true
+  single: false
+  type: NodePort
+
+ports:
+  web:
+    port: 8000
+    hostPort: 80
+    protocol: TCP
+    nodePort: 30080
+  websecure:
+    port: 8443
+    nodePort: 30443
+    hostPort: 443
+    protocol: TCP
+
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      tlsChallenge: false
+      httpChallenge:
+        entryPoint: web
+      email: vadym@opencrvs.org
+      # Storage for certificates:
+      storage: /certificates/acme.json
+      # NOTE: Sometimes Let's Encrypt hit production SSL certificate issuing limits
+      #       If you are having issues, switch to staging
+      # Staging server
+      # caServer: https://acme-staging-v02.api.letsencrypt.org/directory
+      # Production server
+      caServer: https://acme-v02.api.letsencrypt.org/directory
+
+deployment:
+  hostNetwork: true
+  additionalVolumes:
+    - name: acme
+      hostPath:
+        path: /data/traefik
+
+additionalVolumeMounts:
+    - name: acme
+      mountPath: /certificates
+
+nodeSelector:
+  traefik-role: ingress
diff --git a/infrastructure/server-setup/inventory/production.yml b/infrastructure/server-setup/inventory/production.yml
@@ -0,0 +1,82 @@
+all:
+  vars:
+    # single_node:
+    # For development/qa/testing/staging keep true
+    # For production keep false
+    # Defaults production configuration:
+    # - master node
+    # - 2 worker nodes
+    single_node: false
+
+    # Domain/IP address for remote access to your cluster API
+    # Domain/IP address will be added as main endpoint to your ~/.kube/config
+    # - If you are behind VPN, use private IP address
+    # - If your server is exposed (not recommeded), use public IP address
+    # - If you would like to run kubectl commands from the remote server, leave this field empty
+    # kube_api_endpoint: ''
+
+    # IMPORTANT: If master VM has multiple ethernet interfaces, put private IP address at kube_api_address
+    # kube_api_host: 10.10.10.10
+    kube_api_host: tmp-prod.opencrvs.dev
+
+    # Default ansible provision user, keep as is
+    ansible_user: provision
+
+    # users: Add as many users as you wish
+    # Configuration example
+    # - name: <login>
+    #   ssh_keys:
+    #     - <public ssh key 1>
+    #     - <public ssh key 2>
+    #   state: present
+    #   role: admin
+    # Allowed roles:
+    # - operator, read only access to OS, full access to kubernetes cluster
+    # - admin, full access
+    # Allowed states:
+    # - present, user is allowed to login
+    # - absent, account is disabled
+    users:
+      - name: vmudryi
+        state: present
+        role: admin
+        ssh_keys:
+          - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINgMcsSBwTE0EbMDRSF1T4vJDcN/5HAjKGbi2DqV7g/Q vmudryi@opencrvs.org
+
+  children:
+    master:
+      hosts:
+        # Replace master with value returned by command: hostname 
+        master:
+          # Keep values (ansible_host, ansible_connection) as is
+          # Ansible is executed on master node
+          ansible_host: localhost
+          ansible_connection: local
+          labels:
+            # traefik-role label is used to identify where to deploy traefik
+            traefik-role: ingress
+
+    # Workers section is optional, for single node cluster feel free to remove this section
+    # section can be added later
+    # more workers can be added later as well
+
+    workers:
+      hosts:
+        worker0:
+          ansible_host: 10.2.0.5
+          labels:
+            # By default all datastores are deployed to worker node with role data1
+            role: data1
+
+        worker1:
+          ansible_host: 10.2.0.6
+
+
+
+    # backup section is optional, feel free to remove if backups are not enabled
+    # section can be added later
+
+    backup:
+      hosts:
+        backup1:
+          ansible_host: 10.2.0.3
