mirror of
https://github.com/block/buzz.git
synced 2026-10-30 05:51:46 +00:00
781d39510c
The relay can use a configurable HTTP(S) gateway delivery URL and signs the same URL it sends. The gateway verifies NIP-98 against the received request URL, including authority, port, path and query. App Attest, scoped grants, replay checks and delivery quotas are unchanged. Forwarding proxies must preserve Host and supply the original request scheme through X-Forwarded-Proto. The NIP relay-delivery wording now defines the configured HTTP(S) URL as the signed URL and labels the public URL as an example. <!-- buzz-review-completed --> --------- Signed-off-by: Tom Brow <tomb@block.xyz>
98 lines
3.4 KiB
YAML
98 lines
3.4 KiB
YAML
replicaCount: 2
|
|
image:
|
|
repository: ghcr.io/block/buzz-push-gateway
|
|
# `main` is published by the push-gateway lane on every main push.
|
|
tag: main
|
|
digest: ""
|
|
pullPolicy: IfNotPresent
|
|
pullSecrets: []
|
|
existingSecret: buzz-push-gateway
|
|
# DDL-capable credentials are used only by the pre-install/pre-upgrade migration
|
|
# Job. Runtime DATABASE_URL in existingSecret should have DML-only privileges.
|
|
migration:
|
|
existingSecret: buzz-push-gateway-migrations
|
|
databaseUrlKey: DATABASE_URL
|
|
# Existing LOGIN role used by runtime DATABASE_URL. Migrations grant it only
|
|
# CONNECT plus DML on the six gateway tables in this dedicated database.
|
|
runtimeDatabaseRole: buzz_push_gateway_runtime
|
|
resources:
|
|
requests: {cpu: 50m, memory: 64Mi}
|
|
limits: {cpu: 250m, memory: 128Mi}
|
|
# Routing origin used only when httpRoute.enabled=true. Not passed to the binary.
|
|
gatewayOrigin: ""
|
|
maxGrantLifetimeSeconds: 2592000
|
|
profiles:
|
|
dogfood:
|
|
# Production MUST override this with the exact Apple TEAMID.bundle-id.
|
|
appAttestAppId: TEAMID.xyz.block.buzz.dogfood.mobile
|
|
apnsTopic: xyz.block.buzz.dogfood.mobile
|
|
apnsEnvironment: production
|
|
apnsCert:
|
|
secretName: buzz-push-gateway
|
|
secretKey: dogfood-apns-identity.pem
|
|
appAttestRoot:
|
|
secretName: buzz-push-gateway
|
|
secretKey: app-attest-root.pem
|
|
service:
|
|
port: 8080
|
|
podAnnotations: {}
|
|
httpRoute:
|
|
# Disabled by default so a generic install cannot claim an unattached route.
|
|
# Enable only when this chart owns a Gateway API route. Environments with an
|
|
# existing ingress or service mesh route should keep this disabled.
|
|
enabled: false
|
|
parentRefs: []
|
|
resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
minAvailable: 1
|
|
networkPolicy:
|
|
enabled: true
|
|
# Kubernetes NetworkPolicy cannot allow DNS names. Production operators must
|
|
# narrow these CIDRs to their PostgreSQL/NAT destinations where supported.
|
|
apnsEgressCidrs: [0.0.0.0/0]
|
|
# Override with the actual database network. This example private range is
|
|
# intentionally separate from broad APNs HTTPS egress.
|
|
postgresEgressCidrs: [10.0.0.0/8]
|
|
dns:
|
|
namespaceSelector:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
k8s-app: kube-dns
|
|
# Scoped ingress to the private metrics port (8081). Off by default so 8081
|
|
# has no pod ingress at all; enable alongside podMonitor or an external
|
|
# annotation-discovered scraper and name its namespace/pod so reachability
|
|
# stays narrow.
|
|
monitoring:
|
|
enabled: false
|
|
namespaceSelector: {}
|
|
podSelector: {}
|
|
# Prometheus-operator PodMonitor scraping the private /metrics on port 8081.
|
|
# Off by default; requires networkPolicy.monitoring to also be enabled.
|
|
podMonitor:
|
|
enabled: false
|
|
interval: 30s
|
|
scrapeTimeout: 10s
|
|
labels: {}
|
|
# Prometheus-operator alerting rules. Off by default.
|
|
prometheusRule:
|
|
enabled: false
|
|
labels: {}
|
|
# Retryable-outcome fraction (0..1] that fires PushGatewayHighApnsRetryRate.
|
|
apnsRetryRatioThreshold: 0.25
|
|
# Minimum APNs attempts in the 10m window before the retry-ratio alert can
|
|
# fire, so a couple of retries at trivial volume cannot trip it.
|
|
apnsRetryMinSamples: 20
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: buzz-push-gateway
|