From 68ccae15d336e85d02603bd37505e5a063a28e1c Mon Sep 17 00:00:00 2001
From: forgejoadmin <admin@hopeamulets.com>
Date: Sun, 16 Aug 2026 15:41:57 +0000
Subject: [PATCH] masterone: prod-cluster deployment with Longhorn replicated
 storage (edge ingress on node03:443)

---
 .../default/masterone/40-prod-deployment.yaml | 145 ++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100644 clusters/default/masterone/40-prod-deployment.yaml

diff --git a/clusters/default/masterone/40-prod-deployment.yaml b/clusters/default/masterone/40-prod-deployment.yaml
new file mode 100644
index 0000000..2e4b12c
--- /dev/null
+++ b/clusters/default/masterone/40-prod-deployment.yaml
@@ -0,0 +1,145 @@
+# MasterOne on the prod cluster — Longhorn 3-replica storage.
+# Portal + postgres; public entry via hostPort 443 on workernode03 (only free 443).
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: masterone
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata: {name: masterone-postgres, namespace: masterone}
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: longhorn
+  resources: {requests: {storage: 10Gi}}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata: {name: masterone-uploads, namespace: masterone}
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: longhorn
+  resources: {requests: {storage: 10Gi}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata: {name: postgres, namespace: masterone}
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector: {matchLabels: {app: postgres}}
+  template:
+    metadata: {labels: {app: postgres}}
+    spec:
+      containers:
+      - name: postgres
+        image: postgres:17-alpine
+        ports: [{containerPort: 5432}]
+        env:
+        - {name: POSTGRES_DB, value: masterone_portal}
+        - {name: POSTGRES_USER, value: masterone}
+        - name: POSTGRES_PASSWORD
+          valueFrom: {secretKeyRef: {name: masterone-secrets, key: POSTGRES_PASSWORD}}
+        volumeMounts: [{name: data, mountPath: /var/lib/postgresql/data, subPath: pgdata}]
+        readinessProbe:
+          exec: {command: ["pg_isready","-U","masterone","-d","masterone_portal"]}
+          initialDelaySeconds: 5
+          periodSeconds: 5
+      volumes:
+      - name: data
+        persistentVolumeClaim: {claimName: masterone-postgres}
+---
+apiVersion: v1
+kind: Service
+metadata: {name: postgres, namespace: masterone}
+spec:
+  selector: {app: postgres}
+  ports: [{port: 5432, targetPort: 5432}]
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata: {name: portal, namespace: masterone}
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+  selector: {matchLabels: {app: portal}}
+  template:
+    metadata: {labels: {app: portal}}
+    spec:
+      containers:
+      - name: portal
+        image: masterone-portal:k8s2
+        imagePullPolicy: IfNotPresent
+        ports: [{containerPort: 8095}]
+        envFrom: [{secretRef: {name: masterone-secrets}}]
+        env:
+        - {name: PORTAL_MASTERONE_ROOT, value: /masterone}
+        - name: DATABASE_URL
+          value: postgresql://masterone:$(POSTGRES_PASSWORD)@postgres.masterone.svc.cluster.local/masterone_portal
+        - {name: PORTAL_COOKIE_SECURE, value: "1"}
+        volumeMounts: [{name: uploads, mountPath: /app/uploads}]
+        readinessProbe: {httpGet: {path: /healthz, port: 8095}, initialDelaySeconds: 15, periodSeconds: 10}
+        livenessProbe: {httpGet: {path: /healthz, port: 8095}, initialDelaySeconds: 30, periodSeconds: 30}
+        resources:
+          requests: {memory: 512Mi, cpu: 100m}
+          limits: {memory: 2Gi}
+      volumes:
+      - name: uploads
+        persistentVolumeClaim: {claimName: masterone-uploads}
+---
+apiVersion: v1
+kind: Service
+metadata: {name: portal, namespace: masterone}
+spec:
+  selector: {app: portal}
+  ports: [{port: 8095, targetPort: 8095}]
+---
+# Public entry: nginx on node03 hostPort 443 (plain HTTP — TLS terminates at Caddy on the mgmt VPC)
+apiVersion: v1
+kind: ConfigMap
+metadata: {name: ingress-conf, namespace: masterone}
+data:
+  default.conf: |
+    server {
+      listen 443 ssl;
+      ssl_certificate /etc/nginx/tls/tls.crt;
+      ssl_certificate_key /etc/nginx/tls/tls.key;
+      client_max_body_size 100m;
+      location / {
+        proxy_pass http://portal.masterone.svc.cluster.local:8095;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 300s;
+      }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata: {name: edge-ingress, namespace: masterone}
+spec:
+  replicas: 1
+  strategy: {type: Recreate}
+spec:
+  replicas: 1
+  selector: {matchLabels: {app: edge-ingress}}
+  template:
+    metadata: {labels: {app: edge-ingress}}
+    spec:
+      nodeSelector: {kubernetes.io/hostname: workernode03.hopeamulets.com}
+      containers:
+      - name: nginx
+        image: nginx:1.27-alpine
+        ports: [{containerPort: 443, hostPort: 443}]
+        volumeMounts:
+        - {name: conf, mountPath: /etc/nginx/conf.d}
+        - {name: tls, mountPath: /etc/nginx/tls}
+      volumes:
+      - name: conf
+        configMap: {name: ingress-conf}
+      - name: tls
+        secret: {secretName: edge-tls}