From 7941c5645cba274fdb8af1614b2a713e02ebd221 Mon Sep 17 00:00:00 2001 From: Astra Logical Date: Sun, 28 Jun 2026 10:59:26 -0400 Subject: [PATCH] Stub out OSM support --- .../navigation/navigation-deployment.yaml | 177 ++++++++++++++++++ .../navigation-external-secrets.yaml | 26 +++ services/navigation/navigation-ingress.yaml | 82 ++++++++ services/navigation/navigation-pvcs.yaml | 47 +++++ services/navigation/navigation-service.yaml | 63 +++++++ 5 files changed, 395 insertions(+) create mode 100644 services/navigation/navigation-deployment.yaml create mode 100644 services/navigation/navigation-external-secrets.yaml create mode 100644 services/navigation/navigation-ingress.yaml create mode 100644 services/navigation/navigation-pvcs.yaml create mode 100644 services/navigation/navigation-service.yaml diff --git a/services/navigation/navigation-deployment.yaml b/services/navigation/navigation-deployment.yaml new file mode 100644 index 0000000..78bc1ce --- /dev/null +++ b/services/navigation/navigation-deployment.yaml @@ -0,0 +1,177 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: oauth2-proxy + name: oauth2-proxy + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app: oauth2-proxy + template: + metadata: + labels: + app: oauth2-proxy + spec: + containers: + - name: oauth2-proxy + image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0 + ports: + - containerPort: 4180 + protocol: TCP + name: proxy-port + env: + - name: OAUTH2_PROXY_PROVIDER + value: "keycloak-oidc" + - name: OAUTH2_PROXY_PROVIDER_DISPLAY_NAME + value: "Keycloak" + - name: OAUTH2_PROXY_CLIENT_ID + valueFrom: + secretKeyRef: + name: navigation-secrets + key: OIDC_CLIENT_ID + - name: OAUTH2_PROXY_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: navigation-secrets + key: OIDC_CLIENT_SECRET + - name: OAUTH2_PROXY_COOKIE_SECRET + valueFrom: + secretKeyRef: + name: navigation-secrets + key: OAUTH2_PROXY_COOKIE_SECRET + - name: OAUTH2_PROXY_UPSTREAMS + value: "file:///dev/null" + - name: OAUTH2_PROXY_HTTP_ADDRESS + value: "0.0.0.0:4180" + - name: OAUTH2_PROXY_REDIRECT_URL + value: "https://migrate.mynest.love/oauth2/callback" + - name: OAUTH2_PROXY_OIDC_ISSUER_URL + value: "https://sso.mynest.love/realms/nest" + - name: OAUTH2_PROXY_COOKIE_DOMAINS + value: "migrate.mynest.love" + - name: OAUTH2_PROXY_WHITELIST_DOMAINS + value: "migrate.mynest.love" + - name: OAUTH2_PROXY_COOKIE_SECURE + value: "true" + - name: OAUTH2_PROXY_EMAIL_DOMAINS + value: "*" + - name: OAUTH2_PROXY_SKIP_JWT_BEARER_TOKENS + value: "true" + - name: OAUTH2_PROXY_EXTRA_JWT_ISSUERS + value: "https://sso.mynest.love/realms/nest=account" +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: valhalla + name: valhalla + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app: valhalla + strategy: + type: Recreate + template: + metadata: + labels: + app: valhalla + spec: + containers: + - name: valhalla + image: ghcr.io/valhalla/valhalla:latest + ports: + - containerPort: 8002 + protocol: TCP + name: valhalla-port + env: + - name: TZ + value: America/New_York + - name: tile_urls + value: "https://download.geofabrik.de/north-america/us/maryland-latest.osm.pbf" + - name: build_elevation + value: "True" + - name: serve_tiles + value: "True" + - name: force_rebuild + value: "False" + volumeMounts: + - mountPath: /custom_files + name: valhalla-storage + volumes: + - name: valhalla-storage + persistentVolumeClaim: + claimName: valhalla-data-pvc +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: tileserver + name: tileserver + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app: tileserver + strategy: + type: Recreate + template: + metadata: + labels: + app: tileserver + spec: + containers: + - name: tileserver + image: maptiler/tileserver-gl:latest + ports: + - containerPort: 8080 + protocol: TCP + name: tileserver-port + volumeMounts: + - mountPath: /data + name: tileserver-storage + volumes: + - name: tileserver-storage + persistentVolumeClaim: + claimName: tileserver-data-pvc +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: photon + name: photon + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app: photon + strategy: + type: Recreate + template: + metadata: + labels: + app: photon + spec: + containers: + - name: photon + image: komoot/photon:latest + ports: + - containerPort: 2322 + protocol: TCP + name: photon-port + volumeMounts: + - mountPath: /photon/photon_data + name: photon-storage + volumes: + - name: photon-storage + persistentVolumeClaim: + claimName: photon-data-pvc diff --git a/services/navigation/navigation-external-secrets.yaml b/services/navigation/navigation-external-secrets.yaml new file mode 100644 index 0000000..ee1c5c9 --- /dev/null +++ b/services/navigation/navigation-external-secrets.yaml @@ -0,0 +1,26 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: navigation-secrets + namespace: default +spec: + refreshInterval: "1h" + secretStoreRef: + name: vault-external-secrets-store + kind: ClusterSecretStore + target: + name: navigation-secrets + creationPolicy: Owner + data: + - secretKey: OIDC_CLIENT_ID + remoteRef: + key: navigation + property: client-id + - secretKey: OIDC_CLIENT_SECRET + remoteRef: + key: navigation + property: client-secret + - secretKey: OAUTH2_PROXY_COOKIE_SECRET + remoteRef: + key: navigation + property: cookie-secret diff --git a/services/navigation/navigation-ingress.yaml b/services/navigation/navigation-ingress.yaml new file mode 100644 index 0000000..485876c --- /dev/null +++ b/services/navigation/navigation-ingress.yaml @@ -0,0 +1,82 @@ +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: navigation-forwardauth + namespace: default +spec: + forwardAuth: + address: http://oauth2-proxy.default.svc.cluster.local:4180 + trustForwardHeader: true + authResponseHeaders: + - "X-Auth-User" + - "X-Auth-Email" + - "Authorization" +--- +# Unauthenticated Ingress for the OAuth Callback endpoint +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: navigation-ingress-oauth + namespace: default + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" +spec: + tls: + - hosts: + - migrate.mynest.love + secretName: navigation-tls + rules: + - host: migrate.mynest.love + http: + paths: + - path: /oauth2 + pathType: Prefix + backend: + service: + name: oauth2-proxy + port: + name: http-proxy +--- +# Authenticated Ingress protecting the mapping services +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: navigation-ingress + namespace: default + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + traefik.ingress.kubernetes.io/router.middlewares: default-navigation-forwardauth@kubernetescrd +spec: + tls: + - hosts: + - migrate.mynest.love + secretName: navigation-tls + rules: + - host: migrate.mynest.love + http: + paths: + - path: /route + pathType: Prefix + backend: + service: + name: valhalla + port: + name: http-valhalla + - path: /api + pathType: Prefix + backend: + service: + name: photon + port: + name: http-photon + - path: / + pathType: Prefix + backend: + service: + name: tileserver + port: + name: http-tileserver diff --git a/services/navigation/navigation-pvcs.yaml b/services/navigation/navigation-pvcs.yaml new file mode 100644 index 0000000..d784612 --- /dev/null +++ b/services/navigation/navigation-pvcs.yaml @@ -0,0 +1,47 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: valhalla-data-pvc + namespace: default + labels: + recurring-job.longhorn.io/source: "enabled" + recurring-job-group.longhorn.io/app-config-group: "enabled" +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 50Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: tileserver-data-pvc + namespace: default + labels: + recurring-job.longhorn.io/source: "enabled" + recurring-job-group.longhorn.io/app-config-group: "enabled" +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 20Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: photon-data-pvc + namespace: default + labels: + recurring-job.longhorn.io/source: "enabled" + recurring-job-group.longhorn.io/app-config-group: "enabled" +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 20Gi diff --git a/services/navigation/navigation-service.yaml b/services/navigation/navigation-service.yaml new file mode 100644 index 0000000..74f3c65 --- /dev/null +++ b/services/navigation/navigation-service.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app: oauth2-proxy + name: oauth2-proxy + namespace: default +spec: + type: ClusterIP + ports: + - name: http-proxy + port: 4180 + targetPort: proxy-port + selector: + app: oauth2-proxy +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: valhalla + name: valhalla + namespace: default +spec: + type: ClusterIP + ports: + - name: http-valhalla + port: 8002 + targetPort: valhalla-port + selector: + app: valhalla +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: tileserver + name: tileserver + namespace: default +spec: + type: ClusterIP + ports: + - name: http-tileserver + port: 8080 + targetPort: tileserver-port + selector: + app: tileserver +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: photon + name: photon + namespace: default +spec: + type: ClusterIP + ports: + - name: http-photon + port: 2322 + targetPort: photon-port + selector: + app: photon