add vault secrets and fix still poiting to election

.gitea/workflows/build-push.yaml

@@ -3,7 +3,7 @@ name: Build and Push Container Image
 on:
   push:
     branches:
-      - master
+      - main
     paths-ignore:
       - "deploy/**"
 env:

deploy/base/app-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: HCPStaticSecret
+metadata:
+  name: taskarr-ap 
+spec:
+  method: GET
+  mount: secret
+  path: taskarr/app
+  destination:
+    name: taskarr-app
+    create: true
+  refreshAfter: 1h 

deploy/base/cert.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: taskarr-tls
+spec:
+  secretName: taskarr-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - taskarr.milasholsting.dk
+

deploy/base/database-secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: HCPStaticSecret
+metadata:
+  name: taskarr-db
+spec:
+  method: GET
+  mount: secret
+  path: taskarr/db
+  destination:
+    name: taskarr-db
+    create: true
+  refreshAfter: 1h 
+

deploy/base/deployment.yaml

@@ -0,0 +1,76 @@
+# https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: taskarr
+  labels:
+    app: taskarr
+spec:
+  selector:
+    matchLabels:
+      app: taskarr
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container:  taskarr
+      labels:
+        app: taskarr
+    spec:
+      containers:
+      - name: taskarr
+        image: main
+        imagePullPolicy: IfNotPresent
+        resources:
+          requests:
+            cpu: 100m
+            memory: 100Mi
+          limits:
+            cpu: 100m
+            memory: 100Mi
+        livenessProbe:
+          tcpSocket:
+            port: 3000
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+          periodSeconds: 10
+        ports:
+          - containerPort: 3000
+            name: http
+        env:
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: taskarr-app
+              key: DATABASE_URL
+        - name: ORIGIN
+          valueFrom:
+            secretKeyRef:
+              name: taskarr-app
+              key: ORIGIN
+        - name: BETTER_AUTH_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: taskarr-app
+              key: BETTER_AUTH_SECRET
+        - name: GITEA_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: taskarr-app
+              key: GITEA_CLIENT_SECRET
+        - name: GITEA_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: taskarr-app
+              key: GITEA_CLIENT_ID
+
+      restartPolicy: Always
+---
+

deploy/base/ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: taskarr-ingress
+  namespace: vhsmp
+spec:
+  entryPoints:
+    - websecure
+    - web
+  routes:
+    - match: Host(`taskarr.milasholsting.dk`)
+      kind: Rule
+      services:
+        - name: taskarr
+          port: 3000
+  tls:
+    secretName: taskarr-tls
+
+

deploy/base/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: taskarr
+
+resources:
+  - ./deployment.yaml
+  - ./ingress.yaml
+  - ./cert.yaml
+  - ./service.yaml
+  - ./migration-job.yaml
+  - ./postgres-service.yaml
+  - ./postgres-storage.yaml
+  - ./postgres.yaml
+  - ./database-secret.yaml
+  - ./app-secret.yaml

deploy/base/migration-job.yaml

@@ -0,0 +1,35 @@
+# https://kubernetes.io/docs/concepts/workloads/controllers/job/
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: taskarr-migration
+  annotations:
+    # 1. Tells Argo this is a hook to run during sync
+    argocd.argoproj.io/hook: Sync
+    
+    # 2. Ensures the migration runs BEFORE the deployment
+    argocd.argoproj.io/sync-wave: "1"
+    
+    # 3. Deletes the job after it succeeds so it can run again next time
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+  labels:
+    app: taskarr-migration
+spec:
+  template:
+    metadata:
+      name: taskarr-migration
+      labels:
+        app: taskarr-migration
+    spec:
+      containers:
+      - name: taskarr-migrator
+        image: migrator
+        env:
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: election
+              key: DATABASE_URL
+
+      restartPolicy: OnFailure
+      dnsPolicy: ClusterFirst

deploy/base/postgres-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-service
+spec:
+  selector:
+    app: postgres
+  ports:
+    - protocol: TCP
+      port: 5432
+      targetPort: 5432
+  type: ClusterIP

deploy/base/postgres-storage.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-pvc
+spec:
+  storageClassName: local-path
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

deploy/base/postgres.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:18
+          ports:
+            - containerPort: 5432
+          env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: taskarr-db
+                  key: DATABASE
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: taskarr-db
+                  key: USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: taskarr-db
+                  key: PASSWORD
+          volumeMounts:
+            - mountPath: /var/lib/postgresql
+              name: postgredb
+      volumes:
+        - name: postgredb
+          persistentVolumeClaim:
+            claimName: postgres-pvc

deploy/base/service.yaml

@@ -0,0 +1,15 @@
+# https://kubernetes.io/docs/concepts/services-networking/service/
+apiVersion: v1
+kind: Service
+metadata:
+  name: taskarr
+spec:
+  selector:
+    app: taskarr
+  type: ClusterIP
+  ports:
+  - name: taskarr
+    protocol: TCP
+    port: 3000
+    targetPort: 3000
+

deploy/overlays/production/deployment.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: taskarr # Must match the name in base/
+spec:
+  replicas: 2           # Scale up for production
+  template:
+    spec:
+      containers:
+      - name: main   # This name must match base EXACTLY
+        ports:           # Adding this back into the patch solves the diff
+        - containerPort: 3000
+          name: taskarr
+        # Production-specific resource limits
+        resources:
+          limits:
+            cpu: "1"
+            memory: "1Gi"
+          requests:
+            cpu: "500m"
+            memory: "512Mi"
+        # Adding a production-only environment variable
+        env:
+        - name: NODE_ENV
+          value: "production"
+

deploy/overlays/production/kustomization.yaml

@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# 1. Point to the base manifests
+resources:
+- ../../base
+
+# 2. Apply the production-specific changes
+patches:
+- path: deployment.yaml
+  target:
+    kind: Deployment
+    name: taskarr
+
+# 4. Change the namespace for this overlay
+namespace: taskarr
+
+images:
+- name: main
+  newName: reg.milasholsting.dk/taskarr/taskarr
+  newTag: latest
+- name: migrator
+  newName: reg.milasholsting.dk/taskarr/migrator
+  newTag: latest