chore(k8s): take the image reference from build-tools

deploy substitutes ${IMAGE} with <registry>/<owner>/<name>:<tag> from the build-tools config, so the registry is set in one place (infra) instead of in every manifest. Renders the same reference as before. Same change as shiny/time-service#864.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -18,30 +18,16 @@ jobs:
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod-frostmoln:
+  deploy-prod:
     needs: build
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
-      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
       - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Install fm
+      - name: Deploy to production
-        run: |
+        run: deploy prod
-          sudo install -d -m 0755 /etc/apt/keyrings
-          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
-          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
-          sudo apt-get update && sudo apt-get install -y fm
-      - name: Deploy to Frostmoln production
-        env:
-          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
-        # The cluster API is private: the kubeconfig's exec plugin opens an fm
-        # tunnel on demand. fm reads the key from its config file, not the env.
-        run: |
-          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
-          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
-          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n sites

Dockerfile

@@ -1,5 +1,4 @@
-# Unprivileged (uid 101, port 8080): Frostmoln enforces restricted Pod Security.
+FROM amd64/nginx:1.31.6@sha256:8e1fce8cb4de80385f5fc98dd9d8cf0fe75d5dbac383c048eff65871a0d1065e
-FROM nginxinc/nginx-unprivileged:1.31.6@sha256:1d26a516fb93b18f9c0214dc9c645054486e516f13ff09ef63d5bd5c622278a2
 MAINTAINER Joakim Olsson <joakim@unbound.se>
 
 ADD files/*.html files/*.jpg files/*.mp3 /usr/share/nginx/html/

default.conf

@@ -1,5 +1,5 @@
 server {
-    listen       8080;
+    listen       80;
     server_name  localhost;
 
     access_log /dev/stdout combined;

k8s/deploy.yaml

@@ -22,11 +22,6 @@ spec:
       labels:
         app.kubernetes.io/name: lingonpaj-site
     spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 101
-        seccompProfile:
-          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -44,18 +39,14 @@ spec:
         readinessProbe:
           httpGet:
             path: /health
-            port: 8080
+            port: 80
           initialDelaySeconds: 5
           periodSeconds: 5
           timeoutSeconds: 5
         imagePullPolicy: Always
         image: ${IMAGE}
         ports:
-        - containerPort: 8080
+        - containerPort: 80
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop: ["ALL"]
         resources:
           requests:
             cpu: 5m
@@ -73,8 +64,9 @@ metadata:
   labels:
     app.kubernetes.io/name: lingonpaj-site
 spec:
+  type: NodePort
   selector:
     app.kubernetes.io/name: lingonpaj-site
   ports:
   - port: 80
-    targetPort: 8080
+    targetPort: 80

k8s/ingress-prod-frostmoln.yaml

@@ -1,20 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: lingonpaj-site
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: "lingonpaj.com"
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: lingonpaj-site
-                port:
-                  number: 80

k8s/ingress-prod.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: lingonpaj-site-ingress
+  annotations:
+    kubernetes.io/ingress.class: "alb"
+    alb.ingress.kubernetes.io/group.name: default
+    alb.ingress.kubernetes.io/scheme: internet-facing
+    alb.ingress.kubernetes.io/target-type: instance
+    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
+    alb.ingress.kubernetes.io/ssl-redirect: "443"
+spec:
+  rules:
+    - host: "lingonpaj.com"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: lingonpaj-site
+                port:
+                  number: 80