From 2f8c50540e4a7e789789ecd780fd9fd9383edb5c Mon Sep 17 00:00:00 2001 From: Jacques ROUSSEL Date: Thu, 17 Oct 2024 10:17:32 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=9A=80(docs-ia)=20deploy=20new=20environm?= =?UTF-8?q?ent?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Because we use staging for German people, we need a new environment for our demo --- secrets | 2 +- src/helm/env.d/docs-ia/secrets.enc.yaml | 1 + .../env.d/docs-ia/values.impress.yaml.gotmpl | 184 ++++++++++++++++++ src/helm/helmfile.yaml | 5 + 4 files changed, 191 insertions(+), 1 deletion(-) create mode 120000 src/helm/env.d/docs-ia/secrets.enc.yaml create mode 100644 src/helm/env.d/docs-ia/values.impress.yaml.gotmpl diff --git a/secrets b/secrets index 38594182..59590c28 160000 --- a/secrets +++ b/secrets @@ -1 +1 @@ -Subproject commit 38594182e8f3625f9f39d85c597407d9ce6bf23b +Subproject commit 59590c285cbb6748d5e5e5c92bae1d65efe96da2 diff --git a/src/helm/env.d/docs-ia/secrets.enc.yaml b/src/helm/env.d/docs-ia/secrets.enc.yaml new file mode 120000 index 00000000..f9e86a34 --- /dev/null +++ b/src/helm/env.d/docs-ia/secrets.enc.yaml @@ -0,0 +1 @@ +../../../../secrets/numerique-gouv/impress/env/docs-ia/secrets.enc.yaml \ No newline at end of file diff --git a/src/helm/env.d/docs-ia/values.impress.yaml.gotmpl b/src/helm/env.d/docs-ia/values.impress.yaml.gotmpl new file mode 100644 index 00000000..28b40277 --- /dev/null +++ b/src/helm/env.d/docs-ia/values.impress.yaml.gotmpl @@ -0,0 +1,184 @@ +image: + repository: lasuite/impress-backend + pullPolicy: Always + tag: "main" + +backend: + migrateJobAnnotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-delete-policy: HookSucceeded + envVars: + AI_API_KEY: + secretKeyRef: + name: backend + key: AI_API_KEY + AI_BASE_URL: + secretKeyRef: + name: backend + key: AI_BASE_URL + AI_MODEL: meta-llama/Meta-Llama-3.1-70B-Instruct + DJANGO_CSRF_TRUSTED_ORIGINS: http://docs-ia.beta.numerique.gouv.fr,https://docs-ia.beta.numerique.gouv.fr + DJANGO_CONFIGURATION: Production + DJANGO_ALLOWED_HOSTS: "*" + DJANGO_SECRET_KEY: + secretKeyRef: + name: backend + key: DJANGO_SECRET_KEY + DJANGO_SETTINGS_MODULE: impress.settings + DJANGO_SUPERUSER_EMAIL: + secretKeyRef: + name: backend + key: DJANGO_SUPERUSER_EMAIL + DJANGO_SUPERUSER_PASSWORD: + secretKeyRef: + name: backend + key: DJANGO_SUPERUSER_PASSWORD + DJANGO_EMAIL_HOST: "smtp.tem.scw.cloud" + DJANGO_EMAIL_PORT: 587 + DJANGO_EMAIL_USE_TLS: True + DJANGO_EMAIL_FROM: "noreply@docs.beta.numerique.gouv.fr" + DJANGO_EMAIL_HOST_USER: + secretKeyRef: + name: backend + key: DJANGO_EMAIL_HOST_USER + DJANGO_EMAIL_HOST_PASSWORD: + secretKeyRef: + name: backend + key: DJANGO_EMAIL_HOST_PASSWORD + DJANGO_SILENCED_SYSTEM_CHECKS: security.W008,security.W004 + OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks + OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize + OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token + OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo + OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end + OIDC_RP_CLIENT_ID: + secretKeyRef: + name: backend + key: OIDC_RP_CLIENT_ID + OIDC_RP_CLIENT_SECRET: + secretKeyRef: + name: backend + key: OIDC_RP_CLIENT_SECRET + OIDC_RP_SIGN_ALGO: RS256 + OIDC_RP_SCOPES: "openid email" + OIDC_REDIRECT_ALLOWED_HOSTS: https://docs-ia.beta.numerique.gouv.fr + OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}" + LOGIN_REDIRECT_URL: https://docs-ia.beta.numerique.gouv.fr + LOGIN_REDIRECT_URL_FAILURE: https://docs-ia.beta.numerique.gouv.fr + LOGOUT_REDIRECT_URL: https://docs-ia.beta.numerique.gouv.fr + DB_HOST: + secretKeyRef: + name: postgresql.postgres.libre.sh + key: host + DB_NAME: + secretKeyRef: + name: postgresql.postgres.libre.sh + key: database + DB_USER: + secretKeyRef: + name: postgresql.postgres.libre.sh + key: username + DB_PASSWORD: + secretKeyRef: + name: postgresql.postgres.libre.sh + key: password + DB_PORT: + secretKeyRef: + name: postgresql.postgres.libre.sh + key: port + POSTGRES_USER: + secretKeyRef: + name: postgresql.postgres.libre.sh + key: username + POSTGRES_DB: + secretKeyRef: + name: postgresql.postgres.libre.sh + key: database + POSTGRES_PASSWORD: + secretKeyRef: + name: postgresql.postgres.libre.sh + key: password + REDIS_URL: + secretKeyRef: + name: redis.redis.libre.sh + key: url + AWS_S3_ENDPOINT_URL: + secretKeyRef: + name: impress-media-storage.bucket.libre.sh + key: url + AWS_S3_ACCESS_KEY_ID: + secretKeyRef: + name: impress-media-storage.bucket.libre.sh + key: accessKey + AWS_S3_SECRET_ACCESS_KEY: + secretKeyRef: + name: impress-media-storage.bucket.libre.sh + key: secretKey + AWS_STORAGE_BUCKET_NAME: + secretKeyRef: + name: impress-media-storage.bucket.libre.sh + key: bucket + AWS_S3_REGION_NAME: local + STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage + + createsuperuser: + command: + - "/bin/sh" + - "-c" + - | + python manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD + restartPolicy: Never + +frontend: + image: + repository: lasuite/impress-frontend + pullPolicy: Always + tag: "main" + +yProvider: + image: + repository: lasuite/impress-y-provider + pullPolicy: Always + tag: "main" + +ingress: + enabled: true + host: docs-ia.beta.numerique.gouv.fr + className: nginx + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + +ingressWS: + enabled: true + host: docs-ia.beta.numerique.gouv.fr + className: nginx + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + +ingressAdmin: + enabled: true + host: docs-ia.beta.numerique.gouv.fr + className: nginx + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + nginx.ingress.kubernetes.io/auth-signin: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/start + nginx.ingress.kubernetes.io/auth-url: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/auth + +ingressMedia: + enabled: true + host: docs-ia.beta.numerique.gouv.fr + + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256" + nginx.ingress.kubernetes.io/auth-url: https://docs-ia.beta.numerique.gouv.fr/api/v1.0/documents/retrieve-auth/ + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + nginx.ingress.kubernetes.io/force-ssl-redirect: "true" + nginx.ingress.kubernetes.io/rewrite-target: /docs-ia-impress-media-storage/$1 + nginx.ingress.kubernetes.io/ssl-redirect: "true" + nginx.ingress.kubernetes.io/upstream-vhost: s3.margaret-hamilton.indiehosters.net + +serviceMedia: + host: s3.margaret-hamilton.indiehosters.net + port: 443 + diff --git a/src/helm/helmfile.yaml b/src/helm/helmfile.yaml index 434a0241..32f8c948 100644 --- a/src/helm/helmfile.yaml +++ b/src/helm/helmfile.yaml @@ -70,6 +70,11 @@ environments: - version: 0.0.1 secrets: - env.d/{{ .Environment.Name }}/secrets.enc.yaml + docs-ia: + values: + - version: 0.0.1 + secrets: + - env.d/{{ .Environment.Name }}/secrets.enc.yaml preprod: values: - version: 0.0.1