kube infrastructure

kube/configmap.yaml

@@ -0,0 +1,81 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blog-nginx
+data:
+  nginx.conf: |
+    worker_processes auto;
+    pid /tmp/nginx.pid;
+
+    events {
+        worker_connections 1024;
+    }
+
+    http {
+        include mime.types;
+        
+        sendfile        on;
+        tcp_nopush     on;
+        # Prevent nginx HTTP Server Detection
+        server_tokens   off;
+
+        keepalive_timeout  65;
+
+        server {
+            server_name tymur999.com;
+            listen 8000;
+
+            # set max upload size and increase upload timeout:
+            client_max_body_size 10G;
+            client_body_timeout 300s;
+
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-Proto https;
+
+            gzip on;
+            gzip_vary on;
+            gzip_comp_level 4;
+            gzip_min_length 256;
+            gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+            gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+            # HTTP response headers borrowed from Nextcloud `.htaccess`
+            add_header Referrer-Policy                      "no-referrer"       always;
+            add_header X-Content-Type-Options               "nosniff"           always;
+            add_header X-Frame-Options                      "SAMEORIGIN"        always;
+            add_header X-Permitted-Cross-Domain-Policies    "none"              always;
+            add_header X-Robots-Tag                         "noindex, nofollow" always;
+            add_header X-XSS-Protection                     "1; mode=block"     always;
+
+            # Path to the root of your installation
+            root /var/www/html;
+            index index.html;
+
+            location = /robots.txt {
+                allow all;
+                log_not_found off;
+                access_log off;
+            }
+
+            # Serve static files
+            location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
+                try_files $uri /index.php$request_uri;
+                add_header Cache-Control "public, max-age=15778463";
+                add_header Referrer-Policy                   "no-referrer"       always;
+                add_header X-Content-Type-Options            "nosniff"           always;
+                add_header X-Frame-Options                   "SAMEORIGIN"        always;
+                add_header X-Permitted-Cross-Domain-Policies "none"              always;
+                add_header X-Robots-Tag                      "noindex, nofollow" always;
+                add_header X-XSS-Protection                  "1; mode=block"     always;
+            }
+
+            location ~ \.(otf|woff2?)$ {
+                try_files $uri /index.php$request_uri;
+                expires 7d;         # Cache-Control policy borrowed from `.htaccess`
+            }
+
+            location / {
+                try_files $uri $uri/ /index.php$request_uri;
+            }
+        }
+    }

kube/deployment.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata: &meta
+  name: blog
+  labels: &labels
+    app: blog
+spec:
+  replicas: 1
+  selector:
+    matchLabels: *labels
+  template:
+    metadata: *meta
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: nginx
+          image: nginx
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8000
+              protocol: TCP
+              name: http
+          volumeMounts:
+            - mountPath: /var/www/html
+              name: html
+              readOnly: true
+            - mountPath: /etc/nginx/nginx.conf
+              name: nginx-conf
+              subPath: nginx.conf
+              readOnly: true
+      volumes:
+        - name: html
+          persistentVolumeClaim:
+            claimName: blog-html
+        - name: nginx-conf
+          configMap:
+            name: blog-nginx
+            items:
+              - key: nginx.conf
+                path: nginx.conf

kube/ingress.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: blog
+  labels:
+    app: blog
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - tymur999.com
+  rules:
+    - host: tymur999.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: blog
+                port:
+                  name: http

kube/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: blog-html
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1T
+  volumeName: blog-html

kube/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: blog
+  labels: &labels
+    app: blog
+spec:
+  ports:
+    - port: 80
+      protocol: TCP
+      targetPort: http
+      name: http
+  selector: *labels

kube/volume.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: blog-html
+spec:
+  capacity:
+    storage: 1T
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Delete
+  local:
+    path: /hdd/blog
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - tymur999srv