buzz-web client deployed at client.ch4t.buzz (SPA + cert); relay CORS widened

buzz/k8s/buzz-client.yaml

@@ -0,0 +1,136 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: static-nginx-spa-conf
+data:
+  nginx.conf: |
+    worker_processes 1;
+    error_log /dev/stderr warn;
+    pid /run/nginx.pid;
+    events { worker_connections 1024; }
+    http {
+      include /etc/nginx/mime.types;
+      default_type application/octet-stream;
+      access_log /dev/stdout;
+      sendfile on;
+      gzip on;
+      gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;
+      gzip_min_length 1024;
+      server {
+        listen 80;
+        root /usr/share/nginx/html;
+        index index.html;
+        add_header X-Content-Type-Options nosniff always;
+        add_header Referrer-Policy strict-origin-when-cross-origin always;
+        location /assets/ {
+          expires 30d;
+          add_header Cache-Control "public";
+        }
+        location = /config.json {
+          add_header Cache-Control "no-cache";
+        }
+        location / {
+          try_files $uri /index.html;
+        }
+      }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: static-bzc
+  labels:
+    site: buzz-client
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      site: buzz-client
+  template:
+    metadata:
+      labels:
+        site: buzz-client
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: djg-oracle-sl
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          operator: Exists
+          effect: NoSchedule
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+      containers:
+        - name: nginx
+          image: nginx:alpine
+          volumeMounts:
+            - name: conf
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+              readOnly: true
+            - name: html
+              mountPath: /usr/share/nginx/html
+              readOnly: true
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              memory: 128Mi
+          readinessProbe:
+            httpGet: {path: /, port: 80}
+            initialDelaySeconds: 2
+            periodSeconds: 20
+      volumes:
+        - name: conf
+          configMap:
+            name: static-nginx-spa-conf
+        - name: html
+          hostPath:
+            path: /home/opc/zai-home-base/sites/buzz-client
+            type: Directory
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: static-bzc
+spec:
+  selector:
+    site: buzz-client
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: buzz-client
+spec:
+  rules:
+    - host: client.ch4t.buzz
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: static-bzc
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - client.ch4t.buzz
+      secretName: client-ch4t-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: client-ch4t-buzz
+spec:
+  secretName: client-ch4t-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - client.ch4t.buzz