fix: use external minio for files service

.gitea/workflows/deploy.yaml

@@ -51,6 +51,8 @@ jobs:
           kubectl apply -f k8s/secrets.yaml
           kubectl apply -f k8s/configmap.yaml
           kubectl apply -f k8s/postgres.yaml
+          kubectl -n files rollout status statefulset/postgres --timeout=240s
+          kubectl -n files wait --for=condition=ready pod -l app=files-postgres --timeout=240s
           kubectl apply -f k8s/server-deployment.yaml
           kubectl apply -f k8s/server-service.yaml
           kubectl -n files set image deployment/files-server \

cmd/server/main.go

@@ -28,7 +28,7 @@ func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	pool, err := commondb.ConnectWithRetry(ctx, cfg.DatabaseURL, 2*time.Minute)
+	pool, err := commondb.ConnectWithRetry(ctx, cfg.DatabaseURL, 10*time.Minute)
 	if err != nil {
 		slog.Error("connect database", "error", err)
 		os.Exit(1)

k8s/configmap.yaml

@@ -6,7 +6,9 @@ metadata:
 data:
   SERVER_PORT: "3001"
   PUBLIC_BASE_URL: "https://portal.estateliga.work"
-  MINIO_ENDPOINT: "minio.minio.svc.cluster.local:9000"
+  # MinIO живёт на отдельном сервере. Как в telephony/meet/portal,
+  # пинним DNS через hostAliases в deployment, чтобы не попасть во
+  # внутренний Traefik/default-cert.
+  MINIO_ENDPOINT: "s3-minio.estateliga.work"
   MINIO_BUCKET: "portal-files"
-  MINIO_USE_SSL: "false"
+  MINIO_USE_SSL: "true"
-

k8s/postgres.yaml

@@ -34,6 +34,9 @@ spec:
           envFrom:
             - secretRef:
                 name: postgres-secret
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
           volumeMounts:
             - name: data
               mountPath: /var/lib/postgresql/data
@@ -52,4 +55,3 @@ spec:
         resources:
           requests:
             storage: 10Gi
-

k8s/secrets.yaml

@@ -8,8 +8,8 @@ stringData:
   DATABASE_URL: "postgres://files:files@postgres.files.svc.cluster.local:5432/files?sslmode=disable"
   PORTAL_INTERNAL_API_KEY: "36fe89ed40c01fdc54d3cf4e3fcacc8751dc456a4a1acd394e9fed48257c5734"
   INTERNAL_API_KEY: "36fe89ed40c01fdc54d3cf4e3fcacc8751dc456a4a1acd394e9fed48257c5734"
-  MINIO_ACCESS_KEY: "files-svc"
+  MINIO_ACCESS_KEY: "admjn"
-  MINIO_SECRET_KEY: "REPLACE_AFTER_FIRST_DEPLOY"
+  MINIO_SECRET_KEY: "TropicalMacaw9Fantasize"
 ---
 apiVersion: v1
 kind: Secret
@@ -21,4 +21,3 @@ stringData:
   POSTGRES_USER: files
   POSTGRES_PASSWORD: files
   POSTGRES_DB: files
-

k8s/server-deployment.yaml

@@ -13,6 +13,10 @@ spec:
       labels:
         app: files-server
     spec:
+      hostAliases:
+        - ip: "77.105.173.42"
+          hostnames:
+            - "s3-minio.estateliga.work"
       terminationGracePeriodSeconds: 15
       securityContext:
         runAsNonRoot: true