---
namespace: "apps"
environment:
- name: "KEEPORG_MASTER_KEY_FILE"
  value: "/etc/keeporg/config.txt"
- name: "KEEPORG_EXTERNAL_URL"
  value: "https://keeporg.tiredsysadmin.cc"
# Only the hops between nginx and the pod: the nginx host itself, and the
# k3s pod network, which kube-proxy's NodePort translation makes the source
# of every connection. Sign-in rate limits count by the address nginx puts
# in X-Forwarded-For; a whole private range here would let any client on it
# claim a fresh address with a header of its own.
- name: "KEEPORG_TRUSTED_PROXIES"
  value: "10.200.1.3,10.42.0.0/16"
image:
  name: "repo.rcmd.space/keeporg"
  version: "v0.1.0"
network:
  ports:
  - name: "main"
    node: 32970
    source: 8765
    destination: 8765
    # Readiness keeps traffic away until the server has opened (and, on the
    # first start of 0.11, imported) its database; liveness restarts it if
    # it stops answering.
    healthcheckPath: "/healthz"
mounts:
  - name: "db"
    source: "/var/lib/keeporg"
    destination: "/var/lib/keeporg"
secrets:
  - name: "keeporg-encryption"
    destination: "/etc/keeporg"