nils/mg4

Files

T

nilsandClaude Opus 5.5 c253876ed2 Add Kubernetes manifests for car.stinnesbeck.com

Namespace, InfluxDB 2.7.12 StatefulSet with PVC and a NetworkPolicy
that admits only the server, the server Deployment (non-root, read-only
root filesystem), a cert-manager Certificate from letsencrypt-prod and a
Traefik IngressRoute. Secrets are a template only. Nothing is applied;
k8s/README.md has the steps. Server version bumped to 1.1.0.

Validated offline with kustomize and kubeconform (including the
cert-manager and Traefik CRD schemas). The InfluxDB container was tested
locally as UID 1000 with no capabilities.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-17 14:11:58 +02:00

influxdb.yaml

Add Kubernetes manifests for car.stinnesbeck.com

2026-10-17 14:11:58 +02:00

ingress.yaml

Add Kubernetes manifests for car.stinnesbeck.com

2026-10-17 14:11:58 +02:00

kustomization.yaml

Add Kubernetes manifests for car.stinnesbeck.com

2026-10-17 14:11:58 +02:00

namespace.yaml

Add Kubernetes manifests for car.stinnesbeck.com

2026-10-17 14:11:58 +02:00

README.md

Add Kubernetes manifests for car.stinnesbeck.com

2026-10-17 14:11:58 +02:00

secrets.example.yaml

Add Kubernetes manifests for car.stinnesbeck.com

2026-10-17 14:11:58 +02:00

server.yaml

Add Kubernetes manifests for car.stinnesbeck.com

2026-10-17 14:11:58 +02:00

README.md

Kubernetes manifests — car.stinnesbeck.com

Plain manifests for the car server and its InfluxDB 2. They are only files: nothing here is applied automatically. Apply them yourself.

File	What
`namespace.yaml`	Namespace `mg4`
`influxdb.yaml`	InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy allowing only the server
`server.yaml`	Server Deployment (1 replica, non-root, read-only root filesystem) and Service
`ingress.yaml`	cert-manager `Certificate` from `letsencrypt-prod`, Traefik `IngressRoute` on `websecure`
`secrets.example.yaml`	Template for the two Secrets; not in `kustomization.yaml`
`kustomization.yaml`	Everything except the Secrets; pins the server image tag

Before the first apply

Check the ingress class in ingress.yaml. It is set to traefik-external as a placeholder; use the class of your public-facing Traefik.
Create the Secrets. Copy secrets.example.yaml outside the repository, replace every CHANGE-ME (openssl rand -hex 32 for tokens), then apply the copy: influxdb-auth (InfluxDB admin password and token) and mg4-server (ingest token, session secret, dashboard password, your ABRP API key and user token).
Registry access. If the mg4-server package on git.stinnesbeck.com is private, create the git-stinnesbeck-registry pull secret (command in secrets.example.yaml); if it is public, delete imagePullSecrets from server.yaml.

Apply

kubectl apply -f k8s/namespace.yaml
kubectl apply -f <your filled-in secrets file>
kubectl apply -k k8s/

The Let's Encrypt HTTP-01 challenge needs car.stinnesbeck.com to resolve to the public Traefik before the certificate can be issued; check with kubectl -n mg4 get certificate.

Notes

InfluxDB's setup mode runs only on an empty volume. Changing admin-token in the Secret later does not change the token inside InfluxDB.
The server uses the InfluxDB admin token. A token scoped to the mg4 bucket can replace it later (influx auth create --read-bucket … --write-bucket …).
To upgrade the server, push a new image tag and change newTag in kustomization.yaml.