iac/apps/django/vad/backend.yaml
ivan 9ec172c0f4 uralkal: replicate the vad business-app footprint (36 apps) with uralkal domains
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from
clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap —
vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's
login.sarex.local.uralkali.com). Two things are left as explicit
placeholders pending real infra: the Zitadel client_id/org_id
(TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application
registered yet) and the Kafka CA cert in pm/issues/message-hub/flows
(copied from vad, will need swapping once uralkal's Kafka actually
generates its own CA, same as vad's history).

infrastructure/s3-proxy/uralkal: new component, nginx upstream points at
the single uralkal minio endpoint (10.133.0.245:9000) from terraform,
unlike vad's 4-node list.

clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps.

infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28
path-routed virtualServices under sarex.local.uralkali.com (mirroring
vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy)
plus stamp-verification/document-link/s3 on their already-declared hosts.
Pre-existing zitadel/superset/camunda-operate blocks are untouched.

apps/django/vad/backend.yaml: drop a stale explanatory comment (also
removed from the uralkal copy before this commit).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-28 14:56:17 +03:00

155 lines
5.1 KiB
YAML

---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: django
spec:
values:
services:
backend:
envs:
- name: ALLOWED_HOSTS
value:
_default: "*"
- name: SERVER_USE_CHANGELOG
value:
_default: "0"
- name: SERVER_ZITADEL_ENABLED
value:
_default: "True"
- name: DJANGO_SETTINGS_MODULE
value:
_default: config.settings.production
- name: CELERY_REDIS_HOST
value:
_default: redis
- name: CELERY_REDIS_PORT
value:
_default: "6379"
- name: DJANGO_REDIS_HOST
value:
_default: redis
- name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
value:
_default: "True"
- name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
value:
_default: "True"
- name: DJANGO_REDIS_PORT
value:
_default: "6379"
- name: BIMV2_INTERNAL_HOST
value:
_default: http://bim-backend-v2-service.bim-api
- name: BIMV2_TIMEOUT
value:
_default: "60"
- name: JWT_KID
value:
_default: "1"
- name: PDM_SYNC
value:
_default: "1"
- name: KC_SYNC_ENABLE
value:
_default: "0"
- name: MEASUREMENTS_HOST
value:
_default: http://measurements-service.measurements.svc.cluster.local:8000/api
- name: MEASUREMENTS_USE_MEASUREMENTS
value:
_default: "1"
- name: SERVER_API_HOST
value:
_default: https://sarex.vadroad.ru
- name: SERVER_HOST
value:
_default: https://sarex.vadroad.ru
- name: WORKFLOWS_HOST
value:
_default: http://backend-svc.processing.svc.cluster.local:80
- name: WORKFLOWS_BASE_HOST
value:
_default: http://backend-svc.django.svc.cluster.local:80
- name: WORKFLOWS_PREFIX
value:
_default: /internal/v1
- name: WORKFLOWS_USE
value:
_default: "1"
- name: SERVER_S3_STREAM_IMPORT
value:
_default: "1"
- name: SERVER_SAVE_DIFF_DEM
value:
_default: "1"
- name: SERVER_USE_CLICKHOUSE
value:
_default: "0"
- name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
value:
_default: "0"
- name: SERVER_USE_DJANGO_STORAGE
value:
_default: "1"
- name: SERVER_USE_METASHAPE
value:
_default: "0"
- name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
value:
_default: "1"
- name: SERVER_CHANGELOG_MODE
value:
_default: "0"
- name: SERVER_DJANGO_URLS
value:
_default: "1"
- name: CHECK_IMPORT_HASH
value:
_default: "1"
- name: EAV_ENABLE
value:
_default: "1"
- name: SERVER_CHECK_IMPORT_HASH
value:
_default: "1"
- name: SERVER_CHUNKED_PATH
value:
_default: /tmp/chunked_uploads/%Y/%m/%d
- name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
value:
_default: "0"
- name: SERVER_USE_WRORKFLOW_STATUS
value:
_default: "1"
- name: ZITADEL_HOST
value:
_default: https://sarex-login.vadroad.ru
- name: SERVER_KAFKA_ENABLED
value:
_default: "True"
- name: KAFKA_TOPICS
value:
_default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
- name: KAFKA_SSL_CAFILE
value:
_default: /usr/local/share/ca-certificates/kafka.crt
- name: KC_USE_REDIRECT_LOGOUT
value:
_default: "False"
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-template-django-s3: |-
{{- with secret "secrets/data/minio/apps/django" }}
AWS_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
S3_HOST=http://s3-proxy.s3-proxy.svc.cluster.local
{{- $buckets := index .Data.data "buckets" }}
S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
S3_LOGIN={{ index .Data.data "access_key" }}
S3_PASSWORD={{ index .Data.data "secret_key" }}
AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
{{- end }}