update deployment (#4)

deployments/container/start.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+set -eu
+
+TLS_DIR="/etc/nginx/tls"
+TLS_SOURCE_DIR="${TLS_SOURCE_DIR:-/var/run/clawreef-tls}"
+TLS_CERT="${TLS_DIR}/tls.crt"
+TLS_KEY="${TLS_DIR}/tls.key"
+SOURCE_CERT="${TLS_SOURCE_DIR}/tls.crt"
+SOURCE_KEY="${TLS_SOURCE_DIR}/tls.key"
+
+mkdir -p "${TLS_DIR}"
+
+if [ -f "${SOURCE_CERT}" ] && [ -f "${SOURCE_KEY}" ]; then
+  cp "${SOURCE_CERT}" "${TLS_CERT}"
+  cp "${SOURCE_KEY}" "${TLS_KEY}"
+elif [ ! -f "${TLS_CERT}" ] || [ ! -f "${TLS_KEY}" ]; then
+  echo "TLS certificate not found, generating a self-signed certificate for bootstrap use."
+  openssl req \
+    -x509 \
+    -nodes \
+    -days 365 \
+    -newkey rsa:2048 \
+    -subj "/CN=clawreef.local" \
+    -keyout "${TLS_KEY}" \
+    -out "${TLS_CERT}"
+fi
+
+export SERVER_ADDRESS="${SERVER_ADDRESS:-:9001}"
+export SERVER_MODE="${SERVER_MODE:-release}"
+
+/usr/local/bin/clawreef-server &
+backend_pid=$!
+
+nginx -g 'daemon off;' &
+nginx_pid=$!
+
+shutdown() {
+  kill "${backend_pid}" 2>/dev/null || true
+  kill "${nginx_pid}" 2>/dev/null || true
+  wait "${backend_pid}" 2>/dev/null || true
+  wait "${nginx_pid}" 2>/dev/null || true
+}
+
+trap shutdown INT TERM
+
+while kill -0 "${backend_pid}" 2>/dev/null && kill -0 "${nginx_pid}" 2>/dev/null; do
+  sleep 2
+done
+
+shutdown

deployments/k8s/clawmanager.yaml

@@ -305,7 +305,7 @@ spec:
       serviceAccountName: clawmanager-app
       containers:
         - name: clawmanager-app
-          image: ericpearlee/clawmanager:latest
+          image: ghcr.io/iamlovingit/clawmanager:latest
           imagePullPolicy: IfNotPresent
           ports:
             - name: https

deployments/nginx/nginx.conf

@@ -0,0 +1,63 @@
+worker_processes auto;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    server_tokens off;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    upstream clawreef_backend {
+        server 127.0.0.1:9001;
+    }
+
+    server {
+        listen 8443 ssl;
+        http2 on;
+        server_name _;
+
+        ssl_certificate /etc/nginx/tls/tls.crt;
+        ssl_certificate_key /etc/nginx/tls/tls.key;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        ssl_prefer_server_ciphers off;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout 1d;
+
+        root /usr/share/nginx/html;
+        index index.html;
+
+        location = /healthz {
+            access_log off;
+            add_header Content-Type text/plain;
+            return 200 'ok';
+        }
+
+        location /api/ {
+            proxy_pass http://clawreef_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto https;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 3600s;
+        }
+
+        location / {
+            try_files $uri $uri/ /index.html;
+        }
+    }
+}