masoodafar-web
194663e2fd
build-and-deploy / deploy (push) Successful in 3m27s
Limit auth/read/write JSON traffic per IP while leaving audio streams unrestricted; close JWT+deviceId IDOR and add path/input guards. Co-authored-by: Cursor <cursoragent@cursor.com>
168 lines
3.8 KiB
YAML
168 lines
3.8 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: tafsirquran
|
|
---
|
|
# SECURITY: Rotate MSSQL_SA_PASSWORD and Jwt__Key out-of-band; prefer sealed-secrets /
|
|
# external secret store. Do not commit newly rotated production credentials to git.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: tafsirquran-secrets
|
|
namespace: tafsirquran
|
|
type: Opaque
|
|
stringData:
|
|
MSSQL_SA_PASSWORD: "87zH26nbqT"
|
|
Jwt__Key: TafsirQuran-Prod-Secret-Key-Change-Me-32chars
|
|
ConnectionStrings__Default: "Server=mssql-svc.platform.svc.cluster.local,1433;Database=TafsirQuran;User Id=sa;Password=87zH26nbqT;TrustServerCertificate=True;Encrypt=False"
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: tafsirquran-api-env
|
|
namespace: tafsirquran
|
|
data:
|
|
ASPNETCORE_URLS: "http://+:5080"
|
|
AudioRoot: "/data/audio"
|
|
Jwt__Issuer: "TafsirQuran"
|
|
Jwt__Audience: "TafsirQuran"
|
|
Jwt__ExpireMinutes: "43200"
|
|
Cors__Origins__0: "https://quran.afrino.co"
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: tafsirquran-web-env
|
|
namespace: tafsirquran
|
|
data:
|
|
ApiBaseAddress: "https://quranb.afrino.co/"
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: tafsirquran-audio
|
|
namespace: tafsirquran
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: local-path
|
|
resources:
|
|
requests:
|
|
storage: 100Gi
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: tafsirquran-api
|
|
namespace: tafsirquran
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: tafsirquran-api
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: tafsirquran-api
|
|
spec:
|
|
containers:
|
|
- name: api
|
|
image: tafsirquran-api:latest
|
|
imagePullPolicy: Never
|
|
ports:
|
|
- containerPort: 5080
|
|
envFrom:
|
|
- configMapRef:
|
|
name: tafsirquran-api-env
|
|
env:
|
|
- name: Jwt__Key
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: tafsirquran-secrets
|
|
key: Jwt__Key
|
|
- name: ConnectionStrings__Default
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: tafsirquran-secrets
|
|
key: ConnectionStrings__Default
|
|
volumeMounts:
|
|
- name: audio
|
|
mountPath: /data/audio
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 5080
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 5080
|
|
initialDelaySeconds: 40
|
|
periodSeconds: 20
|
|
volumes:
|
|
- name: audio
|
|
persistentVolumeClaim:
|
|
claimName: tafsirquran-audio
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: tafsirquran-api
|
|
namespace: tafsirquran
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
app: tafsirquran-api
|
|
ports:
|
|
- port: 5080
|
|
targetPort: 5080
|
|
nodePort: 30821
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: tafsirquran-web
|
|
namespace: tafsirquran
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: tafsirquran-web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: tafsirquran-web
|
|
spec:
|
|
containers:
|
|
- name: web
|
|
image: tafsirquran-web:latest
|
|
imagePullPolicy: Never
|
|
ports:
|
|
- containerPort: 80
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 80
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 80
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: tafsirquran-web
|
|
namespace: tafsirquran
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
app: tafsirquran-web
|
|
ports:
|
|
- port: 80
|
|
targetPort: 80
|
|
nodePort: 30820
|