mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
650451bdf7
A fourth built-in channel next to email, webhook and ntfy. Browsers register per device, the server encrypts per RFC 8291 and signs per RFC 8292 with node:crypto and sends only to known push services through the SSRF guard. The event matrix decides per category what arrives by push; admins switch the channel on under Notifications. VAPID keys come from the environment or are generated once, only while neither stored row exists, and kept encrypted. A pair that does not decrypt or match is never overwritten and never swapped for another one: push stays off with an error in the log and every device stays registered until the key is fixed. The subject is VAPID_SUBJECT, then an https APP_URL, then the project URL. Only chat messages collapse into one notification per trip, and a replacement still alerts. A 403 removes a device only after three failures in a row; 404 and 410 remove it at once. Password change, reset and an admin setting a password drop the user's devices with the other credentials. The request log redacts subscriptions and endpoints, boot errors print *** for every secret variable, and logout forgets the device with a plain fetch so an expired session cannot redirect midway. Addresses discussion #894.
130 lines
5.1 KiB
YAML
130 lines
5.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "trek.fullname" . }}
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
spec:
|
|
replicas: 1
|
|
# TREK is a single-writer SQLite app on a ReadWriteOnce PVC, so the default
|
|
# RollingUpdate would start a second pod holding the same volume before the old one
|
|
# exits — a Multi-Attach deadlock, or two processes on one travel.db. Recreate tears
|
|
# the old pod down first. Override to RollingUpdate only with a ReadWriteMany volume.
|
|
strategy:
|
|
type: {{ .Values.updateStrategy | default "Recreate" }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ include "trek.name" . }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
|
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
spec:
|
|
{{- if .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- range .Values.imagePullSecrets }}
|
|
- name: {{ .name }}
|
|
{{- end }}
|
|
{{- end }}
|
|
securityContext:
|
|
fsGroup: 1000
|
|
containers:
|
|
- name: trek
|
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
{{- with .Values.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
ports:
|
|
- containerPort: 3000
|
|
envFrom:
|
|
- configMapRef:
|
|
name: {{ include "trek.fullname" . }}-config
|
|
env:
|
|
- name: ENCRYPTION_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}
|
|
optional: true
|
|
- name: ADMIN_EMAIL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: ADMIN_EMAIL
|
|
optional: true
|
|
- name: ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: ADMIN_PASSWORD
|
|
optional: true
|
|
- name: OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: OIDC_CLIENT_SECRET
|
|
optional: true
|
|
- name: UNSPLASH_ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: UNSPLASH_ACCESS_KEY
|
|
optional: true
|
|
- name: PLACES_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: PLACES_API_KEY
|
|
optional: true
|
|
- name: AMAP_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: AMAP_API_KEY
|
|
optional: true
|
|
- name: AMAP_API_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: AMAP_API_SECRET
|
|
optional: true
|
|
- name: VAPID_PRIVATE_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default (printf "%s-secret" (include "trek.fullname" .)) .Values.existingSecret }}
|
|
key: VAPID_PRIVATE_KEY
|
|
optional: true
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /app/data
|
|
- name: uploads
|
|
mountPath: /app/uploads
|
|
{{- with (default dict .Values.probes).liveness }}
|
|
livenessProbe:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- with (default dict .Values.probes).readiness }}
|
|
readinessProbe:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: data
|
|
{{- if .Values.persistence.enabled }}
|
|
persistentVolumeClaim:
|
|
claimName: {{ default (printf "%s-data" (include "trek.fullname" .)) .Values.persistence.data.existingClaim }}
|
|
{{- else }}
|
|
emptyDir: {}
|
|
{{- end }}
|
|
- name: uploads
|
|
{{- if .Values.persistence.enabled }}
|
|
persistentVolumeClaim:
|
|
claimName: {{ default (printf "%s-uploads" (include "trek.fullname" .)) .Values.persistence.uploads.existingClaim }}
|
|
{{- else }}
|
|
emptyDir: {}
|
|
{{- end }}
|