up to git

ANALISA.md

@@ -0,0 +1,284 @@
+# Analisa K3s SatuSehat: Service + Worker
+
+## 1. Paket yang dianalisis
+
+| Paket | Fungsi |
+|---|---|
+| `service-satusehat-main.zip` | Service/API utama SatuSehat berbasis Go/Gin |
+| `worker-satusehat-main.zip` | Worker SatuSehat berbasis Go/Gin dan background worker |
+
+## 2. Kesimpulan struktur aplikasi
+
+Aplikasi ini menggunakan pola Go multi-stage build. Service utama menjalankan REST API dan gRPC, sedangkan worker menjalankan REST health endpoint sekaligus background worker.
+
+| Komponen | Port di K3s | Keterangan |
+|---|---:|---|
+| `satusehat-service` | REST `8196`, gRPC `8197` | Service/API utama, dibuka lewat Traefik |
+| `satusehat-worker` | REST `8080` | Internal-only, tidak diberi ingress |
+| `redis` | `6379` | Cache internal namespace |
+
+## 3. Pola Kustomize yang dibuat
+
+Pola yang dipakai mengikuti referensi QRIS dan SiLARAS, tetapi diubah dari `Secret` menjadi `ConfigMap`:
+
+```yaml
+configMapGenerator:
+- name: satusehat-service-env
+  envs:
+  - .env.service.prod
+- name: satusehat-worker-env
+  envs:
+  - .env.worker.prod
+- name: redis-env
+  envs:
+  - .env.redis.prod
+
+generatorOptions:
+  disableNameSuffixHash: true
+```
+
+Deployment membaca env memakai:
+
+```yaml
+envFrom:
+- configMapRef:
+    name: satusehat-service-env
+```
+
+## 4. Perubahan penting dari source ke K3s
+
+1. Baris env yang tidak valid untuk Kustomize dibuang, terutama komentar `// ...` dan baris bebas seperti `untuk vclaim`.
+2. Duplikasi `APP_ENV` dinormalisasi menjadi `APP_ENV=production`.
+3. Worker dinormalisasi ke port `8080` karena Dockerfile worker terbaru mengekspos `8080`.
+4. Worker diarahkan ke service internal K3s: `http://satusehat-service-prod/api/v1/`.
+5. Redis dibuat sebagai komponen internal K3s agar `CACHE_REDIS_HOST` tidak menggantung ke service eksternal.
+
+## 5. Env yang dibaca service
+
+Nilai sensitif disamarkan di laporan ini. Nilai asli ada di file env hasil generate sesuai source yang Anda kirim.
+
+| Key | Value |
+|---|---|
+| `APP_ENV` | `production` |
+| `GIN_MODE` | `release` |
+| `LOGGER_LEVEL` | `info` |
+| `LOGGER_FORMAT` | `text` |
+| `SERVER_PORT` | `8196` |
+| `SERVER_REST_ENABLED` | `true` |
+| `SERVER_REST_PORT` | `8196` |
+| `SERVER_GRPC_ENABLED` | `true` |
+| `SERVER_GRPC_PORT` | `8197` |
+| `CACHE_REDIS_HOST` | `redis-prod` |
+| `CACHE_REDIS_PORT` | `6379` |
+| `REDIS_PASSWORD` | `***REDACTED***` |
+| `AUTH_TYPE` | `hybrid` |
+| `AUTH_STATIC_TOKENS` | `***REDACTED***` |
+| `AUTH_FALLBACK_TO` | `jwt` |
+| `KEYCLOAK_CLIENT_ID` | `***REDACTED***` |
+| `KEYCLOAK_CLIENT_SECRET` | `***REDACTED***` |
+| `KEYCLOAK_ISSUER` | `***REDACTED***` |
+| `KEYCLOAK_URL` | `***REDACTED***` |
+| `KEYCLOAK_REALM` | `***REDACTED***` |
+| `KEYCLOAK_AUDIENCE` | `***REDACTED***` |
+| `KEYCLOAK_JWKS_URL` | `***REDACTED***` |
+| `KEYCLOAK_ENABLED` | `***REDACTED***` |
+| `POSTGRES_DEFAULT_HOST` | `10.10.123.198` |
+| `POSTGRES_DEFAULT_PORT` | `5100` |
+| `POSTGRES_DEFAULT_USERNAME` | `***REDACTED***` |
+| `POSTGRES_DEFAULT_PASSWORD` | `***REDACTED***` |
+| `POSTGRES_DEFAULT_DATABASE` | `db_farmasi` |
+| `POSTGRES_DEFAULT_SSLMODE` | `disable` |
+| `POSTGRES_DEFAULT_TIMEOUT` | `5s` |
+| `POSTGRES_SIMRS_HOST` | `10.10.123.238` |
+| `POSTGRES_SIMRS_PORT` | `5432` |
+| `POSTGRES_SIMRS_USERNAME` | `***REDACTED***` |
+| `POSTGRES_SIMRS_PASSWORD` | `***REDACTED***` |
+| `POSTGRES_SIMRS_DATABASE` | `simrs` |
+| `POSTGRES_SIMRS_SSLMODE` | `disable` |
+| `POSTGRES_SIMRS_TIMEOUT` | `5s` |
+| `POSTGRES_SATUDATA_CONNECTION` | `postgres` |
+| `POSTGRES_SATUDATA_HOST` | `10.10.123.165` |
+| `POSTGRES_SATUDATA_PORT` | `5000` |
+| `POSTGRES_SATUDATA_USERNAME` | `***REDACTED***` |
+| `POSTGRES_SATUDATA_PASSWORD` | `***REDACTED***` |
+| `POSTGRES_SATUDATA_DATABASE` | `satu_db` |
+| `POSTGRES_SATUDATA_SSLMODE` | `disable` |
+| `POSTGRES_SATUDATA_TIMEOUT` | `5s` |
+| `SQLSERVER_FARMASI_CONNECTION` | `sqlserver` |
+| `SQLSERVER_FARMASI_USERNAME` | `***REDACTED***` |
+| `SQLSERVER_FARMASI_PASSWORD` | `***REDACTED***` |
+| `SQLSERVER_FARMASI_HOST` | `10.10.90.232` |
+| `SQLSERVER_FARMASI_DATABASE` | `DBINV` |
+| `SQLSERVER_FARMASI_PORT` | `1433` |
+| `SQLSERVER_FARMASI_SSLMODE` | `disable` |
+| `SQLSERVER_FARMASI_TIMEOUT` | `5s` |
+| `MYSQL_RIS_CONNECTION` | `mysql` |
+| `MYSQL_RIS_USERNAME` | `***REDACTED***` |
+| `MYSQL_RIS_PASSWORD` | `***REDACTED***` |
+| `MYSQL_RIS_HOST` | `10.10.123.141` |
+| `MYSQL_RIS_PORT` | `3306` |
+| `MYSQL_RIS_DATABASE` | `fk_radiology` |
+| `MYSQL_RIS_TIMEOUT` | `5s` |
+| `BPJS_ENABLED` | `true` |
+| `BPJS_KDPPK` | `1323A036` |
+| `BPJS_CONSID` | `***REDACTED***` |
+| `BPJS_SECRETKEY` | `***REDACTED***` |
+| `BPJS_BASEURL` | `https://apijkn-dev.bpjs-kesehatan.go.id` |
+| `BPJS_SERVICE_NAME` | `vclaim-rest-dev` |
+| `BPJS_APOTEK_CONSID` | `***REDACTED***` |
+| `BPJS_APOTEK_SECRETKEY` | `***REDACTED***` |
+| `BPJS_VCLAIM_USERKEY` | `***REDACTED***` |
+| `BPJS_ANTROL_USERKEY` | `***REDACTED***` |
+| `BPJS_IHS_USERKEY` | `***REDACTED***` |
+| `BPJS_APOTEK_USERKEY` | `***REDACTED***` |
+| `SATUSEHAT_ENABLED` | `true` |
+| `SATUSEHAT_ORG_ID` | `100026555` |
+| `SATUSEHAT_FASYAKES_ID` | `3573011` |
+| `SATUSEHAT_CLIENT_ID` | `***REDACTED***` |
+| `SATUSEHAT_CLIENT_SECRET` | `***REDACTED***` |
+| `SATUSEHAT_AUTH_URL` | `https://api-satusehat.kemkes.go.id/oauth2/v1` |
+| `SATUSEHAT_BASE_URL` | `https://api-satusehat.kemkes.go.id/fhir-r4/v1` |
+| `SATUSEHAT_CONSENT_URL` | `https://api-satusehat.kemkes.go.id/consent/v1` |
+| `SATUSEHAT_KFA_URL` | `https://api-satusehat.kemkes.go.id/kfa-v2` |
+| `SATUSEHAT_KYC_URL` | `https://api-satusehat.kemkes.go.id/kyc/v1` |
+| `SATUSEHAT_KYC_CHALLENGE_CODE_URL` | `https://api-satusehat.kemkes.go.id/kyc/v1/challenge-code` |
+| `SATUSEHAT_WEBHOOK_SECRET` | `***REDACTED***` |
+| `SATUSEHAT_DICOM_URL` | `https://api-satusehat.kemkes.go.id/dicom/v1/dicomWeb/studies` |
+| `KYC_PRIVATE_KEY_B64` | `***REDACTED***` |
+| `KYC_PUBLIC_KEY_B64` | `***REDACTED***` |
+| `SWAGGER_HOST` | `satusehat-service.rssa.id` |
+| `CORS_ORIGINS` | `http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3005,http://meninjar.dev.rssa.id:8198,http://localhost:8080,http://localhost:5173,http://localhost:5174,http://10.10.123.143:3001` |
+| `CORS_ALLOW_ALL` | `false` |
+| `MINIO_ENDPOINT` | `http://10.10.123.8:9000` |
+| `MINIO_ACCESSKEY` | `***REDACTED***` |
+| `MINIO_SECRETKEY` | `***REDACTED***` |
+| `MINIO_USESSL` | `false` |
+| `MINIO_BUCKETNAME` | `dev-test` |
+| `CACHE_ENABLED` | `true` |
+| `SWAGGER_BASE_PATH` | `/api/v1` |
+| `SWAGGER_SCHEMES` | `https` |
+
+## 6. Env yang dibaca worker
+
+| Key | Value |
+|---|---|
+| `APP_ENV` | `production` |
+| `GIN_MODE` | `release` |
+| `LOGGER_LEVEL` | `info` |
+| `LOGGER_FORMAT` | `text` |
+| `SERVER_PORT` | `8080` |
+| `SATU_SEHAT_INTERNAL_FHIR_SERVER_URL` | `http://satusehat-service-prod/api/v1/` |
+| `AUTH_TYPE` | `hybrid` |
+| `AUTH_STATIC_TOKENS` | `***REDACTED***` |
+| `AUTH_FALLBACK_TO` | `jwt` |
+| `KEYCLOAK_CLIENT_ID` | `***REDACTED***` |
+| `KEYCLOAK_CLIENT_SECRET` | `***REDACTED***` |
+| `KEYCLOAK_ISSUER` | `***REDACTED***` |
+| `KEYCLOAK_URL` | `***REDACTED***` |
+| `KEYCLOAK_REALM` | `***REDACTED***` |
+| `KEYCLOAK_AUDIENCE` | `***REDACTED***` |
+| `KEYCLOAK_JWKS_URL` | `***REDACTED***` |
+| `KEYCLOAK_ENABLED` | `***REDACTED***` |
+| `POSTGRES_DEFAULT_HOST` | `10.10.123.198` |
+| `POSTGRES_DEFAULT_PORT` | `5100` |
+| `POSTGRES_DEFAULT_USERNAME` | `***REDACTED***` |
+| `POSTGRES_DEFAULT_PASSWORD` | `***REDACTED***` |
+| `POSTGRES_DEFAULT_DATABASE` | `db_farmasi` |
+| `POSTGRES_DEFAULT_SSLMODE` | `disable` |
+| `POSTGRES_DEFAULT_TIMEOUT` | `5s` |
+| `POSTGRES_SIMRS_HOST` | `10.10.123.163` |
+| `POSTGRES_SIMRS_PORT` | `5432` |
+| `POSTGRES_SIMRS_USERNAME` | `***REDACTED***` |
+| `POSTGRES_SIMRS_PASSWORD` | `***REDACTED***` |
+| `POSTGRES_SIMRS_DATABASE` | `simrs` |
+| `POSTGRES_SIMRS_SSLMODE` | `disable` |
+| `POSTGRES_SIMRS_TIMEOUT` | `5s` |
+| `POSTGRES_SATUDATA_CONNECTION` | `postgres` |
+| `POSTGRES_SATUDATA_HOST` | `10.10.123.165` |
+| `POSTGRES_SATUDATA_PORT` | `5000` |
+| `POSTGRES_SATUDATA_USERNAME` | `***REDACTED***` |
+| `POSTGRES_SATUDATA_PASSWORD` | `***REDACTED***` |
+| `POSTGRES_SATUDATA_DATABASE` | `satu_db` |
+| `POSTGRES_SATUDATA_SSLMODE` | `disable` |
+| `POSTGRES_SATUDATA_TIMEOUT` | `5s` |
+| `SQLSERVER_FARMASI_CONNECTION` | `sqlserver` |
+| `SQLSERVER_FARMASI_USERNAME` | `***REDACTED***` |
+| `SQLSERVER_FARMASI_PASSWORD` | `***REDACTED***` |
+| `SQLSERVER_FARMASI_HOST` | `10.10.90.232` |
+| `SQLSERVER_FARMASI_DATABASE` | `DBINV` |
+| `SQLSERVER_FARMASI_PORT` | `1433` |
+| `SQLSERVER_FARMASI_SSLMODE` | `disable` |
+| `SQLSERVER_FARMASI_TIMEOUT` | `5s` |
+| `MYSQL_RIS_CONNECTION` | `mysql` |
+| `MYSQL_RIS_USERNAME` | `***REDACTED***` |
+| `MYSQL_RIS_PASSWORD` | `***REDACTED***` |
+| `MYSQL_RIS_HOST` | `10.10.123.141` |
+| `MYSQL_RIS_PORT` | `3306` |
+| `MYSQL_RIS_DATABASE` | `fk_radiology` |
+| `MYSQL_RIS_TIMEOUT` | `5s` |
+| `SERVER_REST_ENABLED` | `true` |
+| `SERVER_REST_PORT` | `8080` |
+| `SERVER_GRPC_ENABLED` | `false` |
+| `SERVER_GRPC_PORT` | `8099` |
+| `CACHE_REDIS_HOST` | `redis-prod` |
+| `CACHE_REDIS_PORT` | `6379` |
+| `REDIS_PASSWORD` | `***REDACTED***` |
+| `BPJS_ENABLED` | `true` |
+| `BPJS_KDPPK` | `1323A036` |
+| `BPJS_CONSID` | `***REDACTED***` |
+| `BPJS_SECRETKEY` | `***REDACTED***` |
+| `BPJS_BASEURL` | `https://apijkn-dev.bpjs-kesehatan.go.id` |
+| `BPJS_SERVICE_NAME` | `vclaim-rest-dev` |
+| `BPJS_APOTEK_CONSID` | `***REDACTED***` |
+| `BPJS_APOTEK_SECRETKEY` | `***REDACTED***` |
+| `BPJS_VCLAIM_USERKEY` | `***REDACTED***` |
+| `BPJS_ANTROL_USERKEY` | `***REDACTED***` |
+| `BPJS_IHS_USERKEY` | `***REDACTED***` |
+| `BPJS_APOTEK_USERKEY` | `***REDACTED***` |
+| `SATUSEHAT_ENABLED` | `true` |
+| `SATUSEHAT_ORG_ID` | `100026555` |
+| `SATUSEHAT_FASYAKES_ID` | `3573011` |
+| `SATUSEHAT_CLIENT_ID` | `***REDACTED***` |
+| `SATUSEHAT_CLIENT_SECRET` | `***REDACTED***` |
+| `SATUSEHAT_AUTH_URL` | `https://api-satusehat.kemkes.go.id/oauth2/v1` |
+| `SATUSEHAT_BASE_URL` | `https://api-satusehat.kemkes.go.id/fhir-r4/v1` |
+| `SATUSEHAT_CONSENT_URL` | `https://api-satusehat.dto.kemkes.go.id/consent/v1` |
+| `SATUSEHAT_KFA_URL` | `https://api-satusehat.kemkes.go.id/kfa-v2` |
+| `SWAGGER_HOST` | `satusehat-worker.rssa.id` |
+| `CORS_ORIGINS` | `http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3005,http://meninjar.dev.rssa.id:8093,http://localhost:8080,http://localhost:5173,http://localhost:5174,http://10.10.123.143:3001,http://10.10.123.147:8098` |
+| `CORS_ALLOW_ALL` | `false` |
+| `MINIO_ENDPOINT` | `http://10.10.123.8:9000` |
+| `MINIO_ACCESSKEY` | `***REDACTED***` |
+| `MINIO_SECRETKEY` | `***REDACTED***` |
+| `MINIO_USESSL` | `false` |
+| `MINIO_BUCKETNAME` | `dev-test` |
+| `CACHE_ENABLED` | `true` |
+| `SWAGGER_BASE_PATH` | `/api/v1` |
+| `SWAGGER_SCHEMES` | `https` |
+
+## 7. Catatan validasi env source
+
+Service env source memiliki 3 baris tidak valid untuk format env Kustomize. Worker env source memiliki 3 baris tidak valid. Baris tersebut tidak dimasukkan ke `.env.*.prod` agar `kubectl apply -k` tidak gagal.
+
+Contoh jenis baris yang dibuang:
+
+```text
+// komentar gaya JS
+untuk vclaim
+untuk IHS
+untuk Apotek
+```
+
+## 8. File output
+
+Manifest final tersedia pada folder:
+
+```text
+satusehat-k3s/
+```
+
+Paket siap kirim tersedia sebagai ZIP:
+
+```text
+satusehat-k3s-kustomize-env-nosecret.zip
+```

README.md

@@ -0,0 +1,86 @@
+# SatuSehat K3s - Kustomize + Env Tanpa Secret
+
+Template ini dibuat dari paket `service-satusehat-main.zip` dan `worker-satusehat-main.zip`, dengan pola yang mengikuti referensi QRIS dan SiLARAS:
+
+- `base/` berisi manifest generik.
+- `overlays/prod/` berisi konfigurasi production.
+- Environment dimasukkan melalui `configMapGenerator` dari file `.env.*.prod`.
+- Tidak ada resource Kubernetes `Secret`.
+- Service API dibuka lewat Traefik `IngressRoute`.
+- Worker dibuat internal-only, tanpa ingress.
+- Redis disediakan di dalam namespace yang sama karena aplikasi membaca `CACHE_REDIS_HOST` dan `REDIS_PASSWORD`.
+
+## Struktur
+
+```text
+satusehat-k3s/
+├── base/
+│   ├── satusehat-service-deployment.yaml
+│   ├── satusehat-service-service.yaml
+│   ├── satusehat-service-resources.yaml
+│   ├── satusehat-service-probes.yaml
+│   ├── satusehat-worker-deployment.yaml
+│   ├── satusehat-worker-service.yaml
+│   ├── satusehat-worker-resources.yaml
+│   ├── satusehat-worker-probes.yaml
+│   ├── redis-deployment.yaml
+│   ├── redis-service.yaml
+│   ├── redis-pvc.yaml
+│   └── kustomization.yaml
+├── overlays/
+│   └── prod/
+│       ├── .env.service.prod
+│       ├── .env.worker.prod
+│       ├── .env.redis.prod
+│       ├── ingress-route.yaml
+│       ├── certificate.yaml
+│       ├── hpa-service.yaml
+│       ├── hpa-worker.yaml
+│       └── kustomization.yaml
+├── fleet.yaml
+└── kustomization.yaml
+```
+
+## Deploy
+
+```bash
+kubectl apply -k overlays/prod
+```
+
+Atau dari root repo:
+
+```bash
+kubectl apply -k .
+```
+
+## Cek hasil deploy
+
+```bash
+kubectl get pods -n rssa-apps-prod -l app.kubernetes.io/part-of=satusehat
+kubectl get svc -n rssa-apps-prod | grep satusehat
+kubectl logs -n rssa-apps-prod deploy/satusehat-service-prod -f
+kubectl logs -n rssa-apps-prod deploy/satusehat-worker-prod -f
+```
+
+## Endpoint internal
+
+Service API dari worker diarahkan ke:
+
+```text
+http://satusehat-service-prod/api/v1/
+```
+
+Nilai ini ada di:
+
+```text
+overlays/prod/.env.worker.prod
+```
+
+## Catatan penting
+
+1. File `.env.service.prod` dan `.env.worker.prod` sudah dibersihkan agar valid untuk `configMapGenerator`. Baris komentar gaya `//` dan baris bebas seperti `untuk vclaim` tidak boleh dipakai di env Kustomize.
+2. Worker Dockerfile yang baru mengekspos `8080`. Karena itu manifest worker memakai `SERVER_REST_PORT=8080` dan probe ke port `8080`.
+3. Service utama tetap memakai port REST `8196` dan gRPC `8197`, mengikuti `.env.prod` service.
+4. Jika registry `git.rssa.top/stim/...` memakai private auth, karena template ini sengaja tanpa Secret, pastikan node K3s sudah bisa pull image dari registry tersebut melalui konfigurasi containerd/node-level login.
+5. Jika domain bukan `satusehat-service.rssa.id`, ubah `ingress-route.yaml`, `certificate.yaml`, dan `SWAGGER_HOST`.
+6. Jika storage class `nas-rx300` tidak tersedia, ubah `base/redis-pvc.yaml` atau ganti volume Redis menjadi `emptyDir`.

base/kustomization.yaml

@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- satusehat-service-deployment.yaml
+- satusehat-service-service.yaml
+- satusehat-worker-deployment.yaml
+- satusehat-worker-service.yaml
+- satusehat-worker-data-pvc.yaml
+- redis-deployment.yaml
+- redis-service.yaml
+- redis-pvc.yaml
+
+patches:
+- path: satusehat-service-resources.yaml
+- path: satusehat-service-probes.yaml
+- path: satusehat-worker-resources.yaml
+- path: satusehat-worker-probes.yaml
+- path: patch-worker-writable-path.yaml
+- path: patch-worker-wait-service.yaml
+
+commonLabels:
+  app.kubernetes.io/part-of: satusehat

base/patch-worker-wait-service.yaml

@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: satusehat-worker
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: wait-satusehat-service
+        image: busybox:1.36
+        command:
+        - sh
+        - -c
+        - |
+          echo "Waiting for satusehat-service-prod:80..."
+          until nc -z satusehat-service-prod 80; do
+            echo "satusehat-service-prod belum ready, tunggu 3 detik..."
+            sleep 3
+          done
+          echo "satusehat-service-prod ready."

base/patch-worker-writable-path.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: satusehat-worker
+spec:
+  template:
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        fsGroupChangePolicy: OnRootMismatch
+      containers:
+        - name: satusehat-worker
+          workingDir: /app
+          volumeMounts:
+            - name: satusehat-worker-internal-data
+              mountPath: /app/internal
+      volumes:
+        - name: satusehat-worker-internal-data
+          persistentVolumeClaim:
+            claimName: satusehat-worker-data        
+      

base/redis-deployment.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis-satusehat
+  labels:
+    app: redis-satusehat
+    app.kubernetes.io/name: redis-satusehat 
+    app.kubernetes.io/component: cache
+    app.kubernetes.io/part-of: satusehat
+spec:
+  selector:
+    matchLabels:
+      app: redis-satusehat
+  template:
+    metadata:
+      labels:
+        app: redis-satusehat
+        app.kubernetes.io/name: redis-satusehat
+        app.kubernetes.io/component: cache
+        app.kubernetes.io/part-of: satusehat
+    spec:
+      containers:
+      - name: redis-satusehat 
+        image: redis:7-alpine
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: redis-satusehat
+          containerPort: 6379
+        envFrom:
+        - configMapRef:
+            name: redis-env
+        command:
+        - sh
+        - -c
+        - |
+          if [ -n "$REDIS_PASSWORD" ]; then
+            exec redis-server --appendonly yes --requirepass "$REDIS_PASSWORD"
+          else
+            exec redis-server --appendonly yes
+          fi
+        volumeMounts:
+        - name: redis-satusehat-data
+          mountPath: /data
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
+          limits:
+            cpu: 250m
+            memory: 512Mi
+      volumes:
+      - name: redis-satusehat-data
+        persistentVolumeClaim:
+          claimName: redis-satusehat-data

base/redis-pvc.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-satusehat-data
+  labels:
+    app: redis-satusehat  
+    app.kubernetes.io/name: redis-satusehat
+    app.kubernetes.io/component: cache
+    app.kubernetes.io/part-of: satusehat
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: nas-rx300

base/redis-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-satusehat
+  labels:
+    app: redis-satusehat
+    app.kubernetes.io/name: redis-satusehat 
+    app.kubernetes.io/component: cache
+    app.kubernetes.io/part-of: satusehat
+spec:
+  selector:
+    app: redis-satusehat
+  ports:
+  - name: redis-satusehat
+    port: 6379
+    targetPort: 6379

base/satusehat-service-deployment.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: satusehat-service
+  labels:
+    app: satusehat-service
+    app.kubernetes.io/name: satusehat-service
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: satusehat
+spec:
+  selector:
+    matchLabels:
+      app: satusehat-service
+  template:
+    metadata:
+      labels:
+        app: satusehat-service
+        app.kubernetes.io/name: satusehat-service
+        app.kubernetes.io/component: api
+        app.kubernetes.io/part-of: satusehat
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+      containers:
+      - name: satusehat-service
+        image: git.rssa.top/ryan/satusehat-service:20260624092651-main
+        imagePullPolicy: Always
+        workingDir: /app
+        ports:
+        - name: http
+          containerPort: 8196
+        - name: grpc
+          containerPort: 8197
+        envFrom:
+        - configMapRef:
+            name: satusehat-service-env
+        volumeMounts:
+        - name: service-logs
+          mountPath: /app/logs
+        - name: service-tmp
+          mountPath: /tmp
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+      volumes:
+      - name: service-logs
+        emptyDir: {}
+      - name: service-tmp
+        emptyDir: {}

base/satusehat-service-probes.yaml

@@ -0,0 +1,73 @@
+# apiVersion: apps/v1
+# kind: Deployment
+# metadata:
+#   name: satusehat-service
+# spec:
+#   template:
+#     spec:
+#       containers:
+#       - name: satusehat-service
+#         startupProbe:
+#           httpGet:
+#             scheme: HTTP
+#             port: 8196
+#             path: /health
+#           initialDelaySeconds: 5
+#           periodSeconds: 10
+#           timeoutSeconds: 10
+#           failureThreshold: 30
+#           successThreshold: 1
+#         readinessProbe:
+#           httpGet:
+#             scheme: HTTP
+#             port: 8196
+#             path: /ready
+#           initialDelaySeconds: 10
+#           periodSeconds: 10
+#           timeoutSeconds: 10
+#           failureThreshold: 5
+#           successThreshold: 1
+#         livenessProbe:
+#           httpGet:
+#             scheme: HTTP
+#             port: 8196
+#             path: /live
+#           initialDelaySeconds: 90
+#           periodSeconds: 30
+#           timeoutSeconds: 10
+#           failureThreshold: 5
+#           successThreshold: 1
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: satusehat-service
+spec:
+  template:
+    spec:
+      containers:
+      - name: satusehat-service
+        startupProbe:
+          tcpSocket:
+            port: 8196
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 18
+          successThreshold: 1
+        readinessProbe:
+          tcpSocket:
+            port: 8196
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 3
+          successThreshold: 1
+        livenessProbe:
+          tcpSocket:
+            port: 8196
+          initialDelaySeconds: 60
+          periodSeconds: 30
+          timeoutSeconds: 2
+          failureThreshold: 3
+          successThreshold: 1

base/satusehat-service-resources.yaml

@@ -0,0 +1,17 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: satusehat-service
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+      - name: satusehat-service
+        resources:
+          requests:
+            cpu: 500m
+            memory: 512Mi
+          limits:
+            cpu: 2000m
+            memory: 2Gi

base/satusehat-service-service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: satusehat-service
+  labels:
+    app: satusehat-service
+    app.kubernetes.io/name: satusehat-service
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: satusehat
+spec:
+  selector:
+    app: satusehat-service
+  ports:
+  - name: http
+    port: 80
+    targetPort: 8196
+  - name: grpc
+    port: 8197
+    targetPort: 8197

base/satusehat-worker-data-pvc.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: satusehat-worker-data
+  labels:
+    app: satusehat-worker
+    app.kubernetes.io/name: satusehat-worker
+    app.kubernetes.io/component: worker
+    app.kubernetes.io/part-of: satusehat
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: nas-rx300

base/satusehat-worker-deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: satusehat-worker
+  labels:
+    app: satusehat-worker
+    app.kubernetes.io/name: satusehat-worker
+    app.kubernetes.io/component: worker
+    app.kubernetes.io/part-of: satusehat
+spec:
+  selector:
+    matchLabels:
+      app: satusehat-worker
+  template:
+    metadata:
+      labels:
+        app: satusehat-worker
+        app.kubernetes.io/name: satusehat-worker
+        app.kubernetes.io/component: worker
+        app.kubernetes.io/part-of: satusehat
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+      containers:
+      - name: satusehat-worker
+        image: git.rssa.top/ryan/satusehat-worker:20260612104704-main
+        imagePullPolicy: Always
+        workingDir: /app
+        ports:
+        - name: http
+          containerPort: 8080
+        envFrom:
+        - configMapRef:
+            name: satusehat-worker-env
+        volumeMounts:
+        - name: worker-logs
+          mountPath: /app/logs
+        - name: worker-tmp
+          mountPath: /tmp
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+      volumes:
+      - name: worker-logs
+        emptyDir: {}
+      - name: worker-tmp
+        emptyDir: {}

base/satusehat-worker-probes.yaml

@@ -0,0 +1,73 @@
+# apiVersion: apps/v1
+# kind: Deployment
+# metadata:
+#   name: satusehat-worker
+# spec:
+#   template:
+#     spec:
+#       containers:
+#       - name: satusehat-worker
+#         startupProbe:
+#           httpGet:
+#             scheme: HTTP
+#             port: 8080
+#             path: /health
+#           initialDelaySeconds: 5
+#           periodSeconds: 10
+#           timeoutSeconds: 10
+#           failureThreshold: 30
+#           successThreshold: 1
+#         readinessProbe:
+#           httpGet:
+#             scheme: HTTP
+#             port: 8080
+#             path: /ready
+#           initialDelaySeconds: 10
+#           periodSeconds: 10
+#           timeoutSeconds: 10
+#           failureThreshold: 5
+#           successThreshold: 1
+#         livenessProbe:
+#           httpGet:
+#             scheme: HTTP
+#             port: 8080
+#             path: /live
+#           initialDelaySeconds: 90
+#           periodSeconds: 30
+#           timeoutSeconds: 10
+#           failureThreshold: 5
+#           successThreshold: 1
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: satusehat-worker
+spec:
+  template:
+    spec:
+      containers:
+      - name: satusehat-worker
+        startupProbe:
+          tcpSocket:
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 18
+          successThreshold: 1
+        readinessProbe:
+          tcpSocket:
+            port: 8080
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 2
+          failureThreshold: 3
+          successThreshold: 1
+        livenessProbe:
+          tcpSocket:
+            port: 8080
+          initialDelaySeconds: 60
+          periodSeconds: 30
+          timeoutSeconds: 2
+          failureThreshold: 3
+          successThreshold: 1

base/satusehat-worker-resources.yaml

@@ -0,0 +1,17 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: satusehat-worker
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+      - name: satusehat-worker
+        resources:
+          requests:
+            cpu: 500m
+            memory: 1Gi
+          limits:
+            cpu: 2000m
+            memory: 2Gi

base/satusehat-worker-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: satusehat-worker
+  labels:
+    app: satusehat-worker
+    app.kubernetes.io/name: satusehat-worker
+    app.kubernetes.io/component: worker
+    app.kubernetes.io/part-of: satusehat
+spec:
+  selector:
+    app: satusehat-worker
+  ports:
+  - name: http
+    port: 80
+    targetPort: 8080

fleet.yaml

@@ -0,0 +1,2 @@
+kustomize:
+  dir: ""

kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- overlays/prod

overlays/prod/.env.redis.prod

@@ -0,0 +1,5 @@
+# Redis production env, loaded as ConfigMap
+# Generated from uploaded source env and sanitized for Kustomize configMapGenerator.
+# Do not use // comments or plain text lines without KEY=VALUE in Kustomize env files.
+
+REDIS_PASSWORD=zahw@2904

overlays/prod/.env.service.prod

@@ -0,0 +1,102 @@
+# SatuSehat Service production env, loaded as ConfigMap
+# Generated from uploaded source env and sanitized for Kustomize configMapGenerator.
+# Do not use // comments or plain text lines without KEY=VALUE in Kustomize env files.
+
+APP_ENV=production
+GIN_MODE=release
+LOGGER_LEVEL=info
+LOGGER_FORMAT=text
+SERVER_PORT=8196
+SERVER_REST_ENABLED=true
+SERVER_REST_PORT=8196
+SERVER_GRPC_ENABLED=true
+SERVER_GRPC_PORT=8197
+CACHE_REDIS_HOST=redis-satusehat-prod
+CACHE_REDIS_PORT=6379
+REDIS_PASSWORD=zahw@2904
+AUTH_TYPE=hybrid
+AUTH_STATIC_TOKENS=token5,token6,token7,token8
+AUTH_FALLBACK_TO=jwt
+KEYCLOAK_CLIENT_ID=farmasi
+KEYCLOAK_CLIENT_SECRET=6ttxZK76N8Q6eCk9BaxHiWOrIXECgNAz
+KEYCLOAK_ISSUER=https://auth.rssa.top/realms/Dev
+KEYCLOAK_URL=https://auth.rssa.top
+KEYCLOAK_REALM=Dev
+KEYCLOAK_AUDIENCE=farmasi
+KEYCLOAK_JWKS_URL=https://auth.rssa.top/realms/Dev/protocol/openid-connect/certs
+KEYCLOAK_ENABLED=true
+POSTGRES_DEFAULT_HOST=10.10.123.198
+POSTGRES_DEFAULT_PORT=5100
+POSTGRES_DEFAULT_USERNAME=stim_farmasi_app
+POSTGRES_DEFAULT_PASSWORD=mailadmin123
+POSTGRES_DEFAULT_DATABASE=db_farmasi
+POSTGRES_DEFAULT_SSLMODE=disable
+POSTGRES_DEFAULT_TIMEOUT=5s
+POSTGRES_SIMRS_HOST=10.10.123.238
+POSTGRES_SIMRS_PORT=5432
+POSTGRES_SIMRS_USERNAME=brawijaya
+POSTGRES_SIMRS_PASSWORD=ub*2025
+POSTGRES_SIMRS_DATABASE=simrs
+POSTGRES_SIMRS_SSLMODE=disable
+POSTGRES_SIMRS_TIMEOUT=5s
+POSTGRES_SATUDATA_CONNECTION=postgres
+POSTGRES_SATUDATA_HOST=10.10.123.165
+POSTGRES_SATUDATA_PORT=5000
+POSTGRES_SATUDATA_USERNAME=stim
+POSTGRES_SATUDATA_PASSWORD=stim*RS54
+POSTGRES_SATUDATA_DATABASE=satu_db
+POSTGRES_SATUDATA_SSLMODE=disable
+POSTGRES_SATUDATA_TIMEOUT=5s
+SQLSERVER_FARMASI_CONNECTION=sqlserver
+SQLSERVER_FARMASI_USERNAME=komfar
+SQLSERVER_FARMASI_PASSWORD=Komfar123
+SQLSERVER_FARMASI_HOST=10.10.90.232
+SQLSERVER_FARMASI_DATABASE=DBINV
+SQLSERVER_FARMASI_PORT=1433
+SQLSERVER_FARMASI_SSLMODE=disable
+SQLSERVER_FARMASI_TIMEOUT=5s
+MYSQL_RIS_CONNECTION=mysql
+MYSQL_RIS_USERNAME=admin
+MYSQL_RIS_PASSWORD=R!suser>S3cured
+MYSQL_RIS_HOST=10.10.123.141
+MYSQL_RIS_PORT=3306
+MYSQL_RIS_DATABASE=fk_radiology
+MYSQL_RIS_TIMEOUT=5s
+BPJS_ENABLED=true
+BPJS_KDPPK=1323A036
+BPJS_CONSID=16041
+BPJS_SECRETKEY=8pP3D5431E
+BPJS_BASEURL=https://apijkn-dev.bpjs-kesehatan.go.id
+BPJS_SERVICE_NAME=vclaim-rest-dev
+BPJS_APOTEK_CONSID=16061
+BPJS_APOTEK_SECRETKEY=5dP41F7EAE
+BPJS_VCLAIM_USERKEY=467a2817fde5070f66c9a41fbeb8dc2c
+BPJS_ANTROL_USERKEY=04a742fc834e0d3dc5b18913c8d46b90
+BPJS_IHS_USERKEY=dc36cb7e2fb9acacad3a4bc5c7423530
+BPJS_APOTEK_USERKEY=e4305670a51dcbd2b857e95c34ad588e
+SATUSEHAT_ENABLED=true
+SATUSEHAT_ORG_ID=100026555
+SATUSEHAT_FASYAKES_ID=3573011
+SATUSEHAT_CLIENT_ID=l1ZgJGW6K5pnrqGUikWM7fgIoquA2AQ5UUG0U8WqHaq2VEyZ
+SATUSEHAT_CLIENT_SECRET=Al3PTYAW6axPiAFwaFlpn8qShLFW5YGMgG8w1qhexgCc7lGTEjjcR6zxa06ThPDy
+SATUSEHAT_AUTH_URL=https://api-satusehat.kemkes.go.id/oauth2/v1
+SATUSEHAT_BASE_URL=https://api-satusehat.kemkes.go.id/fhir-r4/v1
+SATUSEHAT_CONSENT_URL=https://api-satusehat.kemkes.go.id/consent/v1
+SATUSEHAT_KFA_URL=https://api-satusehat.kemkes.go.id/kfa-v2
+SATUSEHAT_KYC_URL=https://api-satusehat.kemkes.go.id/kyc/v1
+SATUSEHAT_KYC_CHALLENGE_CODE_URL=https://api-satusehat.kemkes.go.id/kyc/v1/challenge-code
+SATUSEHAT_WEBHOOK_SECRET=token_rahasia_webhook_anda_dari_portal_dto
+SATUSEHAT_DICOM_URL=https://api-satusehat.kemkes.go.id/dicom/v1/dicomWeb/studies
+KYC_PRIVATE_KEY_B64=LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBb01SNDFMVUxabWNiZURBRHVtN2UvQ2dWanRTc3ZNMmJrSHhsS1pwN0VQT2M1UGlICmprMW1MQTBsZ3BqNGg5RkxNY2VHbUZIcnk3QXFmdDlDUThPb0VsUy9HRUJIeFpmRTlndDhERTZxV0lEQW51VXAKeGJQVFVlNEFhVzBsTUZ5ZVF5eXZZaS9PdVR3VXJCN2M3Y1ZlYm0wTnBrREJ3RDJYRjhwdUFPTW1VeGFPdG9LdQpia2g1WWNVcVZ1enBYWStuTXFMK1FqMUF3UGJ3TlowREpyQlp3ejJYQ2EzU3k2bWtqaEJMV3JhZzFtc29oZUM3CmQ0S21oMDZEZ1JGeFBqMDJacVlGU2l2R1FXeWcvYlZ6bFBtSEpwYVMvem1HY0plcUdXTkg0VUMvQU81YThpNVgKbUo4UmJQVTBtVkxoZHpXcmZWNGFMVEVmLzlNQjRtTFc0VnMyTVFJREFRQUJBb0lCQUFXeWlzdnlmZFMvYUJHLwpoVjFOdlRNclhqNjNacWNEQkIybjYrdWdWdmJPQkdBWXR2Q2VDWFk3a2NvTjN1WnN6bFQxZXMyU2Z5aFMvaUdNCml0Z1ZFck55RzRyWjZkVTh4SUVaL1hlZjhORmx3RFhOWGloc2o5dFVJNEY0K2MrN3c0dlN4VVVsOTdYNHRTeVgKcENtY3hGVEdZbnpES0I2bWpDQ09wdXo2LzlaalRJOXBnN2VlMitEL0MxMjM0bTU1OWgvVVVBQjEzczduNytRbAo1MGpkcUE2WHpGZEM1Wlg1TUF3YkNNNU9kM0Y4TXdpM0EvVDlrazdtRTUwL0Z4cVRDQVhFZEUybFJZTnNsRUNBCnQ5d1NQUVNIQmw2OUg5L1Z4VS9oTk5oVkkzeUZMaHFKM0xBRk42b05UVU5VcTZFMzdvVE5ZUlBCbkJ3RkYvRysKRmF2VVA0RUNnWUVBMDdJTEF2MzNoUCsyMms0WHhyakQyMDI0NFJ4MFRJWjI3YXk3bEorT2lTemFtV1FzeGhFOApFN3YvTUpZTHF0T2hzU1VwYUxTZ04vQUxDWTJ1OXJ4WkNtM1JhM1EwZk9jNm5lbEZEUzhoVHJNZ3VVMFNaakgrCkJ2cXNpazM5Nm5uTHlVRFVKR3pITy85ekpxdW1uMHNkd2VsTGd0TFZkQnRGZWVqQnZTb2NJb0VDZ1lFQXdtbmYKRUxuS3pLWlkrZlNzNmptUGtiRWhZYnovWWFuUnFNbzVZK3F3MFN4T1dGVTIveVROOEpKMWh3MXBubytpNkNONQpqd255bTljNThNM3l3MmJkWnkxVmFwWmFJNTBoeE9ldGtYdmJsaGMyZExJVDRTcThzeENvaWM2elhnTi9IWU9rCkh2SExKc2J6YnE3S2d4Nmg3VWxUTjBXUGVHNk9yYnphRXhyajI3RUNnWUVBeGozb3lmaUNubTNKRWs0blBkVXcKdEdIb1RBYVZja1JKZ3ZGTENEY1RCNnFWV3lmUU5mdFZ3elUrR0lXcWoySjMvS2ZNUzEwNjNLZFI3clJic0h0WQo5c2M0WWVRRWN5TW1aVkpaYzZzN0NiUDlaUW1qdlVmN2x4V1FGa1JMRUJUV25iU3o5UmhZeXZyQkh1bUhzNHhvClpYclBWOGVRVkpabFRYQ0dYVnJkMWdFQ2dZRUF0enVoaWRvU1VaL1c3SDYzR21yMTdaTE1xNW05K1FaZEhJQzgKWm5lai93R0xOYVhiRjg1UWF4VWV3QkxjSVIydnBLc0t2czNaWXhnTysrNmZoNXREd1NMeEJteCt1R0k0bWFUaAo2ZVNhcVhOblY4VWZCM0dJT0J6VFBFOGNydGNNejN4ckN0OUpZVnJSeE5mbzludkFraXd4eWo0OVlueVE3UjY1ClNwaGxlWUVDZ1lCd25VQ2dOMnlwWUJ6V2FwaUpKRmwvcHBRS3ZQVjdPSmZHZVVESGgvZVlhWC9IaVlDY3N3LzkKU1IxMVVza1AwMGRSakt5UERtTG1Odlh5QmRaMDFJTHhOZmFpdXBxNkNWNFlXVThRdTFtb1lMYkc4ZHJjTEpVTApuL1pMY3hycitOS2FNUzZOSzZhSWpSd2FFeVhacWUzdEM5d20xWGdRcVcyYmdHV2E4eU5FL2c9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
+KYC_PUBLIC_KEY_B64=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFvTVI0MUxVTFptY2JlREFEdW03ZQovQ2dWanRTc3ZNMmJrSHhsS1pwN0VQT2M1UGlIamsxbUxBMGxncGo0aDlGTE1jZUdtRkhyeTdBcWZ0OUNROE9vCkVsUy9HRUJIeFpmRTlndDhERTZxV0lEQW51VXB4YlBUVWU0QWFXMGxNRnllUXl5dllpL091VHdVckI3YzdjVmUKYm0wTnBrREJ3RDJYRjhwdUFPTW1VeGFPdG9LdWJraDVZY1VxVnV6cFhZK25NcUwrUWoxQXdQYndOWjBESnJCWgp3ejJYQ2EzU3k2bWtqaEJMV3JhZzFtc29oZUM3ZDRLbWgwNkRnUkZ4UGowMlpxWUZTaXZHUVd5Zy9iVnpsUG1ICkpwYVMvem1HY0plcUdXTkg0VUMvQU81YThpNVhtSjhSYlBVMG1WTGhkeldyZlY0YUxURWYvOU1CNG1MVzRWczIKTVFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==
+SWAGGER_HOST=satusehat-service.rssa.id
+CORS_ORIGINS=http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3005,http://meninjar.dev.rssa.id:8198,http://localhost:8080,http://localhost:5173,http://localhost:5174,http://10.10.123.143:3001
+CORS_ALLOW_ALL=false
+MINIO_ENDPOINT=http://10.10.123.8:9000
+MINIO_ACCESSKEY=tiBiJQ88gd08rMjYl9Nw
+MINIO_SECRETKEY=1YXkdicAJbizIJ4vIuEjQwT9kIesImByqTFyphvJ
+MINIO_USESSL=false
+MINIO_BUCKETNAME=dev-test
+CACHE_ENABLED=true
+SWAGGER_BASE_PATH=/api/v1
+SWAGGER_SCHEMES=https

overlays/prod/.env.worker.prod

@@ -0,0 +1,97 @@
+# SatuSehat Worker production env, loaded as ConfigMap
+# Generated from uploaded source env and sanitized for Kustomize configMapGenerator.
+# Do not use // comments or plain text lines without KEY=VALUE in Kustomize env files.
+
+APP_ENV=production
+GIN_MODE=release
+LOGGER_LEVEL=info
+LOGGER_FORMAT=text
+SERVER_PORT=8080
+SATU_SEHAT_INTERNAL_FHIR_SERVER_URL=http://satusehat-service-prod/api/v1/
+AUTH_TYPE=hybrid
+AUTH_STATIC_TOKENS=token5,token6,token7,token8
+AUTH_FALLBACK_TO=jwt
+KEYCLOAK_CLIENT_ID=farmasi
+KEYCLOAK_CLIENT_SECRET=6ttxZK76N8Q6eCk9BaxHiWOrIXECgNAz
+KEYCLOAK_ISSUER=https://auth.rssa.top/realms/Dev
+KEYCLOAK_URL=https://auth.rssa.top
+KEYCLOAK_REALM=Dev
+KEYCLOAK_AUDIENCE=farmasi
+KEYCLOAK_JWKS_URL=https://auth.rssa.top/realms/Dev/protocol/openid-connect/certs
+KEYCLOAK_ENABLED=true
+POSTGRES_DEFAULT_HOST=10.10.123.198
+POSTGRES_DEFAULT_PORT=5100
+POSTGRES_DEFAULT_USERNAME=stim_farmasi_app
+POSTGRES_DEFAULT_PASSWORD=mailadmin123
+POSTGRES_DEFAULT_DATABASE=db_farmasi
+POSTGRES_DEFAULT_SSLMODE=disable
+POSTGRES_DEFAULT_TIMEOUT=5s
+POSTGRES_SIMRS_HOST=10.10.123.163
+POSTGRES_SIMRS_PORT=5432
+POSTGRES_SIMRS_USERNAME=simrs
+POSTGRES_SIMRS_PASSWORD=simrs.rssa
+POSTGRES_SIMRS_DATABASE=simrs
+POSTGRES_SIMRS_SSLMODE=disable
+POSTGRES_SIMRS_TIMEOUT=5s
+POSTGRES_SATUDATA_CONNECTION=postgres
+POSTGRES_SATUDATA_HOST=10.10.123.165
+POSTGRES_SATUDATA_PORT=5000
+POSTGRES_SATUDATA_USERNAME=stim
+POSTGRES_SATUDATA_PASSWORD=stim*RS54
+POSTGRES_SATUDATA_DATABASE=satu_db
+POSTGRES_SATUDATA_SSLMODE=disable
+POSTGRES_SATUDATA_TIMEOUT=5s
+SQLSERVER_FARMASI_CONNECTION=sqlserver
+SQLSERVER_FARMASI_USERNAME=komfar
+SQLSERVER_FARMASI_PASSWORD=Komfar123
+SQLSERVER_FARMASI_HOST=10.10.90.232
+SQLSERVER_FARMASI_DATABASE=DBINV
+SQLSERVER_FARMASI_PORT=1433
+SQLSERVER_FARMASI_SSLMODE=disable
+SQLSERVER_FARMASI_TIMEOUT=5s
+MYSQL_RIS_CONNECTION=mysql
+MYSQL_RIS_USERNAME=admin
+MYSQL_RIS_PASSWORD=R!suser>S3cured
+MYSQL_RIS_HOST=10.10.123.141
+MYSQL_RIS_PORT=3306
+MYSQL_RIS_DATABASE=fk_radiology
+MYSQL_RIS_TIMEOUT=5s
+SERVER_REST_ENABLED=true
+SERVER_REST_PORT=8080
+SERVER_GRPC_ENABLED=false
+SERVER_GRPC_PORT=8099
+CACHE_REDIS_HOST=redis-satusehat-prod
+CACHE_REDIS_PORT=6379
+REDIS_PASSWORD=zahw@2904
+BPJS_ENABLED=true
+BPJS_KDPPK=1323A036
+BPJS_CONSID=16041
+BPJS_SECRETKEY=8pP3D5431E
+BPJS_BASEURL=https://apijkn-dev.bpjs-kesehatan.go.id
+BPJS_SERVICE_NAME=vclaim-rest-dev
+BPJS_APOTEK_CONSID=16061
+BPJS_APOTEK_SECRETKEY=5dP41F7EAE
+BPJS_VCLAIM_USERKEY=467a2817fde5070f66c9a41fbeb8dc2c
+BPJS_ANTROL_USERKEY=04a742fc834e0d3dc5b18913c8d46b90
+BPJS_IHS_USERKEY=dc36cb7e2fb9acacad3a4bc5c7423530
+BPJS_APOTEK_USERKEY=e4305670a51dcbd2b857e95c34ad588e
+SATUSEHAT_ENABLED=true
+SATUSEHAT_ORG_ID=100026555
+SATUSEHAT_FASYAKES_ID=3573011
+SATUSEHAT_CLIENT_ID=l1ZgJGW6K5pnrqGUikWM7fgIoquA2AQ5UUG0U8WqHaq2VEyZ
+SATUSEHAT_CLIENT_SECRET=Al3PTYAW6axPiAFwaFlpn8qShLFW5YGMgG8w1qhexgCc7lGTEjjcR6zxa06ThPDy
+SATUSEHAT_AUTH_URL=https://api-satusehat.kemkes.go.id/oauth2/v1
+SATUSEHAT_BASE_URL=https://api-satusehat.kemkes.go.id/fhir-r4/v1
+SATUSEHAT_CONSENT_URL=https://api-satusehat.dto.kemkes.go.id/consent/v1
+SATUSEHAT_KFA_URL=https://api-satusehat.kemkes.go.id/kfa-v2
+SWAGGER_HOST=satusehat-worker.rssa.id
+CORS_ORIGINS=http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3005,http://meninjar.dev.rssa.id:8093,http://localhost:8080,http://localhost:5173,http://localhost:5174,http://10.10.123.143:3001,http://10.10.123.147:8098
+CORS_ALLOW_ALL=false
+MINIO_ENDPOINT=http://10.10.123.8:9000
+MINIO_ACCESSKEY=tiBiJQ88gd08rMjYl9Nw
+MINIO_SECRETKEY=1YXkdicAJbizIJ4vIuEjQwT9kIesImByqTFyphvJ
+MINIO_USESSL=false
+MINIO_BUCKETNAME=dev-test
+CACHE_ENABLED=true
+SWAGGER_BASE_PATH=/api/v1
+SWAGGER_SCHEMES=https

overlays/prod/certificate.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: satusehat-service-rssa-id
+spec:
+  secretName: satusehat-service-rssa-id-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "satusehat-service.rssa.id"
+  dnsNames:
+  - "satusehat-service.rssa.id"

overlays/prod/hpa-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: autoscaling/v1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: satusehat-service
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: satusehat-service
+  minReplicas: 2
+  maxReplicas: 5
+  targetCPUUtilizationPercentage: 70

overlays/prod/hpa-worker.yaml

@@ -0,0 +1,12 @@
+apiVersion: autoscaling/v1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: satusehat-worker
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: satusehat-worker
+  minReplicas: 1
+  maxReplicas: 1
+  targetCPUUtilizationPercentage: 70

overlays/prod/ingress-route.yaml

@@ -0,0 +1,35 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: satusehat-service-local
+  annotations:
+    kubernetes.io/ingress.class: traefik-internal
+spec:
+  entryPoints:
+  - web
+  routes:
+  - kind: Rule
+    match: Host(`satusehat-service.rssa.id`)
+    services:
+    - name: satusehat-service-prod
+      port: 80
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: satusehat-service
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+  - websecure
+  routes:
+  - kind: Rule
+    match: Host(`satusehat-service.rssa.id`)
+    middlewares:
+    - name: default-headers
+    services:
+    - name: satusehat-service-prod
+      port: 80
+  tls:
+    secretName: satusehat-service-rssa-id-tls

overlays/prod/kustomization.yaml

@@ -0,0 +1,36 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../base
+- ingress-route.yaml
+- certificate.yaml
+- hpa-service.yaml
+- hpa-worker.yaml
+
+namespace: rssa-apps-prod
+nameSuffix: -prod
+commonLabels:
+  environment: prod
+  app.kubernetes.io/managed-by: kustomize
+  app.kubernetes.io/part-of: satusehat
+
+images:
+- name: git.rssa.top/ryan/satusehat-service 
+  newTag: 20260624092651-main
+- name: git.rssa.top/ryan/satusehat-worker
+  newTag: 20260612104704-main
+
+configMapGenerator:
+- name: satusehat-service-env
+  envs:
+  - .env.service.prod
+- name: satusehat-worker-env
+  envs:
+  - .env.worker.prod
+- name: redis-env
+  envs:
+  - .env.redis.prod
+
+generatorOptions:
+  disableNameSuffixHash: true