jasonwitty
7b084dbddd
Two self-hosted apps behind traefik, both keeping their state on the GlusterFS volume that is mounted on every node: - dashwise (home.wittyoneoff.com) is an all-in-one image running its web server, a bundled PocketBase and valkey side by side. Only port 3000 is published: the frontend resolves its backend as window.location.origin and every PocketBase call is made server-side, so 8090 stays inside the pod. It is on the service so the PocketBase admin UI can be reached with kubectl port-forward. - tududi (tududi.wittyoneoff.com) stores a SQLite database and user uploads. Both are VOLUMEs in the image, so both are backed by the claim -- as one volume mounted twice with subPath, because naming the same claim as two volume entries wedges kubelet, which is what happened with limesurvey. Both images are pinned to tags that publish an arm64 manifest. dashwise :latest and :stable are amd64 only and would not start on these nodes. Namespaces and secrets are applied out of band, as with the other apps. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
95 lines
3.0 KiB
YAML
95 lines
3.0 KiB
YAML
# Dashwise all-in-one: the container runs the web/API server (3000), a bundled
|
|
# PocketBase (8090) and valkey, all on localhost inside the pod.
|
|
#
|
|
# Only 3000 is exposed. The browser never talks to PocketBase directly -- the
|
|
# frontend resolves its backend as window.location.origin and every
|
|
# PocketBase call is made server-side -- so 8090 stays internal.
|
|
#
|
|
# NOTE: :latest and :stable are built for amd64 ONLY and will not run on this
|
|
# arm64 cluster. Use a tag that publishes an arm64 manifest.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: dashwise
|
|
namespace: dashwise
|
|
labels:
|
|
app.kubernetes.io/name: dashwise
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 3
|
|
strategy:
|
|
# the PV is ReadWriteOnce and PocketBase is a single-writer SQLite store,
|
|
# so the old pod has to go before the new one starts
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: dashwise
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: dashwise
|
|
spec:
|
|
containers:
|
|
- name: dashwise
|
|
image: andreasmolnardev/dashwise:v1.0-rc1
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: ENVIRONMENT
|
|
value: production
|
|
- name: INSTANCE_NAME
|
|
value: Witty One Off
|
|
- name: START_POCKETBASE
|
|
value: "true"
|
|
- name: PB_BINARY_PATH
|
|
value: /usr/local/bin/pocketbase
|
|
# in-pod addresses: the server talks to PocketBase over localhost
|
|
- name: PB_URL
|
|
value: http://127.0.0.1:8090
|
|
- name: NEXT_PUBLIC_PB_URL
|
|
value: http://127.0.0.1:8090
|
|
- name: APP_BASE_URL
|
|
value: https://home.wittyoneoff.com
|
|
- name: NEXT_PUBLIC_APP_URL
|
|
value: https://home.wittyoneoff.com
|
|
- name: PB_ADMIN_EMAIL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: dashwise
|
|
key: pb-admin-email
|
|
- name: PB_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: dashwise
|
|
key: pb-admin-password
|
|
- name: TZ
|
|
value: America/Los_Angeles
|
|
ports:
|
|
- name: http
|
|
containerPort: 3000
|
|
protocol: TCP
|
|
- name: pocketbase
|
|
containerPort: 8090
|
|
protocol: TCP
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: http
|
|
failureThreshold: 60
|
|
periodSeconds: 5
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
periodSeconds: 20
|
|
failureThreshold: 3
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /app/pocketbase/pb_data
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: dashwise
|