Skip to content

Commit 7230601

Browse files
karimzakzoukkarimzakzouk
committed
major(security): add https
1 parent 42f2c91 commit 7230601

11 files changed

Lines changed: 159 additions & 48 deletions

File tree

‎backend/helm-chart/templates/ingress.yaml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,20 @@ metadata:
1212
{{- end }}
1313
spec:
1414
ingressClassName: {{ .Values.ingress.className }}
15+
{{- if .Values.ingress.tls }}
16+
tls:
17+
{{- range .Values.ingress.tls }}
18+
- hosts:
19+
{{- range .hosts }}
20+
- {{ . | quote }}
21+
{{- end }}
22+
secretName: {{ .secretName }}
23+
{{- end }}
24+
{{- end }}
1525
rules:
1626
{{- range .Values.ingress.hosts }}
17-
- http:
27+
- host: {{ .host | quote }}
28+
http:
1829
paths:
1930
{{- range .paths }}
2031
- path: {{ .path }}

‎backend/helm-chart/values-dev.yaml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,27 @@ image:
66

77
env:
88
NODE_ENV: "dev"
9-
FRONTEND_URL: "frontend-code.duckdns.org"
10-
REDIS_HOST: "redis-code.duckdns.org"
9+
FRONTEND_URL: "https://hankers-frontend.myaddr.tools"
10+
REDIS_HOST: "hankers-redis.myaddr.tools"
1111
REDIS_PORT: "6379"
1212

1313
secrets:
1414
name: hankers-secrets
1515

1616
ingress:
1717
enabled: true
18+
annotations:
19+
cert-manager.io/cluster-issuer: "letsencrypt-prod"
20+
nginx.ingress.kubernetes.io/ssl-redirect: "true"
1821
hosts:
19-
- host: ""
22+
- host: "hankers-backend.myaddr.tools"
2023
paths:
21-
- path: /dev(/|$)(.*)
22-
pathType: ImplementationSpecific
24+
- path: /
25+
pathType: Prefix
26+
tls:
27+
- secretName: backend-tls
28+
hosts:
29+
- hankers-backend.myaddr.tools
2330

2431
migration:
2532
enabled: true

‎backend/helm-chart/values.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,7 @@ service:
1616
ingress:
1717
enabled: true
1818
className: nginx
19-
annotations:
20-
nginx.ingress.kubernetes.io/rewrite-target: /$2
19+
annotations: {}
2120
hosts:
2221
- host: ""
2322
paths:

‎frontend/helm-chart/templates/ingress.yaml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,20 @@ metadata:
1212
{{- end }}
1313
spec:
1414
ingressClassName: {{ .Values.ingress.className }}
15+
{{- if .Values.ingress.tls }}
16+
tls:
17+
{{- range .Values.ingress.tls }}
18+
- hosts:
19+
{{- range .hosts }}
20+
- {{ . | quote }}
21+
{{- end }}
22+
secretName: {{ .secretName }}
23+
{{- end }}
24+
{{- end }}
1525
rules:
1626
{{- range .Values.ingress.hosts }}
17-
- http:
27+
- host: {{ .host | quote }}
28+
http:
1829
paths:
1930
{{- range .paths }}
2031
- path: {{ .path }}

‎frontend/helm-chart/values-dev.yaml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,15 @@ secrets:
1313

1414
ingress:
1515
enabled: true
16+
annotations:
17+
cert-manager.io/cluster-issuer: "letsencrypt-prod"
18+
nginx.ingress.kubernetes.io/ssl-redirect: "true"
1619
hosts:
17-
- host: ""
20+
- host: "hankers-frontend.myaddr.tools"
1821
paths:
19-
- path: /()(.*)
20-
pathType: ImplementationSpecific
22+
- path: /
23+
pathType: Prefix
24+
tls:
25+
- secretName: frontend-tls
26+
hosts:
27+
- hankers-frontend.myaddr.tools

‎frontend/helm-chart/values.yaml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,7 @@ service:
1616
ingress:
1717
enabled: true
1818
className: nginx
19-
annotations:
20-
nginx.ingress.kubernetes.io/rewrite-target: /$2
21-
nginx.ingress.kubernetes.io/ssl-redirect: "false"
19+
annotations: {}
2220
hosts:
2321
- host: ""
2422
paths:

‎infra/install-cert-manager.sh‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎infra/setup.sh‎

Lines changed: 84 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,102 @@
11
#!/bin/bash
22
set -e
33

4-
echo "Installing Nginx Ingress Controller..."
4+
echo "========================================"
5+
echo "Hankers Infrastructure Setup"
6+
echo "========================================"
7+
echo ""
58

6-
# Apply the official nginx ingress controller manifest
9+
# ============================================
10+
# 1. Install Nginx Ingress Controller
11+
# ============================================
12+
echo "[1/5] Installing Nginx Ingress Controller..."
713
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.11.2/deploy/static/provider/cloud/deploy.yaml
814

9-
echo ""
1015
echo "Waiting for controller to be ready..."
1116
kubectl wait --namespace ingress-nginx \
1217
--for=condition=ready pod \
1318
--selector=app.kubernetes.io/component=controller \
1419
--timeout=120s
1520

21+
echo "✅ Nginx Ingress Controller installed!"
22+
echo ""
23+
24+
# ============================================
25+
# 2. Install Cert-Manager
26+
# ============================================
27+
echo "[2/5] Installing Cert-Manager..."
28+
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.2/cert-manager.yaml
29+
30+
echo "Waiting for cert-manager to be ready..."
31+
kubectl wait --namespace cert-manager \
32+
--for=condition=ready pod \
33+
--selector=app.kubernetes.io/instance=cert-manager \
34+
--timeout=120s
35+
36+
echo "✅ Cert-Manager installed!"
37+
echo ""
38+
39+
# ============================================
40+
# 3. Create Let's Encrypt ClusterIssuer
41+
# ============================================
42+
echo "[3/5] Creating Let's Encrypt ClusterIssuer..."
43+
kubectl apply -f setup/letsencrypt-issuer.yaml
44+
45+
echo "✅ Let's Encrypt ClusterIssuer created!"
1646
echo ""
17-
echo "✅ Nginx Ingress Controller installed successfully!"
47+
48+
# ============================================
49+
# 4. Configure TCP Services for Redis
50+
# ============================================
51+
echo "[4/5] Configuring TCP Services for Redis..."
52+
kubectl apply -f setup/tcp-services.yaml
53+
54+
echo "✅ TCP Services ConfigMap created!"
55+
echo ""
56+
57+
# ============================================
58+
# 5. Patch Ingress Controller for TCP
59+
# ============================================
60+
echo "[5/5] Patching Ingress Controller..."
61+
62+
# Add TCP services argument if not already present
63+
if ! kubectl get deployment ingress-nginx-controller -n ingress-nginx -o yaml | grep -q "tcp-services-configmap"; then
64+
echo "Adding TCP services configuration..."
65+
kubectl patch deployment ingress-nginx-controller -n ingress-nginx --type='json' -p='[
66+
{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--tcp-services-configmap=ingress-nginx/tcp-services"}
67+
]'
68+
else
69+
echo "TCP services already configured"
70+
fi
71+
72+
# Add port 6379 to ingress controller service if not already present
73+
if ! kubectl get svc ingress-nginx-controller -n ingress-nginx -o yaml | grep -q "port: 6379"; then
74+
echo "Adding Redis port to ingress controller..."
75+
kubectl patch svc ingress-nginx-controller -n ingress-nginx --type='json' -p='[
76+
{"op": "add", "path": "/spec/ports/-", "value": {"name": "redis", "port": 6379, "protocol": "TCP", "targetPort": 6379}}
77+
]'
78+
else
79+
echo "Redis port already configured"
80+
fi
81+
82+
echo "✅ Ingress Controller patched!"
1883
echo ""
19-
echo "Getting external IP..."
20-
kubectl get svc ingress-nginx-controller -n ingress-nginx
2184

85+
# ============================================
86+
# Summary
87+
# ============================================
88+
echo "========================================"
89+
echo "✅ Infrastructure Setup Complete!"
90+
echo "========================================"
91+
echo ""
92+
echo "Ingress Controller External IP:"
93+
kubectl get svc ingress-nginx-controller -n ingress-nginx | grep ingress-nginx-controller
94+
echo ""
95+
echo "Next steps:"
96+
echo "1. Update your DNS records to point to the external IP above"
97+
echo "2. Deploy your backend: helm install/upgrade hankers-backend-dev"
98+
echo "3. Deploy your frontend: helm install/upgrade hankers-frontend-dev"
99+
echo "4. Deploy Redis if not already deployed"
22100
echo ""
23101
echo "To watch for IP assignment:"
24102
echo "kubectl get svc ingress-nginx-controller -n ingress-nginx -w"

‎infra/setup/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Setup Files
2+
3+
This directory contains all the Kubernetes manifests needed for initial infrastructure setup.
4+
5+
## Files
6+
7+
- **letsencrypt-issuer.yaml** - Let's Encrypt production ClusterIssuer for SSL certificates
8+
- **tcp-services.yaml** - ConfigMap for exposing Redis on port 6379 through nginx ingress
9+
10+
## Usage
11+
12+
These files are automatically applied by the `../setup.sh` script. You don't need to apply them manually.
13+
14+
## Manual Application (if needed)
15+
16+
```bash
17+
kubectl apply -f letsencrypt-issuer.yaml
18+
kubectl apply -f tcp-services.yaml
19+
```

infra/letsencrypt-issuer.yaml renamed to infra/setup/letsencrypt-issuer.yaml

File renamed without changes.

0 commit comments

Comments
 (0)