egommerce/stack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
PB
2025-11-23 21:49:18 +01:00
parent d5596b59cb
commit 68d0f3d48d
18 changed files with 268 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
deploy/db_migrations/basket-svc/0001_create_base_tables.up.sql
View File

@@ -1,5 +1,7 @@
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE SCHEMA "basket" AUTHORIZATION egommerce;
CREATE TABLE IF NOT EXISTS basket.basket
(
id uuid NOT NULL DEFAULT gen_random_uuid(),

2
deploy/db_migrations/catalog-svc/0001_create_base_tables.up.sql
View File

@@ -1,5 +1,7 @@
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE SCHEMA "catalog" AUTHORIZATION egommerce;
CREATE TABLE catalog.product
(
id uuid NOT NULL DEFAULT gen_random_uuid(),

1
deploy/db_migrations/config-svc/0001_create_base_tables.down.sql Normal file
View File

@@ -0,0 +1 @@
DROP TABLE IF EXISTS config.settings;

15
deploy/db_migrations/config-svc/0001_create_base_tables.up.sql Normal file
View File

@@ -0,0 +1,15 @@
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE SCHEMA "config" AUTHORIZATION egommerce;
CREATE TABLE IF NOT EXISTS config.settings
(
id uuid NOT NULL DEFAULT gen_random_uuid(),
"name" character varying NOT NULL,
"value" character varying NOT NULL,
PRIMARY KEY (id),
UNIQUE (name)
);
ALTER TABLE IF EXISTS config.settings OWNER to egommerce;

2
deploy/db_migrations/identity-svc/0001_create_base_tables.up.sql
View File

@@ -1,5 +1,7 @@
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE SCHEMA "identity" AUTHORIZATION egommerce;
CREATE TABLE IF NOT EXISTS identity.users
(
id uuid NOT NULL DEFAULT gen_random_uuid(),

4
deploy/db_migrations/init/init.sql
View File

@@ -4,7 +4,3 @@ CREATE DATABASE egommerce;
GRANT ALL PRIVILEGES ON DATABASE egommerce TO egommerce;
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE SCHEMA "identity" AUTHORIZATION egommerce;
CREATE SCHEMA catalog AUTHORIZATION egommerce;
CREATE SCHEMA basket AUTHORIZATION egommerce;

12
deploy/db_migrations/order-svc/0001_create_base_tables.up.sql
View File

@@ -1,6 +1,8 @@
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE TABLE IF NOT EXISTS "ordering"."order"
CREATE SCHEMA "order" AUTHORIZATION egommerce;
CREATE TABLE IF NOT EXISTS "order"."order"
(
id uuid NOT NULL DEFAULT gen_random_uuid(),
"state" character varying NOT NULL DEFAULT 'new',
@@ -9,7 +11,7 @@ CREATE TABLE IF NOT EXISTS "ordering"."order"
PRIMARY KEY (id)
);
CREATE TABLE IF NOT EXISTS "ordering".order_item
CREATE TABLE IF NOT EXISTS "order".order_item
(
id uuid NOT NULL DEFAULT gen_random_uuid(),
order_id uuid NOT NULL,
@@ -21,12 +23,12 @@ CREATE TABLE IF NOT EXISTS "ordering".order_item
PRIMARY KEY (id)
);
ALTER TABLE IF EXISTS "ordering".order_item
ALTER TABLE IF EXISTS "order".order_item
ADD CONSTRAINT order_item_order_fkey FOREIGN KEY (order_id)
REFERENCES "ordering"."order" (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE NO ACTION
NOT VALID;
ALTER TABLE IF EXISTS "ordering"."order" OWNER to egommerce;
ALTER TABLE IF EXISTS "ordering".order_item OWNER to egommerce;
ALTER TABLE IF EXISTS "order"."order" OWNER to egommerce;
ALTER TABLE IF EXISTS "order".order_item OWNER to egommerce;

2
deploy/k8s/api-cache.yml
View File

@@ -2,7 +2,7 @@ apiVersion: v1
kind: PersistentVolume
metadata:
name: api-cache-pv
namespace: egommerce
# namespace: egommerce
spec:
capacity:
storage: 5Gi

16
deploy/k8s/api-eventbus.yml
View File

@@ -2,7 +2,7 @@ apiVersion: v1
kind: PersistentVolume
metadata:
name: api-eventbus-pv
namespace: egommerce
# namespace: egommerce
spec:
capacity:
storage: 10Gi
@@ -41,7 +41,7 @@ spec:
protocol: TCP
port: 9092
nodePort: 31200
- name: api-eventbus-controller
- name: api-eventbus-ctrl
protocol: TCP
port: 9093
nodePort: 31299
@@ -68,7 +68,7 @@ spec:
imagePullPolicy: Always # For future image
ports:
- containerPort: 9092
name: eventbus
name: eventbus-brkr
- containerPort: 9093
name: eventbus-ctrl
volumeMounts:
@@ -79,14 +79,16 @@ spec:
value: "broker,controller"
- name: KAFKA_CONTROLLER_LISTENER_NAMES
value: "CONTROLLER"
- name: KAFKA_NODE_ID
value: "1"
- name: KAFKA_LISTENERS
value: "PLAINTEXT://:9092,CONTROLLER://:9093"
- name: KAFKA_CONTROLLER_QUORUM_VOTERS
value: "1@localhost:9093"
- name: KAFKA_NODE_ID
value: "1"
value: "1@api-eventbus:9093"
- name: KAFKA_ADVERTISED_LISTENERS
value: "PLAINTEXT://localhost:9092"
value: "PLAINTEXT://api-eventbus:9092"
- name: KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR
value: "1"
- name: KAFKA_LOG_DIRS
value: "/var/lib/kafka/data"
imagePullSecrets:

83
deploy/k8s/api-gateway.yml
View File

@@ -1,4 +1,20 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: api-gateway-config
namespace: egommerce
data:
global-config-snippet: |
# lua-prepend-path /usr/local/lib/lua/5.4/?.lua
# set-dumpable
log 127.0.0.1 local0 debug
lua-load /etc/haproxy/lua/jwt_auth.lua
frontend-config-snippet: |
http-request lua.jwt_auth
http-response lua.jwt_auth
# http-request deny if !{ var(txn.authenticated) -m bool }
---
apiVersion: v1
kind: Service
metadata:
name: api-gateway
@@ -18,11 +34,10 @@ spec:
kind: IngressClass
apiVersion: networking.k8s.io/v1
metadata:
name: haproxy
name: api-gateway
namespace: egommerce
spec:
controller: haproxy.org/ingress-controller/haproxy
# PROBABLY NOT NEEDED :D
---
apiVersion: networking.k8s.io/v1
kind: Ingress
@@ -32,18 +47,23 @@ metadata:
annotations:
haproxy.org/server-ssl: "true"
haproxy.org/server-ca: "egommerce/ca-root"
haproxy.org/server-alpn: "h2,http/1.1"
haproxy.org/enable-lua: "true"
haproxy.org/backend-config-snippet: |
http-response set-header X-Custom-Backend-Header "value"
haproxy.org/path-rewrite: |
/api/identity/(.*) /\1
/api/catalog/(.*) /\1
/api/basket/(.*) /\1
/api/config/(.*) /\1
spec:
ingressClassName: haproxy
ingressClassName: api-gateway
tls:
- secretName: api-gateway-cert
hosts:
- egommerce.io # CHANGE TO PROD DOMAIN
- egommerce.io # CHANGE TO THE PROD DOMAIN
rules:
- host: egommerce.io # CHANGE TO PROD DOMAIN
- host: egommerce.io # CHANGE TO THE PROD DOMAIN
http:
paths:
- path: /api/identity
@@ -67,6 +87,13 @@ spec:
name: basket-svc
port:
number: 443
- path: /api/config
pathType: Prefix
backend:
service:
name: config-svc
port:
number: 443
---
apiVersion: apps/v1
kind: Deployment
@@ -88,19 +115,13 @@ spec:
- name: api-gateway
image: git.ego.freeddns.org/egommerce/api-gateway:dev
imagePullPolicy: Always
resources:
limits:
cpu: 100m
memory: 512M
requests:
cpu: 50m
memory: 256M
ports:
- containerPort: 8443
args:
- --publish-service=egommerce/api-gateway
- --configmap=egommerce/api-gateway-config
- --ingress.class=haproxy
- --https-bind-port=8443
ports:
- containerPort: 8443
env:
- name: POD_NAME
valueFrom:
@@ -112,22 +133,34 @@ spec:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
- name: POD_IP
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: status.podIP
securityContext:
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
# - name: POD_IP
# valueFrom:
# fieldRef:
# apiVersion: v1
# fieldPath: status.podIP
resources:
limits:
cpu: 100m
memory: 512M
requests:
cpu: 50m
memory: 256M
# securityContext:
# capabilities:
# add:
# - NET_BIND_SERVICE
# drop:
# - ALL
# readOnlyRootFilesystem: false
# runAsUser: 1000
# runAsGroup: 1000
# runAsNonRoot: true
# allowPrivilegeEscalation: false
# seccompProfile:
# type: RuntimeDefault
volumes:
- name: api-gateway-config
configMap:
name: api-gateway-config
imagePullSecrets:
- name: regcred

4
deploy/k8s/api-logger.yml
View File

@@ -159,7 +159,7 @@ apiVersion: v1
kind: PersistentVolume
metadata:
name: api-logger-prometheus-pv
namespace: egommerce
# namespace: egommerce
spec:
capacity:
storage: 5Gi
@@ -325,7 +325,7 @@ apiVersion: v1
kind: PersistentVolume
metadata:
name: api-logger-grafana-pv
namespace: egommerce
# namespace: egommerce
spec:
capacity:
storage: 5Gi

133
deploy/k8s/config-svc.yml Normal file
View File

@@ -0,0 +1,133 @@
apiVersion: v1
kind: Service
metadata:
name: config-svc
namespace: egommerce
annotations:
haproxy.org/check: "true"
labels:
app: config-svc
spec:
type: NodePort
selector:
app: config-svc
ports:
- name: config-svc
port: 443
nodePort: 31811
# - name: config-svc-metrics
# port: 9090
# nodePort: 31811
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: config-svc
namespace: egommerce
spec:
replicas: 1
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1 # Number of extra pods that can be created during update
maxUnavailable: 1 # Max number of pods that can be unavailable during update
selector:
matchLabels:
app: config-svc
template:
metadata:
labels:
app: config-svc
spec:
# initContainers:
# - name: config-svc-init
# image: busybox:1.28
# command: [
# 'sh',
# '-c',
# '/bin/migrate'
# ]
containers:
- name: config-svc
image: git.ego.freeddns.org/egommerce/config-svc:dev
imagePullPolicy: Always
env:
- name: APP_NAME
value: config-svc
- name: APP_DOMAIN
value: config-svc.egommerce.io
- name: APP_PATH_PREFIX
value: /config
- name: API_DATABASE_URL
value: postgres://egommerce:12345678@db-postgres:5432/egommerce?sslmode=disable
readinessProbe:
httpGet:
scheme: HTTPS
port: config-svc
path: /health
initialDelaySeconds: 5
periodSeconds: 5
failureThreshold: 1
livenessProbe:
httpGet:
scheme: HTTPS
port: config-svc
path: /health
initialDelaySeconds: 5
periodSeconds: 5
failureThreshold: 1
volumeMounts:
- name: config-cert
mountPath: /certs/config-svc.crt
readOnly: true
- name: config-key
mountPath: /certs/config-svc.key
readOnly: true
- name: config-migrations
mountPath: /migrations
readOnly: true
resources:
limits:
cpu: 100m
memory: 512M
requests:
cpu: 50m
memory: 256M
ports:
- name: config-svc
containerPort: 443
# - name: config-svc-metrics
# image: prom/prometheus-exporter:latest
# ports:
# - containerPort: 9090
# args:
# - --web.listen-address=:9090
# - --web.telemetry-path=/metrics
# - name: config-scheduler # Scheduler Container
# image: git.ego.freeddns.org/egommerce/config-svc:dev
# imagePullPolicy: Always
# command: [
# "/usr/local/bin/scheduler"
# ]
# resources:
# limits:
# cpu: 100m
# memory: 512Mi
# requests:
# cpu: 50m
# memory: 256Mi
imagePullSecrets:
- name: regcred
volumes:
- name: config-cert
hostPath:
path: /egommerce/stack/deploy/certs/config-svc/config-svc.crt
type: File
- name: config-key
hostPath:
path: /egommerce/stack/deploy/certs/config-svc/config-svc.key
type: File
- name: config-migrations
hostPath:
path: /egommerce/stack/deploy/db_migrations/config-svc
type: Directory

2
deploy/k8s/db-postgres.yml
View File

@@ -2,7 +2,7 @@ apiVersion: v1
kind: PersistentVolume
metadata:
name: db-postgres-pv
namespace: egommerce
# namespace: egommerce
spec:
capacity:
storage: 5Gi

2
deploy/k8s/identity-svc.yml
View File

@@ -5,6 +5,8 @@ metadata:
namespace: egommerce
annotations:
haproxy.org/check: "true"
# haproxy.org/backend-config-snippet: |
# http-response set-header X-Custom-Header-Service "rojter"
labels:
app: identity-svc
spec:

36
deploy/scripts/gen-certs.sh
View File

@@ -19,6 +19,8 @@ export POSTGRES_CN="db-postgres.egommerce.local,db-postgres"
export POSTGRES_SAN="DNS:db-postgres.egommerce.local,DNS:db-postgres,IP:127.0.0.1"
# export MONGO_CN="mongo.db.egommerce.local,db-mongo"
# export MONGO_SAN="DNS:mongo.db.egommerce.local,DNS:db-mongo,IP:127.0.0.1"
export CONFIG_CN="config-svc.egommerce.local"
export CONFIG_SAN="DNS:config-svc.egommerce.local,IP:127.0.0.1"
export IDENTITY_CN="identity-svc.egommerce.local"
export IDENTITY_SAN="DNS:identity-svc.egommerce.local,IP:127.0.0.1"
export CATALOG_CN="catalog-svc.egommerce.local,catalog-svc"
@@ -39,6 +41,7 @@ mkdir -p \
${CERTS_DIR}api-cache \
${CERTS_DIR}api-logger \
${CERTS_DIR}db-postgres \
${CERTS_DIR}config-svc \
${CERTS_DIR}identity-svc \
${CERTS_DIR}basket-svc \
${CERTS_DIR}catalog-svc \
@@ -46,13 +49,15 @@ mkdir -p \
${CERTS_DIR}pricing-svc
# Generate Root CA cert
openssl req -newkey rsa:2048 -nodes -x509 -days 1024 \
-subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/OU=DevOps Team/CN=Egommerce CA" \
-keyout ${CERTS_DIR}ca-root/ca-root.key -out ${CERTS_DIR}ca-root/ca-root.crt >/dev/null
# openssl req -newkey rsa:2048 -nodes -x509 -days 1024 \
# -subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/OU=DevOps Team/CN=Egommerce CA" \
# -keyout ${CERTS_DIR}ca-root/ca-root.key -out ${CERTS_DIR}ca-root/ca-root.crt >/dev/null
# Create fullchain pem file
cat ${CERTS_DIR}ca-root/ca-root.key ${CERTS_DIR}ca-root/ca-root.crt > ${CERTS_DIR}ca-root/ca-root.pem
# cat ${CERTS_DIR}ca-root/ca-root.key ${CERTS_DIR}ca-root/ca-root.crt > ${CERTS_DIR}ca-root/ca-root.pem
# Shortcut openssl command
# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout app1-tls.key -out app1-tls.crt -subj "/CN=egommerce.io/O=sisox"
# Generate Gateway cert
openssl req -newkey rsa:2048 -nodes \
@@ -122,7 +127,20 @@ openssl x509 -req -days 365 \
-out ${CERTS_DIR}db-postgres/db-postgres.crt >/dev/null
# Generate Identity cert
# Generate config-svc cert
openssl req -newkey rsa:2048 -nodes \
-subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$CONFIG_CN" \
-keyout ${CERTS_DIR}config-svc/config-svc.key \
-out ${CERTS_DIR}config-svc/config-svc.csr >/dev/null
openssl x509 -req -days 365 \
-in ${CERTS_DIR}config-svc/config-svc.csr -CA ${CERTS_DIR}ca-root/ca-root.crt \
-CAkey ${CERTS_DIR}ca-root/ca-root.key -set_serial 01 \
-extensions SAN -extfile <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=${CONFIG_SAN}")) \
-out ${CERTS_DIR}config-svc/config-svc.crt >/dev/null
# Generate identity-svc cert
openssl req -newkey rsa:2048 -nodes \
-subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$IDENTITY_CN" \
-keyout ${CERTS_DIR}identity-svc/identity-svc.key \
@@ -135,7 +153,7 @@ openssl x509 -req -days 365 \
-out ${CERTS_DIR}identity-svc/identity-svc.crt >/dev/null
# Generate Basket cert
# Generate basket-svc cert
openssl req -newkey rsa:2048 -nodes \
-subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$BASKET_CN" \
-keyout ${CERTS_DIR}basket-svc/basket-svc.key \
@@ -148,7 +166,7 @@ openssl x509 -req -days 365 \
-out ${CERTS_DIR}basket-svc/basket-svc.crt >/dev/null
# Generate Catalog cert
# Generate catalog-svc cert
openssl req -newkey rsa:2048 -nodes \
-subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$CATALOG_CN" \
-keyout ${CERTS_DIR}catalog-svc/catalog-svc.key \
@@ -161,7 +179,7 @@ openssl x509 -req -days 365 \
-out ${CERTS_DIR}catalog-svc/catalog-svc.crt >/dev/null
# Generate Order cert
# Generate order-svc cert
openssl req -newkey rsa:2048 -nodes \
-subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$ORDER_CN" \
-keyout ${CERTS_DIR}order-svc/order-svc.key \
@@ -174,7 +192,7 @@ openssl x509 -req -days 365 \
-out ${CERTS_DIR}order-svc/order-svc.crt >/dev/null
# Generate Pricing cert
# Generate pricing-svc cert
openssl req -newkey rsa:2048 -nodes \
-subj "/C=PL/ST=Silesia/L=Gliwice/O=Egommerce.dev/CN=$PRICING_CN" \
-keyout ${CERTS_DIR}pricing-svc/pricing-svc.key \

1
deploy/scripts/start-k8s.sh
View File

@@ -15,6 +15,7 @@ kubectl apply -f deploy/k8s/api-logger.yml
kubectl apply -f deploy/k8s/db-postgres.yml
# kubectl apply -f deploy/k8s/db-mongo.yml
kubectl apply -f deploy/k8s/config-svc.yml
kubectl apply -f deploy/k8s/identity-svc.yml
kubectl apply -f deploy/k8s/catalog-svc.yml
kubectl apply -f deploy/k8s/basket-svc.yml

1
deploy/scripts/stop-k8s.sh
View File

@@ -5,6 +5,7 @@ alias kubectl="microk8s kubectl" # MicroK8S fix
echo "Stopping egommerce k8s stack..."
kubectl delete -f deploy/k8s/config-svc.yml
kubectl delete -f deploy/k8s/identity-svc.yml
kubectl delete -f deploy/k8s/catalog-svc.yml
kubectl delete -f deploy/k8s/basket-svc.yml

4
deploy/scripts/tunnel-eventbus-to-local.sh Normal file
View File

@@ -0,0 +1,4 @@
#!/bin/sh
# Tunnel local port 9092(kafka) to k8s service node port 31200 (kafka)
socat TCP-LISTEN:9092,fork TCP:127.0.0.1:31200