v2

2026-10-19 12:51:18 -04:00
parent 1bbb5b9898
commit 321f7d8c00
22 changed files with 922 additions and 302 deletions
@@ -0,0 +1,110 @@
+# SPDX-License-Identifier: MIT-0
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ wikideck_name | to_json }}
+  namespace: {{ wikideck_namespace | to_json }}
+  labels:
+    app.kubernetes.io/name: wikideck
+    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    app.kubernetes.io/managed-by: ansible
+spec:
+  # Never expose replicas as a variable: chain.json has no multi-writer locking.
+  replicas: 1
+  strategy:
+    type: Recreate
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: wikideck
+      app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: wikideck
+        app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    spec:
+      serviceAccountName: {{ wikideck_name | to_json }}
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+{% if wikideck_image_pull_secrets | length > 0 %}
+      imagePullSecrets:
+{% for secret in wikideck_image_pull_secrets %}
+        - name: {{ secret | to_json }}
+{% endfor %}
+{% endif %}
+      nodeSelector: {{ wikideck_node_selector | to_json }}
+      tolerations: {{ wikideck_tolerations | to_json }}
+      affinity: {{ wikideck_affinity | to_json }}
+      containers:
+        - name: wikideck
+          image: {{ wikideck_image | to_json }}
+          imagePullPolicy: {{ wikideck_image_pull_policy | to_json }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: [ALL]
+          ports:
+            - name: http
+              containerPort: 3001
+              protocol: TCP
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: HOST
+              value: "0.0.0.0"
+            - name: PORT
+              value: "3001"
+            - name: WIKIDECK_DATA_DIR
+              value: /app/data
+            - name: WIKIDECK_OFFLINE
+              value: {{ ('1' if wikideck_offline else '0') | to_json }}
+{% if wikideck_public_origin | length > 0 %}
+            - name: PUBLIC_ORIGIN
+              value: {{ wikideck_public_origin | to_json }}
+{% endif %}
+          resources: {{ wikideck_resources | to_json }}
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 60
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ (wikideck_existing_claim if wikideck_existing_claim | length > 0 else wikideck_name ~ '-data') | to_json }}
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 32Mi