Infrastructure Overview

Cluster & Namespaces

• Single-node k3s (Hetzner hel1 cx22) at 157.180.66.64.
• Namespaces: lomavuokraus-prod, lomavuokraus-staging.
• Ingress controller: Traefik (k3s default).
• cert-manager v1.15.3 with ClusterIssuers:
  • letsencrypt-prod (ACME prod)
  • letsencrypt-staging (ACME staging for test certs)
• DNS: lomavuokraus.fi, staging.lomavuokraus.fi, api.lomavuokraus.fi -> cluster IP.

Registry

• Private registry: registry.halla-aho.net/thalla/lomavuokraus-web.
• Credentials stored outside repo (creds/), image pull secret registry-halla in staging/prod namespaces.
• Images tagged with git SHA-derived numeric tag and :latest.

App Manifests

• k8s/app.yaml templated via envsubst in deploy scripts.
• Objects:
  • ConfigMap: lomavuokraus-web-config (public env).
  • Deployment: 2 replicas, container port 3000, liveness/readiness on /api/health.
  • Service: ClusterIP on port 80.
  • Ingress: Traefik class, TLS via cert-manager, HTTPS redirect middleware.
  • Traefik Middleware: https-redirect to force HTTPS.
• Secrets: lomavuokraus-web-secrets in cluster (not in repo).

Runtime Environment

• Next.js 14.2.33 (App Router) running via Node.js 20 in Docker.
• PostgreSQL DB at 46.62.203.202 (DATABASE_URL in .env, not committed).
• SMTP: smtp.sohva.org, DKIM key under creds/dkim/....
• Session auth: signed JWT cookie session_token; roles: USER, ADMIN, USER_MODERATOR, LISTING_MODERATOR.

Traffic Flow Diagram

Source: docs/drawio/infra.drawio (edit with draw.io, export PNG locally).