Merge remote-tracking branch 'origin/dev' into dev

deploy/prod/cm.yaml

@@ -0,0 +1,76 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: xlog-caddy
+  namespace: crossbell
+data:
+  Caddyfile: |
+    {
+    	storage redis {
+    	}
+
+    	on_demand_tls {
+    		ask http://localhost:5000/
+    	}
+    }
+
+    xlog.app, *.xlog.app {
+    	tls jeff@rss3.io {
+    		dns cloudflare {env.CF_API_TOKEN}
+    	}
+
+    	reverse_proxy 127.0.0.1:3000
+    }
+
+    :80, :443 {
+    	tls jeff@rss3.io {
+    		on_demand
+    	}
+
+    	reverse_proxy 127.0.0.1:3000
+    }
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: xlog-caddy-validator
+  namespace: crossbell
+data:
+  app.py: |
+    import requests
+    from flask import Flask, request, Response
+
+    app = Flask(__name__)
+
+
+    @app.route("/")
+    def check_domain():
+        domain = request.args.get("domain")
+        if not domain:
+            return Response(status=404)
+        if domain.endswith('.xlog.app') or domain == "xlog.app":
+            return Response(status=200)
+
+        # get TXT
+        res = requests.get("https://cloudflare-dns.com/dns-query", params={
+            "name": f"_xlog-challenge.{domain}",
+            "type": "TXT",
+        }, headers={"Accept": "application/dns-json"})
+        if res.status_code != 200:
+            return Response(status=res.status_code)
+        answer = res.json().get("Answer") or [{}]
+        tenant = answer[0].get("data", "").replace('"', "")
+        if not tenant:
+            return Response(status=404)
+
+        # check crossbell
+        res = requests.get(f"https://indexer.crossbell.io/v1/handles/{tenant}/character")
+        if res.status_code != 200:
+            return Response(status=404)
+        attributes = res.json().get("metadata", {}).get("content", {}).get("attributes", [])
+        for d in attributes:
+            print(d)
+            if d.get("trait_type") == "xlog_custom_domain" and d.get("value") == domain:
+                return Response(status=200)
+
+        return Response(status=404)

deploy/prod/deploy.yaml

@@ -33,11 +33,11 @@ spec:
               protocol: TCP
           resources:
             requests:
-              memory: '200Mi'
-              cpu: '150m'
+              memory: "200Mi"
+              cpu: "150m"
             limits:
-              memory: '500Mi'
-              cpu: '500m'
+              memory: "500Mi"
+              cpu: "500m"
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
           readinessProbe:
@@ -50,8 +50,41 @@ spec:
               port: 3000
             initialDelaySeconds: 40
             periodSeconds: 20
+        - name: caddy
+          image: kindjeff/caddy-tlsredis-docker
+          imagePullPolicy: Always
+          command: ["caddy", "run", "-config", "/app/Caddyfile"]
+          envFrom:
+            - secretRef:
+                name: xlog-caddy
+          ports:
+            - containerPort: 80
+              name: http
+            - containerPort: 443
+              name: https
+          volumeMounts:
+            - name: caddyfile
+              mountPath: /app
+        - name: caddy-validator
+          image: python
+          command: ["/bin/sh", "-c"]
+          args: ["pip install flask requests; flask --app=app run"]
+          ports:
+            - containerPort: 5000
+              name: http
+          volumeMounts:
+            - name: validator
+              mountPath: /app.py
+              subPath: app.py
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
       terminationGracePeriodSeconds: 30
+      volumes:
+        - name: caddyfile
+          configMap:
+            name: xlog-caddy
+        - name: validator
+          configMap:
+            name: xlog-caddy-validator

deploy/prod/secrets.yaml

@@ -14,3 +14,17 @@ metadata:
   name: xlog
   namespace: crossbell
 type: Opaque
+---
+apiVersion: v1
+stringData:
+  CADDY_CLUSTERING_REDIS_HOST: ${CADDY_CLUSTERING_REDIS_HOST}
+  CADDY_CLUSTERING_REDIS_PORT: "6379"
+  CADDY_CLUSTERING_REDIS_USERNAME: ""
+  CADDY_CLUSTERING_REDIS_PASSWORD: ${CADDY_CLUSTERING_REDIS_PASSWORD}
+  CADDY_CLUSTERING_REDIS_DB: "0"
+  CF_API_TOKEN: ${CF_API_TOKEN}
+kind: Secret
+metadata:
+  name: xlog-caddy
+  namespace: crossbell
+type: Opaque

deploy/prod/svc.yaml

@@ -11,4 +11,8 @@ spec:
     - name: http
       protocol: TCP
       port: 80
-      targetPort: 3000
+      targetPort: 80
+    - name: https
+      protocol: TCP
+      port: 443
+      targetPort: 443