add k8s manifests and Gitea Actions CI workflow

.github/workflows/build.yml

@@ -0,0 +1,47 @@
+name: Build and Deploy
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+      - dev
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - run: |
+          TAG=${{ gitea.sha }}
+          docker build \
+            -t mts.dgnr.us:5000/${{ gitea.repository }} \
+            -t mts.dgnr.us:5000/${{ gitea.repository }}:$TAG \
+            .
+
+      - run: |
+          TAG=${{ gitea.sha }}
+          docker push mts.dgnr.us:5000/${{ gitea.repository }} &
+          docker push mts.dgnr.us:5000/${{ gitea.repository }}:$TAG &
+          wait
+
+      - name: Install kubectl
+        run: |
+          ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+          curl -sLO "https://dl.k8s.io/release/v1.35.0/bin/linux/${ARCH}/kubectl"
+          chmod +x kubectl
+          mv kubectl /usr/local/bin/kubectl
+
+      - name: Configure kubectl
+        run: |
+          kubectl config set-cluster astral --server=https://100.75.220.33:6443 --insecure-skip-tls-verify=true
+          kubectl config set-credentials ci-deployer --token=${{ secrets.KUBE_TOKEN }}
+          kubectl config set-context astral --cluster=astral --user=ci-deployer --namespace=enka
+          kubectl config use-context astral
+
+      - name: Deploy to k3s
+        run: |
+          TAG=${{ gitea.sha }}
+          kubectl set image deployment/enka-api enka-api=mts.dgnr.us:5000/${{ gitea.repository }}:$TAG -n enka
+          kubectl rollout status deployment/enka-api -n enka --timeout=180s

k8s/deployment.yaml

@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: enka-api
+  namespace: enka
+  labels:
+    app: enka-api
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 25%
+      maxSurge: 25%
+  selector:
+    matchLabels:
+      app: enka-api
+  template:
+    metadata:
+      labels:
+        app: enka-api
+    spec:
+      containers:
+      - name: enka-api
+        image: mts.dgnr.us:5000/astral/api
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 3000
+        env:
+        - name: TAKUMI_CORE_TARGET
+          value: ./core.linux-arm64-musl.node
+        envFrom:
+        - secretRef:
+            name: enka-env
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 3000
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 1
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 3000
+          initialDelaySeconds: 2
+          periodSeconds: 5
+          timeoutSeconds: 1
+          failureThreshold: 3
+        resources:
+          requests:
+            cpu: 250m
+            memory: 128Mi
+        volumeMounts:
+        - name: assets
+          mountPath: /app/store
+      volumes:
+      - name: assets
+        persistentVolumeClaim:
+          claimName: enka-embed-assets-lh
+      terminationGracePeriodSeconds: 30

k8s/ingress.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: enka-api
+  namespace: enka
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: api.dgnr.us
+    http:
+      paths:
+      - backend:
+          service:
+            name: enka-api
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  - host: api.astrxl.dev
+    http:
+      paths:
+      - backend:
+          service:
+            name: enka-api
+            port:
+              number: 80
+        path: /
+        pathType: Prefix

k8s/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: enka
+
+resources:
+- namespace.yaml
+- deployment.yaml
+- service.yaml
+- ingress.yaml
+- pvc.yaml
+- secret.yaml
+- service-account.yaml
+- role.yaml
+- role-binding.yaml
+- token-secret.yaml

k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: enka

k8s/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: enka-embed-assets-lh
+  namespace: enka
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn

k8s/role-binding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ci-deployer
+  namespace: enka
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ci-deployer
+subjects:
+- kind: ServiceAccount
+  name: ci-deployer
+  namespace: enka

k8s/role.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ci-deployer
+  namespace: enka
+rules:
+- apiGroups: ["apps"]
+  resources: ["deployments"]
+  verbs: ["get", "list", "watch", "update", "patch"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["services"]
+  verbs: ["get", "list", "watch", "create", "update", "patch"]
+- apiGroups: ["networking.k8s.io"]
+  resources: ["ingresses"]
+  verbs: ["get", "list", "watch", "create", "update", "patch"]
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

k8s/secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: enka-env
+  namespace: enka
+type: Opaque
+stringData:
+  PRIVATE_API_KEY: "key is not needed"
+  PUBLIC_API_KEY: "key is not needed"
+  WH_ROUTE_MAP: "https://cdn.astrxl.dev/sec/a2f43a3d249a-routes.json"

k8s/service-account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ci-deployer
+  namespace: enka

k8s/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: enka-api
+  namespace: enka
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 80
+    targetPort: 3000
+  selector:
+    app: enka-api

k8s/token-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-deployer-token
+  namespace: enka
+  annotations:
+    kubernetes.io/service-account.name: ci-deployer
+type: kubernetes.io/service-account-token