Kubernetes at Lysator: image settings and a specification for the admins #173

New issue

Closed

opened 2026-10-19 20:49:17 +00:00 by littlefox · 0 comments

littlefox commented

2026-10-19 20:49:17 +00:00

Owner

D-050. Lysator hosts the web app and relay on Kubernetes. Their admins write the manifests from our specification, TLS ends at their gateway, and the cluster is x86-64.

Needed:

Trusted proxies: the client's address has to reach the relay through the gateway. Otherwise everyone shares one address and the 9th concurrent user is refused. Add NEOKOM_TRUSTED_PROXIES (CIDRs) for Caddy, which then forwards the real client address.
Security headers: CSP, HSTS, X-Content-Type-Options, Referrer-Policy and frame-ancestors, verified not to break the app.
docs/KUBERNETES.md, the specification:
- image and tag; port 8080 only; /relay is a WebSocket;
- environment variables; probes; writable paths for a read-only root;
- resources, replicas, gateway timeouts, logs and shutdown.
Release 0.4.0, so they deploy a pinned image.

Refs #71.

D-050. Lysator hosts the web app and relay on Kubernetes. Their admins write the manifests from our specification, TLS ends at their gateway, and the cluster is x86-64. Needed: - **Trusted proxies:** the client's address has to reach the relay through the gateway. Otherwise everyone shares one address and the 9th concurrent user is refused. Add `NEOKOM_TRUSTED_PROXIES` (CIDRs) for Caddy, which then forwards the real client address. - **Security headers:** CSP, HSTS, X-Content-Type-Options, Referrer-Policy and frame-ancestors, verified not to break the app. - **docs/KUBERNETES.md**, the specification: - image and tag; port 8080 only; /relay is a WebSocket; - environment variables; probes; writable paths for a read-only root; - resources, replicas, gateway timeouts, logs and shutdown. - **Release 0.4.0**, so they deploy a pinned image. Refs #71.

littlefox added the

area/web

kind/infra

labels

2026-10-19 20:49:17 +00:00

littlefox referenced this issue from a pull request that will close it,

2026-10-19 21:05:38 +00:00

Ready for Kubernetes: trusted proxies, security headers, a spec #174

littlefox referenced this issue from a commit

2026-10-19 21:05:38 +00:00

Ready for Kubernetes: trusted proxies, security headers, a spec

littlefox closed this issue