foxhunt/infra/k8s/services/web-dashboard.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-dashboard
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: web-dashboard
    app.kubernetes.io/part-of: foxhunt
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app.kubernetes.io/name: web-dashboard
  template:
    metadata:
      labels:
        app.kubernetes.io/name: web-dashboard
        app.kubernetes.io/part-of: foxhunt
    spec:
      nodeSelector:
        k8s.scaleway.com/pool-name: platform
      imagePullSecrets:
        - name: gitlab-registry
      initContainers:
        - name: fetch-assets
          image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/foxhunt-runtime:latest
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -e
              rclone copy \
                ":s3:foxhunt-binaries/web-dashboard/" \
                "/usr/share/nginx/html/" \
                --s3-provider=Minio \
                --s3-endpoint=http://minio.foxhunt.svc.cluster.local:9000 \
                --s3-access-key-id="${MINIO_ACCESS_KEY}" \
                --s3-secret-access-key="${MINIO_SECRET_KEY}" \
                --s3-no-check-bucket
              echo "Fetched web-dashboard assets ($(find /usr/share/nginx/html -type f | wc -l) files)"
          env:
            - name: MINIO_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: minio-credentials
                  key: access-key
            - name: MINIO_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: minio-credentials
                  key: secret-key
          volumeMounts:
            - name: html
              mountPath: /usr/share/nginx/html
          resources:
            requests:
              cpu: 100m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 128Mi
      containers:
        - name: nginx
          image: nginx:alpine
          ports:
            - containerPort: 80
              name: http
          volumeMounts:
            - name: html
              mountPath: /usr/share/nginx/html
              readOnly: true
            - name: nginx-conf
              mountPath: /etc/nginx/conf.d
              readOnly: true
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 100m
              memory: 64Mi
          livenessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 5
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 2
            periodSeconds: 10
      volumes:
        - name: html
          emptyDir: {}
        - name: nginx-conf
          configMap:
            name: web-dashboard-nginx
---
apiVersion: v1
kind: Service
metadata:
  name: web-dashboard
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: web-dashboard
    app.kubernetes.io/part-of: foxhunt
spec:
  selector:
    app.kubernetes.io/name: web-dashboard
  ports:
    - port: 80
      targetPort: 80
      name: http
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: web-dashboard-nginx
  namespace: foxhunt
data:
  default.conf: |
    server {
        listen 80;
        root /usr/share/nginx/html;
        index index.html;

        # SPA: route all non-file requests to index.html
        location / {
            try_files $uri $uri/ /index.html;
        }

        # Cache static assets aggressively
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        # No cache for index.html (so deploys take effect immediately)
        location = /index.html {
            add_header Cache-Control "no-cache";
        }
    }