devspace.yaml

version: v2beta1
name: devhub-operator-system

hooks:
  - events: ["before:devCommand"]
    command: "cd apps/operator && make install"
    name: install-crds
  - events: ["before:devCommand"]
    command: "kubectl apply -k apps/operator/config/default"
    name: apply-operator-rbac

commands:
  up: |-
    make -C apps/operator install
    kubectl apply -k apps/operator/config/default
    devspace dev
  down: |-
    devspace reset pods
  regen-crds: |-
    cd apps/operator && make generate manifests install
  apply-manifests: |-
    kubectl apply -k apps/operator/config/default

dev:
  web:
    labelSelector:
      app.kubernetes.io/name: web
      app.kubernetes.io/instance: devhub
    namespace: devhub-operator-system
    devImage: node:24
    workingDir: /app
    command:
      - sh
      - -c
      - |
        echo 'Waiting for sync...' && while [ ! -f package.json ]; do sleep 1; done
        echo 'Sync complete.'
        mkdir -p apps/server && echo 'DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy"' > apps/server/.env
        mkdir -p apps/web && echo "NEXT_PUBLIC_SERVER_URL=${NEXT_PUBLIC_SERVER_URL}" > apps/web/.env
        corepack enable pnpm && pnpm install --frozen-lockfile
        cd apps/web && npx next dev --port 3000
    env:
      - name: NODE_ENV
        value: development
      # next dev blocks cross-origin asset requests unless the external
      # reverse-proxy hostname is explicitly trusted.
      - name: ALLOWED_DEV_ORIGIN
        value: app.apps.127-0-0-1.sslip.io
    sync:
      - path: ./:/app
        excludePaths:
          - .git/
          - .devspace/
          - .github/
          - .nx/
          - .turbo/
          - .venv/
          - .vscode/
          - "**/node_modules/"
          - "**/.next/"
          - "**/dist/"
          - "**/tmp/"
          - "**/Dockerfile"
          - "**/.env"
          - "**/.env.*"
          - README.md
          - .dockerignore
          - .prettierignore
          - .prettierrc
          - .gitignore
        initialSync: mirrorLocal
        startContainer: true
    patches:
      # INTENTIONAL dev-only trade-off: devspace replaces the prod image with a
      # generic node/golang base and the inner-loop sync writes into /app, so
      # the dev pod must run as root. The chart hardens the prod pod with a
      # pinned non-root UID (runAsUser: 1001) — flipping only runAsNonRoot
      # leaves that UID in place and the sync fails with `permission denied`.
      # Replace the whole pod securityContext with a root one. Never enable
      # this in a non-dev cluster.
      - op: replace
        path: spec.securityContext
        value:
          runAsNonRoot: false
          runAsUser: 0
          runAsGroup: 0
      # next dev (webpack) is memory-hungry — 2Gi still OOM-killed it, so
      # give the web dev container a generous 4Gi. The chart's prod limit
      # (512Mi) is for the slim standalone build, not the dev toolchain.
      - op: replace
        path: spec.containers.name=web.resources
        value:
          limits:
            cpu: "2"
            memory: 4Gi
          requests:
            cpu: 100m
            memory: 512Mi
    persistenceOptions:
      name: devhub-web-devspace
    persistPaths:
      - path: /app/node_modules
      - path: /app/apps/web/node_modules

  server:
    labelSelector:
      app.kubernetes.io/name: server
      app.kubernetes.io/instance: devhub
    namespace: devhub-operator-system
    devImage: node:24
    workingDir: /app
    command:
      - sh
      - -c
      - |
        echo 'Waiting for sync...' && while [ ! -f package.json ]; do sleep 1; done
        echo 'Sync complete.'
        mkdir -p apps/server
        echo "DATABASE_URL=${DATABASE_URL}" > apps/server/.env
        echo "BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}" >> apps/server/.env
        echo "BETTER_AUTH_URL=${BETTER_AUTH_URL}" >> apps/server/.env
        echo "CORS_ORIGIN=${CORS_ORIGIN}" >> apps/server/.env
        echo "KUBERNETES_SERVICE_HOST=${KUBERNETES_SERVICE_HOST}" >> apps/server/.env
        echo "KUBERNETES_SERVICE_PORT=${KUBERNETES_SERVICE_PORT}" >> apps/server/.env
        corepack enable pnpm && pnpm install --frozen-lockfile
        pnpm dev:server
    env:
      - name: NODE_ENV
        value: development
    sync:
      - path: ./:/app
        excludePaths:
          - .git/
          - .devspace/
          - .github/
          - .nx/
          - .turbo/
          - .venv/
          - .vscode/
          - "**/node_modules/"
          - "**/.next/"
          - "**/dist/"
          - "**/tmp/"
          - "**/Dockerfile"
          - "**/.env"
          - "**/.env.*"
          - README.md
          - .dockerignore
          - .prettierignore
          - .prettierrc
          - .gitignore
        initialSync: mirrorLocal
        startContainer: true
    patches:
      # INTENTIONAL dev-only trade-off: see comment in web patches above.
      - op: replace
        path: spec.securityContext
        value:
          runAsNonRoot: false
          runAsUser: 0
          runAsGroup: 0
      # The chart's prod limit (512Mi) OOM-kills `pnpm install` + the dev
      # server. Give the dev container real headroom.
      - op: replace
        path: spec.containers.name=server.resources
        value:
          limits:
            cpu: "2"
            memory: 2Gi
          requests:
            cpu: 100m
            memory: 256Mi
    persistenceOptions:
      name: devhub-server-devspace
    persistPaths:
      - path: /app/node_modules
      - path: /app/apps/server/node_modules

  operator:
    labelSelector:
      app.kubernetes.io/name: operator
      app.kubernetes.io/instance: devhub
    namespace: devhub-operator-system
    devImage: golang:1.25
    workingDir: /workspace
    command:
      - sh
      - -c
      - |
        echo 'Waiting for sync...' && while [ ! -f cmd/main.go ]; do sleep 1; done
        echo 'Installing air...'
        [ -f /go/bin/air ] || GOTOOLCHAIN=auto go install github.com/air-verse/air@latest
        echo 'Starting operator with hot reload...'
        /go/bin/air
    sync:
      - path: ./apps/operator/:/workspace
        excludePaths:
          - bin/
          - test/
          - "**/*_test.go"
        initialSync: mirrorLocal
        startContainer: true
    patches:
      # INTENTIONAL dev-only trade-off: see comment in web patches above.
      - op: replace
        path: spec.securityContext
        value:
          runAsNonRoot: false
          runAsUser: 0
          runAsGroup: 0
      - op: replace
        path: spec.containers.name=manager.resources
        value:
          limits:
            cpu: "2"
            memory: 2Gi
          requests:
            cpu: 100m
            memory: 256Mi
    persistenceOptions:
      name: devhub-operator-devspace
    persistPaths:
      - path: /go/pkg/mod
      - path: /root/.cache/go-build
      - path: /go/bin