feat : 6 astra improve it

k8s/base/configmap.yaml

@@ -7,7 +7,8 @@ metadata:
 data:
   BASE_URL: https://guide.sudloh.com
   BETTER_AUTH_URL: https://guide.sudloh.com
-  BUZZ_DEMO_MODE: "false"
+  # Traefik must overwrite this header; do not expose the app directly.
+  TRUSTED_CLIENT_IP_HEADER: x-real-ip
   DATABASE_POOL_SIZE: "10"
   HEALTHCHECK_TIMEOUT_MS: "2500"
   NEXT_DEPLOYMENT_ID: replace-me
@@ -18,5 +19,7 @@ data:
   REDIS_CACHE_PREFIX: buzz:next-cache
   REDIS_EVENT_PREFIX: buzz:events
   REDIS_PRESENCE_PREFIX: buzz:presence
+  REDIS_SECURITY_PREFIX: buzz:security
+  CATALOG_SYNC_CONCURRENCY: "12"
   S3_REGION: auto
   S3_VIRTUAL_HOSTED_STYLE: "false"

k8s/base/deployment.yaml

@@ -46,9 +46,62 @@ spec:
           envFrom:
             - configMapRef:
                 name: buzz-sheet-config
-            - secretRef:
-                name: buzz-sheet-env
           env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: DATABASE_URL
+            - name: REDIS_URL
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: REDIS_URL
+            - name: S3_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_ENDPOINT
+            - name: S3_PUBLIC_URL
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_PUBLIC_URL
+            - name: S3_BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_BUCKET
+            - name: S3_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_ACCESS_KEY_ID
+            - name: S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_SECRET_ACCESS_KEY
+            - name: BETTER_AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: BETTER_AUTH_SECRET
+            - name: TURNSTILE_SITE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: TURNSTILE_SITE_KEY
+            - name: TURNSTILE_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: TURNSTILE_SECRET_KEY
+            - name: NEXT_SERVER_ACTIONS_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: NEXT_SERVER_ACTIONS_ENCRYPTION_KEY
             - name: NEXT_DEPLOYMENT_ID
               valueFrom:
                 configMapKeyRef:

k8s/base/discord-worker-deployment.yaml

@@ -40,9 +40,52 @@ spec:
           envFrom:
             - configMapRef:
                 name: buzz-sheet-config
-            - secretRef:
-                name: buzz-sheet-env
           env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: DATABASE_URL
+            - name: REDIS_URL
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: REDIS_URL
+            - name: S3_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_ENDPOINT
+            - name: S3_PUBLIC_URL
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_PUBLIC_URL
+            - name: S3_BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_BUCKET
+            - name: S3_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_ACCESS_KEY_ID
+            - name: S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: S3_SECRET_ACCESS_KEY
+            - name: DISCORD_BOT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: DISCORD_BOT_TOKEN
+            - name: DISCORD_CHANNEL_ID
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: DISCORD_CHANNEL_ID
             - name: NEXT_DEPLOYMENT_ID
               valueFrom:
                 configMapKeyRef:

k8s/base/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - discord-worker-deployment.yaml
   - service.yaml
   - ingress.yaml
+  - network-policy.yaml
   - hpa.yaml
   - pdb.yaml
   - ci-rbac.yaml

k8s/base/network-policy.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: buzz-sheet-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: buzz-sheet
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 3000

k8s/base/worker-deployment.yaml

@@ -43,9 +43,17 @@ spec:
           envFrom:
             - configMapRef:
                 name: buzz-sheet-config
-            - secretRef:
-                name: buzz-sheet-env
           env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: DATABASE_URL
+            - name: REDIS_URL
+              valueFrom:
+                secretKeyRef:
+                  name: buzz-sheet-env
+                  key: REDIS_URL
             - name: NEXT_DEPLOYMENT_ID
               valueFrom:
                 configMapKeyRef: