mirror of
https://github.com/block/buzz.git
synced 2026-11-13 21:01:53 +00:00
7012d86d52
## Summary - add one strict `BUZZ_S3_ADDRESSING_STYLE=path|virtual` setting shared by media and Git/CAS storage - preserve path-style defaults for bundled Compose/Helm MinIO while supporting Railway's virtual-hosted bucket contract - fail startup on invalid or non-Unicode values before dependency connection, and validate the Helm value with the same two choices - document operator mappings and why endpoint and bucket remain separate for routing and SigV4 signing ## Best-practice rationale AWS documents both URL forms and favors virtual-hosted addressing for S3, while compatibility endpoints such as the bundled MinIO deployment can require path style. `rust-s3` defaults to virtual/subdomain addressing and provides `with_path_style()` for the explicit compatibility case. Some providers buckets only support as virtual-hosted bucket styles. This PR therefore uses one explicit, provider-neutral switch rather than endpoint heuristics or fallback behavior, while retaining `path` as Buzz's backward-compatible default. Sources: - https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html - https://docs.rs/rust-s3/0.37.0/s3/bucket/struct.Bucket.html - https://docs.railway.com/storage-buckets#url-style - https://github.com/minio/minio/blob/master/docs/config/README.md#domain ## Validation - `cargo fmt --all` - `cargo check --workspace --all-targets` - targeted `buzz-media` and `buzz-relay` parsing/client-construction tests for defaults, strict errors, and both URL styles - Helm unittest: 45/45 passed - Compose config/render validation passed - local MinIO path-mode relay startup passed the Git A3 conformance probe and became ready - unreachable object storage failed startup and readiness never opened - push hooks completed the broader Rust and desktop suites successfully --------- Signed-off-by: npub122y0pqkertljmedu303rl0aqrj3w8pvu43t6jxm6875lzg6f2pwqegc3xc <5288f082d91aff2de5bc8be23fbfa01ca2e3859cac57a91b7a3fa9f12349505c@buzz.block.builderlab.xyz> Signed-off-by: Kalvin Chau <kalvin@block.xyz> Co-authored-by: npub122y0pqkertljmedu303rl0aqrj3w8pvu43t6jxm6875lzg6f2pwqegc3xc <5288f082d91aff2de5bc8be23fbfa01ca2e3859cac57a91b7a3fa9f12349505c@buzz.block.builderlab.xyz>
64 lines
1.7 KiB
YAML
64 lines
1.7 KiB
YAML
# Flux HelmRelease — GitOps-safe Buzz install.
|
|
#
|
|
# Prerequisite: a Secret named `buzz-secrets` in namespace `buzz`. See
|
|
# `secret-sample.yaml`. Flux renders the chart server-side via the
|
|
# helm-controller, which (like ArgoCD) treats chart-side `randAlphaNum`
|
|
# autogen as non-idempotent. `existingSecret` is the only safe path.
|
|
---
|
|
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: HelmRepository
|
|
metadata:
|
|
name: buzz
|
|
namespace: buzz
|
|
spec:
|
|
type: oci
|
|
url: oci://ghcr.io/block/buzz/charts
|
|
interval: 10m
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: buzz
|
|
namespace: buzz
|
|
spec:
|
|
interval: 10m
|
|
chart:
|
|
spec:
|
|
chart: buzz
|
|
version: "0.1.0"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: buzz
|
|
values:
|
|
relayUrl: wss://buzz.example.com
|
|
ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000" # replace
|
|
replicaCount: 3
|
|
|
|
secrets:
|
|
existingSecret: buzz-secrets
|
|
|
|
|
|
s3:
|
|
endpoint: "https://s3.us-east-1.amazonaws.com"
|
|
bucket: "buzz-media"
|
|
region: "us-east-1"
|
|
addressingStyle: virtual
|
|
|
|
persistence:
|
|
git:
|
|
enabled: true
|
|
accessMode: ReadWriteOnce # RWO is fine at any replicaCount (object-store-backed git)
|
|
storageClass: "" # any RWO class; no shared/RWX filesystem needed
|
|
size: 50Gi
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
tls:
|
|
- hosts: [buzz.example.com]
|
|
secretName: buzz-tls
|