105 lines
2.4 KiB
YAML
105 lines
2.4 KiB
YAML
# Production profile — external data plane, registry images, HPA/PDB/NetworkPolicy, cert-manager.
|
|
# helm upgrade --install pargar ./deploy/helm/pargar -n pargar --create-namespace \
|
|
# -f deploy/helm/pargar/values-prod.yaml
|
|
#
|
|
# Prerequisites:
|
|
# - images pushed to src.panahifar.ir/ahp/{pargar-backend,pargar-frontend}:<tag>
|
|
# (by .gitea/workflows/build-and-push.yaml on a v* tag push)
|
|
# - Secret pargar-app (jwt-secret, admin-password, metrics-token, database-url, redis-url,
|
|
# storage-access-key, storage-secret-key)
|
|
# - cert-manager ClusterIssuer letsencrypt-prod
|
|
# - imagePullSecrets if the Gitea package registry visibility is private
|
|
|
|
global:
|
|
domain: app.example.com
|
|
publicUrl: https://app.example.com
|
|
frontendOrigins: "https://app.example.com"
|
|
imageRegistry: src.panahifar.ir/ahp
|
|
|
|
imagePullSecrets:
|
|
- name: gitea-pull
|
|
|
|
backend:
|
|
replicaCount: 2
|
|
image:
|
|
repository: pargar-backend
|
|
tag: "0.2.1"
|
|
pullPolicy: IfNotPresent
|
|
existingSecret: pargar-app
|
|
env:
|
|
devMode: "false"
|
|
seedCurriculum: "false"
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 1Gi
|
|
autoscaling:
|
|
enabled: true
|
|
minReplicas: 2
|
|
maxReplicas: 8
|
|
targetCPUUtilizationPercentage: 70
|
|
targetMemoryUtilizationPercentage: 80
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
minAvailable: 1
|
|
|
|
frontend:
|
|
replicaCount: 2
|
|
image:
|
|
repository: pargar-frontend
|
|
tag: "0.2.1"
|
|
pullPolicy: IfNotPresent
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 1Gi
|
|
autoscaling:
|
|
enabled: true
|
|
minReplicas: 2
|
|
maxReplicas: 8
|
|
targetCPUUtilizationPercentage: 70
|
|
targetMemoryUtilizationPercentage: 80
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
minAvailable: 1
|
|
|
|
# Prefer managed Postgres / Redis / object storage in real prod.
|
|
postgres:
|
|
enabled: false
|
|
redis:
|
|
enabled: false
|
|
rustfs:
|
|
enabled: false
|
|
|
|
external:
|
|
databaseUrl: "" # prefer secret key database-url on pargar-app
|
|
redisUrl: ""
|
|
storageEndpoint: "https://s3.example.com"
|
|
|
|
ingress:
|
|
enabled: true
|
|
useIngressRoute: true
|
|
tls:
|
|
enabled: true
|
|
existingSecret: "" # Certificate CR owns the secret below
|
|
clusterIssuer: letsencrypt-prod
|
|
|
|
certManager:
|
|
enabled: true
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
|
|
networkPolicy:
|
|
enabled: true
|
|
ingressNamespaces:
|
|
- kube-system
|
|
ingressPodLabels:
|
|
app.kubernetes.io/name: traefik
|