home-docker/archive/passkey-auth.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: passkey-auth-config
  namespace: apps
data:
  config.yaml: |
    server:
      port: "8080"
      host: "0.0.0.0"

    webauthn:
      rp_display_name: "Junv's Home Passkey Auth"
      rp_id: "passkey.junv.cc"
      rp_origins:
        - "https://passkey.junv.cc"

    database:
      path: "/data/passkey-auth.db"

    cors:
      allowed_origins:
        - "https://*.junv.cc"

    auth:
      require_approval: true
      cookie_domain: ".junv.cc"
      allowed_emails:
        - "wahyd4@gmail.com"
        - "hi@junv.cc"
        # - "ncjunv@gmail.com"
        # - "tangyanhua9@gmail.com"
        # - "wwwheygo@gmail.com"

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: passkey-auth-pvc
  namespace: apps
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName: nfs-client
  volumeMode: Filesystem

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: passkey-auth
  namespace: apps
  labels:
    app: passkey-auth
    version: v1
spec:
  replicas: 1
  revisionHistoryLimit: 3
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app: passkey-auth
  template:
    metadata:
      labels:
        app: "passkey-auth"
        version: "v1"
    spec:
      securityContext:
        # Removed restrictive user settings that conflict with the Docker image
        # The image expects to run as root with access to /root/ directory
        fsGroup: 1000
      imagePullSecrets:
        - name: github-image-pull-secret
      containers:
        - name: passkey-auth
          image: ghcr.io/wahyd4/passkey-auth:main
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          env:
            - name: DEFAULT_EMAIL
              value: "hi@junv.cc"
            - name: CONFIG_PATH
              value: "/app/config.yaml"
            - name: SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: passkey-auth-secrets
                  key: session-secret
            - name: ADMIN_EMAIL
              value: "hi@junv.cc"
          volumeMounts:
            - name: config
              mountPath: "/app/config.yaml"
              subPath: config.yaml
              readOnly: true
            - name: data
              mountPath: /data
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          startupProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 6
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "400m"
          securityContext:
            # Relaxed security context to allow the container to run properly
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            # Removed readOnlyRootFilesystem and runAsNonRoot that were causing permission issues
      volumes:
        - name: config
          configMap:
            name: passkey-auth-config
        - name: data
          persistentVolumeClaim:
            claimName: passkey-auth-pvc
      restartPolicy: Always

---
apiVersion: v1
kind: Service
metadata:
  name: passkey-auth-service
  namespace: apps
  labels:
    app: passkey-auth
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: http
      protocol: TCP
      name: http
  selector:
    app: passkey-auth

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: passkey-auth-ingress
  namespace: apps
  annotations:
    kubernetes.io/ingress.class: "nginx"
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/proxy-set-headers: "passkey-auth-headers"
    nginx.ingress.kubernetes.io/upstream-vhost: "passkey.junv.cc"
    nginx.ingress.kubernetes.io/proxy-redirect-from: "http://"
    nginx.ingress.kubernetes.io/proxy-redirect-to: "https://"
  labels:
    app: passkey-auth
spec:
  tls:
    - hosts:
        - "passkey.junv.cc"
      secretName: passkey-auth-tls
  rules:
    - host: "passkey.junv.cc"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: passkey-auth-service
                port:
                  number: 80