add DocuSeal to GKE — manifests, Terraform, Argo CD app; update ci-base Dockerfile

servers/gcp/k8s/docuseal/deployment.yaml

@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docuseal
+  namespace: docuseal
+  labels:
+    app: docuseal
+spec:
+  replicas: 1
+  # Recreate — only one pod can hold the RWO PVC at a time.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: docuseal
+  template:
+    metadata:
+      labels:
+        app: docuseal
+    spec:
+      serviceAccountName: docuseal
+      containers:
+        - name: docuseal
+          image: ee.docuseal.com/lip5viwf/ds-ee:latest
+          ports:
+            - containerPort: 3000
+          env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: docuseal-secrets
+                  key: secret_key_base
+            - name: FORCE_SSL
+              value: "false"
+            - name: HOST
+              value: "sign.neurontechnologies.ai"
+            - name: SMTP_ADDRESS
+              valueFrom:
+                secretKeyRef:
+                  name: docuseal-secrets
+                  key: smtp_host
+            - name: SMTP_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: docuseal-secrets
+                  key: smtp_port
+            - name: SMTP_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: docuseal-secrets
+                  key: smtp_username
+            - name: SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: docuseal-secrets
+                  key: smtp_password
+            - name: SMTP_FROM
+              valueFrom:
+                secretKeyRef:
+                  name: docuseal-secrets
+                  key: smtp_from
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: docuseal-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: docuseal
+  namespace: docuseal
+  annotations:
+    # External GCP Network LB — Cloudflare proxies in front, provides TLS.
+    # After provisioning, get the external IP:
+    #   kubectl -n docuseal get svc docuseal
+    # Update Cloudflare DNS A record for sign.neurontechnologies.ai to this IP.
+    cloud.google.com/load-balancer-type: "External"
+spec:
+  selector:
+    app: docuseal
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3000
+  type: LoadBalancer