Add new infra architecture 11

2026-01-20 22:05:10 +01:00
parent 0217ad83be
commit 2512de4173
42 changed files with 1056 additions and 874 deletions
--- a/infrastructure/platform/cert-manager/cluster-issuer-production.yaml
+++ b/infrastructure/platform/cert-manager/cluster-issuer-production.yaml
@@ -16,7 +16,7 @@ spec:
    solvers:
    - http01:
        ingress:
-          class: nginx
+          class: public
          podTemplate:
            spec:
              nodeSelector:
--- a/infrastructure/platform/cert-manager/cluster-issuer-staging.yaml
+++ b/infrastructure/platform/cert-manager/cluster-issuer-staging.yaml
@@ -17,7 +17,7 @@ spec:
    solvers:
    - http01:
        ingress:
-          class: nginx
+          class: public
          podTemplate:
            spec:
              nodeSelector:
--- a/infrastructure/platform/cert-manager/selfsigned-issuer.yaml
+++ b/infrastructure/platform/cert-manager/selfsigned-issuer.yaml
@@ -0,0 +1,8 @@
+# Self-signed ClusterIssuer for local development certificates
+# This issuer can generate self-signed certificates without needing external CA
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: {}
--- a/infrastructure/platform/mail/mailu-helm/configs/mailgun-credentials-secret.yaml
+++ b/infrastructure/platform/mail/mailu-helm/configs/mailgun-credentials-secret.yaml
@@ -0,0 +1,77 @@
+# Mailgun SMTP Credentials Secret for Mailu
+#
+# This secret stores Mailgun credentials for outbound email relay.
+# Mailu uses Mailgun as an external SMTP relay to send all outbound emails.
+#
+# HOW TO CONFIGURE:
+# 1. Go to https://www.mailgun.com and create an account
+# 2. Add and verify your domain (e.g., bakery-ia.dev or bakewise.ai)
+# 3. Go to Domain Settings > SMTP credentials
+# 4. Note your SMTP credentials:
+#    - SMTP hostname: smtp.mailgun.org
+#    - Port: 587 (TLS)
+#    - Username: usually postmaster@yourdomain.com
+#    - Password: your Mailgun SMTP password (NOT API key)
+# 5. Base64 encode your password:
+#    echo -n 'your-mailgun-smtp-password' | base64
+# 6. Replace MAILGUN_SMTP_PASSWORD_BASE64 below with the encoded value
+# 7. Apply this secret:
+#    kubectl apply -f mailgun-credentials-secret.yaml -n bakery-ia
+#
+# IMPORTANT NOTES:
+# - Use the SMTP password from Mailgun, not the API key
+# - The username is typically postmaster@yourdomain.com
+# - For sandbox domains, Mailgun requires authorized recipients
+# - Production domains need DNS verification (SPF, DKIM, MX records)
+#
+# DNS RECORDS REQUIRED FOR MAILGUN:
+# You will need to add these DNS records for your domain:
+# - SPF: TXT record for email authentication
+# - DKIM: TXT records for email signing (Mailgun provides these)
+# - MX: If you want to receive emails via Mailgun (optional for relay-only)
+#
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mailu-mailgun-credentials
+  namespace: bakery-ia
+  labels:
+    app: mailu
+    component: external-relay
+type: Opaque
+data:
+  # Base64 encoded Mailgun SMTP password
+  # To encode: echo -n 'your-password' | base64
+  # To decode: echo 'encoded-value' | base64 -d
+  RELAY_PASSWORD: MAILGUN_SMTP_PASSWORD_BASE64
+---
+# Development environment secret (separate for different Mailgun domain)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mailu-mailgun-credentials-dev
+  namespace: bakery-ia
+  labels:
+    app: mailu
+    component: external-relay
+    environment: dev
+type: Opaque
+data:
+  # Mailgun credentials for bakery-ia.dev domain
+  RELAY_PASSWORD: MAILGUN_DEV_SMTP_PASSWORD_BASE64
+---
+# Production environment secret
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mailu-mailgun-credentials-prod
+  namespace: bakery-ia
+  labels:
+    app: mailu
+    component: external-relay
+    environment: prod
+type: Opaque
+data:
+  # Mailgun credentials for bakewise.ai domain
+  RELAY_PASSWORD: MAILGUN_PROD_SMTP_PASSWORD_BASE64
--- a/infrastructure/platform/mail/mailu-helm/dev/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/dev/values.yaml
@@ -36,11 +36,17 @@ domain: "bakery-ia.dev"
 hostnames:
  - "mail.bakery-ia.dev"

-# External relay configuration for dev
+# External relay configuration for dev (Mailgun)
+# All outbound emails will be relayed through Mailgun SMTP
+# To configure:
+#   1. Register at mailgun.com and verify your domain (bakery-ia.dev)
+#   2. Get your SMTP credentials from Mailgun dashboard
+#   3. Update the secret in configs/mailgun-credentials-secret.yaml
+#   4. Apply the secret: kubectl apply -f configs/mailgun-credentials-secret.yaml
 externalRelay:
  host: "[smtp.mailgun.org]:587"
-  username: "postmaster@bakery-ia.dev"
-  password: "mailgun-api-key-replace-in-production"
+  username: "postmaster@bakery-ia.dev"  # Your Mailgun SMTP username (usually postmaster@yourdomain)
+  password: ""  # Will be loaded from secret - see configs/mailgun-credentials-secret.yaml

 # Environment-specific configurations
 persistence:
--- a/infrastructure/platform/mail/mailu-helm/mailu-ingress.yaml
+++ b/infrastructure/platform/mail/mailu-helm/mailu-ingress.yaml
@@ -2,27 +2,30 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: mailu-ingress
-  namespace: bakery-ia  # Same as Mailu's namespace
+  namespace: bakery-ia
+  labels:
+    app.kubernetes.io/name: mailu
+    app.kubernetes.io/component: ingress
  annotations:
-    kubernetes.io/ingress.class: nginx  # Or your Ingress class
-    nginx.ingress.kubernetes.io/proxy-body-size: "100m"  # Allow larger email attachments
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"  # For long connections
+    nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"  # Redirect HTTP to HTTPS
-    # If using Cert-Manager: cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
 spec:
+  ingressClassName: nginx
  tls:
  - hosts:
-    - mail.bakery-ia.dev  # or mail.bakewise.ai for prod
-    secretName: mail-tls-secret  # Your TLS Secret
+    - mail.bakery-ia.dev
+    secretName: bakery-dev-tls-cert
  rules:
-  - host: mail.bakery-ia.dev  # or mail.bakewise.ai for prod
+  - host: mail.bakery-ia.dev
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
-            name: mailu-front-http  # Mailu's front service (check with kubectl get svc -n bakery-ia)
+            name: mailu-front  # Helm release name 'mailu' + component 'front'
            port:
              number: 80
--- a/infrastructure/platform/mail/mailu-helm/prod/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/prod/values.yaml
@@ -21,11 +21,17 @@ domain: "bakewise.ai"
 hostnames:
  - "mail.bakewise.ai"

-# External relay configuration for production
+# External relay configuration for production (Mailgun)
+# All outbound emails will be relayed through Mailgun SMTP
+# To configure:
+#   1. Register at mailgun.com and verify your domain (bakewise.ai)
+#   2. Get your SMTP credentials from Mailgun dashboard
+#   3. Update the secret in configs/mailgun-credentials-secret.yaml
+#   4. Apply the secret: kubectl apply -f configs/mailgun-credentials-secret.yaml
 externalRelay:
  host: "[smtp.mailgun.org]:587"
-  username: "postmaster@bakewise.ai"
-  password: "PRODUCTION_MAILGUN_API_KEY"  # This should be set via secret
+  username: "postmaster@bakewise.ai"  # Your Mailgun SMTP username
+  password: ""  # Will be loaded from secret - see configs/mailgun-credentials-secret.yaml

 # Environment-specific configurations
 persistence:
--- a/infrastructure/platform/mail/mailu-helm/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/values.yaml
@@ -39,10 +39,12 @@ limits:
    value: "200/day"

 # External relay configuration (Mailgun)
+# Mailu will relay all outbound emails through Mailgun SMTP
+# Credentials should be provided via Kubernetes secret or environment-specific values
 externalRelay:
  host: "[smtp.mailgun.org]:587"
-  username: "postmaster@DOMAIN_PLACEHOLDER"
-  password: "mailgun-api-key-replace-in-production"
+  username: ""  # Set in environment-specific values or via secret
+  password: ""  # Set in environment-specific values or via secret

 # Webmail configuration
 webmail:
--- a/infrastructure/platform/networking/ingress/overlays/dev/gitea-service.yaml
+++ b/infrastructure/platform/networking/ingress/overlays/dev/gitea-service.yaml
@@ -1,18 +0,0 @@
---
-# Service to route traffic from bakery-ia namespace to Gitea in gitea namespace
-# Using ExternalName pointing to the headless service FQDN
-# The ingress controller can resolve headless services via DNS (returns pod IPs)
-# NOTE: Gitea's container registry is served on port 3000 (same as HTTP) at /v2/ path
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitea-http
-  namespace: bakery-ia
-spec:
-  type: ExternalName
-  # Use the headless service DNS name - nginx ingress resolves this to pod IPs
-  externalName: gitea-http.gitea.svc.cluster.local
-  ports:
-    - name: http
-      port: 3000
-      targetPort: 3000
--- a/infrastructure/platform/networking/ingress/overlays/dev/kustomization.yaml
+++ b/infrastructure/platform/networking/ingress/overlays/dev/kustomization.yaml
@@ -3,7 +3,6 @@ kind: Kustomization

 resources:
  - ../../base
-  - gitea-service.yaml

 namePrefix: dev-

@@ -15,30 +14,14 @@ patches:
      - op: replace
        path: /spec/tls/0/hosts/0
        value: bakery-ia.local
-      - op: replace
-        path: /spec/tls/0/hosts/1
-        value: gitea.bakery-ia.local
-      - op: replace
-        path: /spec/tls/0/hosts/2
-        value: registry.bakery-ia.local
-      - op: replace
-        path: /spec/tls/0/hosts/3
-        value: mail.bakery-ia.dev
      - op: replace
        path: /spec/tls/0/secretName
        value: bakery-dev-tls-cert
      - op: replace
        path: /spec/rules/0/host
        value: bakery-ia.local
-      - op: replace
-        path: /spec/rules/1/host
-        value: gitea.bakery-ia.local
-      - op: replace
-        path: /spec/rules/2/host
-        value: registry.bakery-ia.local
-      - op: replace
-        path: /spec/rules/3/host
-        value: mail.bakery-ia.dev
      - op: replace
        path: /metadata/annotations/nginx.ingress.kubernetes.io~1cors-allow-origin
        value: "https://localhost,https://localhost:3000,https://localhost:3001,https://127.0.0.1,https://127.0.0.1:3000,https://127.0.0.1:3001,https://bakery-ia.local,https://registry.bakery-ia.local,https://gitea.bakery-ia.local,http://localhost,http://localhost:3000,http://localhost:3001,http://127.0.0.1,http://127.0.0.1:3000"
+# NOTE: Gitea and Registry ingresses are managed by Gitea Helm chart (infrastructure/cicd/gitea/values.yaml)
+# NOTE: Mail ingress (mail.bakery-ia.dev) is deployed separately via mailu-helm Tilt resource
--- a/infrastructure/platform/networking/ingress/overlays/prod/gitea-service.yaml
+++ b/infrastructure/platform/networking/ingress/overlays/prod/gitea-service.yaml
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitea-http
-  namespace: bakery-ia
-spec:
-  type: ExternalName
-  externalName: gitea-http.gitea.svc.cluster.local
-  ports:
-    - port: 3000
-      targetPort: 3000