mirror of
https://github.com/block/buzz.git
synced 2026-10-31 14:31:02 +00:00
781d39510c
The relay can use a configurable HTTP(S) gateway delivery URL and signs the same URL it sends. The gateway verifies NIP-98 against the received request URL, including authority, port, path and query. App Attest, scoped grants, replay checks and delivery quotas are unchanged. Forwarding proxies must preserve Host and supply the original request scheme through X-Forwarded-Proto. The NIP relay-delivery wording now defines the configured HTTP(S) URL as the signed URL and labels the public URL as an example. <!-- buzz-review-completed --> --------- Signed-off-by: Tom Brow <tomb@block.xyz>
70 lines
4.0 KiB
YAML
70 lines
4.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "push.name" . }}
|
|
labels: {{- include "push.runtimeLabels" . | nindent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.replicaCount }}
|
|
strategy: { type: RollingUpdate, rollingUpdate: { maxSurge: 1, maxUnavailable: 0 } }
|
|
selector:
|
|
matchLabels: {{- include "push.runtimeLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels: {{- include "push.runtimeLabels" . | nindent 8 }}
|
|
{{- with .Values.podAnnotations }}
|
|
annotations: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
terminationGracePeriodSeconds: 60
|
|
securityContext: { runAsNonRoot: true, runAsUser: 65532, runAsGroup: 65532, fsGroup: 65532, seccompProfile: { type: RuntimeDefault } }
|
|
{{- with .Values.image.pullSecrets }}
|
|
imagePullSecrets: {{ toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: gateway
|
|
image: "{{ .Values.image.repository }}{{ if .Values.image.digest }}@{{ .Values.image.digest }}{{ else }}:{{ required "image.tag or image.digest is required" .Values.image.tag }}{{ end }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: { drop: [ALL] } }
|
|
ports:
|
|
- { name: public, containerPort: 8080 }
|
|
- { name: health, containerPort: 8081 }
|
|
env:
|
|
- { name: BUZZ_PUSH_BIND_ADDR, value: "0.0.0.0:8080" }
|
|
- { name: BUZZ_PUSH_HEALTH_ADDR, value: "0.0.0.0:8081" }
|
|
{{/* Schema bounds this integer; normalize YAML numbers before quote can emit scientific notation. */}}
|
|
- { name: BUZZ_PUSH_MAX_GRANT_LIFETIME_SECONDS, value: {{ .Values.maxGrantLifetimeSeconds | int64 | quote }} }
|
|
- { name: BUZZ_PUSH_APP_ATTEST_ROOT_CERT_PATH, value: /run/buzz/app-attest/root.pem }
|
|
- { name: BUZZ_PUSH_DOGFOOD_APP_ATTEST_APP_ID, value: {{ .Values.profiles.dogfood.appAttestAppId | quote }} }
|
|
- { name: BUZZ_PUSH_DOGFOOD_APNS_TOPIC, value: {{ .Values.profiles.dogfood.apnsTopic | quote }} }
|
|
- { name: BUZZ_PUSH_DOGFOOD_APNS_ENVIRONMENT, value: {{ .Values.profiles.dogfood.apnsEnvironment | quote }} }
|
|
- { name: BUZZ_PUSH_DOGFOOD_APNS_CERT_PATH, value: /run/buzz/apns-dogfood/identity.pem }
|
|
{{- range $name := list "DATABASE_URL" "BUZZ_PUSH_GRANT_KEYS" "BUZZ_PUSH_TOKEN_KEYS" }}
|
|
- name: {{ $name }}
|
|
valueFrom: { secretKeyRef: { name: {{ $.Values.existingSecret }}, key: {{ $name }} } }
|
|
{{- end }}
|
|
volumeMounts:
|
|
- { name: app-attest-root, mountPath: /run/buzz/app-attest, readOnly: true }
|
|
- { name: apns-dogfood, mountPath: /run/buzz/apns-dogfood, readOnly: true }
|
|
livenessProbe: { httpGet: { path: /_liveness, port: health }, periodSeconds: 10, timeoutSeconds: 3, failureThreshold: 3 }
|
|
readinessProbe: { httpGet: { path: /_readiness, port: health }, periodSeconds: 5, timeoutSeconds: 3, failureThreshold: 3 }
|
|
startupProbe: { httpGet: { path: /_liveness, port: health }, periodSeconds: 2, failureThreshold: 60 }
|
|
resources: {{- toYaml .Values.resources | nindent 12 }}
|
|
volumes:
|
|
- name: app-attest-root
|
|
secret: { secretName: {{ .Values.appAttestRoot.secretName }}, items: [{ key: {{ .Values.appAttestRoot.secretKey }}, path: root.pem }] }
|
|
- name: apns-dogfood
|
|
secret: { secretName: {{ .Values.profiles.dogfood.apnsCert.secretName }}, defaultMode: 0400, items: [{ key: {{ .Values.profiles.dogfood.apnsCert.secretKey }}, path: identity.pem }] }
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.topologySpreadConstraints }}
|
|
topologySpreadConstraints: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|