chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 12:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
82a2c2ed2e
prole/conf/gke.cfg
chrisfu 82a2c2ed2e net: pin public ingresses to reserved static IPs + wire gitlab-shell SSH LB 
Reserved 5 named external static IPs and threaded the
kubernetes.io/ingress.global-static-ip-name annotation through every
public GCE L7 ingress the installer renders, so ingress delete/recreate
stops churning DNS. Also turned on a dedicated regional L4
LoadBalancer for gitlab-shell (port 22) so SSH git workflows work.

New config surface in conf/gke.cfg:
  GITLAB_GLOBAL_STATIC_IP_NAME     = git-knoe-dev     (34.102.141.87)
  SVC_KNOE_GLOBAL_STATIC_IP_NAME   = svc-knoe         (34.111.197.33)
  SUPABASE_API_GLOBAL_STATIC_IP_NAME    = supabase-api    (34.120.221.5)
  SUPABASE_STUDIO_GLOBAL_STATIC_IP_NAME = supabase-studio (136.110.189.6)
  GITLAB_SSH_HOST                  = git-ssh.knoe.dev
  GITLAB_SHELL_LOADBALANCER_IP     = 34.106.243.154  (regional us-west3)
  GITLAB_SHELL_EXTERNAL_TRAFFIC_POLICY = Local        (default)

Why SSH lives on a separate hostname+IP: Google-managed certs require
a GCE global L7 IP; port 22 needs a regional Network LB. Those can not
share an IP on GCP, so git.knoe.dev stays on HTTPS and git-ssh.knoe.dev
takes SSH.

Wiring per surface:
- etc/init_gitlab.sh
  * Added GITLAB_SSH_HOST (default git-ssh.<root> in k8s mode),
    GITLAB_SHELL_LOADBALANCER_IP, GITLAB_SHELL_EXTERNAL_TRAFFIC_POLICY,
    GITLAB_GLOBAL_STATIC_IP_NAME config keys.
  * CR global.hosts.ssh now reads ${GITLAB_SSH_HOST}.
  * gitlab-shell block conditionally renders service: {type:
    LoadBalancer, loadBalancerIP, externalTrafficPolicy} when the LB IP
    is set.
  * GITLAB_GCE_TLS_ANNOTATIONS_YAML gains
    kubernetes.io/ingress.global-static-ip-name: "<name>" when
    GITLAB_GLOBAL_STATIC_IP_NAME is set.
- etc/init_kong.sh
  * Added SVC_KNOE_GLOBAL_STATIC_IP_NAME var near other SERVICE_TLS_*
    defaults.
  * gce_tls_annotations heredoc gets the static-IP line appended on the
    same condition.
- supabase/helm/render_supabase.py
  * Two new _first(env, cfg, default) extractions for
    SUPABASE_API_GLOBAL_STATIC_IP_NAME and
    SUPABASE_STUDIO_GLOBAL_STATIC_IP_NAME near the existing managed-cert
    / frontend-config vars.
  * Two new dict-spread blocks in the Kong + Studio ingress annotations
    that emit the static-IP annotation only when mode=k8s and the value
    is non-empty.

All three ingress surfaces already use kubectl apply (merge-friendly);
re-running init_gitlab.sh / init_kong.sh / deploy.sh (supabase step) is
enough to pick up the new annotation. The GKE LB controller will swap
each ingress's forwarding rule from the auto-generated k8s2-fr-*
reservation to the named reservation, then release the old ephemeral.
Ingress IPs change; DNS records need updating (TTL <=300s while
iterating). Google-managed cert for gitlab-managed-cert will briefly
Provision again during the swap; the other three were already
Provisioning.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 22:09:51 -07:00

274 lines
12 KiB
INI
Raw Blame History

; Prole Master Configuration File
; Generated by install.py on 2026-04-20 14:42:17
; This file is used as input for Ansible deployment and k8s cluster creation.
[User]
; User-editable values; derived values below reference these by default.
; No user values captured yet for this section.
[Inputs]
; Screen-scoped inputs used for unattended replays (-S)
auth.clientId = 200699021716-pbaekj5q8i3fplhof0u7gccrvkvvacug.apps.googleusercontent.com
auth.clientSecret = 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
build.deploy_env = Prod
build.run_build = false
dependencies.ansible.install = true
dependencies.auto_install_missing = true
dependencies.brew.install = true
dependencies.docker.install = true
dependencies.gcloud.install = true
dependencies.gke-gcloud-auth-plugin.install = true
dependencies.k3d.install = true
dependencies.kubectl.install = true
dependencies.kubectx.install = true
dependencies.opentofu.install = true
dependencies.python.install = true
dependencies.verify_all = false
disk_selection.disk_type = local
disk_selection.local_path = /Users/chrisfu
disk_selection.removable_mount =
env_setup.APP_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0
env_setup.APP_CLUSTER_MODE = standard
env_setup.APP_CLUSTER_NAME = knoe-dev-0
env_setup.CLUSTER_NAME = ${CLUSTER_NAME}
env_setup.DATABASE_NAMESPACE = ${DATABASE_NAMESPACE}
env_setup.DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0
env_setup.DB_CLUSTER_MODE = standard
env_setup.DB_CLUSTER_NAME = knoe-dev-cnpg-0
env_setup.PROLE_CONF = /Users/chrisfu/dev/prole/conf
env_setup.PROLE_DATA = /Users/chrisfu/dev/prole/data
env_setup.PROLE_HOME = /Users/chrisfu/dev/prole
env_setup.PROLE_LOGS = /Users/chrisfu/dev/prole/logs
env_setup.PROLE_SERVICE = /Users/chrisfu/dev/prole/etc
gitops.git_provider = GitLab
init_cluster.app_cluster_kubecontext = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0
init_cluster.app_cluster_machine_type = e2-small
init_cluster.app_cluster_mode = standard
init_cluster.app_cluster_name = knoe-dev-0
init_cluster.app_cluster_node_count = 3
init_cluster.app_cluster_region = us-west3
init_cluster.at_rest_encryption_enabled = true
init_cluster.cluster_env = prod
init_cluster.db_boot_disk_size_gb = 50
init_cluster.db_boot_disk_type = pd-standard
init_cluster.db_cluster_kubecontext = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0
init_cluster.db_cluster_machine_type = e2-standard-2
init_cluster.db_cluster_mode = standard
init_cluster.db_cluster_name = knoe-dev-cnpg-0
init_cluster.db_cluster_node_count = 3
init_cluster.db_cluster_region = us-west3
init_cluster.db_cluster_zones =
init_cluster.gitops_enabled = true
init_cluster.k3s_server_url =
init_cluster.k3s_token =
init_cluster.kerberos_enabled = false
init_cluster.project_id = plenary-truck-485623-p7
init_cluster.start_cluster = true
init_cluster.supabase_analytics_enabled = true
init_cluster.supabase_auth_enabled = true
init_cluster.supabase_enabled = true
init_cluster.supabase_meta_enabled = true
init_cluster.supabase_realtime_enabled = true
init_cluster.supabase_studio_enabled = true
init_cluster.supabase_studio_url = db.0.knoe.dev
init_cnpg_deploy.force_rollout = false
init_cnpg_deploy.run_deploy = true
init_db_build.run_build = true
init_password.app_cluster_name = knoe-dev-0
init_password.cluster_name = ${CLUSTER_NAME}
init_password.db_cluster_name = knoe-dev-cnpg-0
init_password.db_host_port = 5432
init_password.db_namespace = ${DATABASE_NAMESPACE}
init_password.db_password = ${PROLE_SECRET:v1:t152p6lozmV1olHq:cJCCJAqk8iusivgp9akabPgYgi5RZYqVI9grBY4pRzaWcuQviqizZg==}
init_password.db_password_confirm = ${PROLE_SECRET:v1:t152p6lozmV1olHq:cJCCJAqk8iusivgp9akabPgYgi5RZYqVI9grBY4pRzaWcuQviqizZg==}
init_password.db_username = chrisfu
init_password.generate_ssh_key = true
init_scripts.run_scripts = true
kerberos_config.enabled = False
kerberos_config.init_authority = true
kerberos_config.kdc = 192.168.5.32
kerberos_config.password =
kerberos_config.realm =
kerberos_config.test_connection = false
kerberos_config.user = administrator
network_scan.run = true
ollama_config.model =
ollama_config.server_host =
ollama_config.server_port = 11434
[Global]
; Variables used by name in more than one place or assumed global scope
APP_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-0
ARGOCD_NAMESPACE = argocd
ARTIFACT_REGISTRY = us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system
AUTHORITY_ENABLED = true
AUTH_HOSTNAME = api.knoe.dev
AUTH_LOGIN_PATH = /auth/login
AUTH_RESPONSE_HEADERS = X-Prole-User,X-Prole-Email,X-Prole-Groups
AUTH_VERIFY_PATH = /auth/verify
CLUSTER_ENV = prod
CLUSTER_NAME = knoe-db
CLUSTER_SIZE_PROFILE = small
CNPG_INSTANCES = 3
CNPG_SIZE_PROFILE = small
DATABASE_NAMESPACE = knoe-db-0
DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0
DB_HOST_PORT = 5432
DB_PASSWORD = ${PROLE_SECRET:v1:AX1bdMcT41sPTZbS:wvvf8AVN-hvKOcJWg1EIBtly78nrTL7rBrjfLXboqqMUD_qw-lSoSQ==}
DEPLOYMENT_MODE = k8s
DEPLOYMENT_TARGET = prole-prod-cluster
DOCKER_IMPORT_DIR =
DOCKER_PRELOAD = false
GARAGE_PRIVATE_S3_ENDPOINT = http://10.180.15.239:3900
GITLAB_DOMAIN = git.knoe.dev
GITLAB_GITALY_STORAGE_CLASS = standard
GITLAB_INGRESS_CLASS = gce
GITLAB_OIDC_CLIENT_ID = secretref://google-oidc-client-id
GITLAB_OIDC_CLIENT_SECRET = secretref://google-oidc-client-secret
GITLAB_OIDC_ISSUER = https://accounts.google.com
GITLAB_PUBLIC_HOSTS = git.knoe.dev
; Pin the GCE L7 HTTPS ingresses to reserved GLOBAL static IPs (gcloud compute
; addresses create --global). Prevents IP churn on ingress delete/recreate.
GITLAB_GLOBAL_STATIC_IP_NAME = git-knoe-dev
; Kong (knoe-system/svc-knoe-ingress, serves svc.knoe.dev + api.knoe.dev)
SVC_KNOE_GLOBAL_STATIC_IP_NAME = svc-knoe
; Supabase Kong API ingress (supabase/supabase-kong, serves api.0.knoe.dev)
SUPABASE_API_GLOBAL_STATIC_IP_NAME = supabase-api
; Supabase Studio ingress (supabase/supabase-studio, serves db.0.knoe.dev)
SUPABASE_STUDIO_GLOBAL_STATIC_IP_NAME = supabase-studio
; SSH ingress — dedicated REGIONAL external static IP (us-west3) bound to
; gitlab-shell Service of type LoadBalancer. Must be created via
; gcloud compute addresses create git-knoe-ssh --region=us-west3
; then fill in the .address value below.
GITLAB_SSH_HOST = git-ssh.knoe.dev
GITLAB_SHELL_LOADBALANCER_IP = 34.106.243.154
GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 1
GITLAB_WEBSERVICE_LIMITS_MEMORY = 3Gi
GITLAB_WEBSERVICE_PUMA_THREADS_MAX = 2
GITLAB_WEBSERVICE_PUMA_THREADS_MIN = 2
GITLAB_WEBSERVICE_REQUESTS_CPU = 500m
GITLAB_WEBSERVICE_REQUESTS_MEMORY = 2Gi
GITLAB_WEBSERVICE_WORKER_PROCESSES = 1
GRAFANA_HOSTNAME = svc.knoe.dev
K3S_SERVER =
K3S_TOKEN =
KNOE_DB_USER = chrisfu
KNOE_USER_GITLAB_API_BASE = https://git.knoe.dev/api/v4
KNOE_USER_GITLAB_AUTH_PROVIDER = openid_connect
KNOE_USER_GITLAB_JIT_AUTO_CREATE_USERS = true
KNOE_USER_GITLAB_OIDC_ISSUER = https://accounts.google.com
KNOE_USER_GITLAB_OIDC_REDIRECT_URI = https://git.knoe.dev/users/auth/openid_connect/callback
KNOE_USER_GITLAB_PROVISIONING_READY = true
OPENTOFU_URL = http://127.0.0.1:8080
OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
PROLE_HOME = $HOME/dev/prole
PROTECTED_DB_HOSTS = db.0.knoe.dev,api.0.knoe.dev
PROTECTED_GIT_HOSTS = git.knoe.dev
REDIS_HOST = redis-master.knoe-system.svc.cluster.local
REGISTRY_NAMESPACE = knoe-system
SERVICE_NAMESPACE = knoe-system
SUPABASE_API_HOSTNAME = api.0.knoe.dev
SUPABASE_AUTO_CLEAN_RETAINED_GCE_DISKS = true
SUPABASE_AUTO_CLEAN_RETAINED_PVS = true
SUPABASE_HOSTNAME = db.0.knoe.dev
SUPABASE_INGRESS_CLASS = gce
SUPABASE_STUDIO_HOSTNAME = db.0.knoe.dev
[Welcome]
; No configuration values captured yet for this section.
[Dependencies]
STATUS = All installed
[Network]
KDC_AUTO_DETECTED = 192.168.5.32
KERBEROS_AUTO_ENABLED = True
[Port Forwards]
PORT_FORWARD_K3D_MAPPING_1 = id=argocd;namespace=argocd;target=svc/argocd-server;address=0.0.0.0;hostPort=8081;servicePort=80;protocol=TCP;description=ArgoCD
PORT_FORWARD_K3D_MAPPING_10 = id=supabase-studio;namespace=supabase;target=svc/studio;address=0.0.0.0;hostPort=18080;servicePort=3000;protocol=TCP;description=Supabase Studio
PORT_FORWARD_K3D_MAPPING_11 = id=supabase-auth;namespace=supabase;target=svc/auth;address=127.0.0.1;hostPort=9999;servicePort=9999;protocol=TCP;description=Supabase Auth (GoTrue)
PORT_FORWARD_K3D_MAPPING_12 = id=supabase-rest;namespace=supabase;target=svc/rest;address=0.0.0.0;hostPort=3001;servicePort=3000;protocol=TCP;description=Supabase REST (PostgREST)
PORT_FORWARD_K3D_MAPPING_13 = id=supabase-realtime;namespace=supabase;target=svc/realtime;address=0.0.0.0;hostPort=4000;servicePort=4000;protocol=TCP;description=Supabase Realtime
PORT_FORWARD_K3D_MAPPING_14 = id=gitea-http;namespace=gitea;target=svc/gitea-http;address=0.0.0.0;hostPort=13000;servicePort=3000;protocol=TCP;description=Gitea Web
PORT_FORWARD_K3D_MAPPING_15 = id=gitea-ssh;namespace=gitea;target=svc/gitea-ssh;address=0.0.0.0;hostPort=22;servicePort=22;protocol=TCP;description=Gitea SSH
PORT_FORWARD_K3D_MAPPING_2 = id=garage;namespace=knoe-system;target=svc/garage;address=0.0.0.0;hostPort=3900;servicePort=3900;protocol=TCP;description=Garage S3
PORT_FORWARD_K3D_MAPPING_3 = id=openbao;namespace=knoe-system;target=svc/openbao;address=0.0.0.0;hostPort=8200;servicePort=8200;protocol=TCP;description=OpenBao
PORT_FORWARD_K3D_MAPPING_4 = id=opentofu;namespace=knoe-system;target=svc/opentofu;address=0.0.0.0;hostPort=8080;servicePort=8080;protocol=TCP;description=OpenTofu
PORT_FORWARD_K3D_MAPPING_5 = id=dashboard;namespace=kubernetes-dashboard;target=svc/kubernetes-dashboard-kong-proxy;address=127.0.0.1;hostPort=8443;servicePort=443;protocol=TCP;description=Kubernetes Dashboard
PORT_FORWARD_K3D_MAPPING_6 = id=postgres;namespace=${DATABASE_NAMESPACE};target=svc/knoe-db-rw;address=0.0.0.0;hostPort=5432;servicePort=5432;protocol=TCP;description=PostgreSQL (primary)
PORT_FORWARD_K3D_MAPPING_7 = id=prometheus;namespace=monitoring;target=svc/kps-kube-prometheus-stack-prometheus;address=127.0.0.1;hostPort=9090;servicePort=9090;protocol=TCP;description=Prometheus UI
PORT_FORWARD_K3D_MAPPING_8 = id=grafana;namespace=monitoring;target=svc/kps-grafana;address=0.0.0.0;hostPort=3000;servicePort=80;protocol=TCP;description=Grafana UI
PORT_FORWARD_K3D_MAPPING_9 = id=supabase-kong;namespace=supabase;target=svc/kong;address=0.0.0.0;hostPort=8000;servicePort=8000;protocol=TCP;description=Supabase API (Kong)
[System Environment]
PROLE_CONF = $HOME/dev/prole/conf
PROLE_DATA = $HOME/dev/prole/data
PROLE_HOME = $HOME/dev/prole
PROLE_LOGS = $HOME/dev/prole/logs
PROLE_SERVICE = $HOME/dev/prole/etc
[Monitoring]
; No configuration values captured yet for this section.
[Kerberos Authentication]
STATUS = Skipped
[Ollama]
; No configuration values captured yet for this section.
[Optional Features]
AT_REST_ENCRYPTION_ENABLED = true
GITOPS_ENABLED = true
GITOPS_PROVIDER = gitlab
KERBEROS_ENABLED = false
SUPABASE_ENABLED = true
[GitOps]
STATUS = Deployed
[Database Creation]
APP_CLUSTER_NAME = knoe-dev-0
DB_CLUSTER_NAME = knoe-dev-cnpg-0
DB_USER = chrisfu
[Initialize Cluster]
; No configuration values captured yet for this section.
[Dev Cluster (k3d)]
CLUSTER_ENV = k3d-knoe-dev-cluster
DISPLAY_NAME = knoe-dev-cluster
KUBECTL_CONTEXT = prod
MODE = k3d
[Service Cluster (k3s)]
CLUSTER_ENV = prole-service-cluster
DISPLAY_NAME = prole-service-cluster
K3S_SERVER_URL =
K3S_TOKEN =
MODE = k3s
PIPELINE_URL = http://127.0.0.1:8080
[GCP]
; No configuration values captured yet for this section.
[Prod Cluster (k8s)]
ARTIFACTS_DIR =
CLUSTER_ENV = prole-prod-cluster
DISPLAY_NAME = prole-prod-cluster
MODE = k8s
PIPELINE_URL = http://127.0.0.1:8080
[Docker Build]
; No configuration values captured yet for this section.
[Initialization Scripts]
; No configuration values captured yet for this section.
[Deployment]
MODE = k8s
TARGET = prole-prod-cluster
[Install]
STATUS = Finished
Reference in New Issue View Git Blame Copy Permalink