nholtware/platform
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(new-service): render __DOMAIN__ from INGRESS_DOMAIN; HTTPS URLs and health checks

Browse source 
Plan 11 step 7. INGRESS_DOMAIN=lab.holtlabs.xyz; health checks pin the host
to INGRESS_IP on 443 and verify the wildcard cert.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
nholtware 2026-11-10 13:15:00 -06:00
parent b133a0d120
commit 2a6971df03
4 changed files with 22 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

15
README.md
View file

@ -37,11 +37,11 @@ new-service NAME --kind backend|frontend [--with postgres,redis] [--api BACKEND]
| 2 | generate public repo from `service-template-express` / `service-template-react` | repo exists |
| 3 | set Actions secrets `REGISTRY_USER`, `REGISTRY_TOKEN`, `GITOPS_TOKEN` | never (PUT is idempotent) |
| 4 | create namespace + Secret `unleash-client-token` (copied from `unleash/unleash-init-tokens`) | they exist |
| 5 | render gitops `templates/<kind>` (+ `postgres`, `redis`) → `manifests/NAME`, `kustomize build` lint, commit, push | dir exists |
| 5 | render gitops `templates/<kind>` (+ `postgres`, `redis`; `__APP__`, `__API__`, `__DOMAIN__`) → `manifests/NAME`, `kustomize build` lint, commit, push | dir exists |
| 6 | clone repo to `$CODE_DIR/NAME`, push empty commit `chore: kick ci` | CI already deployed, or a kick is running/succeeded |
| 7 | wait for CI's `gitops-bump` to replace `newTag: latest` (fails fast if the CI run fails) | tag already bumped |
| 8 | write `apps/NAME.yaml`, commit, push, refresh ArgoCD `root` | file exists |
| 9 | `--wait`: ArgoCD app `Synced/Healthy`, then `/readyz` (backend) or `/healthz` + `/api/readyz` (frontend) → 200 | no `--wait` |
| 9 | `--wait`: ArgoCD app `Synced/Healthy`, then `https://NAME.$INGRESS_DOMAIN/readyz` (backend) or `/healthz` + `/api/readyz` (frontend) → 200 | no `--wait` |
Then it prints the service, ArgoCD, Kibana (pre-filtered on `service:"NAME"`)
and Unleash URLs, and the elapsed time.
@ -91,6 +91,11 @@ call (secret values redacted), git push and kubectl change instead of doing it.
registry push token (same user).
- Git pushes use the admin token through an inline credential helper; it is
never written into a remote URL or `argv`.
- Platform UIs: ArgoCD, Kibana and Unleash at `argocd.` / `kibana.` /
`unleash.192.168.1.83.nip.io`. Credentials and conventions: homelab
`PLATFORM.md`.
- Platform UIs: ArgoCD, Kibana and Unleash at `https://argocd.` / `kibana.` /
`unleash.lab.holtlabs.xyz` (`INGRESS_DOMAIN`). Credentials and conventions:
homelab `PLATFORM.md`.
- `INGRESS_DOMAIN` (`lab.holtlabs.xyz`) fills `__DOMAIN__` in the gitops
templates, so services get `https://NAME.$INGRESS_DOMAIN/`. The wildcard
DNS record and the wildcard certificate are cluster-level (Plan 11); a new
service creates no DNS record and requests no certificate. Health checks
pin the host to `INGRESS_IP` with `curl --resolve` but still verify TLS.