From 6a9db2094e4995d452874a946bac29bfe2010e6f Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Sat, 4 Apr 2026 09:47:41 -0500 Subject: [PATCH] feat: add harmonic-wordpress dev environment on Legion - Add harmonic-wordpress namespace - WordPress + MySQL deployment with PVCs and ExternalSecrets - Ingress for dev.harmonic-framework.com via Traefik + cert-manager - Argo CD Application watching k8s/harmonic-wordpress/ - Add public Gitea repo credential for git.neuralplatform.ai --- servers/legion/apps/harmonic-wordpress.yaml | 20 +++ servers/legion/argocd.tf | 22 ++- .../k8s/harmonic-wordpress/deployment.yaml | 150 ++++++++++++++++++ .../harmonic-wordpress/external-secrets.yaml | 22 +++ .../k8s/harmonic-wordpress/ingress.yaml | 25 +++ .../legion/k8s/harmonic-wordpress/pvc.yaml | 25 +++ servers/legion/namespaces.tf | 10 ++ 7 files changed, 273 insertions(+), 1 deletion(-) create mode 100644 servers/legion/apps/harmonic-wordpress.yaml create mode 100644 servers/legion/k8s/harmonic-wordpress/deployment.yaml create mode 100644 servers/legion/k8s/harmonic-wordpress/external-secrets.yaml create mode 100644 servers/legion/k8s/harmonic-wordpress/ingress.yaml create mode 100644 servers/legion/k8s/harmonic-wordpress/pvc.yaml diff --git a/servers/legion/apps/harmonic-wordpress.yaml b/servers/legion/apps/harmonic-wordpress.yaml new file mode 100644 index 0000000..bc6f136 --- /dev/null +++ b/servers/legion/apps/harmonic-wordpress.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: harmonic-wordpress + namespace: argocd +spec: + project: default + source: + repoURL: https://git.neuralplatform.ai/will/infrastructure.git + targetRevision: main + path: servers/legion/k8s/harmonic-wordpress + destination: + server: https://kubernetes.default.svc + namespace: harmonic-wordpress + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/servers/legion/argocd.tf b/servers/legion/argocd.tf index 9fe8328..14253b8 100644 --- a/servers/legion/argocd.tf +++ b/servers/legion/argocd.tf @@ -83,7 +83,7 @@ resource "kubernetes_ingress_v1" "argocd" { depends_on = [helm_release.argocd, helm_release.cert_manager] } -# Gitea repo credentials for Argo CD +# Gitea repo credentials for Argo CD (internal cluster IP) # Label argocd.argoproj.io/secret-type=repository tells Argo CD to use this as a repo credential resource "kubernetes_secret" "argocd_gitea_repo" { metadata { @@ -104,6 +104,26 @@ resource "kubernetes_secret" "argocd_gitea_repo" { depends_on = [helm_release.argocd] } +# Gitea repo credentials via public hostname (for apps referencing git.neuralplatform.ai) +resource "kubernetes_secret" "argocd_gitea_repo_public" { + metadata { + name = "argocd-repo-gitea-infrastructure-public" + namespace = kubernetes_namespace.argocd.metadata[0].name + labels = { + "argocd.argoproj.io/secret-type" = "repository" + } + } + + data = { + type = "git" + url = "https://git.neuralplatform.ai/will/infrastructure.git" + username = "will" + password = var.gitea_api_token + } + + depends_on = [helm_release.argocd] +} + # Root application — watches servers/legion/apps/ for app manifests resource "kubernetes_manifest" "argocd_root_app" { manifest = { diff --git a/servers/legion/k8s/harmonic-wordpress/deployment.yaml b/servers/legion/k8s/harmonic-wordpress/deployment.yaml new file mode 100644 index 0000000..dc206b0 --- /dev/null +++ b/servers/legion/k8s/harmonic-wordpress/deployment.yaml @@ -0,0 +1,150 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: mysql + namespace: harmonic-wordpress + labels: + app: mysql +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: mysql + template: + metadata: + labels: + app: mysql + spec: + containers: + - name: mysql + image: mysql:8.0 + ports: + - containerPort: 3306 + env: + - name: MYSQL_DATABASE + value: wordpress + - name: MYSQL_USER + value: wordpress + - name: MYSQL_PASSWORD + valueFrom: + secretKeyRef: + name: wordpress-db + key: mysql_password + - name: MYSQL_ROOT_PASSWORD + valueFrom: + secretKeyRef: + name: wordpress-db + key: mysql_root_password + volumeMounts: + - name: data + mountPath: /var/lib/mysql + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 512Mi + cpu: 500m + livenessProbe: + exec: + command: ["mysqladmin", "ping", "-h", "localhost"] + initialDelaySeconds: 30 + periodSeconds: 10 + readinessProbe: + exec: + command: ["mysqladmin", "ping", "-h", "localhost"] + initialDelaySeconds: 10 + periodSeconds: 5 + volumes: + - name: data + persistentVolumeClaim: + claimName: mysql-data +--- +apiVersion: v1 +kind: Service +metadata: + name: mysql + namespace: harmonic-wordpress +spec: + selector: + app: mysql + ports: + - port: 3306 + targetPort: 3306 + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: wordpress + namespace: harmonic-wordpress + labels: + app: wordpress +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: wordpress + template: + metadata: + labels: + app: wordpress + spec: + containers: + - name: wordpress + image: wordpress:latest + ports: + - containerPort: 80 + env: + - name: WORDPRESS_DB_HOST + value: mysql:3306 + - name: WORDPRESS_DB_NAME + value: wordpress + - name: WORDPRESS_DB_USER + value: wordpress + - name: WORDPRESS_DB_PASSWORD + valueFrom: + secretKeyRef: + name: wordpress-db + key: mysql_password + - name: WORDPRESS_CONFIG_EXTRA + value: | + define('WP_HOME', 'https://dev.harmonic-framework.com'); + define('WP_SITEURL', 'https://dev.harmonic-framework.com'); + volumeMounts: + - name: data + mountPath: /var/www/html + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 512Mi + cpu: 500m + readinessProbe: + httpGet: + path: /wp-login.php + port: 80 + initialDelaySeconds: 30 + periodSeconds: 10 + volumes: + - name: data + persistentVolumeClaim: + claimName: wordpress-data +--- +apiVersion: v1 +kind: Service +metadata: + name: wordpress + namespace: harmonic-wordpress +spec: + selector: + app: wordpress + ports: + - port: 80 + targetPort: 80 + type: ClusterIP diff --git a/servers/legion/k8s/harmonic-wordpress/external-secrets.yaml b/servers/legion/k8s/harmonic-wordpress/external-secrets.yaml new file mode 100644 index 0000000..204a5d5 --- /dev/null +++ b/servers/legion/k8s/harmonic-wordpress/external-secrets.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: wordpress-db + namespace: harmonic-wordpress +spec: + refreshInterval: 1h + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: wordpress-db + creationPolicy: Owner + data: + - secretKey: mysql_root_password + remoteRef: + key: secret/data/harmonic-wordpress + property: mysql_root_password + - secretKey: mysql_password + remoteRef: + key: secret/data/harmonic-wordpress + property: mysql_password diff --git a/servers/legion/k8s/harmonic-wordpress/ingress.yaml b/servers/legion/k8s/harmonic-wordpress/ingress.yaml new file mode 100644 index 0000000..04fbc02 --- /dev/null +++ b/servers/legion/k8s/harmonic-wordpress/ingress.yaml @@ -0,0 +1,25 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: wordpress + namespace: harmonic-wordpress + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + cert-manager.io/cluster-issuer: letsencrypt-prod +spec: + ingressClassName: traefik + tls: + - hosts: + - dev.harmonic-framework.com + secretName: wordpress-tls + rules: + - host: dev.harmonic-framework.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: wordpress + port: + number: 80 diff --git a/servers/legion/k8s/harmonic-wordpress/pvc.yaml b/servers/legion/k8s/harmonic-wordpress/pvc.yaml new file mode 100644 index 0000000..8197552 --- /dev/null +++ b/servers/legion/k8s/harmonic-wordpress/pvc.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: wordpress-data + namespace: harmonic-wordpress +spec: + storageClassName: local-path + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: mysql-data + namespace: harmonic-wordpress +spec: + storageClassName: local-path + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 5Gi diff --git a/servers/legion/namespaces.tf b/servers/legion/namespaces.tf index 487003f..c840944 100644 --- a/servers/legion/namespaces.tf +++ b/servers/legion/namespaces.tf @@ -37,3 +37,13 @@ resource "kubernetes_namespace" "mudcraft" { } } } + +resource "kubernetes_namespace" "harmonic_wordpress" { + metadata { + name = "harmonic-wordpress" + labels = { + managed-by = "terraform" + tier = "apps" + } + } +}