# Kubernetes manifests — car.stinnesbeck.com

Plain manifests for the car server and its InfluxDB 2. They are only files: nothing here is
applied automatically. Apply them yourself.

| File | What |
|---|---|
| `namespace.yaml` | Namespace `mg4` |
| `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy allowing only the server |
| `server.yaml` | Server Deployment (1 replica, non-root, read-only root filesystem) and Service |
| `ingress.yaml` | cert-manager `Certificate` from `letsencrypt-prod`, Traefik `IngressRoute` on `websecure` |
| `secrets.example.yaml` | **Template** for the two Secrets; not in `kustomization.yaml` |
| `kustomization.yaml` | Everything except the Secrets; pins the server image tag |

## Before the first apply

1. **Check the ingress class** in `ingress.yaml`. It is set to `traefik-external` as a
   placeholder; use the class of your public-facing Traefik.
2. **Create the Secrets.** Copy `secrets.example.yaml` outside the repository, replace every
   `CHANGE-ME` (`openssl rand -hex 32` for tokens), then apply the copy:
   `influxdb-auth` (InfluxDB admin password and token) and `mg4-server` (ingest token,
   session secret, dashboard password, your ABRP API key and user token).
3. **Registry access.** If the `mg4-server` package on git.stinnesbeck.com is private, create
   the `git-stinnesbeck-registry` pull secret (command in `secrets.example.yaml`); if it is
   public, delete `imagePullSecrets` from `server.yaml`.

## Apply

```sh
kubectl apply -f k8s/namespace.yaml
kubectl apply -f <your filled-in secrets file>
kubectl apply -k k8s/
```

The Let's Encrypt HTTP-01 challenge needs car.stinnesbeck.com to resolve to the public
Traefik before the certificate can be issued; check with `kubectl -n mg4 get certificate`.

## Notes

- InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret
  later does not change the token inside InfluxDB.
- The server uses the InfluxDB admin token. A token scoped to the `mg4` bucket can replace it
  later (`influx auth create --read-bucket … --write-bucket …`).
- To upgrade the server, push a new image tag and change `newTag` in `kustomization.yaml`.