AI overhaul

2026-10-23 12:49:53 -04:00
parent b040ca26c3
commit b4db1a0182
21 changed files with 1226 additions and 189 deletions
@@ -0,0 +1,172 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: data
+  namespace: {{ www_namespace }}
+spec:
+  accessModes: [ReadWriteMany]
+  resources:
+    requests:
+      storage: {{ www_archive_storage_size }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: httpd
+  namespace: {{ www_namespace }}
+data:
+  httpd.conf: {{ lookup('ansible.builtin.file', role_path ~ '/files/httpd.conf') | to_json }}
+  membership.conf: {{ _www_proxy_config | to_json }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: httpd
+  namespace: {{ www_namespace }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: httpd
+  template:
+    metadata:
+      labels:
+        app: httpd
+      annotations:
+        www/config-revision: {{ (lookup('ansible.builtin.file', role_path ~ '/files/httpd.conf') ~ _www_proxy_config ~ www_rollout_revision ~ www_repo_url ~ www_repo_version) | hash('sha256') | to_json }}
+    spec:
+      automountServiceAccountToken: false
+{% if www_image_pull_secrets | length %}
+      imagePullSecrets:
+{{ www_image_pull_secrets | to_nice_yaml | indent(8, true) }}
+{% endif %}
+      initContainers:
+        - name: init
+          image: {{ www_source_image | to_json }}
+          command:
+            - /bin/bash
+            - -ec
+            - |
+              apt-get update
+              apt-get install --no-install-recommends -y git ca-certificates
+              git clone --depth 1 -- "$WWW_REPO_URL" /tmp/www
+              git -C /tmp/www fetch --depth 1 origin "$WWW_REPO_VERSION"
+              git -C /tmp/www checkout --detach FETCH_HEAD
+              # Never delete /data: it contains persistent archives, not just
+              # this repository's static site. Copy hidden site assets too.
+              cp -a /tmp/www/htdocs/. /data/
+          env:
+            - name: WWW_REPO_URL
+              value: {{ www_repo_url | to_json }}
+            - name: WWW_REPO_VERSION
+              value: {{ www_repo_version | to_json }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: httpd
+          image: {{ www_httpd_image | to_json }}
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 80
+            - name: metrics
+              containerPort: 9117
+          readinessProbe:
+            tcpSocket: {port: http}
+          volumeMounts:
+            - name: data
+              mountPath: /usr/local/apache2/htdocs
+            - name: httpd
+              mountPath: /usr/local/apache2/conf/httpd.conf
+              subPath: httpd.conf
+              readOnly: true
+            - name: httpd
+              mountPath: /usr/local/apache2/conf/extra/membership.conf
+              subPath: membership.conf
+              readOnly: true
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: data
+        - name: httpd
+          configMap:
+            name: httpd
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: prometheus
+  namespace: {{ www_namespace }}
+spec:
+  type: ClusterIP
+  selector:
+    app: httpd
+  ports:
+    - name: http
+      port: 9117
+      targetPort: metrics
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: httpd
+  namespace: {{ www_namespace }}
+spec:
+  type: ClusterIP
+  selector:
+    app: httpd
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+{% if www_onion_enabled %}
+---
+apiVersion: tor.k8s.torproject.org/v1alpha2
+kind: OnionService
+metadata:
+  name: httpd
+  namespace: {{ www_namespace }}
+spec:
+  version: 3
+  rules:
+    - port:
+        number: 80
+      backend:
+        service:
+          name: httpd
+          port:
+            number: 80
+{% endif %}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: www
+  namespace: {{ www_namespace }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ www_cluster_issuer | to_json }}
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    # Redact email verification tokens and OIDC codes at the edge, not only in
+    # Apache/Gunicorn. Do not enable request-body/error tracing for /members/.
+    nginx.ingress.kubernetes.io/enable-access-log: "false"
+    nginx.ingress.kubernetes.io/proxy-body-size: "256k"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
+spec:
+  ingressClassName: {{ www_ingress_class }}
+  rules:
+    - host: {{ www_hostname }}
+      http:
+        paths:
+          - pathType: Prefix
+            path: /
+            backend:
+              service:
+                name: httpd
+                port:
+                  number: 80
+  tls:
+    - hosts: [{{ www_hostname }}]
+      secretName: www