Scott KarpandClaude Fable 5.1
85883acc17
bikoret.ch and www.bikoret.ch served with a Let's Encrypt certificate through cert-manager (letsencrypt-prod, HTTP-01), ssl-redirect on; bikoret.org and www redirect permanently to https://bikoret.ch; the no-host catch-all stays; shorashim.ch still answers over plain HTTP until its callers have moved. KOHEN Day 8 gives the order: A records, wait for the name to resolve, then apply — never before. Tamid's names table updated. Doorpost re-pinned. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
153 lines
4.5 KiB
YAML
153 lines
4.5 KiB
YAML
# Bikoret Services
|
|
# Operations spec §1.1: Four access tiers
|
|
# - Pe'ah (public, no auth)
|
|
# - Machaneh Leviyah (authenticated)
|
|
# - Chatzer (full access)
|
|
# - Kodesh (operator, mTLS)
|
|
#
|
|
# All tiers go through a single Service → vav-pipeline port 4000
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: shorashim
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: shorashim
|
|
ports:
|
|
- port: 80
|
|
targetPort: 4000
|
|
protocol: TCP
|
|
name: http
|
|
---
|
|
# ============================================================
|
|
# The gate to the world — through the shared ingress
|
|
# ============================================================
|
|
#
|
|
# Until 2026-10-06 Bikoret had its own LoadBalancer Service
|
|
# (`shorashim-external`, NLB 185.19.29.180, NodePort 30923). It is gone:
|
|
# one NLB per Service was a third of the account's bill, and the pod saw
|
|
# every caller as the node (kube-proxy SNAT) so the pe'ah's per-IP watch
|
|
# could not tell callers apart. The ingress-nginx Service is already
|
|
# externalTrafficPolicy: Local with its health-check port open, so the
|
|
# controller sees the caller and hands it on in X-Real-IP; the pipeline
|
|
# believes that header only from TRUSTED_PROXIES (configmap.yaml).
|
|
#
|
|
# Hosts (2026-10-13, the name): bikoret.ch is the place; www.bikoret.ch
|
|
# and the old shorashim.ch are served too; bikoret.org (second Ingress
|
|
# below) only redirects. TLS from Let's Encrypt through cert-manager's
|
|
# letsencrypt-prod ClusterIssuer, HTTP-01 — so apply this ONLY after
|
|
# `dig +short A bikoret.ch` answers 185.19.28.170: a certificate asked
|
|
# for before the name resolves only burns the failed-validation limit.
|
|
# The no-host catch-all stays, so http://<ingress-ip>/... keeps working
|
|
# with no DNS; with ssl-redirect on, named hosts go to https.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: shorashim
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
# A 71-judge Sanhedrin may deliberate for ten minutes (Construction §2.2).
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "620"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "620"
|
|
# The bedikah accepts 65,536 bytes of output and 1 MiB of sources;
|
|
# leave room for the envelope.
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "2m"
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- bikoret.ch
|
|
- www.bikoret.ch
|
|
secretName: bikoret-tls
|
|
rules:
|
|
- http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: shorashim
|
|
port:
|
|
number: 80
|
|
- host: bikoret.ch
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: shorashim
|
|
port:
|
|
number: 80
|
|
- host: www.bikoret.ch
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: shorashim
|
|
port:
|
|
number: 80
|
|
# The old name, kept until its callers have moved; no certificate asked for it.
|
|
- host: shorashim.ch
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: shorashim
|
|
port:
|
|
number: 80
|
|
---
|
|
# bikoret.org: the stranger's guess, redirected to the place. No service
|
|
# of its own; nginx answers the redirect itself. Add its A records too.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: bikoret-org
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: shorashim
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch$request_uri
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- bikoret.org
|
|
- www.bikoret.org
|
|
secretName: bikoret-org-tls
|
|
rules:
|
|
- host: bikoret.org
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: shorashim
|
|
port:
|
|
number: 80
|
|
- host: www.bikoret.org
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: shorashim
|
|
port:
|
|
number: 80
|