Add k8s manifests and Forgejo CI for cluster deployment

.forgejo/workflows/build.yaml

@@ -0,0 +1,52 @@
+name: Build and Push
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  REGISTRY: git.mcintire.me
+  IMAGE_NAME: graham/prop
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-push:
+    name: Build and Push Docker Image
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout code
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Generate image tag
+        id: tag
+        run: |
+          TIMESTAMP=$(date +%s)
+          SHORT_SHA=$(git rev-parse --short=7 HEAD | cut -c1-7)
+          TAG="main-${TIMESTAMP}-${SHORT_SHA}"
+          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+
+      - name: Set up Docker Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+
+      - name: Log in to container registry
+        uses: https://github.com/docker/login-action@v3
+        with:
+          registry: ${{ secrets.REGISTRY_URL }}
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push Docker image
+        uses: https://github.com/docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max

k8s/deployment.yaml

@@ -0,0 +1,98 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prop
+  namespace: prop
+spec:
+  replicas: 1
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app: prop
+  template:
+    metadata:
+      labels:
+        app: prop
+    spec:
+      imagePullSecrets:
+        - name: forgejo-registry
+      securityContext:
+        runAsUser: 65534
+        runAsNonRoot: true
+        fsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: prop
+          image: git.mcintire.me/graham/prop:latest # {"$imagepolicy": "flux-system:prop"}
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: PHX_SERVER
+              value: "true"
+            - name: PHX_HOST
+              value: "prop.w5isp.com"
+            - name: PORT
+              value: "5000"
+            - name: HRRR_BASE_URL
+              value: "http://skippy.w5isp.com:8080"
+          envFrom:
+            - secretRef:
+                name: prop-secrets
+          ports:
+            - name: http
+              containerPort: 5000
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            failureThreshold: 12
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            failureThreshold: 2
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            periodSeconds: 10
+            failureThreshold: 3
+            timeoutSeconds: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 65534
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: srtm-data
+              mountPath: /srtm
+              readOnly: true
+      volumes:
+        - name: srtm-data
+          nfs:
+            server: 204.110.191.8
+            path: /data/srtm
+            readOnly: true

k8s/flux.yaml

@@ -0,0 +1,79 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: prop
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://git.mcintire.me/graham/prop.git
+  ref:
+    branch: main
+  secretRef:
+    name: forgejo-git-credentials
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: prop-app
+  namespace: flux-system
+spec:
+  interval: 5m
+  sourceRef:
+    kind: GitRepository
+    name: prop
+  path: ./k8s
+  prune: true
+  targetNamespace: prop
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: prop
+  namespace: flux-system
+spec:
+  image: git.mcintire.me/graham/prop
+  interval: 1m
+  provider: generic
+  secretRef:
+    name: forgejo-registry
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: prop
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: prop
+  policy:
+    numerical:
+      order: asc
+  filterTags:
+    pattern: ^main-(?P<ts>[0-9]+)-[a-f0-9]+$
+    extract: $ts
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageUpdateAutomation
+metadata:
+  name: prop
+  namespace: flux-system
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: prop
+  git:
+    checkout:
+      ref:
+        branch: main
+    commit:
+      author:
+        name: FluxCD
+        email: fluxcd@w5isp.com
+      messageTemplate: 'chore: update prop image to {{range .Changed.Changes}}{{.NewValue}}{{end}} [skip ci]'
+    push:
+      branch: main
+  update:
+    path: ./k8s
+    strategy: Setters

k8s/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - secret.yaml
+  - deployment.yaml
+  - service.yaml

k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prop

k8s/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: prop
+  namespace: prop
+spec:
+  type: ClusterIP
+  selector:
+    app: prop
+  ports:
+    - name: http
+      port: 5000
+      targetPort: 5000
+      protocol: TCP