p2p

templates/deployment.yml.j2

@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/instance: {{ wikideck_name | to_json }}
     app.kubernetes.io/managed-by: ansible
 spec:
-  # Never expose replicas as a variable: chain.json has no multi-writer locking.
+  # One validator per ledger/PVC. Other validators need separate role instances.
   replicas: 1
   strategy:
     type: Recreate
@@ -67,8 +67,10 @@ spec:
               value: "3001"
             - name: WIKIDECK_DATA_DIR
               value: /app/data
-            - name: WIKIDECK_OFFLINE
-              value: {{ ('1' if wikideck_offline else '0') | to_json }}
+            - name: WIKIDECK_PEERS
+              value: {{ (wikideck_peers | join(',')) | to_json }}
+            - name: WIKIDECK_ALLOW_PRIVATE_PEERS
+              value: {{ ('1' if wikideck_allow_private_peers else '0') | to_json }}
 {% if wikideck_public_origin | length > 0 %}
             - name: PUBLIC_ORIGIN
               value: {{ wikideck_public_origin | to_json }}
@@ -80,7 +82,7 @@ spec:
               port: http
             periodSeconds: 5
             timeoutSeconds: 5
-            failureThreshold: 60
+            failureThreshold: {{ wikideck_startup_probe_failure_threshold | int }}
           readinessProbe:
             httpGet:
               path: /healthz

templates/networkpolicy.yml.j2

@@ -23,7 +23,8 @@ spec:
 {% else %}
   ingress: []
 {% endif %}
-{% if wikideck_network_policy_dns_to | length == 0 and (wikideck_offline or wikideck_network_policy_https_to | length == 0) %}
+{% set public_egress = wikideck_peers | length > 0 and wikideck_network_policy_https_to | length > 0 and wikideck_network_policy_https_ports | length > 0 %}
+{% if wikideck_network_policy_dns_to | length == 0 and not public_egress and (wikideck_peers | length == 0 or wikideck_network_policy_peer_egress | length == 0) %}
   egress: []
 {% else %}
   egress:
@@ -35,10 +36,17 @@ spec:
         - protocol: TCP
           port: 53
 {% endif %}
-{% if not wikideck_offline and wikideck_network_policy_https_to | length > 0 %}
+{% if public_egress %}
     - to: {{ wikideck_network_policy_https_to | to_json }}
       ports:
+{% for port in wikideck_network_policy_https_ports %}
         - protocol: TCP
-          port: 443
+          port: {{ port | int }}
+{% endfor %}
+{% endif %}
+{% if wikideck_peers | length > 0 %}
+{% for rule in wikideck_network_policy_peer_egress %}
+    - {{ rule | to_json }}
+{% endfor %}
 {% endif %}
 {% endif %}