Scaffold react-platform — GitOps multi-tenant frontend#2
Open
MWest2020 wants to merge 2 commits into
Open
Conversation
Mirror Nextcloud-base GitOps shape voor de WOO PWA. Twee canary-tenants
draaien live op canary.openwoo.app en canary.accept.openwoo.app.
## Architectuur
- ApplicationSet `react-tenants` genereert één Argo Application per
`tenant-<name>-<env>.yaml`. Tenants worden automatisch geadopteerd na
PR-merge — geen kubectl, geen Cloudflare, geen TLS-handelingen.
- AppProject `react-platform` met sync windows (Mon-Vr 07:00-17:00 deny)
voor platform-changes; tenant-additions altijd toegestaan.
- App-of-Apps bootstrap: één root Application beheert AppProject +
ApplicationSet. Eenmalig `./react-platform/scripts/bootstrap.sh`,
daarna alles GitOps.
- Vendored woo-website chart op upstream b1ac4e89 (refactor branch).
Toegevoegd: pod-label-scoped NetworkPolicies (default-deny + ingress
vanuit ingress-nginx + egress 443 met RFC1918 block).
## Conventies
- Filename: `tenant-<name>-<env>.yaml` — uniek per (org, env)
- Namespace: `<name>-<env>` — paired met Nextcloud co-tenant
- Application: `<name>-<env>-reactfront` — matcht oude toolchain naam
- Hostname: `<name>.openwoo.app` (prod) / `<name>.accept.openwoo.app` (accept)
- Upstream: `<name>.commonground.nu` / `<name>.accept.commonground.nu`
- TLS secret: `<name>-<env>-tls` (één cert per tenant)
## Image strategy
- common.yaml pin: `development-V1.0.260422`
(digest sha256:fb21855fd19fea835109c35237483c513f4fe417ed93e9b8b80e5e3d58e70ceb)
- 44 bestaande toolchain-managed `*-reactfront` Applications draaien
`:latest` en BLIJVEN `:latest` totdat ze expliciet gemigreerd worden.
- Migratie-pad: per-tenant override `pwa.image.tag: latest` tijdens
cut-over, in aparte sync window verwijderen voor upgrade naar pin.
Gedocumenteerd in tenant-template.yaml + docs/MIGRATION.md.
## CI (.github/workflows/validate.yaml)
Vijf jobs, alle blocking:
- yamllint (config in .yamllint.yaml; charts/ uitgesloten ivm helm templates)
- validate-values (vereiste velden + filename-conventie per tenant)
- smoke-checks (helm template + kubeconform op elke tenant)
- trivy config scan (charts/ + react-platform/, severity CRITICAL+HIGH)
- trivy fs secret scan (hele repo, blocking op elk gevonden secret)
## Live test
- canary.openwoo.app live (HTTP/2 200)
- canary.accept.openwoo.app live
- DNS auto-create via cluster-infra/external-dns + Cloudflare
- TLS via cert-manager HTTP-01
- HPA actief (2-5 replicas, 80% CPU target)
- Co-tenancy met Nextcloud werkt — pod-label scoped NetworkPolicies
raken Nextcloud-policies niet
## Inhoud
- charts/woo-website/ — vendored Helm chart + UPSTREAM divergence-tracking
- react-platform/argo/applications/root.yaml — App-of-Apps root
- react-platform/argo/projects/react-platform.yaml — AppProject
- react-platform/argo/applicationsets/react-tenants.yaml — generator
- react-platform/values/{common,env/{accept,prod},templates,tenants}/
- react-platform/platform/policies/README.md — verwijst naar chart-templates
- react-platform/scripts/{bootstrap,validate-values,smoke-checks}.sh
- react-platform/docs/{ADDING-TENANT,ROLLOUTS,MIGRATION,BOOTSTRAP}.md (NL)
- .github/workflows/validate.yaml + .yamllint.yaml
- CLAUDE.md, README.md update, CHANGELOG entries
## Tijdelijk: feature-branch refs
ApplicationSet en root Application wijzen nu naar
`feat/bootstrap-react-platform` (4 plekken, alle gemarkeerd
`TODO(post-canary)`). Eén follow-up PR op main zet ze naar `HEAD`
zodra de canary stabiel is.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
MWest2020
force-pushed
the
feat/bootstrap-react-platform
branch
from
May 4, 2026 10:04
c1fde76 to
a0da604
Compare
GitHub org ConductionNL shadowbanned; react-platform + canary reactfront apps SYNC=Unknown. Repoint React-base repoURL github -> codeberg (public HTTPS) in the react-platform AppProject, react-tenants ApplicationSet, and root app. GitHub kept for rollback. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mirror Nextcloud-base GitOps shape voor de WOO PWA. Twee canary-tenants draaien live op canary.openwoo.app en canary.accept.openwoo.app.
Architectuur: ApplicationSet + AppProject + App-of-Apps bootstrap, vendored woo-website chart, pod-label-scoped NetworkPolicies.
Conventies: filename `tenant--.yaml`, namespace `-` (paired met Nextcloud co-tenant), Application `--reactfront` (matcht oude toolchain naam).
Image strategy: `common.yaml` pin op `development-V1.0.260422`. Bestaande 44 toolchain-managed reactfront Apps blijven `:latest`. Per-tenant override-pattern voor migratie.
Live verificatie
Test plan na merge naar development
🤖 Generated with Claude Code