Changeset 0.6.0 (#36)

k8s/backend.yaml

@@ -2,6 +2,14 @@
 # ============================================
 # Chat Switchboard - Backend Deployment
 # ============================================
+# Secrets:
+#   switchboard-db-credentials  - POSTGRES_USER, POSTGRES_PASSWORD
+#   switchboard-admin           - username, password, email (optional)
+#
+# Admin bootstrap: on every pod start, if SWITCHBOARD_ADMIN_* env vars
+# are set, the backend upserts an admin user. Change the secret and
+# restart the pod to reset the admin password.
+# ============================================
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -37,6 +45,8 @@ spec:
           value: "${ENVIRONMENT}"
         - name: PORT
           value: "8080"
+        - name: BASE_PATH
+          value: "${BASE_PATH}"
         - name: POSTGRES_HOST
           value: "${POSTGRES_HOST}"
         - name: POSTGRES_PORT
@@ -55,6 +65,24 @@ spec:
               key: POSTGRES_PASSWORD
         - name: DATABASE_URL
           value: "postgres://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@${POSTGRES_HOST}:${POSTGRES_PORT}/${DB_NAME}?sslmode=disable"
+        - name: SWITCHBOARD_ADMIN_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: switchboard-admin
+              key: username
+              optional: true
+        - name: SWITCHBOARD_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: switchboard-admin
+              key: password
+              optional: true
+        - name: SWITCHBOARD_ADMIN_EMAIL
+          valueFrom:
+            secretKeyRef:
+              name: switchboard-admin
+              key: email
+              optional: true
         resources:
           requests:
             memory: "${BE_MEMORY_REQUEST}"
@@ -64,7 +92,7 @@ spec:
             cpu: "${BE_CPU_LIMIT}"
         readinessProbe:
           httpGet:
-            path: /health
+            path: ${BASE_PATH}/health
             port: 8080
           initialDelaySeconds: 5
           periodSeconds: 10
@@ -72,7 +100,7 @@ spec:
           failureThreshold: 3
         livenessProbe:
           httpGet:
-            path: /health
+            path: ${BASE_PATH}/health
             port: 8080
           initialDelaySeconds: 10
           periodSeconds: 30

k8s/frontend.yaml

@@ -35,6 +35,9 @@ spec:
         ports:
         - containerPort: 80
           name: http
+        env:
+        - name: BASE_PATH
+          value: "${BASE_PATH}"
         resources:
           requests:
             memory: "${FE_MEMORY_REQUEST}"
@@ -44,7 +47,7 @@ spec:
             cpu: "${FE_CPU_LIMIT}"
         readinessProbe:
           httpGet:
-            path: /
+            path: /healthz
             port: 80
           initialDelaySeconds: 3
           periodSeconds: 10
@@ -52,7 +55,7 @@ spec:
           failureThreshold: 3
         livenessProbe:
           httpGet:
-            path: /
+            path: /healthz
             port: 80
           initialDelaySeconds: 5
           periodSeconds: 30

k8s/ingress.yaml

@@ -2,11 +2,18 @@
 # ============================================
 # Chat Switchboard - Ingress
 # ============================================
-# Routes for a single subdomain:
-#   /api/*   → backend service (Go API on :8080)
-#   /health  → backend service (health check)
-#   /ws      → backend service (WebSocket, upgraded)
-#   /*       → frontend service (nginx SPA on :80)
+# Path-based routing on a single domain:
+#   switchboard.DOMAIN/         → production
+#   switchboard.DOMAIN/test/    → test (main branch)
+#   switchboard.DOMAIN/dev/     → dev  (PR branches)
+#
+# Each environment deploys its own Ingress resource.
+# Traefik merges rules for the same host automatically.
+# Longer path prefixes take priority (Traefik default).
+#
+# BASE_PATH is empty for prod, "/test" or "/dev" for others.
+# Backend handles BASE_PATH via r.Group(cfg.BasePath).
+# Frontend entrypoint injects BASE_PATH into nginx + HTML.
 # ============================================
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -24,13 +31,13 @@ spec:
   tls:
   - hosts:
     - ${DEPLOY_HOST}
-    secretName: switchboard${DEPLOY_SUFFIX}-tls
+    secretName: switchboard-tls
   rules:
   - host: "${DEPLOY_HOST}"
     http:
       paths:
       # API routes → backend
-      - path: /api
+      - path: ${BASE_PATH}/api
         pathType: Prefix
         backend:
           service:
@@ -38,7 +45,7 @@ spec:
             port:
               number: 8080
       # Health check → backend
-      - path: /health
+      - path: ${BASE_PATH}/health
         pathType: Exact
         backend:
           service:
@@ -46,15 +53,15 @@ spec:
             port:
               number: 8080
       # WebSocket → backend (traefik handles upgrade automatically)
-      - path: /ws
+      - path: ${BASE_PATH}/ws
         pathType: Exact
         backend:
           service:
             name: switchboard-be${DEPLOY_SUFFIX}
             port:
               number: 8080
-      # Everything else → frontend
-      - path: /
+      # Everything else under this prefix → frontend
+      - path: ${BASE_PATH}/
         pathType: Prefix
         backend:
           service: