neiam /oh-my-ex-oh-ircd

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ircd
  namespace: neiam-ircd
  labels:
    name: ircd
    keel.sh/policy: force
    keel.sh/trigger: poll
spec:
  replicas: 3
  selector:
    matchLabels:
      app: ircd
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels:
        app: ircd
    spec:
      serviceAccountName: ircd
      terminationGracePeriodSeconds: 30
      containers:
        - name: ircd
          image: r.g.gmp.io/neiam/ohmyxo:kubernetes-master
          imagePullPolicy: Always
          ports:
            - { name: http, containerPort: 4000 }
            - { name: irc,  containerPort: 6667 }
            - { name: ircs, containerPort: 6697 }
            - { name: epmd, containerPort: 4369 }
            - { name: dist, containerPort: 9100 }
          env:
            # Phoenix bring-up
            - { name: PHX_SERVER, value: "true" }
            - { name: PHX_HOST,   value: "irc.skyjeep.club" }
            - { name: PORT,       value: "4000" }

            # IRC config
            - { name: IRC_PORT,            value: "6667" }
            - { name: IRC_SERVER_NAME,     value: "irc.skyjeep.club" }
            - { name: IRC_NETWORK_NAME,    value: "SkyjeepIRC" }
            # Defaults in runtime.exs: anonymous IRC ON, web registration
            # invite-only. Uncomment to override:
            # - { name: IRC_ALLOW_ANONYMOUS, value: "false" }
            # - { name: REGISTRATION_MODE,   value: "open" }

            # TLS — cert files come from the cert-manager Secret below.
            - { name: IRC_TLS_ENABLED,    value: "true" }
            - { name: IRC_TLS_PORT,       value: "6697" }
            - { name: IRC_TLS_CERT_PATH,  value: "/etc/tls/tls.crt" }
            - { name: IRC_TLS_KEY_PATH,   value: "/etc/tls/tls.key" }
            # PROXY v2 from Traefik — required so we see the real client IP
            # instead of Traefik's pod IP. Matched by the IngressRouteTCP
            # service `proxyProtocol.version: 2` setting below.
            - { name: IRC_PROXY_PROTOCOL, value: "true" }

            # BEAM cluster
            - { name: CLUSTER_STRATEGY,      value: "kubernetes" }
            - { name: CLUSTER_K8S_NAMESPACE, value: "neiam-ircd" }
            - { name: CLUSTER_K8S_SERVICE,   value: "ircd-headless" }
            - { name: CLUSTER_K8S_APP_NAME,  value: "ircd" }
            - { name: CLUSTER_K8S_SELECTOR,  value: "app=ircd" }
            - name: POD_IP
              valueFrom: { fieldRef: { fieldPath: status.podIP } }

            # StackGres-generated DB credentials
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef: { name: postgres-ircd, key: superuser-username }
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef: { name: postgres-ircd, key: superuser-password }
            - { name: POSTGRES_HOST, value: "postgres-ircd" }
            - { name: POSTGRES_PORT, value: "5432" }
            - name: DATABASE_URL
              value: ecto://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/ircd

            # App secrets
            - name: SECRET_KEY_BASE
              valueFrom: { secretKeyRef: { name: ircd-secrets, key: SECRET_KEY_BASE } }
            - name: RELEASE_COOKIE
              valueFrom: { secretKeyRef: { name: ircd-secrets, key: RELEASE_COOKIE } }

          volumeMounts:
            - { name: tls, mountPath: /etc/tls, readOnly: true }

          readinessProbe:
            httpGet: { path: /, port: http }
            initialDelaySeconds: 10
            periodSeconds: 5
          livenessProbe:
            tcpSocket: { port: irc }
            initialDelaySeconds: 30
            periodSeconds: 15

          resources:
            requests: { cpu: 100m, memory: 256Mi }
            limits:   { cpu: 1,    memory: 1Gi }

      imagePullSecrets:
        - name: gitlabgmp
      volumes:
        - name: tls
          secret:
            secretName: ircd-tls
---
# Headless Service for libcluster pod discovery.
apiVersion: v1
kind: Service
metadata:
  name: ircd-headless
  namespace: neiam-ircd
spec:
  clusterIP: None
  publishNotReadyAddresses: true
  selector:
    app: ircd
  ports:
    - { name: epmd, port: 4369, targetPort: 4369 }
    - { name: dist, port: 9100, targetPort: 9100 }
---
# Web UI service, fronted by Traefik via the Ingress below.
apiVersion: v1
kind: Service
metadata:
  name: ircd-web
  namespace: neiam-ircd
spec:
  selector:
    app: ircd
  ports:
    - { name: http, port: 80, targetPort: 4000 }
---
# Plain + TLS IRC service. Traefik routes TCP from public entryPoints
# to these ports via the IngressRouteTCPs below.
apiVersion: v1
kind: Service
metadata:
  name: ircd-irc
  namespace: neiam-ircd
spec:
  selector:
    app: ircd
  ports:
    - { name: irc,  port: 6667, targetPort: 6667 }
    - { name: ircs, port: 6697, targetPort: 6697 }
---
# HTTPS Ingress for the Phoenix LiveView / web UI.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ircd-web
  namespace: neiam-ircd
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: traefik
spec:
  tls:
    - hosts: [irc.skyjeep.club]
      secretName: ircd-tls
  rules:
    - host: irc.skyjeep.club
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ircd-web
                port: { number: 80 }
---
# Traefik raw-TCP routing for the IRC plain port. Assumes a Traefik
# entryPoint named `irc` listening on 6667 — add to your Traefik
# static config:
#
#   entryPoints:
#     irc:
#       address: ":6667"
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ircd-irc
  namespace: neiam-ircd
spec:
  entryPoints: [ircd]
  routes:
    - match: HostSNI(`*`)
      services:
        - name: ircd-irc
          port: 6667
          proxyProtocol:
            version: 2
---
# Traefik TLS-passthrough for IRC-over-TLS. Termination happens inside
# the IRC pod using the cert-manager-issued cert. Add to Traefik:
#
#   entryPoints:
#     ircs:
#       address: ":6697"
apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata:
  name: ircd-ircs
  namespace: neiam-ircd
spec:
  entryPoints: [ircds]
  routes:
    - match: HostSNI(`*`)
      services:
        - name: ircd-irc
          port: 6697
          proxyProtocol:
            version: 2
  tls:
    passthrough: true