forked from sagnik/Velocity-OS
159 lines
4.1 KiB
YAML
159 lines
4.1 KiB
YAML
# ============================================================
|
|
# Velocity-OS — K3s Traefik Ingress
|
|
# Domain: velocity.local | TLS: self-signed via cert-manager
|
|
# ============================================================
|
|
|
|
# ── cert-manager ClusterIssuer (self-signed for velocity.local) ──
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: velocity-selfsigned-issuer
|
|
spec:
|
|
selfSigned: {}
|
|
|
|
---
|
|
# Self-signed CA Certificate
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: velocity-local-ca
|
|
namespace: velocity-infra
|
|
spec:
|
|
isCA: true
|
|
commonName: velocity-local-ca
|
|
secretName: velocity-local-ca-secret
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
issuerRef:
|
|
name: velocity-selfsigned-issuer
|
|
kind: ClusterIssuer
|
|
group: cert-manager.io
|
|
|
|
---
|
|
# CA-backed ClusterIssuer for velocity.local
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: velocity-ca-issuer
|
|
spec:
|
|
ca:
|
|
secretName: velocity-local-ca-secret
|
|
|
|
---
|
|
# TLS Certificate for velocity.local
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: velocity-local-tls
|
|
namespace: velocity-os
|
|
spec:
|
|
secretName: velocity-local-tls-secret
|
|
duration: 8760h # 1 year
|
|
renewBefore: 720h # renew 30 days before expiry
|
|
subject:
|
|
organizations: [Desineuron]
|
|
commonName: velocity.local
|
|
dnsNames:
|
|
- velocity.local
|
|
- "*.velocity.local"
|
|
issuerRef:
|
|
name: velocity-ca-issuer
|
|
kind: ClusterIssuer
|
|
group: cert-manager.io
|
|
|
|
---
|
|
# ── Main Ingress ─────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: velocity-os-ingress
|
|
namespace: velocity-os
|
|
annotations:
|
|
# Traefik (K3s built-in)
|
|
kubernetes.io/ingress.class: traefik
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
# WebSocket support (Sentinel, Oracle canvas, Catalyst)
|
|
traefik.ingress.kubernetes.io/router.middlewares: velocity-os-ws-headers@kubernetescrd
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- velocity.local
|
|
secretName: velocity-local-tls-secret
|
|
rules:
|
|
- host: velocity.local
|
|
http:
|
|
paths:
|
|
# API (FastAPI backend)
|
|
- path: /api
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: core-api
|
|
port:
|
|
number: 8443
|
|
# WebSockets (must route before generic /api catch)
|
|
- path: /ws
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: core-api
|
|
port:
|
|
number: 8443
|
|
# Dream Weaver gateway
|
|
- path: /dream-weaver
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: media-engine
|
|
port:
|
|
number: 8290
|
|
# Vault public links (no auth)
|
|
- path: /vault
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: core-api
|
|
port:
|
|
number: 8443
|
|
# WebOS (React SPA — catch-all last)
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: webos
|
|
port:
|
|
number: 80
|
|
|
|
---
|
|
# ── Traefik Middleware: WebSocket upgrade headers ─────────────
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: ws-headers
|
|
namespace: velocity-os
|
|
spec:
|
|
headers:
|
|
customRequestHeaders:
|
|
Connection: "Upgrade"
|
|
Upgrade: "websocket"
|
|
|
|
---
|
|
# ── Traefik Middleware: Security headers ─────────────────────
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-headers
|
|
namespace: velocity-os
|
|
spec:
|
|
headers:
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
forceSTSHeader: true
|
|
contentTypeNosniff: true
|
|
browserXssFilter: true
|
|
referrerPolicy: strict-origin-when-cross-origin
|
|
frameDeny: true
|