Marcos Paulo
e2bcfff5ab
The skills-review desk is static, so "which draft would you ship?" needs a stateful counterpart. vote-service is a small Go API on its own pod backed by a JSON file on a ReadWriteOnce PVC, with one active vote per skill per source IP as the anti-abuse rule and CORS (ALLOWED_ORIGIN) as the caller boundary. Deployment notes that differ from the obvious path, all confirmed against the live cluster: the image is side-loaded with `ctr image import` plus `imagePullPolicy: Never` because kubelet has no credentials for the Nexus ref; the pod is pinned to `kubernets` because the hostpath PV takes a nodeAffinity for whichever node first binds it; and public exposure is Caddy on the VPS, not the cloudflared tunnel. The ingress controller runs with `use-forwarded-headers` off, so nginx overwrites X-Forwarded-For with its own peer — every visitor would collapse into one voter and each skill would cap at one vote overall. Caddy stamps the true remote address into X-Client-IP, which nginx forwards untouched, and clientIP() reads that first. Scoped to this app rather than flipping the global flag, which would change client-IP handling for every other ingress. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
# Public exposure is required: the vote widget runs in each visitor's
|
|
# browser (client-side JS on a static Pages site), so it calls this API
|
|
# straight from the internet — it cannot reach a cluster-internal-only
|
|
# Service. CORS (ALLOWED_ORIGIN in deployment.yaml) is the real boundary:
|
|
# it restricts which origin's browser code may call the API, not which
|
|
# network can reach it.
|
|
#
|
|
# No `tls:` block here on purpose: TLS is terminated upstream by Caddy on the
|
|
# Oracle VPS, which reverse-proxies over Tailscale to this node's port 80
|
|
# (the nginx ingress runs on hostNetwork and routes by Host). That is how all
|
|
# ~21 public hosts in this account are served. Reaching this host publicly
|
|
# needs the DNS record plus the Caddy block — see vote-service/README.md:
|
|
# cf-dns add ai-for-dummies-vote A 129.148.56.8
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: ai-for-dummies-vote
|
|
namespace: ai-for-dummies
|
|
spec:
|
|
ingressClassName: public
|
|
rules:
|
|
- host: ai-for-dummies-vote.marcospaulo.dev.br
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: ai-for-dummies-vote
|
|
port:
|
|
number: 80
|