control-interface/admin-frontend: drop explicit podAnnotations

universal-chart already injects proxy.istio.io/config and
traffic.sidecar.istio.io/excludeOutboundPorts by default for every
service — explicitly setting them too produced a duplicate-key YAML
error in Flux's post-render step:

  error while running post render on files: ... yaml: unmarshal errors:
    line 42: mapping key "traffic.sidecar.istio.io/excludeOutboundPorts" already defined at line 25
    line 41: mapping key "proxy.istio.io/config" already defined at line 26

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -27,7 +27,9 @@ build_offline_mirror:
         --build-arg BUILT_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
         ${BUILD_ARGS}
         -t ${IMAGE_NAME}
+        -t ${CR}/${RELEASE_NAME}:latest
 
     - docker run --rm -e DRY_RUN=true ${IMAGE_NAME}
     - docker push ${IMAGE_NAME}
+    - docker push ${CR}/${RELEASE_NAME}:latest
   timeout: 30m

apps/ams-sync/brusnika-stage/backend.yaml

@@ -138,6 +138,10 @@ spec:
           - name: KAFKA_SASL_MECHANISM
             value:
               _default: "SCRAM-SHA-512"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: TELEGRAM_TOKEN
             secretName:

apps/attachments/asterus/backend.yaml

@@ -0,0 +1,139 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      attachments:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
+          pullPolicy:
+            _default: Always
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: attachments
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: attachments-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+        envs:
+          - name: DATABASE_SSL_MODE
+            value:
+              _default: disable
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "4"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8000
+          - name: YANDEX_S3_ACCOUNT_PATH
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+          - name: BUCKET_NAME
+            value:
+              _default: attachments
+          - name: YANDEX_S3_VERIFY
+            value:
+              _default: "false"
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+          - name: DATABASE_HOST
+            value:
+              _default: postgres-service
+
+        secretEnvs:
+          - name: DATABASE_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: DATABASE_NAME
+            secretName:
+              _default: postgres-secret
+            secretKey: database
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/attachments/asterus/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: attachments
+resources:
+  - backend.yaml

apps/attachments/brusnika-stage/backend.yaml

@@ -110,6 +110,10 @@ spec:
           - name: YANDEX_S3_VERIFY
             value:
               _default: "false"
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
         secretEnvs:
           - name: DATABASE_HOST
             secretName:

apps/attachments/uralkal/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: attachments
+resources:
+  - ../base
+patches:
+  - path: patch.yaml
+    target:
+      kind: HelmRelease
+      name: attachments

apps/attachments/uralkal/patch.yaml

@@ -0,0 +1,34 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+spec:
+  values:
+    services:
+      attachments:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: attachments
+            vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres
+            vault.hashicorp.com/agent-inject-template-attachments-db: |-
+              {{- with secret "secrets/data/apps/attachments/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USER={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              DATABASE_SSL_MODE=disable
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
+            vault.hashicorp.com/agent-inject-template-attachments-s3: |-
+              {{- with secret "secrets/data/minio/apps/attachments" -}}
+              YANDEX_S3_ENDPOINT_URL=s3-proxy.s3-proxy.svc.cluster.local
+              YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YANDEX_S3_USE_SSL=false
+              YANDEX_S3_REGION=ru-central
+              YANDEX_S3_VERIFY=false
+              BUCKET_NAME=attachments
+              {{- end -}}

apps/auth-flow/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: auth-flow
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/auth-flow/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/bi/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:production_afb137d4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:contour_9cfd1a0b
           pullPolicy:
             _default: IfNotPresent
 

apps/bi/uralkal/backend.yaml

@@ -0,0 +1,79 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bi-backend
+  namespace: bi
+spec:
+  values:
+    services:
+      main:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        envs:
+          - name: SETTINGS_DEBUG
+            value:
+              _default: "0"
+
+          - name: SETTINGS_VERIFY_SSL
+            value:
+              _default: "1"
+
+          - name: SETTINGS_API_V1_PREFIX
+            value:
+              _default: "/api/v1"
+
+          - name: AUTH_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
+          - name: WORKER_TIMEOUT
+            value:
+              _default: "120"
+
+          - name: SUPERSET_HOST
+            value:
+              _default: "https://sarex-bi.sarex.local.uralkali.com/"
+
+          - name: PYTHONPATH
+            value:
+              _default: "src"
+
+          - name: ISSUES_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.issues.svc.cluster.local"
+
+          - name: EAV_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local"
+
+          - name: PM_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.pm.svc.cluster.local:8000"
+
+          - name: SUPERSET_SYSTEM_WIDGETS
+            value:
+              _default: '{"MDR": {"id": "e7343f21-1ee0-4a87-b712-e8cfd413cc49","name": "MDR"},"SC": {"id": "d63d25e4-eab6-452f-8b31-065094bc2cb6","name": "Стройконтроль"}}'
+
+          - name: SUPERSET_DOCUMENTATION_URL
+            value:
+              _default: "https://sarex.local.uralkali.com/documentations/"
+          
+          - name: SUPERSET_JWT_SECRET
+            value:
+              _default: "6TosZjqxxZ3kAPiht4miaGICRV5AbfvuenWnYfOUnxfbYJJXUNWedOS0QeJQaryr"
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]'
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-prod"}'
+
+          - name: KAFKA_ENABLE
+            value:
+              _default: "0"

apps/bi/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bi-frontend
+  namespace: bi
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/bi/uralkal/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: bi-backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: bi-frontend

apps/bim/asterus/backend.yaml

@@ -0,0 +1,199 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: bim
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:97de42bb1e5de1228e04b1caad0530715bf9bc63
+          pullPolicy:
+            _default: Always
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        envs:
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "100000"
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "100000"
+          - name: LAST_MASTER_BIM_V3
+            value:
+              _default: "100000"
+          - name: LAST_SLAVE_1_BIM_V3
+            value:
+              _default: "100000"
+          - name: LAST_SLAVE_1_BIM_V4
+            value:
+              _default: "100000"
+          - name: LAST_SLAVE_2_BIM
+            value:
+              _default: "1000000000"
+          - name: DB_CERT_PATH_3
+            value:
+              _default: /root/yandex_pg.pem
+          - name: POSTGRES_ADDRESS_3
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT_3
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB_3
+            value:
+              _default: bimapidb
+          - name: DB_CERT_PATH_2
+            value:
+              _default: /root/yandex_pg.pem
+          - name: POSTGRES_ADDRESS_2
+            value:
+              _default: postgres-service
+          - name: POSTGRES_ADDRESS_4
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT_2
+            value:
+              _default: "5432"
+          - name: POSTGRES_PORT_4
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB_2
+            value:
+              _default: bimapidb
+          - name: POSTGRES_DB_4
+            value:
+              _default: bimapidb
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB
+            value:
+              _default: bimapidb
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "30"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8000
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: POSTGRES_USER_2
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: POSTGRES_PASSWORD_2
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: POSTGRES_USER_3
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: POSTGRES_PASSWORD_3
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: POSTGRES_USER_4
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: POSTGRES_PASSWORD_4
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/bim/asterus/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: bim
+resources:
+  - backend.yaml

apps/bim/uralkal/backend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: bim
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/bim/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/cde/uralkal/cde-flowscallback.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-flowscallback
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-flowscallback:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-splitpdf.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-splitpdf
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-splitpdf:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-alert.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-alert
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-alert:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-copy.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-copy
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-copy:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-copyv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-copyv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-copyv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-create-versions.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-create-versions
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-create-versions:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-create-versionsv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-create-versionsv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-create-versionsv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-markings.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-markings
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-markings:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-markingsv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-markingsv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-markingsv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-sign.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-sign
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-sign:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-signv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-signv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-signv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-update-bundles.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-update-bundles
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-update-bundles:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde
+  namespace: cde
+spec:
+  values:
+    services:
+      cde:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/kustomization.yaml

@@ -0,0 +1,57 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: cde-flowscallback.yaml
+    target:
+      kind: HelmRelease
+      name: cde-flowscallback
+  - path: cde-splitpdf.yaml
+    target:
+      kind: HelmRelease
+      name: cde-splitpdf
+  - path: cde-worker-alert.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-alert
+  - path: cde-worker-copy.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-copy
+  - path: cde-worker-copyv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-copyv2
+  - path: cde-worker-create-versions.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-create-versions
+  - path: cde-worker-create-versionsv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-create-versionsv2
+  - path: cde-worker-markings.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-markings
+  - path: cde-worker-markingsv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-markingsv2
+  - path: cde-worker-sign.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-sign
+  - path: cde-worker-signv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-signv2
+  - path: cde-worker-update-bundles.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-update-bundles
+  - path: cde.yaml
+    target:
+      kind: HelmRelease
+      name: cde

apps/checklists/asterus/backend.yaml

@@ -0,0 +1,137 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: checklist
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:preprod_b1980fc6
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        envs:
+          - name: HTTP_APP_HOST
+            value:
+              _default: 0.0.0.0
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: /checklists
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "8"
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+          - name: DEBUG
+            value:
+              _default: "false"
+
+        secretEnvs:
+          - name: DATABASE_HOST
+            secretName:
+              _default: checklists-postgresql-secret
+            secretKey: hostname
+          - name: DATABASE_PORT
+            secretName:
+              _default: checklists-postgresql-secret
+            secretKey: port
+          - name: DATABASE_NAME
+            secretName:
+              _default: checklists-postgresql-secret
+            secretKey: database
+          - name: DATABASE_USER
+            secretName:
+              _default: checklists-postgresql-secret
+            secretKey: username
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: checklists-postgresql-secret
+            secretKey: password
+          - name: JWT_AUTH_PUBLIC_KEY
+            secretName:
+              _default: checklists-public-key
+            secretKey: key
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/checklists/asterus/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: checklist
+resources:
+  - backend.yaml

apps/checklists/brusnika-stage/backend.yaml

@@ -114,6 +114,18 @@ spec:
           - name: DEBUG
             value:
               _default: "false"
+          - name: DATABASE_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "checklists_db"
+
         secretEnvs:
           - name: DATABASE_HOST
             secretName:

apps/checklists/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists
+  namespace: checklists
+spec:
+  values:
+    services:
+      checklists:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/checklists/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: checklists

apps/comparisons/asterus/backend.yaml

@@ -0,0 +1,148 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-backend:964d9d277da96990fd89ddacabcfb2f4d7243635
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB
+            value:
+              _default: comparisons_db
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8000
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8000
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:80/
+          - name: DOCUMENTATION_FILESTREAM_URL
+            value:
+              _default: http://documentations-filestream-service.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-api-service.workflow.svc.cluster.local:80/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:80/
+          - name: COMPARISON_URL
+            value:
+              _default: http://backend-service.comparisons.svc.cluster.local:8000/
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: EXTERNAL_DOCUMENTATION_URL
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:80/
+          - name: BIM_V2_INTERNAL_URL
+            value:
+              _default: http://bim-backend-v2-service.bim-api.svc.cluster.local:80/
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/comparisons/asterus/frontend.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: comparisons
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:contour_8ce2d431
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/comparisons/asterus/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: comparisons
+resources:
+  - backend.yaml
+  - frontend.yaml

apps/comparisons/uralkal/backend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/comparisons/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/comparisons/uralkal/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/contracts/uralkal/backend.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: contracts
+  namespace: contracts
+spec:
+  values:
+    services:
+      contracts:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-contracts-db: |-
+              {{- with secret "secrets/data/apps/contracts/postgres" -}}
+              DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }}?sslmode=disable
+              {{- end -}}

apps/contracts/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: contracts

apps/control-interface/asterus/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: control-interface
+resources:
+  - srx-admin.yaml

apps/control-interface/asterus/srx-admin.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin
+  namespace: control-interface
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      srx-admin:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_feb59026
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: srx-admin
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: srx-admin-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/control-interface/base/admin-frontend.yaml

@@ -0,0 +1,94 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: admin-frontend
+  namespace: control-interface
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      admin-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/admin-frontend:contour_9dc27b40
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: admin-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: admin-frontend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/control-interface/base/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 namespace: control-interface
 resources:
   - helmrelease.yaml
+  - admin-frontend.yaml
 

apps/control-interface/uralkal/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - namespace.yaml

apps/control-interface/uralkal/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: control-interface
+  labels:
+    istio-injection: enabled

apps/cross-section/asterus/frontend.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cross-section
+  namespace: cross-section
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-static:377ae058139538a53f3b90d2ee7e5585f9199497
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/cross-section/asterus/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cross-section
+resources:
+  - frontend.yaml

apps/cross-section/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cross-section-static
+  namespace: cross-section
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cross-section/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: cross-section-static

apps/django/asterus/backend.yaml

@@ -0,0 +1,359 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_8f05291e
+          pullPolicy:
+            _default: Always
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        volumes:
+          _default:
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "1"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: GATEWAY_HOST
+            value:
+              _default: http://pdm-api.documentations.svc.cluster.local:8080
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis-service
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis-service
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "False"
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "False"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["asterus-kafka-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: SSL
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: SCRAM-SHA-512
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/kafka.crt
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: http://bim-backend-v2-service.bim-api
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+          - name: JWT_KID
+            value:
+              _default: "1"
+          - name: SERVER_SYNC_KC_ADMIN_HANDLER
+            value:
+              _default: "True"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: SERVER_HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: WORKFLOWS_HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: SERVER_VERIFY_SSL
+            value:
+              _default: "False"
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: WORKFLOWS_TAG
+            value:
+              _default: stable
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "1"
+          - name: ZITADEL_HOST
+            value:
+              _default: https://zitadel.asterus.ru
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: /tmp/chunked_uploads/%Y/%m/%d
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+          - name: GK_ENCRYPTION_KEY
+            value:
+              _default: zfDjuszywHSbAhY8KJQbESbpUYN74XTs
+          - name: SERVER_EXTERNAL_PDF_CONVERTER_HOST
+            value:
+              _default: http://export-project-service:8000
+          - name: S3_HOST
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: AWS_S3_ENDPOINT_URL
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "120"
+          - name: SERVER_LOGINGG_BODY_ACTION
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: KC_CLIENT_ID
+            secretName:
+              _default: gatekeeper-secret
+            secretKey: client_id
+          - name: KC_CLIENT_SECRET
+            secretName:
+              _default: gatekeeper-secret
+            secretKey: client_secret
+          - name: KAFKA_SASL_PLAIN_USERNAME
+            secretName:
+              _default: kafka-secret
+            secretKey: username
+          - name: KAFKA_SASL_PLAIN_PASSWORD
+            secretName:
+              _default: kafka-secret
+            secretKey: password
+          - name: ZITADEL_ACCESS_TOKEN
+            secretName:
+              _default: zitadel-secret
+            secretKey: access_token
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: backend-secret
+            secretKey: ssh_private.key
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: backend-secret
+            secretKey: ssh_public.key
+          - name: DJANGO_POSTGRES_DATABASE
+            secretName:
+              _default: postgres-secret
+            secretKey: database
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: DJANGO_POSTGRES_HOST
+            secretName:
+              _default: postgres-secret
+            secretKey: host
+          - name: DJANGO_POSTGRES_PORTS
+            secretName:
+              _default: postgres-secret
+            secretKey: port
+          - name: S3_LOGIN
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: login
+          - name: S3_PASSWORD
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: password
+          - name: S3_BUCKET
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: bucket
+          - name: CELERY_RABBITMQ_HOST
+            secretName:
+              _default: rabbitmq-secret
+            secretKey: host
+          - name: CELERY_RABBITMQ_USER
+            secretName:
+              _default: rabbitmq-secret
+            secretKey: username
+          - name: CELERY_RABBITMQ_PASSWORD
+            secretName:
+              _default: rabbitmq-secret
+            secretKey: password
+          - name: CELERY_RABBITMQ_VHOST
+            secretName:
+              _default: rabbitmq-secret
+            secretKey: vhost
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/asterus/celery.yaml

@@ -0,0 +1,310 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_8f05291e
+          pullPolicy:
+            _default: Always
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        volumes:
+          _default:
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "1"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis-service
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis-service
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: http://bim-backend-v2-service.bim-api
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+          - name: JWT_KID
+            value:
+              _default: "1"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: SERVER_HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: WORKFLOWS_HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: WORKFLOWS_TAG
+            value:
+              _default: stable
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "1"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "True"
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: /tmp/chunked_uploads/%Y/%m/%d
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["asterus-kafka-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: SSL
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: SCRAM-SHA-512
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/kafka.crt
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+          - name: SERVER_EXTERNAL_PDF_CONVERTER_HOST
+            value:
+              _default: http://export-project-service:8000
+          - name: S3_HOST
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: AWS_S3_ENDPOINT_URL
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "120"
+          - name: SERVER_LOGINGG_BODY_ACTION
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: KAFKA_SASL_PLAIN_USERNAME
+            secretName:
+              _default: kafka-secret
+            secretKey: username
+          - name: KAFKA_SASL_PLAIN_PASSWORD
+            secretName:
+              _default: kafka-secret
+            secretKey: password
+          - name: KC_USERNAME
+            secretName:
+              _default: kc-admin
+            secretKey: username
+          - name: KC_PASSWORD
+            secretName:
+              _default: kc-admin
+            secretKey: password
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: backend-secret
+            secretKey: ssh_private.key
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: backend-secret
+            secretKey: ssh_public.key
+          - name: DJANGO_POSTGRES_DATABASE
+            secretName:
+              _default: postgres-secret
+            secretKey: database
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: DJANGO_POSTGRES_HOST
+            secretName:
+              _default: postgres-secret
+            secretKey: host
+          - name: DJANGO_POSTGRES_PORTS
+            secretName:
+              _default: postgres-secret
+            secretKey: port
+          - name: S3_LOGIN
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: login
+          - name: S3_PASSWORD
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: password
+          - name: S3_BUCKET
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: bucket
+          - name: CELERY_RABBITMQ_HOST
+            secretName:
+              _default: rabbitmq-secret
+            secretKey: host
+          - name: CELERY_RABBITMQ_USER
+            secretName:
+              _default: rabbitmq-secret
+            secretKey: username
+          - name: CELERY_RABBITMQ_PASSWORD
+            secretName:
+              _default: rabbitmq-secret
+            secretKey: password
+          - name: CELERY_RABBITMQ_VHOST
+            secretName:
+              _default: rabbitmq-secret
+            secretKey: vhost
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/asterus/export-project.yaml

@@ -0,0 +1,105 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-project
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      export-project:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_37a48176
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: export-project
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            limits:
+              cpu:
+                _default: "2"
+              memory:
+                _default: 16Gi
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 512Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: export-project-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/asterus/frontend.yaml

@@ -0,0 +1,105 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.16.3
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        volumes:
+          _default:
+            - name: nginx-configmap
+              mountPath:
+                _default: /etc/nginx/nginx.conf
+              subPath:
+                _default: nginx.conf
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: nginx-configmap
+                items:
+                  - key: nginx.conf
+                    path:
+                      _default: nginx.conf
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/asterus/kafka-cert.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUeuNKW4rB4ReiwjDidNIdob7VRokwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTA4MjYxMDM0NDRaFw0yNjA4MjYxMDM0NDRaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCv7lvKnTUpgnDd91YgCMQSYTSVUdkkQITXZENXj2km
+    UN5k2NhnDIMOeHD4Bu8fjSUvELcilNAgsPqKNWO97CWtU9/phxsQRMgDwywtyr8Q
+    W3Vc2RYk/7vcpi77M/IjmFoRExXowO9U3mLNd0vACk+yC7WObcNr9veFnVyrmoL3
+    iOqLbmzKiZvdIz1f6lwDDOXNuj26Ct6jRatV96HcqKzK50Jj9eS5SvV57JQLvTsZ
+    LbPnesAxgKzW7sci6N9lB9jrDirBl2h/QJXAmhUyg2yAvrU8wBTTpQWCdQRQ54Pv
+    LCZV3iXMkTYkxoyCg/GPbb2M7DF1sEe45iWsYkqDsWvdhirfp8BBVp+oni3xmj9J
+    +8hzB2MZhyA9i6v6Hfua7d0ExKUhuJkUxBcGyFHbXpC2m2m8plaHL2mNBXAuQZDw
+    wf+aHvHo2QLoNFL2xR8/63IHosnnRgzdKpZX6Z1Ftd8caHf/L+XgI3ET8LwklC55
+    y4FmFQwd8rOGiR38Ixg9zhr44tV3foWWrIM+sb/ni4UokeGkX2AymSsdln9pAnIj
+    usGG9ZuSZUPZ+w5HjtL3hxh9pbGdYja2YcfusCCQK56LBWRJnB8W/IafEOvVxMT/
+    gqx6Hee/geY3G2LRlMfsLRAbCvYOIi7kDzOM/LnM+XlbEkJO8uyjnT5wbCFCRnvy
+    nwIDAQABo0UwQzAdBgNVHQ4EFgQUeNSYqykN5qUxAfLJ7z9Say0XIHAwEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AH82HGTXnJKbBln7q+Wx9chwMUFZc4u43Q0QAvCgGXMRFa5Dl4x/9rtrYYuDpZwh
+    /GKgOkhZ/SKLeuy9e7bgoHnt2sNR4CqAjK6YQp7o5aBNRGhiQZTkfjoG/P17AV7e
+    nKP65WXPAirouUxlvC8Kplh2vsuUkGcjzsKRTYQRNR1+yHw+P91qcX+RglrHFyMJ
+    wWKOldwgR3Mit+tAMbgioqrNTmwIEREDCF0DcJuX3LKTo7/q3I9cMFhz7/kk5CTm
+    pePoWMcvhgOX/cQcqNA7Q0HAOIV3OioxAod+XyjpaTo42YrTUSjq5Rl2a9U7GNN/
+    xazxT+YDs/mHSP0Yt/5jxMSjsifPP4l4KP9YvqiC7UZGrZ9ctzkg3UlQmr87Km9W
+    FqVLoX6Y1OmNB/c5XCg4S4g2q5VavXM792fn1ow6oR5hgDHXBLNA+TKWFmJ5UXJB
+    z4l7Hn7rFJB5e9QVEDRIzr8c2QcUZ668kicP3Oh45NywMcSV6GZO4PNDNsNW0kFf
+    3txTYwDEvT3n83C0lybw2hgLl3Q//lX+Zn3TMdqGVXkCXR0df45U8p14Wfe7QRtb
+    Jmg3tvOOpueyc3I+mrpDbyxdYQxr8IZdFoaV+mZUCi+ezMrHBNNNq0Lc/t2ICa+p
+    bpTSKuKNG91nPGXEd7sFGL8ZYypObQc5HC6wMCeVC3Cx
+    -----END CERTIFICATE-----
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: django

apps/django/asterus/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+  - django-configmap.yaml
+  - uwsgi-configmap.yaml
+  - kafka-cert.yaml
+  - nginx-configmap.yaml
+  - backend.yaml
+  - celery.yaml
+  - export-project.yaml
+  - s3-proxy.yaml
+  - frontend.yaml

apps/django/asterus/nginx-configmap.yaml

@@ -0,0 +1,112 @@
+apiVersion: v1
+data:
+  nginx.conf: |
+    worker_processes auto;
+
+    pid /var/run/nginx.pid;
+
+    events {
+        use epoll;
+        worker_connections 1024;
+    }
+
+    http {
+
+        # Basic Settings
+        large_client_header_buffers 8 128k;
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 300;
+        types_hash_max_size 2048;
+        client_max_body_size 5000M;
+        client_header_buffer_size 5M;
+        # server_tokens off;
+        # server_names_hash_bucket_size 64;
+        # server_name_in_redirect off;
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        # Logging Settings
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+
+        # GZIP Settings
+        gzip on;
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+        server {
+            listen 80;
+            listen [::]:80;
+            root /opt/react_client/;
+
+            proxy_set_header Host 'sarex.asterus.ru';
+
+            location ~^/workflows/(.+).js {
+                rewrite /workflows/(.+) /$1 break;
+                proxy_pass http://frontend-service.workflows.svc.cluster.local:8080;
+            }
+
+            location = /static/index.bundle.js {
+                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+            }
+
+            location ~^/api/pm/ {
+              proxy_pass http://backend-service.pm.svc.cluster.local:8000;
+          }
+
+            location ~^/(api|admin)/ {
+                # proxy_set_header Host $host;
+                # proxy_set_header Referer $http_referer;
+                proxy_pass http://backend-service:8000;
+            }
+
+            location @index {
+                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+                try_files /static/index.html =404;
+            }
+
+            location /service-worker.js {
+                try_files /static/$uri @index;
+            }
+
+            location ~ ^/workspaces-v2/(.+)\.wasm$ {
+              rewrite /workspaces-v2/(.+) /$1 break;
+              proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:80;
+
+                add_header Content-Type application/wasm;
+                proxy_set_header Accept application/wasm;
+
+            }
+
+          location ~ ^/workspaces-v2/(.+)\.js$ {
+              rewrite /workspaces-v2/(.+) /$1 break;
+              proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:80;
+          }
+            location ~^/comparisons/static/(.+).js {
+                rewrite /comparisons/static/(.+) /$1 break;
+                proxy_pass http://frontend-service.comparisons.svc.cluster.local:80;
+            }
+
+            location / {
+                try_files $uri @index;
+            }
+        }
+    }
+kind: ConfigMap
+metadata:
+  name: nginx-configmap
+  namespace: django

apps/django/asterus/s3-proxy.yaml

@@ -0,0 +1,113 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      s3-proxy:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+          pullPolicy:
+            _default: Always
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: s3-proxy
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: s3-proxy-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        envs:
+          - name: AWS_API_ENDPOINT
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: ACCESS_LOG
+            value:
+              _default: "true"
+          - name: CORS_ALLOW_HEADERS
+            value:
+              _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
+
+        secretEnvs:
+          - name: AWS_ACCESS_KEY_ID
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: login
+          - name: AWS_SECRET_ACCESS_KEY
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: password
+          - name: AWS_S3_BUCKET
+            secretName:
+              _default: sarex-media-storage-secret
+            secretKey: bucket
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/asterus/uwsgi-configmap.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+data:
+  uwsgi.ini: |-
+    [uwsgi]
+    module                 = config.wsgi:application
+    DJANGO_SETTINGS_MODULE = config.settings.production
+    DEBUG                  = True
+    http                   = 0.0.0.0:8000
+    processes              = 8
+    master                 = true
+    vacuum                 = true
+    enable-threads         = true
+    buffer-size            = 65535
+    stats                  = :3031
+    stats-http             = true
+    memory-report          = true
+    lazy-apps              = true
+    # listen                 = 1024
+    disable-write-exception= 0
+    harakiri               = 300
+    socket-timeout         = 300
+    chunked-input-timeout  = 300
+    http-timeout           = 300
+    worker-reload-mercy    = 240
+    mule-reload-mercy      = 240
+    static-map = /api/static=/opt/sarex/static/
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: django

apps/django/brusnika-stage/celery.yaml

@@ -330,6 +330,14 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/brusnika-stage/export-project.yaml

@@ -88,6 +88,11 @@ spec:
         labels:
           monitoring: prometheus
 
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/django/brusnika-stage/sarex-backend.yaml

@@ -313,6 +313,18 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/uralkal/backend.yaml

@@ -0,0 +1,159 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: django
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        envs:
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: http://bim-backend-v2-service.bim-api
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+          - name: JWT_KID
+            value:
+              _default: "1"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://sarex.local.uralkali.com
+          - name: SERVER_HOST
+            value:
+              _default: https://sarex.local.uralkali.com
+          - name: WORKFLOWS_HOST
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: WORKFLOWS_PREFIX
+            value:
+              _default: /internal/v1
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: /tmp/chunked_uploads/%Y/%m/%d
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+          - name: ZITADEL_HOST
+            value:
+              _default: https://login.sarex.local.uralkali.com
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "False"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/kafka.crt
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-django-s3: |-
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
+              S3_HOST=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- $buckets := index .Data.data "buckets" }}
+              S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              S3_LOGIN={{ index .Data.data "access_key" }}
+              S3_PASSWORD={{ index .Data.data "secret_key" }}
+              AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              {{- end }}

apps/django/uralkal/celery.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+spec:
+  values:
+    services:
+      celery:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/uralkal/kustomization.yaml

@@ -0,0 +1,33 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: nginx-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: nginx-configmap
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: zitadel-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: zitadel-configmap
+  - path: s3-proxy.yaml
+    target:
+      kind: HelmRelease
+      name: s3-proxy
+  - path: celery.yaml
+    target:
+      kind: HelmRelease
+      name: celery
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
+  - path: srx-admin.yaml
+    target:
+      kind: HelmRelease
+      name: srx-admin-frontend

apps/django/uralkal/nginx-configmap.yaml

@@ -0,0 +1,160 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-configmap
+  namespace: django
+data:
+  nginx.conf: |
+    worker_processes auto;
+
+    pid /var/run/nginx.pid;
+
+    events {
+        use epoll;
+        worker_connections 1024;
+    }
+
+    http {
+
+        # Basic Settings
+        large_client_header_buffers 8 128k;
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 300;
+        types_hash_max_size 2048;
+        client_max_body_size 5000M;
+        client_header_buffer_size 5M;
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        # Logging Settings
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+
+        # GZIP Settings
+        gzip on;
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+        server {
+            listen 80;
+            listen [::]:80;
+            root /opt/react_client/;
+
+            add_header 'Access-Control-Allow-Origin' '*' always;
+            add_header 'Access-Control-Allow-Methods' '*' always;
+            add_header 'Access-Control-Allow-Headers' '*' always;
+
+            location = /static/index.bundle.js {
+                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+            }
+
+            # location ~^/api/pm/ {
+            #     proxy_http_version 1.1;
+            #     proxy_set_header Connection "";
+            #     proxy_set_header Host $host;
+            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            # }
+
+            location ~^/api/v1/documents/ {
+                proxy_http_version 1.1;
+                proxy_set_header Host $host;
+                proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80;
+            }
+
+            location ~^/(api|admin)/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.django.svc.cluster.local:80;
+            }
+
+            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
+                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
+                add_header Content-Type application/wasm always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
+                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
+                add_header Content-Type application/wasm always;
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
+            }
+
+             location ~^/workspaces-v2/(.+).js {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite /workspaces-v2/(.+) /$1 break;
+                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+            }
+
+            location ~^/workspaces-v2/(.+)\.wasm$ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite ^/workspaces-v2/(.+) /$1 break;
+                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+            }
+
+            location @index {
+                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+                try_files /static/index.html =404;
+            }
+
+            location ~^/workflows/(.+).js {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite /workflows/(.+) /$1 break;
+                proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
+            }
+
+            location /service-worker.js {
+                try_files /static/$uri @index;
+            }
+
+            location / {
+                try_files $uri @index;
+            }
+        }
+    }

apps/django/uralkal/s3-proxy.yaml

@@ -0,0 +1,31 @@
+---
+# Патч s3-proxy для vad.
+#
+# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech —
+# в закрытом контуре этот хост недоступен, прокси не достучится до MinIO
+# и маршрут /media/ (s3-proxy-virt-service в istio-config) вернёт ошибку.
+#
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# agent-inject-template-s3; остальные vault-аннотации берутся из base.
+# Эндпоинт задан литералом, а не через .Data.data.client.endpoint: так же
+# сделано в apps/django/vad/backend.yaml для того же секрета
+# secrets/data/minio/apps/django — держим один способ на весь ns.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy
+  namespace: django
+spec:
+  values:
+    services:
+      s3-proxy:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-s3: |
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_API_ENDPOINT=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- $buckets := index .Data.data "buckets" }}
+              AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end }}

apps/django/uralkal/srx-admin.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin-frontend
+  namespace: django
+spec:
+  values:
+    services:
+      srx-admin:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/uralkal/zitadel-configmap.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: zitadel-configmap
+  namespace: django
+data:
+  config.json: |
+    {
+      "auth_type": "zitadel",
+      "zitadel": {
+        "client_id": "392748840802936023",
+        "host": "https://login.sarex.local.uralkali.com"
+      }
+    }

apps/django/vad/backend.yaml

@@ -126,10 +126,6 @@ spec:
           - name: ZITADEL_HOST
             value:
               _default: https://sarex-login.vadroad.ru
-          # Включено вместе с message-hub: он консьюмер топика message-hub-stage
-          # (SETTINGS_TOPICS в apps/message-hub/d8-ugmk-prod/message-hub.yaml),
-          # а писать в этот топик должен django. Vault-шаблон django-kafka
-          # и KAFKA_SSL_CAFILE уже есть в base — здесь только флаг.
           - name: SERVER_KAFKA_ENABLED
             value:
               _default: "True"

apps/django/vad/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            # location ~^/api/pm/ {
+            location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
+                proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
+                proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
+                proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;
@@ -142,12 +142,12 @@ data:
                 try_files /static/index.html =404;
             }
 
-            # location ~^/workflows/(.+).js {
+            location ~^/workflows/(.+).js {
-            #     proxy_http_version 1.1;
+                proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
+                proxy_set_header Connection "";
-            #     rewrite /workflows/(.+) /$1 break;
+                rewrite /workflows/(.+) /$1 break;
-            #     proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
+                proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
-            # }
+            }
 
             location /service-worker.js {
                 try_files /static/$uri @index;

apps/django/wb/django-configmap.yaml

@@ -248,7 +248,10 @@ data:
             "name": "Рабочие процессы",
             "uri": "/processes"
         },
-
+        {
+          "name": "Справочники",
+          "uri": "/assets"
+        },
         {
           "name": "Аналитика",
           "uri": "/analytics"

apps/document-link/asterus/frontend.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: document-link
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:83a92ae26b0bb38ee297c68c2a7a2c5a00811bfb
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 3000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 3000
+
+          portName:
+            _default: http
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/document-link/asterus/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: document-link
+resources:
+  - frontend.yaml

apps/document-link/uralkal/frontend.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: document-link
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:vad_60487abb

apps/document-link/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/documentations/asterus/api.yaml

@@ -0,0 +1,294 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-api
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentations-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_ace84de8
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentations-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          resources:
+            requests:
+              cpu:
+                _default: 500m
+              memory:
+                _default: 500Mi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 8080
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 60
+              failureThreshold:
+                _default: 10
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 8080
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 30
+              failureThreshold:
+                _default: 20
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentations-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB
+            value:
+              _default: documentations_db
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: FILE_URL_EXTERNAL
+            value:
+              _default: https://sarex.asterus.ru/files
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-api-service.workflows.svc.cluster.local:8000/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8080/
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.asterus.ru/workspaces-v2/
+          - name: BIM_API_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: BIM_API_URL_EXTERNAL
+            value:
+              _default: https://sarex.asterus.ru/bim
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:8000/
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service.documentations.svc.cluster.local:8000
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link.asterus.ru
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-service.flows.svc.cluster.local:8000
+          - name: AUTOMATION_URL
+            value:
+              _default: http://automation-api-service.automation.svc.cluster.local:8000
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-service.django.svc.cluster.local:8000
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+          - name: SENTRY_DEBUG
+            value:
+              _default: "0"
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+          - name: DELETE_S3D_AFTER_MESHOPT
+            value:
+              _default: "true"
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: USE_BIMV1_FOR_BIMV2
+            value:
+              _default: "0"
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: django-auth
+            secretKey: key
+          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
+            secretName:
+              _default: django-auth
+            secretKey: key
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            secretName:
+              _default: yc-jwt-secret
+            secretKey: secret
+          - name: PUBLIC_KEY
+            secretName:
+              _default: public-key
+            secretKey: ssh_public.key
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/asterus/filestream.yaml

@@ -0,0 +1,288 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentations-filestream:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_5904312b
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentations-filestream
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          resources:
+            requests:
+              cpu:
+                _default: 150m
+              memory:
+                _default: 200Mi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 8080
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 60
+              failureThreshold:
+                _default: 10
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 8080
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 30
+              failureThreshold:
+                _default: 20
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentations-filestream-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB
+            value:
+              _default: documentations_db
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: HOST
+            value:
+              _default: https://sarex.asterus.ru
+          - name: FILE_URL_EXTERNAL
+            value:
+              _default: https://sarex.asterus.ru/files
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-api-service.workflow.svc.cluster.local:80/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:80/
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.asterus.ru/workspaces-v2/
+          - name: BIM_API_URL
+            value:
+              _default: http://bim-api-service.bim-api.svc.cluster.local:5555/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://bim-backend-v2-service.bim-api.svc.cluster.local:80/
+          - name: BIM_API_URL_EXTERNAL
+            value:
+              _default: https://sarex.asterus.ru/bim
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service.processing:8000
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link.asterus.ru
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-service.flows.svc.cluster.local:8000
+          - name: AUTOMATION_URL
+            value:
+              _default: http://automation-api-service.automation.svc.cluster.local:8000
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+          - name: SENTRY_DEBUG
+            value:
+              _default: "0"
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: USE_BIMV1_FOR_BIMV2
+            value:
+              _default: "1"
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+
+        secretEnvs:
+          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
+            secretName:
+              _default: django-auth
+            secretKey: key
+          - name: POSTGRES_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: django-auth
+            secretKey: key
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            secretName:
+              _default: yc-jwt-secret
+            secretKey: secret
+          - name: PUBLIC_KEY
+            secretName:
+              _default: public-key
+            secretKey: ssh_public.key
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/asterus/frontend.yaml

@@ -0,0 +1,123 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentation-frontend-static
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_5a4e4adc
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentation-frontend-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 80
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 10
+              failureThreshold:
+                _default: 10
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 80
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 10
+              failureThreshold:
+                _default: 20
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentation-frontend-static
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/asterus/hasher.yaml

@@ -0,0 +1,145 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: hasher
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      hasher:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: normal
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        envs:
+          - name: HASHER_APP__LOG_LEVEL
+            value:
+              _default: INFO
+          - name: HASHER_APP__NUM_WORKERS
+            value:
+              _default: "4"
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
+            value:
+              _default: hash.compute.normal.tasks
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
+            value:
+              _default: hash.compute
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
+            value:
+              _default: direct
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
+            value:
+              _default: hash.compute.normal
+          - name: HASHER_S3__MAX_POOL_CONNECTIONS
+            value:
+              _default: "10"
+          - name: HASHER_S3__CONNECT_TIMEOUT
+            value:
+              _default: "10"
+          - name: HASHER_S3__READ_TIMEOUT
+            value:
+              _default: "30"
+          - name: HASHER_S3__REGION_NAME
+            value:
+              _default: ru-central1
+          - name: HASHER_S3__USE_SSL
+            value:
+              _default: "true"
+          - name: HASHER_S3__VERIFY
+            value:
+              _default: "true"
+
+        secretEnvs:
+          - name: HASHER_AMQP__USERNAME
+            secretName:
+              _default: hasher-rabbitmq-secret
+            secretKey: user
+          - name: HASHER_AMQP__PASSWORD
+            secretName:
+              _default: hasher-rabbitmq-secret
+            secretKey: password
+          - name: HASHER_AMQP__HOST
+            secretName:
+              _default: hasher-rabbitmq-secret
+            secretKey: host
+          - name: HASHER_AMQP__PORT
+            secretName:
+              _default: hasher-rabbitmq-secret
+            secretKey: port
+          - name: HASHER_AMQP__VHOST
+            secretName:
+              _default: hasher-rabbitmq-secret
+            secretKey: vhost
+          - name: HASHER_S3__ENDPOINT
+            secretName:
+              _default: hasher-s3-secret
+            secretKey: endpoint
+          - name: HASHER_S3__ACCESS_KEY
+            secretName:
+              _default: hasher-s3-secret
+            secretKey: access_key
+          - name: HASHER_S3__SECRET_KEY
+            secretName:
+              _default: hasher-s3-secret
+            secretKey: secret_key
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/asterus/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: documentations
+resources:
+  - frontend.yaml
+  - api.yaml
+  - filestream.yaml
+  - hasher.yaml
+  - pdf-markings-amqp.yaml
+  - pdf-markings.yaml
+  - pdm.yaml

apps/documentations/asterus/pdf-markings-amqp.yaml

@@ -0,0 +1,171 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdf-markings-amqp
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdf-markings-amqp:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdf-markings-amqp
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+        envs:
+          - name: MARKS_APP__LOG_LEVEL
+            value:
+              _default: INFO
+          - name: MARKS_CRYPTO__HASHING_ALGO
+            value:
+              _default: md_gost12_256
+          - name: MARKS_DOCUMENTS_DB__HOST
+            value:
+              _default: postgres-service
+          - name: MARKS_DOCUMENTS_DB__PORT
+            value:
+              _default: "5432"
+          - name: MARKS_DOCUMENTS_DB__DATABASE
+            value:
+              _default: documentations_db
+          - name: MARKS_DOCUMENTS_DB__SSLMODE
+            value:
+              _default: disable
+          - name: MARKS_QR__REDIRECT_URL
+            value:
+              _default: https://stamp-verification.sarex.asterus.ru/
+          - name: MARKS_QR__BASE_DOCUMENT_URL
+            value:
+              _default: https://sarex.asterus.ru
+          - name: MARKS_S3__USE_SSL
+            value:
+              _default: "false"
+          - name: MARKS_S3__SSL_VERIFY
+            value:
+              _default: "false"
+          - name: MARKS_S3__REGION
+            value:
+              _default: ru-central1
+          - name: MARKS_S3__DEFAULT_BUCKET
+            value:
+              _default: documentations-stage-1-sarex-new
+          - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+            value:
+              _default: pdf_markings_input
+
+        secretEnvs:
+          - name: MARKS_DOCUMENTS_DB__USERNAME
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: MARKS_DOCUMENTS_DB__PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: MARKS_S3__URL
+            secretName:
+              _default: yc-s3
+            secretKey: endpoint_url
+          - name: MARKS_S3__ACCESS_KEY
+            secretName:
+              _default: yc-s3
+            secretKey: key_id
+          - name: MARKS_S3__SECRET_KEY
+            secretName:
+              _default: yc-s3
+            secretKey: access_key
+          - name: MARKS_RABBITMQ__HOST
+            secretName:
+              _default: rabbitmq
+            secretKey: host
+          - name: MARKS_RABBITMQ__PORT
+            secretName:
+              _default: rabbitmq
+            secretKey: port
+          - name: MARKS_RABBITMQ__USERNAME
+            secretName:
+              _default: rabbitmq
+            secretKey: username
+          - name: MARKS_RABBITMQ__PASSWORD
+            secretName:
+              _default: rabbitmq
+            secretKey: password
+          - name: MARKS_RABBITMQ__VHOST
+            secretName:
+              _default: rabbitmq
+            secretKey: vhost
+          - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+            secretName:
+              _default: rabbitmq
+            secretKey: heartbeat
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/asterus/pdf-markings.yaml

@@ -0,0 +1,174 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdf-markings
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdf-markings:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/process-pdf-marks-service:0.3.3
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdf-markings
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: marks-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: APP_NAME
+            value:
+              _default: pdm_v2
+          - name: VERIFY
+            value:
+              _default: "False"
+          - name: APP_VERSION
+            value:
+              _default: 0.0.1
+          - name: LOG_LEVEL
+            value:
+              _default: INFO
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+          - name: DOC_POSTGRES_HOST
+            value:
+              _default: postgres-service
+          - name: DOC_POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: DOC_POSTGRES_DB
+            value:
+              _default: documentations_db
+          - name: DOC_POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+          - name: DOC_POSTGRES_SSL_MODE
+            value:
+              _default: disable
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8000
+          - name: DATABASE_SSL_MODE
+            value:
+              _default: disable
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "0"
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: YANDEX_S3_ACCOUNT_PATH
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+          - name: REDIRECT_URL_QR
+            value:
+              _default: https://stamp-verification.asterus.ru/
+          - name: BASE_DOCUMENT_URL
+            value:
+              _default: https://sarex.asterus.ru
+
+        secretEnvs:
+          - name: DOC_POSTGRES_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: DOC_POSTGRES_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: YANDEX_S3_ENDPOINT_URL
+            secretName:
+              _default: yc-s3
+            secretKey: endpoint_url
+          - name: YANDEX_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: yc-s3
+            secretKey: access_key
+          - name: YANDEX_S3_ACCESS_KEY_ID
+            secretName:
+              _default: yc-s3
+            secretKey: key_id
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/asterus/pdm.yaml

@@ -0,0 +1,291 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdm-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_9507c2d5
+          pullPolicy:
+            _default: IfNotPresent
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdm-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: pdm-api
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3-pdm
+
+        envs:
+          - name: BIM_V2_HOST
+            value:
+              _default: ""
+          - name: DRAWINGS_INTERNAL_URL
+            value:
+              _default: ""
+          - name: ENABLE_PERMISSIONS_FILTER
+            value:
+              _default: "1"
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+          - name: APP_NAME
+            value:
+              _default: pdm_v2
+          - name: APP_VERSION
+            value:
+              _default: 0.0.1
+          - name: LOG_LEVEL
+            value:
+              _default: INFO
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB
+            value:
+              _default: documentations_db
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: ENABLE_OBSERVABILITY
+            value:
+              _default: "1"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: FILE_URL_EXTERNAL
+            value:
+              _default: https://sarex.asterus.ru/files
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-api-service.workflow.svc.cluster.local:80/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8080
+          - name: BIM_API_URL
+            value:
+              _default: http://bim-api-service.bim-api.svc.cluster.local:5555/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://bim-backend-v2-service.bim-api.svc.cluster.local:80/
+          - name: BIM_API_URL_EXTERNAL
+            value:
+              _default: https://docs.dogma.ru/bim
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-service.django.svc.cluster.local:8000
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-service.flows.svc.cluster.local:8000
+          - name: NOTES_URL
+            value:
+              _default: https://sarex.asterus.ru/notes
+          - name: RESOURCES_URL
+            value:
+              _default: http://resources-service.resources.svc.cluster.local:8000
+          - name: REMARKS_URL
+            value:
+              _default: https://sarex.asterus.ru/remarks
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: ATTACHMENTS_URL
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:80
+          - name: STATES_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8080
+          - name: INSPECTIONS_URL
+            value:
+              _default: http://inspections-service.inspections.svc.cluster.local:8000
+          - name: WIDTH_THUMB_STATES
+            value:
+              _default: "120"
+          - name: HEIGHT_THUMB_STATES
+            value:
+              _default: "73"
+          - name: WIDTH_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: HEIGHT_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: SUBSCRIPTIONS_URL
+            value:
+              _default: http://sarex-subscriptions-service.subscriptions.svc.cluster.local:80
+          - name: EAV_URL
+            value:
+              _default: http://eav-service.eav.svc.cluster.local:8000
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:8000
+          - name: API_HOST_PREFIX
+            value:
+              _default: /gateway
+          - name: TRANSMITTALS_BASE_URL
+            value:
+              _default: ""
+          - name: TRANSMITTALS_ENABLE
+            value:
+              _default: "false"
+          - name: TARGET_URL
+            value:
+              _default: http://backend-service.django.svc.cluster.local:8000
+          - name: RELEASES_URL
+            value:
+              _default: https://gitlab.com
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+          - name: SENTRY_DEBUG
+            value:
+              _default: "0"
+          - name: ENVIRONMENT
+            value:
+              _default: prod
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: postgres-secret
+            secretKey: username
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: postgres-secret
+            secretKey: password
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: django-auth
+            secretKey: key
+          - name: PUBLIC_KEY
+            secretName:
+              _default: public-key
+            secretKey: ssh_public.key
+          - name: RELEASES_TOKEN
+            secretName:
+              _default: releases-token
+            secretKey: key
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/base/api.yaml

@@ -65,7 +65,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_3f19a21d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -116,6 +116,9 @@ spec:
           - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
             value:
               _default: "5"
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
           - name: ENABLE_SQL_QUERY
             value:
               _default: "0"

apps/documentations/base/filestream.yaml

@@ -64,7 +64,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -94,6 +94,9 @@ spec:
           - name: ZITADEL_DOMAIN
             value:
               _default: zitadel-srx.wb.ru
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
           - name: USE_ZITADEL
             value:
               _default: "1"

apps/documentations/brusnika-prod/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_b34286a7
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -267,6 +267,15 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/api.yaml

@@ -255,6 +255,34 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/filestream.yaml

@@ -255,6 +255,19 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/pdm.yaml

@@ -308,6 +308,14 @@ spec:
           - name: WORKSPACE_URL
             value:
               _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+
         secretEnvs:
           - name: RELEASES_TOKEN
             secretName:

apps/documentations/ugok/api.yaml

@@ -1,7 +1,4 @@
 ---
-# standalone HelmRelease — base vault-native, в ugok Vault не используется.
-# Кастомный тег UGOK_4bf15a64 оставлен как есть (не как в wb — см.
-# предыдущее решение по этому приложению).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -39,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: 10.4.10.187:80/library/documentations:ugok_0b17a10e
+            _default: 10.4.10.187:80/library/documentations:ugok_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -153,6 +150,9 @@ spec:
           - name: CONTAINER_REGISTRY
             value:
               _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
           - name: ENVIRONMENT
             value:
               _default: production

apps/documentations/ugok/filestream.yaml

@@ -1,6 +1,4 @@
 ---
-# standalone HelmRelease — base vault-native, в ugok Vault не используется.
-# Кастомный тег prod_dfaa58f7_ugok оставлен как есть (не как в wb).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -38,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: 10.4.10.187:80/library/documentations-api-files:ugok_a62fce61
+            _default: 10.4.10.187:80/library/documentations-api-files:ugok_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -129,6 +127,9 @@ spec:
           - name: ENABLE_SSL
             value:
               _default: "0"
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
           - name: ENABLE_S3
             value:
               _default: "1"

apps/documentations/uralkal/api.yaml

@@ -0,0 +1,163 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-api
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: login.sarex.local.uralkali.com
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.local.uralkali.com/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: sarex.local.uralkali.com
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://backend-svc.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: USE_MARKS_RABBITMQ
+            value:
+              _default: "true"
+          - name: MARKS_RABBITMQ_HOST
+            value:
+              _default: rabbitmq.rabbitmq.svc.cluster.local
+          - name: MARKS_RABBITMQ_PORT
+            value:
+              _default: "5672"
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link.sarex.local.uralkali.com
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            value:
+              _default: "mock"
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "true"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "false"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"

apps/documentations/uralkal/filestream.yaml

@@ -0,0 +1,151 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: login.sarex.local.uralkali.com
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.local.uralkali.com/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: sarex.local.uralkali.com
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-api-service.workflow.svc.cluster.local:8000/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-svc.bim.svc.cluster.local:80/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link.sarex.local.uralkali.com
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            value:
+              _default: "mock"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"