ipsportal.yaml

kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: ipsportal
  name: db
  labels:
    app: ipsportal-db
spec:
  selector:
    matchLabels:
      app: ipsportal-db
  strategy:
    rollingUpdate:
      maxSurge: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: ipsportal-db
    spec:
      containers:
      - name: db
        image: mongo:6
        env:
        - name: MONGO_INITDB_ROOT_USERNAME_FILE
          value: /secrets/MONGO_USERNAME
        - name: MONGO_INITDB_ROOT_PASSWORD_FILE
          value: /secrets/MONGO_PASSWORD
        securityContext:
          capabilities:
            add:
            - CHOWN
            - DAC_OVERRIDE
            - FOWNER
            - SETGID
            - SETUID
            drop:
            - ALL
        volumeMounts:
        - mountPath: /data/db
          name: mongo
        - mountPath: /secrets
          name: secrets
      volumes:
      - name: mongo
        persistentVolumeClaim:
          claimName: mongo
      - name: secrets
        secret:
          secretName: mongo-secrets
          defaultMode: 292

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: ipsportal
  name: minio
  labels:
    app: ipsportal-minio
spec:
  selector:
    matchLabels:
      app: ipsportal-minio
  strategy:
    rollingUpdate:
      maxSurge: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: ipsportal-minio
    spec:
      containers:
      - name: minio
        image: "minio/minio:RELEASE.2025-09-07T16-13-09Z-cpuv1"
        env:
        - name: MINIO_SERVER_URL
          value: "https://data.ipsportal.development.svc.spin.nersc.org/"
        - name: MINIO_BROWSER_REDIRECT_URL
          value: "https://data.ipsportal.development.svc.spin.nersc.org/console/"
        envFrom:
        - secretRef:
            name: minio-secrets
        args: ["server", "start"]
        securityContext:
          capabilities:
            add:
            - CHOWN
            - DAC_OVERRIDE
            - FOWNER
            - SETGID
            - SETUID
            drop:
            - ALL
        volumeMounts:
        - mountPath: /data
          name: minio
      volumes:
      - name: minio
        persistentVolumeClaim:
          claimName: minio

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: ipsportal
  name: jaeger
  labels:
    app: ipsportal-jaeger
spec:
  selector:
    matchLabels:
      app: ipsportal-jaeger
  template:
    metadata:
      labels:
        app: ipsportal-jaeger
    spec:
      containers:
      - name: jaeger
        image: jaegertracing/all-in-one:1.38
        env:
        - name: COLLECTOR_ZIPKIN_HOST_PORT
          value: "9411"
        - name: QUERY_BASE_PATH
          value: /jaeger
        securityContext:
          capabilities:
            drop:
            - ALL
        livenessProbe:
          httpGet:
            path: /jaeger
            port: 16686
            scheme: HTTP
        readinessProbe:
          httpGet:
            path: /jaeger
            port: 16686
            scheme: HTTP

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: ipsportal
  name: ipsportal
  labels:
    app: ipsportal-ipsportal
spec:
  selector:
    matchLabels:
      app: ipsportal-ipsportal
  template:
    metadata:
      labels:
        app: ipsportal-ipsportal
    spec:
      containers:
      - name: ipsportal
        # use "latest" tag for production instance
        image: ghcr.io/hpc-simtools/ips-portal/ipsportal:dev
        imagePullPolicy: Always
        envFrom:
        - secretRef:
            name: mongo-secrets
        - secretRef:
            name: minio-secrets
        - secretRef:
            name: ipsportal-secrets
        env:
        - name: JAEGER_HOST
          value: jaeger
        - name: MONGO_HOST
          value: db
        - name: MINIO_PRIVATE_URL
          value: https://data.ipsportal.development.svc.spin.nersc.org
        - name: TZ
          value: America/Los_Angeles
        - name: JUPYTERHUB_PORTAL_DIR
          # value should be the same as the directory in the CONTAINER
          value: /tmp/ipsportal-jupyter
        - name: JUPYTERHUB_DIR
          # value should be the same as the directory on the HOST
          value: /global/cfs/cdirs/atom/users/ipsportal/ipsportal-runs-development
        - name: JUPYTERHUB_BASE_URL
          # empty because we use a special NERSC implementation to resolve the URL
          value: ''
        - name: JUPYTERHUB_IMPLEMENTATION
          value: nersc
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - ALL
          privileged: false
          readOnlyRootFilesystem: false
          runAsNonRoot: true
          runAsUser: 102616
        livenessProbe:
          httpGet:
            path: /
            port: 8080
            scheme: HTTP
        readinessProbe:
          httpGet:
            path: /
            port: 8080
            scheme: HTTP
        volumeMounts:
          - mountPath: /tmp/ipsportal-jupyter
            name: jupyterhub-data-files
      securityContext:
        fsGroup: 62365
        runAsGroup: 62365
        runAsUser: 102616
      volumes:
        - hostPath:
            path: /global/cfs/cdirs/atom/users/ipsportal/ipsportal-runs-development
            type: Directory
          name: jupyterhub-data-files

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: ipsportal
  name: me
  labels:
    app: ipsportal-me
spec:
  replicas: 0
  selector:
    matchLabels:
      app: ipsportal-me
  template:
    metadata:
      labels:
        app: ipsportal-me
    spec:
      containers:
      - name: me
        image: mongo-express
        env:
        - name: ME_CONFIG_MONGODB_SERVER
          value: db
        - name: ME_CONFIG_SITE_BASEURL
          value: /me
        - name: ME_CONFIG_MONGODB_ADMINUSERNAME_FILE
          value: /secrets/MONGO_USERNAME
        - name: ME_CONFIG_MONGODB_ADMINPASSWORD_FILE
          value: /secrets/MONGO_PASSWORD
        - name: ME_CONFIG_BASICAUTH_USERNAME_FILE
          value: /secrets/ME_USERNAME
        - name: ME_CONFIG_BASICAUTH_PASSWORD_FILE
          value: /secrets/ME_PASSWORD
        securityContext:
          capabilities:
            drop:
            - ALL
        volumeMounts:
        - mountPath: /secrets
          name: secrets
      volumes:
      - name: secrets
        secret:
          secretName: mongo-secrets
---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: ipsportal
  name: certbot-nginx
  labels:
    app: ipsportal-certbot-nginx
spec:
  selector:
    matchLabels:
      app: ipsportal-certbot-nginx
  template:
    metadata:
      labels:
        app: ipsportal-certbot-nginx
    spec:
      containers:
      - name: certbot-nginx
        image: nginx
        imagePullPolicy: Always
        securityContext:
          capabilities:
            add:
            - CHOWN
            - DAC_OVERRIDE
            - FOWNER
            - SETGID
            - SETUID
            drop:
            - ALL
        volumeMounts:
        - mountPath: /usr/share/nginx/html
          name: certbot-html
      volumes:
      - name: certbot-html
        persistentVolumeClaim:
          claimName: certbot-html

---
kind: CronJob
apiVersion: batch/v1
metadata:
  namespace: ipsportal
  name: mongodb-dump
  labels:
    app: ipsportal-mongodb-dump
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: mongodb-dump
            image: ghcr.io/hpc-simtools/ips-portal/mongodb-backup:latest
            envFrom:
            - secretRef:
                name: mongo-secrets
            env:
            - name: MONGODB_DUMP_DIR
              value: /backup
            - name: MONGODB_DATABASE
              value: portal
            - name: MONGODB_HOST
              value: db:27017
            - name: MONGODB_DUMP_FILE_BASE
              value: mongodb-dump.archive.gz
            - name: MONGODB_DUMP_RETAIN_DAYS
              value: "7"
            securityContext:
              capabilities:
                add:
                - NET_BIND_SERVICE
                drop:
                - ALL
              runAsNonRoot: true
              runAsUser: 102616
            volumeMounts:
            - mountPath: /backup
              name: backup
          restartPolicy: Never
          securityContext:
            fsGroup: 62365
          volumes:
          - hostPath:
              path: /global/cfs/cdirs/atom/users/ipsportal
              type: Directory
            name: backup
  schedule: 12 3 * * *

---
kind: CronJob
apiVersion: batch/v1
metadata:
  namespace: ipsportal
  name: certbot
  labels:
    app: ipsportal-certbot
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: certbot
            command:
            - /scripts/renew.sh
            image: openchemistry/certbot-rancher
            env:
            - name: CERT_NAME
              value: letsencrypt
            - name: CONTEXT
              value: c-fwj56:p-lbd2g
            - name: EMAIL
              value: whitfieldre@ornl.gov
            - name: DOMAIN
              value: lb.ipsportal.development.svc.spin.nersc.org
            - name: ENDPOINT_URL
              value: https://rancher2.spin.nersc.gov/v3
            - name: NAMESPACE
              value: ipsportal
            securityContext:
              capabilities:
                drop:
                - ALL
            volumeMounts:
            - mountPath: /secrets
              name: secrets
            - mountPath: /data/letsencrypt
              name: certbot-html
            - mountPath: /etc/letsencrypt
              name: certbot-certs
          restartPolicy: Never
          volumes:
          - name: secrets
            secret:
              secretName: mongo-secrets
          - name: certbot-html
            persistentVolumeClaim:
              claimName: certbot-html
          - name: certbot-certs
            persistentVolumeClaim:
              claimName: certbot-certs
  schedule: 32 1 * * *

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  namespace: ipsportal
  name: mongo
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: nfs-client

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  namespace: ipsportal
  name: minio
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: nfs-client

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  namespace: ipsportal
  name: certbot-html
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: nfs-client

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  namespace: ipsportal
  name: certbot-certs
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: nfs-client

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: ipsportal
  name: lb
spec:
  rules:
  - host: lb.ipsportal.development.svc.spin.nersc.org
    http:
      paths:
      - backend:
          service:
            name: ipsportal
            port:
              number: 8080
        path: /
        pathType: Prefix
      - backend:
          service:
            name: jaeger
            port:
              number: 16686
        path: /jaeger
        pathType: Prefix
      - backend:
          service:
            name: me
            port:
              number: 8081
        path: /me
        pathType: Prefix
      - backend:
          service:
            name: certbot-nginx
            port:
              number: 80
        path: /.well-known/acme-challenge
        pathType: Prefix
  tls:
    - secretName: letsencrypt

---
apiVersion: v1
kind: Service
metadata:
  namespace: ipsportal
  name: db
  annotations:
    field.cattle.io/targetWorkloadIds: '["ipsportal/db"]'
spec:
  ports:
  - name: default
    port: 27017
    protocol: TCP
    targetPort: 27017
  selector:
    app: ipsportal-db

---
apiVersion: v1
kind: Service
metadata:
  namespace: ipsportal
  name: minio
  annotations:
    field.cattle.io/targetWorkloadIds: '["ipsportal/minio"]'
spec:
  ports:
  - name: api
    port: 9000
    protocol: TCP
    targetPort: 9000
  - name: console
    port: 9001
    protocol: TCP
    targetPort: 9001
  selector:
    app: ipsportal-minio

---
apiVersion: v1
kind: Service
metadata:
  namespace: ipsportal
  name: ipsportal
  annotations:
    field.cattle.io/targetWorkloadIds: '["ipsportal/ipsportal"]'
spec:
  ports:
  - name: default
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app: ipsportal-ipsportal

---
apiVersion: v1
kind: Service
metadata:
  namespace: ipsportal
  name: jaeger
  annotations:
    field.cattle.io/targetWorkloadIds: '["ipsportal/jaeger"]'
spec:
  ports:
  - name: default
    port: 16686
    protocol: TCP
    targetPort: 16686
  - name: zipkin
    port: 9411
    protocol: TCP
    targetPort: 9411
  selector:
    app: ipsportal-jaeger

---
apiVersion: v1
kind: Service
metadata:
  namespace: ipsportal
  name: me
  annotations:
    field.cattle.io/targetWorkloadIds: '["ipsportal/me"]'
spec:
  ports:
  - name: default
    port: 8081
    protocol: TCP
    targetPort: 8081
  selector:
    app: ipsportal-me

---
apiVersion: v1
kind: Service
metadata:
  namespace: ipsportal
  name: certbot-nginx
  annotations:
    field.cattle.io/targetWorkloadIds: '["ipsportal/certbot-nginx"]'
spec:
  ports:
  - name: default
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: ipsportal-certbot-nginx

---
#################### begin data ingress config ##################
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: ipsportal
  name: data
  #annotations:
    #nginx.ingress.kubernetes.io/use-regex: "true"
    #nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  rules:
  - host: data.ipsportal.development.svc.spin.nersc.org
    http:
      paths:
      - backend:
          service:
            name: minio
            port:
              number: 9000
        path: /
        pathType: Prefix
      - backend:
          service:
            name: minio
            port:
              number: 9001
        path: /console/
        pathType: Prefix
      - backend:
          service:
            name: certbot-nginx-data
            port:
              number: 80
        path: /.well-known/acme-challenge
        pathType: Prefix
  tls:
    - secretName: letsencrypt-data

---
kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: ipsportal
  name: certbot-nginx-data
  labels:
    app: ipsportal-certbot-nginx-data
spec:
  selector:
    matchLabels:
      app: ipsportal-certbot-nginx-data
  template:
    metadata:
      labels:
        app: ipsportal-certbot-nginx-data
    spec:
      containers:
      - name: certbot-nginx-data
        image: nginx
        imagePullPolicy: Always
        securityContext:
          capabilities:
            add:
            - CHOWN
            - DAC_OVERRIDE
            - FOWNER
            - SETGID
            - SETUID
            drop:
            - ALL
        volumeMounts:
        - mountPath: /usr/share/nginx/html
          name: certbot-html
      volumes:
      - name: certbot-html
        persistentVolumeClaim:
          claimName: certbot-html-data

---
kind: CronJob
apiVersion: batch/v1
metadata:
  namespace: ipsportal
  name: certbot-data
  labels:
    app: ipsportal-certbot-data
spec:
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: certbot-data
            command:
            - /scripts/renew.sh
            image: openchemistry/certbot-rancher
            env:
            - name: CERT_NAME
              value: letsencrypt-data
            - name: CONTEXT
              value: c-fwj56:p-lbd2g
            - name: EMAIL
              value: dranelt@ornl.gov
            - name: DOMAIN
              value: data.ipsportal.development.svc.spin.nersc.org
            - name: ENDPOINT_URL
              value: https://rancher2.spin.nersc.gov/v3
            - name: NAMESPACE
              value: ipsportal
            securityContext:
              capabilities:
                drop:
                - ALL
            volumeMounts:
            - mountPath: /secrets
              name: secrets
            - mountPath: /data/letsencrypt
              name: certbot-html
            - mountPath: /etc/letsencrypt
              name: certbot-certs
          restartPolicy: Never
          volumes:
          - name: secrets
            secret:
              secretName: mongo-secrets
          - name: certbot-html
            persistentVolumeClaim:
              claimName: certbot-html-data
          - name: certbot-certs
            persistentVolumeClaim:
              claimName: certbot-certs-data
  schedule: 32 1 * * *

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  namespace: ipsportal
  name: certbot-html-data
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: nfs-client

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  namespace: ipsportal
  name: certbot-certs-data
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: nfs-client

---
apiVersion: v1
kind: Service
metadata:
  namespace: ipsportal
  name: certbot-nginx-data
  annotations:
    field.cattle.io/targetWorkloadIds: '["ipsportal/certbot-nginx-data"]'
spec:
  ports:
  - name: default
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: ipsportal-certbot-nginx-data