f3s: add ychat revival (Mode A) Helm chart + ArgoCD app

In-memory guest chat, no DB. Deployment pulls
registry.lan.buetow.org:30001/ychat:f387bac, port 2000, non-root (UID 1000),
readOnlyRootFilesystem with emptyDir on /app/log. TCP-socket probes (ychat
speaks HTTP/0.9-style responses). Ingress: ychat.f3s.buetow.org +
ychat.f3s.lan.buetow.org.

5 files changed, 160 insertions, 0 deletions

diff --git a/f3s/argocd-apps/services/ychat.yaml b/f3s/argocd-apps/services/ychat.yaml
new file mode 100644
index 0000000..31a7d22
--- /dev/null
+++ b/f3s/argocd-apps/services/ychat.yaml
@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ychat
+  namespace: cicd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: http://git-server.cicd.svc.cluster.local/conf.git
+    targetRevision: master
+    path: f3s/ychat/helm-chart
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: services
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
+    retry:
+      limit: 3
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 1m
\ No newline at end of file
diff --git a/f3s/ychat/helm-chart/Chart.yaml b/f3s/ychat/helm-chart/Chart.yaml
new file mode 100644
index 0000000..14f694c
--- /dev/null
+++ b/f3s/ychat/helm-chart/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: ychat
+description: yChat revival (Mode A, in-memory guest chat) for f3s
+type: application
+version: 0.1.0
+appVersion: "f387bac"
\ No newline at end of file
diff --git a/f3s/ychat/helm-chart/templates/deployment.yaml b/f3s/ychat/helm-chart/templates/deployment.yaml
new file mode 100644
index 0000000..53f8443
--- /dev/null
+++ b/f3s/ychat/helm-chart/templates/deployment.yaml
@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ychat
+  namespace: services
+spec:
+  replicas: 1
+  # Recreate: single-instance stateful-in-memory chat; avoid two pods racing
+  # for the same Service while the old one drains its sessions.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: ychat
+  template:
+    metadata:
+      labels:
+        app: ychat
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: ychat
+          image: registry.lan.buetow.org:30001/ychat:f387bac
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+          ports:
+            - containerPort: 2000
+              name: http
+          # yChat speaks HTTP/0.9-style responses (no status line), so an
+          # httpGet probe would never succeed. Use a TCP socket probe instead.
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          resources:
+            requests:
+              memory: 32Mi
+              cpu: 25m
+            limits:
+              memory: 128Mi
+              cpu: 250m
+          volumeMounts:
+            - name: log
+              mountPath: /app/log
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: log
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
\ No newline at end of file
diff --git a/f3s/ychat/helm-chart/templates/ingress.yaml b/f3s/ychat/helm-chart/templates/ingress.yaml
new file mode 100644
index 0000000..59f8f2e
--- /dev/null
+++ b/f3s/ychat/helm-chart/templates/ingress.yaml
@@ -0,0 +1,45 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ychat-ingress
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+    - host: ychat.f3s.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ychat-service
+                port:
+                  number: 2000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ychat-ingress-lan
+  namespace: services
+  annotations:
+    spec.ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  tls:
+    - hosts:
+        - ychat.f3s.lan.buetow.org
+      secretName: f3s-lan-tls
+  rules:
+    - host: ychat.f3s.lan.buetow.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ychat-service
+                port:
+                  number: 2000
\ No newline at end of file
diff --git a/f3s/ychat/helm-chart/templates/service.yaml b/f3s/ychat/helm-chart/templates/service.yaml
new file mode 100644
index 0000000..0e7beb8
--- /dev/null
+++ b/f3s/ychat/helm-chart/templates/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: ychat
+  name: ychat-service
+  namespace: services
+spec:
+  ports:
+    - name: web
+      port: 2000
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: ychat
\ No newline at end of file