deployment.yaml (7542B)
1 apiVersion: apps/v1 2 kind: Deployment 3 metadata: 4 name: convex 5 namespace: convex 6 spec: 7 progressDeadlineSeconds: 120 8 strategy: 9 rollingUpdate: 10 maxUnavailable: 0 11 type: RollingUpdate 12 selector: 13 matchLabels: 14 app: convex 15 template: 16 metadata: 17 labels: 18 app: convex 19 spec: 20 automountServiceAccountToken: false 21 securityContext: 22 fsGroup: 1000 23 containers: 24 - name: backend 25 image: ghcr.io/mtrnord/git-convex:latest 26 env: 27 - name: "CONVEX_CLOUD_ORIGIN" 28 value: "https://api.convex.mtrnord.blog" 29 - name: "CONVEX_SITE_ORIGIN" 30 value: "https://convex.mtrnord.blog" 31 - name: "DOCUMENT_RETENTION_DELAY" 32 value: "172800" 33 - name: "RUST_LOG" 34 value: "debug" 35 - name: "RUST_BACKTRACE" 36 value: "full" 37 # Database nanme 38 - name: "INSTANCE_NAME" 39 value: "convex" 40 - name: "POSTGRES_URL" 41 valueFrom: 42 secretKeyRef: 43 name: pg-secret 44 key: postgres-url 45 - name: "DO_NOT_REQUIRE_SSL" 46 value: "1" 47 - name: "DISABLE_BEACON" 48 value: "1" 49 - name: "ACTIONS_USER_TIMEOUT_SECS" 50 value: "60" 51 # Unused 52 # - name: "AWS_ACCESS_KEY_ID" 53 # value: "" 54 # - name: "AWS_REGION" 55 # value: "" 56 # - name: "AWS_S3_DISABLE_CHECKSUMS" 57 # value: "" 58 # - name: "AWS_S3_DISABLE_SSE" 59 # value: "" 60 # - name: "AWS_S3_FORCE_PATH_STYLE" 61 # value: "" 62 # - name: "AWS_SECRET_ACCESS_KEY" 63 # value: "" 64 # - name: "AWS_SESSION_TOKEN" 65 # value: "" 66 # - name: "CONVEX_RELEASE_VERSION_DEV" 67 # value: "" 68 # - name: "DATABASE_URL" 69 # value: "" 70 # - name: "REDACT_LOGS_TO_CLIENT" 71 # value: "" 72 # - name: "S3_ENDPOINT_URL" 73 # value: "" 74 # - name: "S3_STORAGE_EXPORTS_BUCKET" 75 # value: "" 76 # - name: "S3_STORAGE_FILES_BUCKET" 77 # value: "" 78 # - name: "S3_STORAGE_MODULES_BUCKET" 79 # value: "" 80 # - name: "S3_STORAGE_SEARCH_BUCKET" 81 # value: "" 82 # - name: "S3_STORAGE_SNAPSHOT_IMPORTS_BUCKET" 83 # value: "" 84 securityContext: 85 allowPrivilegeEscalation: false 86 readOnlyRootFilesystem: true 87 # runAsNonRoot/runAsUser omitted: image entrypoint script perms are tied 88 # to the image's own user; override breaks exec. Image must set non-root USER. 89 capabilities: 90 drop: 91 - ALL 92 seccompProfile: 93 type: RuntimeDefault 94 resources: 95 limits: 96 cpu: "2000m" 97 memory: "1Gi" 98 requests: 99 memory: "344Mi" 100 cpu: "252m" 101 ports: 102 - containerPort: 3210 103 name: api 104 protocol: TCP 105 - containerPort: 3211 106 name: site 107 protocol: TCP 108 volumeMounts: 109 - name: data 110 mountPath: "/convex/data" 111 - mountPath: /tmp 112 name: tmp 113 livenessProbe: 114 httpGet: 115 path: /version 116 port: api 117 scheme: HTTP 118 readinessProbe: 119 httpGet: 120 path: /version 121 port: api 122 scheme: HTTP 123 startupProbe: 124 httpGet: 125 path: /version 126 port: api 127 scheme: HTTP 128 - name: dashboard 129 image: ghcr.io/get-convex/convex-dashboard:latest 130 securityContext: 131 allowPrivilegeEscalation: false 132 readOnlyRootFilesystem: true 133 runAsNonRoot: true 134 runAsUser: 1000 135 runAsGroup: 1000 136 capabilities: 137 drop: 138 - ALL 139 seccompProfile: 140 type: RuntimeDefault 141 env: 142 - name: "NEXT_PUBLIC_DEPLOYMENT_URL" 143 value: "https://api.convex.mtrnord.blog" 144 - name: "NEXT_PUBLIC_LOAD_MONACO_INTERNALLY" 145 value: "true" 146 resources: 147 limits: 148 cpu: "500m" 149 memory: "512Mi" 150 requests: 151 memory: "344Mi" 152 cpu: "252m" 153 ports: 154 - containerPort: 6791 155 name: dashboard 156 protocol: TCP 157 volumeMounts: 158 - mountPath: /tmp 159 name: tmp 160 livenessProbe: 161 httpGet: 162 path: / 163 port: dashboard 164 scheme: HTTP 165 readinessProbe: 166 httpGet: 167 path: / 168 port: dashboard 169 scheme: HTTP 170 startupProbe: 171 httpGet: 172 path: / 173 port: dashboard 174 scheme: HTTP 175 volumes: 176 - name: tmp 177 emptyDir: 178 sizeLimit: 2048Mi 179 - name: data 180 persistentVolumeClaim: 181 claimName: convex-data 182 --- 183 apiVersion: v1 184 kind: Service 185 metadata: 186 name: convex 187 spec: 188 selector: 189 app: convex 190 ports: 191 - name: dashboard 192 port: 6791 193 targetPort: 6791 194 - name: api 195 port: 3210 196 targetPort: 3210 197 - name: site 198 port: 3211 199 targetPort: 3211 200 --- 201 apiVersion: gateway.networking.k8s.io/v1 202 kind: HTTPRoute 203 metadata: 204 name: convex-dashboard 205 namespace: convex 206 spec: 207 parentRefs: 208 - name: envoy-gateway 209 namespace: envoy-gateway 210 hostnames: 211 - dashboard.convex.mtrnord.blog 212 rules: 213 - backendRefs: 214 - name: convex 215 port: 6791 216 timeouts: 217 request: 240s 218 backendRequest: 0s 219 --- 220 apiVersion: gateway.networking.k8s.io/v1 221 kind: HTTPRoute 222 metadata: 223 name: convex-api 224 namespace: convex 225 spec: 226 parentRefs: 227 - name: envoy-gateway 228 namespace: envoy-gateway 229 hostnames: 230 - api.convex.mtrnord.blog 231 rules: 232 - backendRefs: 233 - name: convex 234 port: 3210 235 timeouts: 236 request: 240s 237 backendRequest: 0s 238 filters: 239 - type: CORS 240 cors: 241 allowOrigins: 242 - "https://convex.mtrnord.blog" 243 - "https://api.convex.mtrnord.blog" 244 - "https://dashboard.convex.mtrnord.blog" 245 - "http://localhost:5173" 246 allowMethods: 247 - "*" 248 allowHeaders: 249 - "*" 250 --- 251 apiVersion: gateway.networking.k8s.io/v1 252 kind: HTTPRoute 253 metadata: 254 name: convex-site 255 namespace: convex 256 spec: 257 parentRefs: 258 - name: envoy-gateway 259 namespace: envoy-gateway 260 hostnames: 261 - convex.mtrnord.blog 262 rules: 263 - backendRefs: 264 - name: convex 265 port: 3211 266 timeouts: 267 request: 240s 268 backendRequest: 0s 269 filters: 270 - type: CORS 271 cors: 272 allowOrigins: 273 - "https://convex.mtrnord.blog" 274 - "https://api.convex.mtrnord.blog" 275 - "https://dashboard.convex.mtrnord.blog" 276 - "http://localhost:5173" 277 allowMethods: 278 - "*" 279 allowHeaders: 280 - "*"