ReactorcoremeltdownandClaude Opus 5.5
cc1aeb6a00
Every Android release build runs lint, which AGP 8.7 cannot run on JDK 26, the JDK Homebrew's Gradle starts on; make android failed unless JAVA_HOME was set by hand. gradle/gradle-daemon-jvm.properties now runs the Gradle daemon on JDK 17 whatever launches it. The Helm values trusted every private address range as a proxy, which let any client on the LAN choose its own address for the sign-in rate limits. They now name only the nginx host and the k3s pod network. The port gains healthcheckPath, so the pod gets readiness and liveness probes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
---
|
|
namespace: "apps"
|
|
environment:
|
|
- name: "KEEPORG_MASTER_KEY_FILE"
|
|
value: "/etc/keeporg/config.txt"
|
|
- name: "KEEPORG_EXTERNAL_URL"
|
|
value: "https://keeporg.tiredsysadmin.cc"
|
|
# Only the hops between nginx and the pod: the nginx host itself, and the
|
|
# k3s pod network, which kube-proxy's NodePort translation makes the source
|
|
# of every connection. Sign-in rate limits count by the address nginx puts
|
|
# in X-Forwarded-For; a whole private range here would let any client on it
|
|
# claim a fresh address with a header of its own.
|
|
- name: "KEEPORG_TRUSTED_PROXIES"
|
|
value: "10.200.1.3,10.42.0.0/16"
|
|
image:
|
|
name: "repo.rcmd.space/keeporg"
|
|
version: "v0.1.0"
|
|
network:
|
|
ports:
|
|
- name: "main"
|
|
node: 32970
|
|
source: 8765
|
|
destination: 8765
|
|
# Readiness keeps traffic away until the server has opened (and, on the
|
|
# first start of 0.11, imported) its database; liveness restarts it if
|
|
# it stops answering.
|
|
healthcheckPath: "/healthz"
|
|
mounts:
|
|
- name: "db"
|
|
source: "/var/lib/keeporg"
|
|
destination: "/var/lib/keeporg"
|
|
secrets:
|
|
- name: "keeporg-encryption"
|
|
destination: "/etc/keeporg"
|