feat: Gitea Actions + k8s manifests + ArgoCD for k3s deploy

k8s/app-config.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app-config
+  namespace: toolrate
+data:
+  PORT: "8080"
+  NODE_ENV: production
+  LOCAL_ADMIN_USERNAME: admin
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secrets
+  namespace: toolrate
+type: Opaque
+stringData:
+  POSTGRES_PASSWORD: changeme
+  SESSION_SECRET: change-this-to-a-random-64-char-string
+  LOCAL_ADMIN_PASSWORD: pssw0rd
+  DATABASE_URL: postgres://toolrate:changeme@postgres:5432/toolrate

k8s/app.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  namespace: toolrate
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: toolrate
+  template:
+    metadata:
+      labels:
+        app: toolrate
+    spec:
+      containers:
+        - name: app
+          image: gitea.example.com/your-org/tool-evaluator:sha-abcdef
+          ports:
+            - containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: app-config
+            - secretRef:
+                name: app-secrets
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /api/healthz
+              port: 8080
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: /api/healthz
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: app
+  namespace: toolrate
+spec:
+  selector:
+    app: toolrate
+  ports:
+    - port: 8080
+      targetPort: 8080

k8s/argocd-app.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: toolrate
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.example.com/your-org/tool-evaluator.git
+    targetRevision: main
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: toolrate
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+  ignoreDifferences:
+    - group: apps
+      kind: StatefulSet
+      jsonPointers:
+        - /spec/replicas
+        - /spec/template/spec/containers/0/image

k8s/ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: app
+  namespace: toolrate
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: tools.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: app
+                port:
+                  number: 8080
+  tls:
+    - hosts:
+        - tools.example.com
+      secretName: app-tls

k8s/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: toolrate
+
+resources:
+  - namespace.yaml
+  - postgres.yaml
+  - app-config.yaml
+  - app.yaml
+  - ingress.yaml
+
+images:
+  - name: gitea.example.com/your-org/tool-evaluator
+    newName: gitea.example.com/your-org/tool-evaluator
+    newTag: sha-abcdef

k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: toolrate

k8s/postgres.yaml

@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: toolrate
+spec:
+  serviceName: postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          ports:
+            - containerPort: 5432
+              name: pg
+          env:
+            - name: POSTGRES_USER
+              value: toolrate
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: app-secrets
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_DB
+              value: toolrate
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            exec:
+              command: [pg_isready, -U, toolrate]
+            initialDelaySeconds: 15
+            periodSeconds: 10
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: [ReadWriteOnce]
+        resources:
+          requests:
+            storage: 10Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: toolrate
+spec:
+  selector:
+    app: postgres
+  ports:
+    - port: 5432
+      targetPort: 5432