hz/step3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add isolated UAT and production environments

Browse Source
This commit is contained in:
hz
2026-07-20 20:32:22 -05:00
parent 4e0ca70157
commit 17747d96a0
30 changed files with 780 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files
WEB_DEPLOYMENT.md
+3 -35
View File
@@ -1,37 +1,5 @@
# Browser Pre-Alpha Deployment
# Browser deployment
The browser build is served at `https://doctor.ranaze.com`. Gitea builds and
deploys the Web image to the `step3-web` Kubernetes namespace on every push to
`main`. The service is exposed on NodePort `30089`.
Browser, API, DNS, Traefik, database, secret, promotion, and rollback procedures are maintained in [ENVIRONMENTS.md](ENVIRONMENTS.md).
## Cloudflare
Create a proxied `doctor` DNS record that targets the same public endpoint as
the existing `s3q` and `pauth` records. Keep SSL/TLS mode consistent with those
working services and redirect HTTP to HTTPS.
## Traefik
Create one `websecure` router with a host rule for `doctor.ranaze.com` and route
it to the Kubernetes nodes on port `30089`, the Web game NodePort. Reuse the existing
certificate resolver, load-balancing node list, and HTTP-to-HTTPS middleware.
The Web container proxies `/api/Auth/*` to `pauth.ranaze.com` and all other
`/api/*` requests to `s3q.ranaze.com`, so Traefik does not need separate API
routers or prefix middleware for this hostname.
## Verification
After DNS and Traefik are configured:
```bash
curl -fsS https://doctor.ranaze.com/healthz
curl -i -X OPTIONS https://doctor.ranaze.com/api/Auth/login
curl -i -X OPTIONS https://doctor.ranaze.com/api/questions/search
```
The health endpoint must return `ok`. Open the site in a desktop browser and
verify registration or login, question loading, images, answer submission,
ratings, and question reporting. Browser requests must remain on
`doctor.ranaze.com`; requests to `pauth.ranaze.com` or `s3q.ranaze.com` indicate
that the Web origin resolver did not run.
The browser container proxies `/api/*` to the `step3-api` Kubernetes service in its own namespace. Traefik therefore routes the web and public API hostnames to their respective NodePorts without path rewriting.