macanhhuy
d6dddbbc91
Build + push image / build-and-push (push) Successful in 1m8s
Replace eu.gcr.io/vnc-development image refs with gitea.saas.vnc.biz/vnciac, swap gcr-json-key pull secret for gitea-registry, and update CI/deploy docs from GitLab CI to Gitea Actions.
157 lines
5.0 KiB
YAML
157 lines
5.0 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: prosody
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: prosody
|
|
project: default
|
|
source:
|
|
# example for a Helm chart from a Git repository
|
|
path: charts/prosody
|
|
repoURL: https://gitea.saas.vnc.biz/VNC/vnctalk-prosody.git
|
|
targetRevision: HEAD
|
|
helm:
|
|
parameters:
|
|
- name: nameOverride
|
|
value: "prosody"
|
|
values: |
|
|
imagePullSecrets:
|
|
- name: gitea-registry
|
|
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
|
|
image:
|
|
repository: gitea.saas.vnc.biz/vnciac/vnctalk-prosody
|
|
pullPolicy: IfNotPresent
|
|
# Overrides the image tag whose default is the chart appVersion.
|
|
tag: release-13.0.6-vnc
|
|
tlsUpdates:
|
|
enabled: true
|
|
secretName: prosody-tls
|
|
ingress:
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: lets-encrypt
|
|
kubernetes.io/tls-acme: "true"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "900"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: 100m
|
|
kubernetes.io/ingress.class: "public"
|
|
enabled: true
|
|
hosts:
|
|
- host: "xmpp.example.com"
|
|
paths: ["/xmpp-websocket"]
|
|
pathType: ImplementationSpecific
|
|
service:
|
|
name: http
|
|
port:
|
|
number: 5280
|
|
- host: "example.com"
|
|
paths: ["/"]
|
|
pathType: ImplementationSpecific
|
|
service:
|
|
name: web2
|
|
port:
|
|
number: 8080
|
|
- host: "conference.example.com"
|
|
paths: ["/"]
|
|
pathType: ImplementationSpecific
|
|
service:
|
|
name: web2
|
|
port:
|
|
number: 8080
|
|
tls:
|
|
- hosts:
|
|
- "xmpp.example.com"
|
|
- "example.com"
|
|
- "conference.example.com"
|
|
secretName: prosody-tls
|
|
|
|
ingress_additional_host:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: lets-encrypt
|
|
kubernetes.io/tls-acme: "true"
|
|
kubernetes.io/ingress.class: "public"
|
|
nginx.ingress.kubernetes.io/auth-type: basic
|
|
nginx.ingress.kubernetes.io/auth-secret: prosody-basic-auth
|
|
nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required'
|
|
nginx.ingress.kubernetes.io/upstream-vhost: "example.com"
|
|
host: "xmpprest.example.com"
|
|
hosts:
|
|
- host: "xmpprest.example.com"
|
|
paths: ["/rest"]
|
|
pathType: ImplementationSpecific
|
|
service:
|
|
name: http
|
|
port:
|
|
number: 5280
|
|
tls:
|
|
- hosts:
|
|
- "xmpprest.example.com"
|
|
secretName: prosody-tls-rest
|
|
|
|
|
|
autoscaling:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
# Dedicated resource requests and limits per container. The prosody
|
|
# (XMPP) container carries the real workload; the sidecar only serves
|
|
# a small static redirect/status page, so it gets a tiny slice.
|
|
resourcesProsody:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
resourcesSidecar:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
|
|
env:
|
|
PROSODY_DEBUG: false
|
|
prosodyDBhost: 10.20.20.115
|
|
prosodyDBname: prosody
|
|
prosodyDBuser: prosody
|
|
prosodyDBport: 5432
|
|
prosodyDomain: example.com
|
|
hybridaAuthUrl: "http://api.hybridauth.svc.cluster.local:80/"
|
|
fcm_api_url: "http://vnctalk-notificationproxy.vnctalk.svc.cluster.local:3898/notify"
|
|
del_api_url: "http://vnctalk-notificationproxy.vnctalk.svc.cluster.local:3898/delete"
|
|
fileShareBaseUrl: "https://vnc-fileshare.example.com/share.php/"
|
|
avatarUploadUrl: "https://avatar.vnc.biz/avatarupload/"
|
|
avatarUploadUser: avatar
|
|
log_slow_events_threshold: 2.0
|
|
secretTestName: prosody-tls
|
|
|
|
# Sensitive credentials mounted from a pre-provisioned Secret
|
|
# (prosody-secrets). Provision out-of-band, e.g.:
|
|
# kubectl create secret generic prosody-secrets -n prosody \
|
|
# --from-literal=prosodyDBpass=... \
|
|
# --from-literal=fcmApiKey=... \
|
|
# --from-literal=fileShareSecret=... \
|
|
# --from-literal=avatarUploadPass=...
|
|
secretEnv:
|
|
existingSecret: prosody-secrets
|
|
keys:
|
|
prosodyDBpass: prosodyDBpass
|
|
fcmApiKey: fcmApiKey
|
|
fileShareSecret: fileShareSecret
|
|
avatarUploadPass: avatarUploadPass
|
|
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|