master
5fd4032c7c
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
- Implemented EmailChannelTestProvider to generate email preview payloads. - Implemented SlackChannelTestProvider to create Slack message previews. - Implemented TeamsChannelTestProvider for generating Teams Adaptive Card previews. - Implemented WebhookChannelTestProvider to create webhook payloads. - Added INotifyChannelTestProvider interface for channel-specific preview generation. - Created ChannelTestPreviewContracts for request and response models. - Developed NotifyChannelTestService to handle test send requests and generate previews. - Added rate limit policies for test sends and delivery history. - Implemented unit tests for service registration and binding. - Updated project files to include necessary dependencies and configurations.
283 lines
10 KiB
YAML
283 lines
10 KiB
YAML
global:
|
||
profile: mirror-managed
|
||
release:
|
||
version: "2025.10.0-edge"
|
||
channel: edge
|
||
manifestSha256: "822f82987529ea38d2321dbdd2ef6874a4062a117116a20861c26a8df1807beb"
|
||
image:
|
||
pullPolicy: IfNotPresent
|
||
labels:
|
||
stellaops.io/channel: edge
|
||
|
||
configMaps:
|
||
mirror-gateway:
|
||
data:
|
||
mirror.conf: |
|
||
proxy_cache_path /var/cache/nginx/mirror levels=1:2 keys_zone=mirror_cache:100m max_size=10g inactive=12h use_temp_path=off;
|
||
|
||
map $request_uri $mirror_cache_key {
|
||
default $scheme$request_method$host$request_uri;
|
||
}
|
||
|
||
upstream concelier_backend {
|
||
server stellaops-concelier:8445;
|
||
keepalive 32;
|
||
}
|
||
|
||
upstream excititor_backend {
|
||
server stellaops-excititor:8448;
|
||
keepalive 32;
|
||
}
|
||
|
||
server {
|
||
listen 80;
|
||
server_name _;
|
||
return 301 https://$host$request_uri;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name mirror-primary.stella-ops.org;
|
||
|
||
ssl_certificate /etc/nginx/tls/mirror-primary.crt;
|
||
ssl_certificate_key /etc/nginx/tls/mirror-primary.key;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_prefer_server_ciphers on;
|
||
|
||
auth_basic "StellaOps Mirror – primary";
|
||
auth_basic_user_file /etc/nginx/secrets/mirror-primary.htpasswd;
|
||
|
||
include /etc/nginx/conf.d/mirror-locations.conf;
|
||
}
|
||
|
||
server {
|
||
listen 443 ssl http2;
|
||
server_name mirror-community.stella-ops.org;
|
||
|
||
ssl_certificate /etc/nginx/tls/mirror-community.crt;
|
||
ssl_certificate_key /etc/nginx/tls/mirror-community.key;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_prefer_server_ciphers on;
|
||
|
||
auth_basic "StellaOps Mirror – community";
|
||
auth_basic_user_file /etc/nginx/secrets/mirror-community.htpasswd;
|
||
|
||
include /etc/nginx/conf.d/mirror-locations.conf;
|
||
}
|
||
mirror-locations.conf: |
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_redirect off;
|
||
|
||
add_header X-Cache-Status $upstream_cache_status always;
|
||
|
||
location = /healthz {
|
||
default_type application/json;
|
||
return 200 '{"status":"ok"}';
|
||
}
|
||
|
||
location /concelier/exports/ {
|
||
proxy_pass http://concelier_backend/concelier/exports/;
|
||
proxy_cache mirror_cache;
|
||
proxy_cache_key $mirror_cache_key;
|
||
proxy_cache_valid 200 5m;
|
||
proxy_cache_valid 404 1m;
|
||
add_header Cache-Control "public, max-age=300, immutable" always;
|
||
}
|
||
|
||
location /concelier/ {
|
||
proxy_pass http://concelier_backend/concelier/;
|
||
proxy_cache off;
|
||
}
|
||
|
||
location /excititor/mirror/ {
|
||
proxy_pass http://excititor_backend/excititor/mirror/;
|
||
proxy_cache mirror_cache;
|
||
proxy_cache_key $mirror_cache_key;
|
||
proxy_cache_valid 200 5m;
|
||
proxy_cache_valid 404 1m;
|
||
add_header Cache-Control "public, max-age=300, immutable" always;
|
||
}
|
||
|
||
location /excititor/ {
|
||
proxy_pass http://excititor_backend/excititor/;
|
||
proxy_cache off;
|
||
}
|
||
|
||
location / {
|
||
return 404;
|
||
}
|
||
|
||
services:
|
||
concelier:
|
||
image: registry.stella-ops.org/stellaops/concelier@sha256:dafef3954eb4b837e2c424dd2d23e1e4d60fa83794840fac9cd3dea1d43bd085
|
||
service:
|
||
port: 8445
|
||
env:
|
||
ASPNETCORE_URLS: "http://+:8445"
|
||
CONCELIER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://stellaops_mirror:mirror-password@stellaops-mongo:27017/concelier?authSource=admin"
|
||
CONCELIER__STORAGE__S3__ENDPOINT: "http://stellaops-minio:9000"
|
||
CONCELIER__STORAGE__S3__ACCESSKEYID: "stellaops-mirror"
|
||
CONCELIER__STORAGE__S3__SECRETACCESSKEY: "mirror-minio-secret"
|
||
CONCELIER__TELEMETRY__SERVICENAME: "stellaops-concelier-mirror"
|
||
CONCELIER__MIRROR__ENABLED: "true"
|
||
CONCELIER__MIRROR__EXPORTROOT: "/exports/json"
|
||
CONCELIER__MIRROR__LATESTDIRECTORYNAME: "latest"
|
||
CONCELIER__MIRROR__MIRRORDIRECTORYNAME: "mirror"
|
||
CONCELIER__MIRROR__REQUIREAUTHENTICATION: "true"
|
||
CONCELIER__MIRROR__MAXINDEXREQUESTSPERHOUR: "600"
|
||
CONCELIER__MIRROR__DOMAINS__0__ID: "primary"
|
||
CONCELIER__MIRROR__DOMAINS__0__DISPLAYNAME: "Primary Mirror"
|
||
CONCELIER__MIRROR__DOMAINS__0__REQUIREAUTHENTICATION: "true"
|
||
CONCELIER__MIRROR__DOMAINS__0__MAXDOWNLOADREQUESTSPERHOUR: "3600"
|
||
CONCELIER__MIRROR__DOMAINS__1__ID: "community"
|
||
CONCELIER__MIRROR__DOMAINS__1__DISPLAYNAME: "Community Mirror"
|
||
CONCELIER__MIRROR__DOMAINS__1__REQUIREAUTHENTICATION: "false"
|
||
CONCELIER__MIRROR__DOMAINS__1__MAXDOWNLOADREQUESTSPERHOUR: "1800"
|
||
CONCELIER__AUTHORITY__ENABLED: "true"
|
||
CONCELIER__AUTHORITY__ALLOWANONYMOUSFALLBACK: "false"
|
||
CONCELIER__AUTHORITY__ISSUER: "https://authority.stella-ops.org"
|
||
CONCELIER__AUTHORITY__METADATAADDRESS: ""
|
||
CONCELIER__AUTHORITY__CLIENTID: "stellaops-concelier-mirror"
|
||
CONCELIER__AUTHORITY__CLIENTSECRETFILE: "/run/secrets/concelier-authority-client"
|
||
CONCELIER__AUTHORITY__CLIENTSCOPES__0: "concelier.mirror.read"
|
||
CONCELIER__AUTHORITY__AUDIENCES__0: "api://concelier.mirror"
|
||
CONCELIER__AUTHORITY__BYPASSNETWORKS__0: "10.0.0.0/8"
|
||
CONCELIER__AUTHORITY__BYPASSNETWORKS__1: "127.0.0.1/32"
|
||
CONCELIER__AUTHORITY__BYPASSNETWORKS__2: "::1/128"
|
||
CONCELIER__AUTHORITY__RESILIENCE__ENABLERETRIES: "true"
|
||
CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__0: "00:00:01"
|
||
CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__1: "00:00:02"
|
||
CONCELIER__AUTHORITY__RESILIENCE__RETRYDELAYS__2: "00:00:05"
|
||
CONCELIER__AUTHORITY__RESILIENCE__ALLOWOFFLINECACHEFALLBACK: "true"
|
||
CONCELIER__AUTHORITY__RESILIENCE__OFFLINECACHETOLERANCE: "00:10:00"
|
||
volumeMounts:
|
||
- name: concelier-jobs
|
||
mountPath: /var/lib/concelier/jobs
|
||
- name: concelier-exports
|
||
mountPath: /exports/json
|
||
- name: concelier-secrets
|
||
mountPath: /run/secrets
|
||
readOnly: true
|
||
volumes:
|
||
- name: concelier-jobs
|
||
persistentVolumeClaim:
|
||
claimName: concelier-mirror-jobs
|
||
- name: concelier-exports
|
||
persistentVolumeClaim:
|
||
claimName: concelier-mirror-exports
|
||
- name: concelier-secrets
|
||
secret:
|
||
secretName: concelier-mirror-auth
|
||
|
||
excititor:
|
||
image: registry.stella-ops.org/stellaops/excititor@sha256:d9bd5cadf1eab427447ce3df7302c30ded837239771cc6433b9befb895054285
|
||
env:
|
||
ASPNETCORE_URLS: "http://+:8448"
|
||
EXCITITOR__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://stellaops_mirror:mirror-password@stellaops-mongo:27017/excititor?authSource=admin"
|
||
EXCITITOR__STORAGE__MONGO__DATABASENAME: "excititor"
|
||
EXCITITOR__ARTIFACTS__FILESYSTEM__ROOT: "/exports"
|
||
EXCITITOR__ARTIFACTS__FILESYSTEM__OVERWRITEEXISTING: "false"
|
||
EXCITITOR__MIRROR__DOMAINS__0__ID: "primary"
|
||
EXCITITOR__MIRROR__DOMAINS__0__DISPLAYNAME: "Primary Mirror"
|
||
EXCITITOR__MIRROR__DOMAINS__0__REQUIREAUTHENTICATION: "true"
|
||
EXCITITOR__MIRROR__DOMAINS__0__MAXINDEXREQUESTSPERHOUR: "300"
|
||
EXCITITOR__MIRROR__DOMAINS__0__MAXDOWNLOADREQUESTSPERHOUR: "2400"
|
||
EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__KEY: "consensus-json"
|
||
EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__FORMAT: "json"
|
||
EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__0__VIEW: "consensus"
|
||
EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__KEY: "consensus-openvex"
|
||
EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__FORMAT: "openvex"
|
||
EXCITITOR__MIRROR__DOMAINS__0__EXPORTS__1__VIEW: "consensus"
|
||
EXCITITOR__MIRROR__DOMAINS__1__ID: "community"
|
||
EXCITITOR__MIRROR__DOMAINS__1__DISPLAYNAME: "Community Mirror"
|
||
EXCITITOR__MIRROR__DOMAINS__1__REQUIREAUTHENTICATION: "false"
|
||
EXCITITOR__MIRROR__DOMAINS__1__MAXINDEXREQUESTSPERHOUR: "120"
|
||
EXCITITOR__MIRROR__DOMAINS__1__MAXDOWNLOADREQUESTSPERHOUR: "600"
|
||
EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__KEY: "community-consensus"
|
||
EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__FORMAT: "json"
|
||
EXCITITOR__MIRROR__DOMAINS__1__EXPORTS__0__VIEW: "consensus"
|
||
volumeMounts:
|
||
- name: excititor-exports
|
||
mountPath: /exports
|
||
- name: excititor-secrets
|
||
mountPath: /run/secrets
|
||
readOnly: true
|
||
volumes:
|
||
- name: excititor-exports
|
||
persistentVolumeClaim:
|
||
claimName: excititor-mirror-exports
|
||
- name: excititor-secrets
|
||
secret:
|
||
secretName: excititor-mirror-auth
|
||
|
||
mongo:
|
||
class: infrastructure
|
||
image: docker.io/library/mongo@sha256:c258b26dbb7774f97f52aff52231ca5f228273a84329c5f5e451c3739457db49
|
||
service:
|
||
port: 27017
|
||
command:
|
||
- mongod
|
||
- --bind_ip_all
|
||
env:
|
||
MONGO_INITDB_ROOT_USERNAME: "stellaops_mirror"
|
||
MONGO_INITDB_ROOT_PASSWORD: "mirror-password"
|
||
volumeMounts:
|
||
- name: mongo-data
|
||
mountPath: /data/db
|
||
volumeClaims:
|
||
- name: mongo-data
|
||
claimName: mirror-mongo-data
|
||
|
||
minio:
|
||
class: infrastructure
|
||
image: docker.io/minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
|
||
service:
|
||
port: 9000
|
||
command:
|
||
- server
|
||
- /data
|
||
- --console-address
|
||
- :9001
|
||
env:
|
||
MINIO_ROOT_USER: "stellaops-mirror"
|
||
MINIO_ROOT_PASSWORD: "mirror-minio-secret"
|
||
volumeMounts:
|
||
- name: minio-data
|
||
mountPath: /data
|
||
volumeClaims:
|
||
- name: minio-data
|
||
claimName: mirror-minio-data
|
||
|
||
mirror-gateway:
|
||
image: docker.io/library/nginx@sha256:208b70eefac13ee9be00e486f79c695b15cef861c680527171a27d253d834be9
|
||
service:
|
||
type: LoadBalancer
|
||
port: 443
|
||
portName: https
|
||
targetPort: 443
|
||
configMounts:
|
||
- name: mirror-gateway-conf
|
||
mountPath: /etc/nginx/conf.d
|
||
configMap: mirror-gateway
|
||
volumeMounts:
|
||
- name: mirror-gateway-tls
|
||
mountPath: /etc/nginx/tls
|
||
readOnly: true
|
||
- name: mirror-gateway-secrets
|
||
mountPath: /etc/nginx/secrets
|
||
readOnly: true
|
||
- name: mirror-cache
|
||
mountPath: /var/cache/nginx
|
||
volumes:
|
||
- name: mirror-gateway-tls
|
||
secret:
|
||
secretName: mirror-gateway-tls
|
||
- name: mirror-gateway-secrets
|
||
secret:
|
||
secretName: mirror-gateway-htpasswd
|
||
- name: mirror-cache
|
||
emptyDir: {}
|