neiam /diogramos

apiVersion: v1
kind: Namespace
metadata:
  name: diogramos
---
# RBAC for libcluster's Kubernetes strategy. The ServiceAccount on the
# pod gets read-only access to its own namespace's pods so it can
# discover peer node IPs.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: diogramos
  namespace: diogramos
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: diogramos-pod-reader
  namespace: diogramos
rules:
  - apiGroups: [""]
    resources: ["pods", "endpoints"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: diogramos-pod-reader
  namespace: diogramos
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: diogramos-pod-reader
subjects:
  - kind: ServiceAccount
    name: diogramos
    namespace: diogramos
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: diogramos
  namespace: diogramos
  labels:
    name: diogramos
    keel.sh/policy: force
    keel.sh/trigger: poll
spec:
  replicas: 2
  selector:
    matchLabels:
      name: diogramos
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        name: diogramos
    spec:
      serviceAccountName: diogramos
      containers:
        - image: r.g.gmp.io/neiam/diogramos:latest
          imagePullPolicy: Always
          name: diogramos
          ports:
            - containerPort: 4000
          env:
            - name: PHX_HOST
              value: diogramos.neiam.co
            - name: PORT
              value: "4000"
            - name: PHX_SERVER
              value: "true"
            - name: POOL_SIZE
              value: "10"

            # Cluster glue: every pod becomes diogramos@<pod-ip>.
            # libcluster (Cluster.Strategy.Kubernetes) discovers peers
            # via the K8s API (RBAC defined above) and Horde rides on
            # top to keep the Authority registry coherent.
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: RELEASE_COOKIE
              valueFrom:
                secretKeyRef:
                  name: elixir-args
                  key: erlang_cookie

            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: elixir-args
                  key: secret_key_base

            - name: SENTRY_DSN
              valueFrom:
                secretKeyRef:
                  name: elixir-args
                  key: sentry_dsn
                  optional: true

            # Postgres creds come from the StackGres-managed auth secret
            # (named after the SGCluster in pg.yml). runtime.exs reads
            # these directly — no URL composition — so passwords with
            # special characters don't get mangled by URL parsing.
            - name: POSTGRES_HOST
              value: postgres
            - name: POSTGRES_PORT
              value: "5432"
            - name: POSTGRES_DB
              value: diogramos
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: postgres
                  key: superuser-username
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres
                  key: superuser-password
          readinessProbe:
            httpGet:
              path: /
              port: 4000
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /
              port: 4000
            initialDelaySeconds: 30
            periodSeconds: 30
      imagePullSecrets:
        - name: gitlabgmp
---
apiVersion: v1
kind: Service
metadata:
  name: diogramos-svc
  namespace: diogramos
spec:
  ports:
    - port: 80
      targetPort: 4000
      protocol: TCP
  selector:
    name: diogramos
---
# Headless service so dns_cluster can resolve all pod IPs for clustering.
# Pods discover siblings via SRV/A records on this name; epmd-less long-
# name distribution does the actual node connection.
apiVersion: v1
kind: Service
metadata:
  name: diogramos-headless
  namespace: diogramos
spec:
  clusterIP: None
  publishNotReadyAddresses: true
  ports:
    - port: 4000
      targetPort: 4000
      protocol: TCP
      name: http
  selector:
    name: diogramos
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-https
  namespace: diogramos
spec:
  redirectScheme:
    scheme: https
    permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: diogramos-ingress
  namespace: diogramos
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: "traefik"
    # Listen on both Traefik entrypoints. The middleware below redirects
    # http → https for the `web` (port 80) entrypoint, so the app itself
    # never has to issue a 301 (which broke the LiveView WS handshake).
    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
    traefik.ingress.kubernetes.io/router.middlewares: diogramos-redirect-https@kubernetescrd
spec:
  tls:
    - hosts:
        - diogramos.neiam.co
      secretName: diogramos-tls
  rules:
    - host: diogramos.neiam.co
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: diogramos-svc
                port:
                  number: 80