Skip to content

Commit 298eb8d

Browse files
UntersanderUntersander
committed
Add k8s prod deployment files and update readme
1 parent 9a6c12b commit 298eb8d

8 files changed

Lines changed: 268 additions & 70 deletions

File tree

‎README.md‎

Lines changed: 3 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,80 +1,13 @@
11
# Backend
22

3-
- Ubuntu 24.04.2 LTS
4-
- Hostname: srbsci-141.ost.ch
5-
- IP: 10.8.36.141/23
6-
- DNS: 130.59.31.251(primary)/130.59.31.248
7-
- all ports are open
8-
- 2 vCPU, RAM 4096 MB, Drive 50 GB
9-
- End of life: 2025-10-31 (automatically deleted after this date)
10-
- Support: <sgi-support@ost.ch>
3+
Runs in DMZ Kubernetes cluster of the institute for network and security at the eastern swiss university of applied sciences (OST).
4+
- Support: <jan.untersander@ost.ch>
115

126
## Service
137

148
The backend service is written in python. For development follow these [instructions](service/README.md)
159

16-
## Connect to Ubuntu server
17-
18-
1. Connect to OST VPN.
19-
2. `ssh -i ~/.ssh/id_ed25519 ins@srbsci-141.ost.ch`
20-
21-
The SSH keys of all our team members were added to the server.
22-
23-
## Connect to DB
24-
25-
OST VPN connection required! Any application that can make connections to a postgres database should work. For example [pgadmin4](https://www.pgadmin.org/download/).
26-
27-
- Hostname: `srbsci-141.ost.ch`
28-
- Port: `5432`
29-
- Database: `ost`
30-
- Username: `postgres`
31-
- Password: ask Roman
32-
33-
!["pg4 admin settings"](./img/pg4admin-settings.png "pg4 admin settings")
34-
35-
## Server setup
36-
37-
This is the server setup part, which is only needed in case the server needs to be reinstalled!
38-
39-
### Authorized keys
40-
41-
[SSH keys](https://ostch-my.sharepoint.com/:t:/r/personal/leo_oetterli_ost_ch/Documents/Bachelor_Inf_Sem6/SE-Project/Server/authorized_keys.txt?csf=1&web=1&e=AtQha6) were added to ./ssh/authorized_keys.
42-
43-
### Docker installation
44-
45-
Docker was installed using the apt repository and as shown in [this guide](https://docs.docker.com/engine/install/ubuntu/#install-using-the-repository).
46-
47-
#### Add user to docker group
48-
49-
The INS user needs to be added to the docker group, otherwise a permission denied error appears when using docker run. Refer [to this guide](https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user) for more details. The commands are the following:
50-
51-
```terminal
52-
sudo groupadd docker
53-
sudo usermod -aG docker $USER
54-
newgrp docker # applies group changes
55-
docker run hello-world # confirms the successful installation.
56-
```
57-
58-
### Clone backend repository
59-
60-
1. A new SSH key called `backend-SSH-key` was created on the server (no passphrase).
61-
2. The SSK key was added as a deploy-key (read/write) in the backend repository. [Link to guide](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys).
62-
3. `~/.ssh/config` created to use correct SSH key.
63-
64-
```text
65-
Host github.com
66-
User git
67-
IdentityFile ~/.ssh/backend-SSH-key
68-
IdentitiesOnly yes
69-
```
70-
71-
### Postgres password
72-
73-
1. In the backend repository, create a new file `touch .env` and add the password.
74-
75-
The docker-compose file will import the file as a secret and set it as the Postgres password. `.env` is added go the `.gitignore` file, so the password isn't in GitHub.
76-
7710
## Dev Setup
7811

7912
### Environment Variables
80-
Create a `.env` in the root of the directory. See the environment variables in the example.env file.
13+
Create a `.env` in the root of the directory. See the environment variables in the example.env file.

‎deployment/backend-deployment.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
annotations:
5+
labels:
6+
service: backend
7+
name: backend
8+
namespace: lost-university
9+
spec:
10+
replicas: 1
11+
selector:
12+
matchLabels:
13+
service: backend
14+
template:
15+
metadata:
16+
annotations:
17+
labels:
18+
service: backend
19+
spec:
20+
containers:
21+
- image: ghcr.io/lost-university/backend:main
22+
name: backend
23+
envFrom:
24+
- secretRef:
25+
name: backend-secrets
26+
env:
27+
- name: POSTGRES_USER
28+
valueFrom:
29+
secretKeyRef:
30+
name: lost-university-postgres-pguser-postgres
31+
key: user
32+
- name: POSTGRES_PASSWORD
33+
valueFrom:
34+
secretKeyRef:
35+
name: lost-university-postgres-pguser-postgres
36+
key: password
37+
- name: POSTGRES_DB
38+
valueFrom:
39+
secretKeyRef:
40+
name: lost-university-postgres-pguser-postgres
41+
key: dbname
42+
- name: POSTGRES_HOST
43+
valueFrom:
44+
secretKeyRef:
45+
name: lost-university-postgres-pguser-postgres
46+
key: host
47+
- name: POSTGRES_PORT
48+
valueFrom:
49+
secretKeyRef:
50+
name: lost-university-postgres-pguser-postgres
51+
key: port
52+
- name: AUTHORIZED_PARTIES
53+
value: https://lost.university
54+
ports:
55+
- name: http
56+
containerPort: 80
57+
resources:
58+
limits:
59+
cpu: "1"
60+
memory: 512Mi
61+
requests:
62+
cpu: 1
63+
memory: 512Mi
64+
---
65+
apiVersion: v1
66+
kind: Service
67+
metadata:
68+
name: backend
69+
namespace: lost-university
70+
spec:
71+
ports:
72+
- port: 80
73+
protocol: TCP
74+
targetPort: http
75+
selector:
76+
service: backend
77+
type: ClusterIP

‎deployment/cnp.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
apiVersion: cilium.io/v2
2+
kind: CiliumNetworkPolicy
3+
metadata:
4+
name: default-deny-all
5+
namespace: lost-university
6+
spec:
7+
endpointSelector: {}
8+
egress:
9+
- toEndpoints:
10+
- matchLabels:
11+
io.kubernetes.pod.namespace: kube-system
12+
k8s-app: kube-dns
13+
toPorts:
14+
- ports:
15+
- port: "53"
16+
protocol: UDP
17+
rules:
18+
dns:
19+
- matchPattern: "*"
20+
---
21+
apiVersion: cilium.io/v2
22+
kind: CiliumNetworkPolicy
23+
metadata:
24+
name: backend
25+
namespace: lost-university
26+
spec:
27+
endpointSelector:
28+
matchLabels:
29+
service: backend
30+
egress:
31+
- toFQDNs:
32+
- matchName: api.clerk.com
33+
toPorts:
34+
- ports:
35+
- port: "443"
36+
- toEndpoints:
37+
- matchLabels:
38+
postgres-operator.crunchydata.com/cluster: lost-university-postgres
39+
postgres-operator.crunchydata.com/instance-set: instance1
40+
---
41+
apiVersion: cilium.io/v2
42+
kind: CiliumNetworkPolicy
43+
metadata:
44+
name: postgres
45+
namespace: lost-university
46+
spec:
47+
endpointSelector:
48+
matchLabels:
49+
postgres-operator.crunchydata.com/cluster: lost-university-postgres
50+
postgres-operator.crunchydata.com/instance-set: instance1
51+
egress:
52+
- toEntities:
53+
- kube-apiserver

‎deployment/external-secret.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: external-secrets.io/v1
2+
kind: ExternalSecret
3+
metadata:
4+
name: backend-secrets
5+
namespace: lost-university
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: 1password-sdk
10+
target:
11+
template:
12+
data:
13+
CLERK_PUBLISHABLE_KEY: "{{ .clerkPublishableKey }}"
14+
CLERK_SECRET_KEY: "{{ .clerkSecretKey }}"
15+
data:
16+
- secretKey: clerkPublishableKey
17+
remoteRef:
18+
key: /Lost University Clerk/publishable_key
19+
- secretKey: clerkSecretKey
20+
remoteRef:
21+
key: /Lost University Clerk/credential

‎deployment/frontend-deployment.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
service: frontend
6+
name: frontend
7+
namespace: lost-university
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
service: frontend
13+
template:
14+
metadata:
15+
labels:
16+
service: frontend
17+
spec:
18+
containers:
19+
- image: ghcr.io/lost-university/web:main
20+
name: frontend
21+
ports:
22+
- name: http
23+
containerPort: 80
24+
resources:
25+
limits:
26+
cpu: "1"
27+
memory: 512Mi
28+
requests:
29+
cpu: 1
30+
memory: 512Mi
31+
---
32+
apiVersion: v1
33+
kind: Service
34+
metadata:
35+
name: frontend
36+
namespace: lost-university
37+
spec:
38+
type: ClusterIP
39+
selector:
40+
service: frontend
41+
ports:
42+
- protocol: TCP
43+
port: 80
44+
targetPort: http

‎deployment/ingress.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: lost-university-ingress
5+
namespace: lost-university
6+
spec:
7+
ingressClassName: nginx
8+
rules:
9+
- host: lost.university
10+
http:
11+
paths:
12+
- backend:
13+
service:
14+
name: frontend
15+
port:
16+
number: 80
17+
path: /
18+
pathType: Prefix
19+
tls:
20+
- hosts:
21+
- lost.university
22+
secretName: lost-university-tls
23+
---
24+
apiVersion: networking.k8s.io/v1
25+
kind: Ingress
26+
metadata:
27+
name: lost-university-ingress-api
28+
namespace: lost-university
29+
spec:
30+
ingressClassName: nginx
31+
rules:
32+
- host: lost.university
33+
http:
34+
paths:
35+
- backend:
36+
service:
37+
name: backend
38+
port:
39+
number: 80
40+
path: /api(/|$)(.*)
41+
pathType: ImplementationSpecific
42+
tls:
43+
- hosts:
44+
- lost.university
45+
secretName: lost-university-tls

‎deployment/ns.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: lost-university

‎deployment/postgres-db.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: postgres-operator.crunchydata.com/v1beta1
2+
kind: PostgresCluster
3+
metadata:
4+
name: lost-university-postgres
5+
namespace: lost-university
6+
annotations:
7+
postgres-operator.crunchydata.com/autoCreateUserSchema: "true"
8+
spec:
9+
postgresVersion: 17
10+
users:
11+
- name: postgres
12+
databases:
13+
- ost
14+
instances:
15+
- name: instance1
16+
dataVolumeClaimSpec:
17+
accessModes:
18+
- ReadWriteOnce
19+
resources:
20+
requests:
21+
storage: 10Gi

0 commit comments

Comments
 (0)