fix: route dev frontend through k3sctl catalog

2026-05-18 10:55:06 +00:00
parent 76f6b9fd01
commit 51c1576aa3
6 changed files with 82 additions and 3 deletions
@@ -22,6 +22,8 @@ browser -> main-server:18083 -> dev-frontend-proxy -> prod backend-core microser

 `dev-frontend-proxy` is an nginx sidecar in the main-server Compose project. It proxies requests to `backend-core:8080/api/microservices/k3sctl-adapter/proxy/api/services/frontend-dev/proxy...`, so D601 does not expose a new public port and the dev UI still crosses the existing UniDesk/k3sctl-adapter control boundary. The proxy is intentionally thin: it does not build frontend assets, does not talk to D601 directly, and does not contain DevOps logic.

+`frontend-dev` and `backend-core-dev` are registered with `k3sctl-adapter` through the managed-service catalog `src/components/microservices/k3sctl-adapter/k3s/dev/unidesk-dev-core.k3s.json`. The public dev port must use that cataloged Kubernetes API service-proxy path; it must not add a direct D601 public port, NodePort, or backend-core catalog entry for arbitrary k3s services.
+
 The dev public port is configured in `config.json` as `network.devFrontend.port=18083`, surfaced by `server status` as `urls.devFrontend`, and managed by `server rebuild dev-frontend-proxy`. The proxy health depends on `frontend-dev`; it can be unhealthy until the D601 dev frontend has been deployed.

 The unrestricted public network entries are therefore production frontend, dev frontend, and provider ingress. backend-core REST, PostgreSQL, user-service backend ports, k3s Services, NodePorts and D601 host ports remain private or explicitly restricted.
@@ -239,7 +239,7 @@ export function rebuildService(config: UniDeskConfig, service: RebuildableServic
    `cid=$(${shellJoin(listServiceContainersCommand)} || true)`,
    `if [ -z "$cid" ]; then echo "$(date -Is) compose_rebuild_watchdog_restore service=${service}" >> ${shellQuote(watchdogLog)}; ${shellJoin(restoreCommand)} >> ${shellQuote(watchdogLog)} 2>&1 || true; fi`,
  ].join("\n");
-  const watchdogScript = `set -euo pipefail; ${shellJoin(["flock", "-w", "300", lockPath, "bash", "-lc", watchdogInnerScript])} || true`;
+  const watchdogScript = `set -euo pipefail; ${shellJoin(["flock", "-w", "30", lockPath, "bash", "-lc", watchdogInnerScript])} || true`;
  const validateScript = [
    "ready=0",
    "for attempt in $(seq 1 60); do",
@@ -1,6 +1,7 @@
 server {
  listen 8080;
  server_name _;
+  resolver 127.0.0.11 valid=30s ipv6=off;

  # The dev frontend is intentionally reached through the existing backend-core
  # microservice proxy so the public port does not need direct access to D601.
@@ -41,7 +41,7 @@ services:
      K3SCTL_NATIVE_SERVICE_URL_MDTODO: "${K3SCTL_NATIVE_SERVICE_URL_MDTODO:-}"
      K3SCTL_NATIVE_SERVICE_URL_DECISION_CENTER: "${K3SCTL_NATIVE_SERVICE_URL_DECISION_CENTER:-}"
      K3SCTL_NATIVE_SERVICE_URL_DEVOPS: "${K3SCTL_NATIVE_SERVICE_URL_DEVOPS:-}"
-      K3SCTL_MANIFEST_PATHS: "${K3SCTL_MANIFEST_PATHS:-k3s/code-queue.k3s.json,k3s/mdtodo.k3s.json,k3s/claudeqq.k3s.json,k3s/decision-center.k3s.json}"
+      K3SCTL_MANIFEST_PATHS: "${K3SCTL_MANIFEST_PATHS:-k3s/code-queue.k3s.json,k3s/mdtodo.k3s.json,k3s/claudeqq.k3s.json,k3s/decision-center.k3s.json,k3s/dev/unidesk-dev-core.k3s.json}"
      K3SCTL_SERVICES_JSON: "${K3SCTL_SERVICES_JSON:-[]}"
      UNIDESK_LOG_RETENTION_BYTES: "${UNIDESK_LOG_RETENTION_BYTES:-512MiB}"
    volumes:
@@ -0,0 +1,76 @@
+[
+  {
+    "apiVersion": "unidesk.ai/k3s/v1",
+    "kind": "ManagedKubernetesService",
+    "metadata": {
+      "name": "backend-core-dev",
+      "namespace": "unidesk-dev"
+    },
+    "spec": {
+      "adapterServiceId": "k3sctl-adapter",
+      "controlPlane": {
+        "type": "kubernetes",
+        "cluster": "unidesk-k3s",
+        "context": "unidesk-k3s"
+      },
+      "route": {
+        "kind": "kubernetes-service",
+        "serviceName": "backend-core-dev",
+        "servicePort": 8080
+      },
+      "activeInstanceId": "D601-dev-backend",
+      "singleWriter": true,
+      "expectedNodeIds": [
+        "D601"
+      ],
+      "instances": [
+        {
+          "id": "D601-dev-backend",
+          "nodeId": "D601",
+          "role": "primary",
+          "baseUrl": "kubernetes://unidesk-dev/services/backend-core-dev:8080",
+          "healthPath": "/health",
+          "healthMode": "service-proxy"
+        }
+      ],
+      "requireAllInstancesHealthy": true
+    }
+  },
+  {
+    "apiVersion": "unidesk.ai/k3s/v1",
+    "kind": "ManagedKubernetesService",
+    "metadata": {
+      "name": "frontend-dev",
+      "namespace": "unidesk-dev"
+    },
+    "spec": {
+      "adapterServiceId": "k3sctl-adapter",
+      "controlPlane": {
+        "type": "kubernetes",
+        "cluster": "unidesk-k3s",
+        "context": "unidesk-k3s"
+      },
+      "route": {
+        "kind": "kubernetes-service",
+        "serviceName": "frontend-dev",
+        "servicePort": 8080
+      },
+      "activeInstanceId": "D601-dev-frontend",
+      "singleWriter": false,
+      "expectedNodeIds": [
+        "D601"
+      ],
+      "instances": [
+        {
+          "id": "D601-dev-frontend",
+          "nodeId": "D601",
+          "role": "primary",
+          "baseUrl": "kubernetes://unidesk-dev/services/frontend-dev:8080",
+          "healthPath": "/health",
+          "healthMode": "service-proxy"
+        }
+      ],
+      "requireAllInstancesHealthy": true
+    }
+  }
+]
@@ -274,7 +274,7 @@ function mergeServices(services: ManagedService[]): ManagedService[] {
 }

 function readConfig(): RuntimeConfig {
-  const paths = manifestPaths(envString("K3SCTL_MANIFEST_PATHS", "k3s/code-queue.k3s.json,k3s/mdtodo.k3s.json,k3s/claudeqq.k3s.json,k3s/decision-center.k3s.json"));
+  const paths = manifestPaths(envString("K3SCTL_MANIFEST_PATHS", "k3s/code-queue.k3s.json,k3s/mdtodo.k3s.json,k3s/claudeqq.k3s.json,k3s/decision-center.k3s.json,k3s/dev/unidesk-dev-core.k3s.json"));
  const inlineServices = parseServices(envString("K3SCTL_SERVICES_JSON", "[]"));
  const manifestServices = readManifestServices(paths);
  return {