flux cd refactoring enable git repo, and global resources deploy

deploy/whiteboard/.env.d/.gitignore

@@ -0,0 +1,3 @@
+**
+!*.example
+!.gitignore

deploy/whiteboard/.env.d/whiteboard.env.example

@@ -0,0 +1 @@
+JWT_SECRET_KEY= ????

deploy/whiteboard/deployment.yaml

@@ -0,0 +1,37 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: whiteboard
+  labels:
+    app: whiteboard
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: whiteboard
+  template:
+    metadata:
+      labels:
+        app: whiteboard
+    spec:
+      containers:
+        - name: whiteboard-ws
+          image: ghcr.io/nextcloud-releases/whiteboard:stable
+          ports:
+            - containerPort: 3002
+          env:
+            - name: NEXTCLOUD_URL
+              value: https://cloud.limbosolutions.com
+            - name: JWT_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: nextcloud-whiteboard
+                  key: JWT_SECRET_KEY
+          resources:
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+ 

deploy/whiteboard/ingress-web-public.yaml

@@ -0,0 +1,29 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: whiteboard-web-public
+  annotations:
+    kubernetes.io/ingress.class: traefik-public
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: cloud-limbosolutions-com-tls
+    domains:
+      - main: cloud.limbosolutions.com
+
+  routes:
+
+    - match: Host(`cloud.limbosolutions.com`) && PathPrefix(`/whiteboard`)
+      kind: Rule
+      services:
+        - name: whiteboard
+          port: 3002
+      middlewares:
+         - name: nextcloud-security-headers
+         - name: rate-limit
+         - name: nextcloud-deny-paths
+         - name: nextcloud-wellknown
+         - name: nextcloud-hostmeta
+         - name: nextcloud-dav
+         - name: strip-whiteboard

deploy/whiteboard/ingress-web.yaml

@@ -0,0 +1,29 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: whiteboard-web
+  annotations:
+    kubernetes.io/ingress.class: traefik
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: cloud-limbosolutions-com-tls
+    domains:
+      - main: cloud.limbosolutions.com
+
+  routes:
+
+    - match: Host(`cloud.limbosolutions.com`) && PathPrefix(`/whiteboard`)
+      kind: Rule
+      services:
+        - name: whiteboard
+          port: 3002
+      middlewares:
+         - name: nextcloud-security-headers
+         - name: rate-limit
+         - name: nextcloud-deny-paths
+         - name: nextcloud-wellknown
+         - name: nextcloud-hostmeta
+         - name: nextcloud-dav
+         - name: strip-whiteboard

deploy/whiteboard/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+secretGenerator:
+  - name: whiteboard
+    envs:
+      - ./.env.d/whiteboard.env
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+resources:
+  - ./deployment.yaml
+  - ./service.yaml
+  - ./middlewares.yaml
+  - ./network-policies.yaml
+  - ./ingress-web-public.yaml
+  - ./ingress-web.yaml

deploy/whiteboard/middlewares.yaml

@@ -0,0 +1,8 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-whiteboard
+spec:
+  stripPrefix:
+    prefixes:
+      - "/whiteboard"

deploy/whiteboard/network-policies.yaml

@@ -0,0 +1,27 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-traefik-to-whiteboard-ingress
+spec:
+  endpointSelector:
+    matchLabels:
+      app: nextcloud-whiteboard
+
+  ingress:
+    # -------------------------------------------------------------
+    # Allow Traefik (internal and public) to reach whiteboard ws
+    # -------------------------------------------------------------
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: traefik
+          matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - traefik
+                - traefik-public
+      toPorts:
+        - ports:
+            - port: "3002"
+    
+              protocol: TCP

deploy/whiteboard/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: whiteboard
+spec:
+  selector:
+    app: whiteboard
+  ports:
+    - name: ws
+      port: 3002
+      targetPort: 3002
+  type: ClusterIP