bikoret/deploy/k8s/service.yaml

# Bikoret Services
# Operations spec §1.1: Four access tiers
#   - Pe'ah (public, no auth)
#   - Machaneh Leviyah (authenticated)
#   - Chatzer (full access)
#   - Kodesh (operator, mTLS)
#
# All tiers go through a single Service → vav-pipeline port 4000
---
apiVersion: v1
kind: Service
metadata:
  name: shorashim
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: shorashim
  ports:
    - port: 80
      targetPort: 4000
      protocol: TCP
      name: http
---
# ============================================================
# The gate to the world — through the shared ingress
# ============================================================
#
# Until 2026-10-06 Bikoret had its own LoadBalancer Service
# (`shorashim-external`, NLB 185.19.29.180, NodePort 30923). It is gone:
# one NLB per Service was a third of the account's bill, and the pod saw
# every caller as the node (kube-proxy SNAT) so the pe'ah's per-IP watch
# could not tell callers apart. The ingress-nginx Service is already
# externalTrafficPolicy: Local with its health-check port open, so the
# controller sees the caller and hands it on in X-Real-IP; the pipeline
# believes that header only from TRUSTED_PROXIES (configmap.yaml).
#
# Hosts (2026-10-13, the name): bikoret.ch is the place; www.bikoret.ch
# and the old shorashim.ch are served too; bikoret.org (second Ingress
# below) only redirects. TLS from Let's Encrypt through cert-manager's
# letsencrypt-prod ClusterIssuer, HTTP-01 — so apply this ONLY after
# `dig +short A bikoret.ch` answers 185.19.28.170: a certificate asked
# for before the name resolves only burns the failed-validation limit.
# The no-host catch-all stays, so http://<ingress-ip>/... keeps working
# with no DNS; with ssl-redirect on, named hosts go to https.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shorashim
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    # A 71-judge Sanhedrin may deliberate for ten minutes (Construction §2.2).
    nginx.ingress.kubernetes.io/proxy-read-timeout: "620"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "620"
    # The bedikah accepts 65,536 bytes of output and 1 MiB of sources; a
    # coding agent's request through the gate carries its whole context.
    nginx.ingress.kubernetes.io/proxy-body-size: "32m"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - bikoret.ch
        - www.bikoret.ch
      secretName: bikoret-tls
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: shorashim
                port:
                  number: 80
    - host: bikoret.ch
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: shorashim
                port:
                  number: 80
    - host: www.bikoret.ch
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: shorashim
                port:
                  number: 80
    # The old name, kept until its callers have moved; no certificate asked for it.
    - host: shorashim.ch
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: shorashim
                port:
                  number: 80
---
# bikoret.org: the stranger's guess, redirected to the place. No service
# of its own; nginx answers the redirect itself. Add its A records too.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bikoret-org
  namespace: shorashim
  labels:
    app.kubernetes.io/name: shorashim
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    # The admission webhook refuses `$request_uri` in this annotation; the bare host is enough for a redirect domain.
    nginx.ingress.kubernetes.io/permanent-redirect: https://bikoret.ch
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - bikoret.org
        - www.bikoret.org
      secretName: bikoret-org-tls
  rules:
    - host: bikoret.org
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: shorashim
                port:
                  number: 80
    - host: www.bikoret.org
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: shorashim
                port:
                  number: 80