Initial commit

2026-10-24 18:46:35 -04:00
commit 8b74548a4c
24 changed files with 1276 additions and 0 deletions
@@ -0,0 +1,110 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ luanti_wasm_name | to_json }}
+  namespace: {{ luanti_wasm_namespace | to_json }}
+spec:
+  replicas: {{ luanti_wasm_replicas }}
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: {{ luanti_wasm_name | to_json }}
+  template:
+    metadata:
+      labels:
+        app: {{ luanti_wasm_name | to_json }}
+      annotations:
+        checksum/config: {{ lookup('ansible.builtin.template', 'configmap.yml.j2') | hash('sha256') | to_json }}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        fsGroup: 101
+        seccompProfile:
+          type: RuntimeDefault
+      imagePullSecrets: {{ luanti_wasm_image_pull_secrets | to_json }}
+      nodeSelector: {{ luanti_wasm_node_selector | to_json }}
+      tolerations: {{ luanti_wasm_tolerations | to_json }}
+      containers:
+        - name: web
+          image: {{ luanti_wasm_web_image | to_json }}
+          imagePullPolicy: {{ luanti_wasm_image_pull_policy | to_json }}
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 101
+            runAsGroup: 101
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 2
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 20
+          resources: {{ luanti_wasm_web_resources | to_json }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+        - name: proxy
+          image: {{ luanti_wasm_proxy_image | to_json }}
+          imagePullPolicy: {{ luanti_wasm_image_pull_policy | to_json }}
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          ports:
+            - name: proxy
+              containerPort: 7777
+              protocol: TCP
+          startupProbe:
+            tcpSocket:
+              port: proxy
+            periodSeconds: 2
+            failureThreshold: 30
+          readinessProbe:
+            tcpSocket:
+              port: proxy
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: proxy
+            periodSeconds: 20
+          resources: {{ luanti_wasm_proxy_resources | to_json }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/lwproxy.toml
+              subPath: lwproxy.toml
+              readOnly: true
+      volumes:
+        - name: config
+          configMap:
+            name: {{ (luanti_wasm_name ~ '-config') | to_json }}
+            defaultMode: 0444
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: {{ luanti_wasm_tmp_size_limit | to_json }}