From 78e1d1a98a7209f5a480221baf27c34cfb5cf77b Mon Sep 17 00:00:00 2001 From: ryan Date: Wed, 24 Jun 2026 09:44:24 +0700 Subject: [PATCH] up to git --- ANALISA.md | 284 +++++++++++++++++++++++++ README.md | 86 ++++++++ base/kustomization.yaml | 23 ++ base/patch-worker-wait-service.yaml | 20 ++ base/patch-worker-writable-path.yaml | 24 +++ base/redis-deployment.yaml | 54 +++++ base/redis-pvc.yaml | 16 ++ base/redis-service.yaml | 16 ++ base/satusehat-service-deployment.yaml | 54 +++++ base/satusehat-service-probes.yaml | 73 +++++++ base/satusehat-service-resources.yaml | 17 ++ base/satusehat-service-service.yaml | 19 ++ base/satusehat-worker-data-pvc.yaml | 16 ++ base/satusehat-worker-deployment.yaml | 52 +++++ base/satusehat-worker-probes.yaml | 73 +++++++ base/satusehat-worker-resources.yaml | 17 ++ base/satusehat-worker-service.yaml | 16 ++ fleet.yaml | 2 + kustomization.yaml | 5 + overlays/prod/.env.redis.prod | 5 + overlays/prod/.env.service.prod | 102 +++++++++ overlays/prod/.env.worker.prod | 97 +++++++++ overlays/prod/certificate.yaml | 12 ++ overlays/prod/hpa-service.yaml | 12 ++ overlays/prod/hpa-worker.yaml | 12 ++ overlays/prod/ingress-route.yaml | 35 +++ overlays/prod/kustomization.yaml | 36 ++++ 27 files changed, 1178 insertions(+) create mode 100644 ANALISA.md create mode 100644 README.md create mode 100644 base/kustomization.yaml create mode 100644 base/patch-worker-wait-service.yaml create mode 100644 base/patch-worker-writable-path.yaml create mode 100644 base/redis-deployment.yaml create mode 100644 base/redis-pvc.yaml create mode 100644 base/redis-service.yaml create mode 100644 base/satusehat-service-deployment.yaml create mode 100644 base/satusehat-service-probes.yaml create mode 100644 base/satusehat-service-resources.yaml create mode 100644 base/satusehat-service-service.yaml create mode 100644 base/satusehat-worker-data-pvc.yaml create mode 100644 base/satusehat-worker-deployment.yaml create mode 100644 base/satusehat-worker-probes.yaml create mode 100644 base/satusehat-worker-resources.yaml create mode 100644 base/satusehat-worker-service.yaml create mode 100644 fleet.yaml create mode 100644 kustomization.yaml create mode 100644 overlays/prod/.env.redis.prod create mode 100644 overlays/prod/.env.service.prod create mode 100644 overlays/prod/.env.worker.prod create mode 100644 overlays/prod/certificate.yaml create mode 100644 overlays/prod/hpa-service.yaml create mode 100644 overlays/prod/hpa-worker.yaml create mode 100644 overlays/prod/ingress-route.yaml create mode 100644 overlays/prod/kustomization.yaml diff --git a/ANALISA.md b/ANALISA.md new file mode 100644 index 0000000..28d5669 --- /dev/null +++ b/ANALISA.md @@ -0,0 +1,284 @@ +# Analisa K3s SatuSehat: Service + Worker + +## 1. Paket yang dianalisis + +| Paket | Fungsi | +|---|---| +| `service-satusehat-main.zip` | Service/API utama SatuSehat berbasis Go/Gin | +| `worker-satusehat-main.zip` | Worker SatuSehat berbasis Go/Gin dan background worker | + +## 2. Kesimpulan struktur aplikasi + +Aplikasi ini menggunakan pola Go multi-stage build. Service utama menjalankan REST API dan gRPC, sedangkan worker menjalankan REST health endpoint sekaligus background worker. + +| Komponen | Port di K3s | Keterangan | +|---|---:|---| +| `satusehat-service` | REST `8196`, gRPC `8197` | Service/API utama, dibuka lewat Traefik | +| `satusehat-worker` | REST `8080` | Internal-only, tidak diberi ingress | +| `redis` | `6379` | Cache internal namespace | + +## 3. Pola Kustomize yang dibuat + +Pola yang dipakai mengikuti referensi QRIS dan SiLARAS, tetapi diubah dari `Secret` menjadi `ConfigMap`: + +```yaml +configMapGenerator: +- name: satusehat-service-env + envs: + - .env.service.prod +- name: satusehat-worker-env + envs: + - .env.worker.prod +- name: redis-env + envs: + - .env.redis.prod + +generatorOptions: + disableNameSuffixHash: true +``` + +Deployment membaca env memakai: + +```yaml +envFrom: +- configMapRef: + name: satusehat-service-env +``` + +## 4. Perubahan penting dari source ke K3s + +1. Baris env yang tidak valid untuk Kustomize dibuang, terutama komentar `// ...` dan baris bebas seperti `untuk vclaim`. +2. Duplikasi `APP_ENV` dinormalisasi menjadi `APP_ENV=production`. +3. Worker dinormalisasi ke port `8080` karena Dockerfile worker terbaru mengekspos `8080`. +4. Worker diarahkan ke service internal K3s: `http://satusehat-service-prod/api/v1/`. +5. Redis dibuat sebagai komponen internal K3s agar `CACHE_REDIS_HOST` tidak menggantung ke service eksternal. + +## 5. Env yang dibaca service + +Nilai sensitif disamarkan di laporan ini. Nilai asli ada di file env hasil generate sesuai source yang Anda kirim. + +| Key | Value | +|---|---| +| `APP_ENV` | `production` | +| `GIN_MODE` | `release` | +| `LOGGER_LEVEL` | `info` | +| `LOGGER_FORMAT` | `text` | +| `SERVER_PORT` | `8196` | +| `SERVER_REST_ENABLED` | `true` | +| `SERVER_REST_PORT` | `8196` | +| `SERVER_GRPC_ENABLED` | `true` | +| `SERVER_GRPC_PORT` | `8197` | +| `CACHE_REDIS_HOST` | `redis-prod` | +| `CACHE_REDIS_PORT` | `6379` | +| `REDIS_PASSWORD` | `***REDACTED***` | +| `AUTH_TYPE` | `hybrid` | +| `AUTH_STATIC_TOKENS` | `***REDACTED***` | +| `AUTH_FALLBACK_TO` | `jwt` | +| `KEYCLOAK_CLIENT_ID` | `***REDACTED***` | +| `KEYCLOAK_CLIENT_SECRET` | `***REDACTED***` | +| `KEYCLOAK_ISSUER` | `***REDACTED***` | +| `KEYCLOAK_URL` | `***REDACTED***` | +| `KEYCLOAK_REALM` | `***REDACTED***` | +| `KEYCLOAK_AUDIENCE` | `***REDACTED***` | +| `KEYCLOAK_JWKS_URL` | `***REDACTED***` | +| `KEYCLOAK_ENABLED` | `***REDACTED***` | +| `POSTGRES_DEFAULT_HOST` | `10.10.123.198` | +| `POSTGRES_DEFAULT_PORT` | `5100` | +| `POSTGRES_DEFAULT_USERNAME` | `***REDACTED***` | +| `POSTGRES_DEFAULT_PASSWORD` | `***REDACTED***` | +| `POSTGRES_DEFAULT_DATABASE` | `db_farmasi` | +| `POSTGRES_DEFAULT_SSLMODE` | `disable` | +| `POSTGRES_DEFAULT_TIMEOUT` | `5s` | +| `POSTGRES_SIMRS_HOST` | `10.10.123.238` | +| `POSTGRES_SIMRS_PORT` | `5432` | +| `POSTGRES_SIMRS_USERNAME` | `***REDACTED***` | +| `POSTGRES_SIMRS_PASSWORD` | `***REDACTED***` | +| `POSTGRES_SIMRS_DATABASE` | `simrs` | +| `POSTGRES_SIMRS_SSLMODE` | `disable` | +| `POSTGRES_SIMRS_TIMEOUT` | `5s` | +| `POSTGRES_SATUDATA_CONNECTION` | `postgres` | +| `POSTGRES_SATUDATA_HOST` | `10.10.123.165` | +| `POSTGRES_SATUDATA_PORT` | `5000` | +| `POSTGRES_SATUDATA_USERNAME` | `***REDACTED***` | +| `POSTGRES_SATUDATA_PASSWORD` | `***REDACTED***` | +| `POSTGRES_SATUDATA_DATABASE` | `satu_db` | +| `POSTGRES_SATUDATA_SSLMODE` | `disable` | +| `POSTGRES_SATUDATA_TIMEOUT` | `5s` | +| `SQLSERVER_FARMASI_CONNECTION` | `sqlserver` | +| `SQLSERVER_FARMASI_USERNAME` | `***REDACTED***` | +| `SQLSERVER_FARMASI_PASSWORD` | `***REDACTED***` | +| `SQLSERVER_FARMASI_HOST` | `10.10.90.232` | +| `SQLSERVER_FARMASI_DATABASE` | `DBINV` | +| `SQLSERVER_FARMASI_PORT` | `1433` | +| `SQLSERVER_FARMASI_SSLMODE` | `disable` | +| `SQLSERVER_FARMASI_TIMEOUT` | `5s` | +| `MYSQL_RIS_CONNECTION` | `mysql` | +| `MYSQL_RIS_USERNAME` | `***REDACTED***` | +| `MYSQL_RIS_PASSWORD` | `***REDACTED***` | +| `MYSQL_RIS_HOST` | `10.10.123.141` | +| `MYSQL_RIS_PORT` | `3306` | +| `MYSQL_RIS_DATABASE` | `fk_radiology` | +| `MYSQL_RIS_TIMEOUT` | `5s` | +| `BPJS_ENABLED` | `true` | +| `BPJS_KDPPK` | `1323A036` | +| `BPJS_CONSID` | `***REDACTED***` | +| `BPJS_SECRETKEY` | `***REDACTED***` | +| `BPJS_BASEURL` | `https://apijkn-dev.bpjs-kesehatan.go.id` | +| `BPJS_SERVICE_NAME` | `vclaim-rest-dev` | +| `BPJS_APOTEK_CONSID` | `***REDACTED***` | +| `BPJS_APOTEK_SECRETKEY` | `***REDACTED***` | +| `BPJS_VCLAIM_USERKEY` | `***REDACTED***` | +| `BPJS_ANTROL_USERKEY` | `***REDACTED***` | +| `BPJS_IHS_USERKEY` | `***REDACTED***` | +| `BPJS_APOTEK_USERKEY` | `***REDACTED***` | +| `SATUSEHAT_ENABLED` | `true` | +| `SATUSEHAT_ORG_ID` | `100026555` | +| `SATUSEHAT_FASYAKES_ID` | `3573011` | +| `SATUSEHAT_CLIENT_ID` | `***REDACTED***` | +| `SATUSEHAT_CLIENT_SECRET` | `***REDACTED***` | +| `SATUSEHAT_AUTH_URL` | `https://api-satusehat.kemkes.go.id/oauth2/v1` | +| `SATUSEHAT_BASE_URL` | `https://api-satusehat.kemkes.go.id/fhir-r4/v1` | +| `SATUSEHAT_CONSENT_URL` | `https://api-satusehat.kemkes.go.id/consent/v1` | +| `SATUSEHAT_KFA_URL` | `https://api-satusehat.kemkes.go.id/kfa-v2` | +| `SATUSEHAT_KYC_URL` | `https://api-satusehat.kemkes.go.id/kyc/v1` | +| `SATUSEHAT_KYC_CHALLENGE_CODE_URL` | `https://api-satusehat.kemkes.go.id/kyc/v1/challenge-code` | +| `SATUSEHAT_WEBHOOK_SECRET` | `***REDACTED***` | +| `SATUSEHAT_DICOM_URL` | `https://api-satusehat.kemkes.go.id/dicom/v1/dicomWeb/studies` | +| `KYC_PRIVATE_KEY_B64` | `***REDACTED***` | +| `KYC_PUBLIC_KEY_B64` | `***REDACTED***` | +| `SWAGGER_HOST` | `satusehat-service.rssa.id` | +| `CORS_ORIGINS` | `http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3005,http://meninjar.dev.rssa.id:8198,http://localhost:8080,http://localhost:5173,http://localhost:5174,http://10.10.123.143:3001` | +| `CORS_ALLOW_ALL` | `false` | +| `MINIO_ENDPOINT` | `http://10.10.123.8:9000` | +| `MINIO_ACCESSKEY` | `***REDACTED***` | +| `MINIO_SECRETKEY` | `***REDACTED***` | +| `MINIO_USESSL` | `false` | +| `MINIO_BUCKETNAME` | `dev-test` | +| `CACHE_ENABLED` | `true` | +| `SWAGGER_BASE_PATH` | `/api/v1` | +| `SWAGGER_SCHEMES` | `https` | + +## 6. Env yang dibaca worker + +| Key | Value | +|---|---| +| `APP_ENV` | `production` | +| `GIN_MODE` | `release` | +| `LOGGER_LEVEL` | `info` | +| `LOGGER_FORMAT` | `text` | +| `SERVER_PORT` | `8080` | +| `SATU_SEHAT_INTERNAL_FHIR_SERVER_URL` | `http://satusehat-service-prod/api/v1/` | +| `AUTH_TYPE` | `hybrid` | +| `AUTH_STATIC_TOKENS` | `***REDACTED***` | +| `AUTH_FALLBACK_TO` | `jwt` | +| `KEYCLOAK_CLIENT_ID` | `***REDACTED***` | +| `KEYCLOAK_CLIENT_SECRET` | `***REDACTED***` | +| `KEYCLOAK_ISSUER` | `***REDACTED***` | +| `KEYCLOAK_URL` | `***REDACTED***` | +| `KEYCLOAK_REALM` | `***REDACTED***` | +| `KEYCLOAK_AUDIENCE` | `***REDACTED***` | +| `KEYCLOAK_JWKS_URL` | `***REDACTED***` | +| `KEYCLOAK_ENABLED` | `***REDACTED***` | +| `POSTGRES_DEFAULT_HOST` | `10.10.123.198` | +| `POSTGRES_DEFAULT_PORT` | `5100` | +| `POSTGRES_DEFAULT_USERNAME` | `***REDACTED***` | +| `POSTGRES_DEFAULT_PASSWORD` | `***REDACTED***` | +| `POSTGRES_DEFAULT_DATABASE` | `db_farmasi` | +| `POSTGRES_DEFAULT_SSLMODE` | `disable` | +| `POSTGRES_DEFAULT_TIMEOUT` | `5s` | +| `POSTGRES_SIMRS_HOST` | `10.10.123.163` | +| `POSTGRES_SIMRS_PORT` | `5432` | +| `POSTGRES_SIMRS_USERNAME` | `***REDACTED***` | +| `POSTGRES_SIMRS_PASSWORD` | `***REDACTED***` | +| `POSTGRES_SIMRS_DATABASE` | `simrs` | +| `POSTGRES_SIMRS_SSLMODE` | `disable` | +| `POSTGRES_SIMRS_TIMEOUT` | `5s` | +| `POSTGRES_SATUDATA_CONNECTION` | `postgres` | +| `POSTGRES_SATUDATA_HOST` | `10.10.123.165` | +| `POSTGRES_SATUDATA_PORT` | `5000` | +| `POSTGRES_SATUDATA_USERNAME` | `***REDACTED***` | +| `POSTGRES_SATUDATA_PASSWORD` | `***REDACTED***` | +| `POSTGRES_SATUDATA_DATABASE` | `satu_db` | +| `POSTGRES_SATUDATA_SSLMODE` | `disable` | +| `POSTGRES_SATUDATA_TIMEOUT` | `5s` | +| `SQLSERVER_FARMASI_CONNECTION` | `sqlserver` | +| `SQLSERVER_FARMASI_USERNAME` | `***REDACTED***` | +| `SQLSERVER_FARMASI_PASSWORD` | `***REDACTED***` | +| `SQLSERVER_FARMASI_HOST` | `10.10.90.232` | +| `SQLSERVER_FARMASI_DATABASE` | `DBINV` | +| `SQLSERVER_FARMASI_PORT` | `1433` | +| `SQLSERVER_FARMASI_SSLMODE` | `disable` | +| `SQLSERVER_FARMASI_TIMEOUT` | `5s` | +| `MYSQL_RIS_CONNECTION` | `mysql` | +| `MYSQL_RIS_USERNAME` | `***REDACTED***` | +| `MYSQL_RIS_PASSWORD` | `***REDACTED***` | +| `MYSQL_RIS_HOST` | `10.10.123.141` | +| `MYSQL_RIS_PORT` | `3306` | +| `MYSQL_RIS_DATABASE` | `fk_radiology` | +| `MYSQL_RIS_TIMEOUT` | `5s` | +| `SERVER_REST_ENABLED` | `true` | +| `SERVER_REST_PORT` | `8080` | +| `SERVER_GRPC_ENABLED` | `false` | +| `SERVER_GRPC_PORT` | `8099` | +| `CACHE_REDIS_HOST` | `redis-prod` | +| `CACHE_REDIS_PORT` | `6379` | +| `REDIS_PASSWORD` | `***REDACTED***` | +| `BPJS_ENABLED` | `true` | +| `BPJS_KDPPK` | `1323A036` | +| `BPJS_CONSID` | `***REDACTED***` | +| `BPJS_SECRETKEY` | `***REDACTED***` | +| `BPJS_BASEURL` | `https://apijkn-dev.bpjs-kesehatan.go.id` | +| `BPJS_SERVICE_NAME` | `vclaim-rest-dev` | +| `BPJS_APOTEK_CONSID` | `***REDACTED***` | +| `BPJS_APOTEK_SECRETKEY` | `***REDACTED***` | +| `BPJS_VCLAIM_USERKEY` | `***REDACTED***` | +| `BPJS_ANTROL_USERKEY` | `***REDACTED***` | +| `BPJS_IHS_USERKEY` | `***REDACTED***` | +| `BPJS_APOTEK_USERKEY` | `***REDACTED***` | +| `SATUSEHAT_ENABLED` | `true` | +| `SATUSEHAT_ORG_ID` | `100026555` | +| `SATUSEHAT_FASYAKES_ID` | `3573011` | +| `SATUSEHAT_CLIENT_ID` | `***REDACTED***` | +| `SATUSEHAT_CLIENT_SECRET` | `***REDACTED***` | +| `SATUSEHAT_AUTH_URL` | `https://api-satusehat.kemkes.go.id/oauth2/v1` | +| `SATUSEHAT_BASE_URL` | `https://api-satusehat.kemkes.go.id/fhir-r4/v1` | +| `SATUSEHAT_CONSENT_URL` | `https://api-satusehat.dto.kemkes.go.id/consent/v1` | +| `SATUSEHAT_KFA_URL` | `https://api-satusehat.kemkes.go.id/kfa-v2` | +| `SWAGGER_HOST` | `satusehat-worker.rssa.id` | +| `CORS_ORIGINS` | `http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3005,http://meninjar.dev.rssa.id:8093,http://localhost:8080,http://localhost:5173,http://localhost:5174,http://10.10.123.143:3001,http://10.10.123.147:8098` | +| `CORS_ALLOW_ALL` | `false` | +| `MINIO_ENDPOINT` | `http://10.10.123.8:9000` | +| `MINIO_ACCESSKEY` | `***REDACTED***` | +| `MINIO_SECRETKEY` | `***REDACTED***` | +| `MINIO_USESSL` | `false` | +| `MINIO_BUCKETNAME` | `dev-test` | +| `CACHE_ENABLED` | `true` | +| `SWAGGER_BASE_PATH` | `/api/v1` | +| `SWAGGER_SCHEMES` | `https` | + +## 7. Catatan validasi env source + +Service env source memiliki 3 baris tidak valid untuk format env Kustomize. Worker env source memiliki 3 baris tidak valid. Baris tersebut tidak dimasukkan ke `.env.*.prod` agar `kubectl apply -k` tidak gagal. + +Contoh jenis baris yang dibuang: + +```text +// komentar gaya JS +untuk vclaim +untuk IHS +untuk Apotek +``` + +## 8. File output + +Manifest final tersedia pada folder: + +```text +satusehat-k3s/ +``` + +Paket siap kirim tersedia sebagai ZIP: + +```text +satusehat-k3s-kustomize-env-nosecret.zip +``` diff --git a/README.md b/README.md new file mode 100644 index 0000000..019d1ef --- /dev/null +++ b/README.md @@ -0,0 +1,86 @@ +# SatuSehat K3s - Kustomize + Env Tanpa Secret + +Template ini dibuat dari paket `service-satusehat-main.zip` dan `worker-satusehat-main.zip`, dengan pola yang mengikuti referensi QRIS dan SiLARAS: + +- `base/` berisi manifest generik. +- `overlays/prod/` berisi konfigurasi production. +- Environment dimasukkan melalui `configMapGenerator` dari file `.env.*.prod`. +- Tidak ada resource Kubernetes `Secret`. +- Service API dibuka lewat Traefik `IngressRoute`. +- Worker dibuat internal-only, tanpa ingress. +- Redis disediakan di dalam namespace yang sama karena aplikasi membaca `CACHE_REDIS_HOST` dan `REDIS_PASSWORD`. + +## Struktur + +```text +satusehat-k3s/ +├── base/ +│ ├── satusehat-service-deployment.yaml +│ ├── satusehat-service-service.yaml +│ ├── satusehat-service-resources.yaml +│ ├── satusehat-service-probes.yaml +│ ├── satusehat-worker-deployment.yaml +│ ├── satusehat-worker-service.yaml +│ ├── satusehat-worker-resources.yaml +│ ├── satusehat-worker-probes.yaml +│ ├── redis-deployment.yaml +│ ├── redis-service.yaml +│ ├── redis-pvc.yaml +│ └── kustomization.yaml +├── overlays/ +│ └── prod/ +│ ├── .env.service.prod +│ ├── .env.worker.prod +│ ├── .env.redis.prod +│ ├── ingress-route.yaml +│ ├── certificate.yaml +│ ├── hpa-service.yaml +│ ├── hpa-worker.yaml +│ └── kustomization.yaml +├── fleet.yaml +└── kustomization.yaml +``` + +## Deploy + +```bash +kubectl apply -k overlays/prod +``` + +Atau dari root repo: + +```bash +kubectl apply -k . +``` + +## Cek hasil deploy + +```bash +kubectl get pods -n rssa-apps-prod -l app.kubernetes.io/part-of=satusehat +kubectl get svc -n rssa-apps-prod | grep satusehat +kubectl logs -n rssa-apps-prod deploy/satusehat-service-prod -f +kubectl logs -n rssa-apps-prod deploy/satusehat-worker-prod -f +``` + +## Endpoint internal + +Service API dari worker diarahkan ke: + +```text +http://satusehat-service-prod/api/v1/ +``` + +Nilai ini ada di: + +```text +overlays/prod/.env.worker.prod +``` + +## Catatan penting + +1. File `.env.service.prod` dan `.env.worker.prod` sudah dibersihkan agar valid untuk `configMapGenerator`. Baris komentar gaya `//` dan baris bebas seperti `untuk vclaim` tidak boleh dipakai di env Kustomize. +2. Worker Dockerfile yang baru mengekspos `8080`. Karena itu manifest worker memakai `SERVER_REST_PORT=8080` dan probe ke port `8080`. +3. Service utama tetap memakai port REST `8196` dan gRPC `8197`, mengikuti `.env.prod` service. +4. Jika registry `git.rssa.top/stim/...` memakai private auth, karena template ini sengaja tanpa Secret, pastikan node K3s sudah bisa pull image dari registry tersebut melalui konfigurasi containerd/node-level login. +5. Jika domain bukan `satusehat-service.rssa.id`, ubah `ingress-route.yaml`, `certificate.yaml`, dan `SWAGGER_HOST`. +6. Jika storage class `nas-rx300` tidak tersedia, ubah `base/redis-pvc.yaml` atau ganti volume Redis menjadi `emptyDir`. diff --git a/base/kustomization.yaml b/base/kustomization.yaml new file mode 100644 index 0000000..b796c86 --- /dev/null +++ b/base/kustomization.yaml @@ -0,0 +1,23 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +- satusehat-service-deployment.yaml +- satusehat-service-service.yaml +- satusehat-worker-deployment.yaml +- satusehat-worker-service.yaml +- satusehat-worker-data-pvc.yaml +- redis-deployment.yaml +- redis-service.yaml +- redis-pvc.yaml + +patches: +- path: satusehat-service-resources.yaml +- path: satusehat-service-probes.yaml +- path: satusehat-worker-resources.yaml +- path: satusehat-worker-probes.yaml +- path: patch-worker-writable-path.yaml +- path: patch-worker-wait-service.yaml + +commonLabels: + app.kubernetes.io/part-of: satusehat diff --git a/base/patch-worker-wait-service.yaml b/base/patch-worker-wait-service.yaml new file mode 100644 index 0000000..5180b3d --- /dev/null +++ b/base/patch-worker-wait-service.yaml @@ -0,0 +1,20 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: satusehat-worker +spec: + template: + spec: + initContainers: + - name: wait-satusehat-service + image: busybox:1.36 + command: + - sh + - -c + - | + echo "Waiting for satusehat-service-prod:80..." + until nc -z satusehat-service-prod 80; do + echo "satusehat-service-prod belum ready, tunggu 3 detik..." + sleep 3 + done + echo "satusehat-service-prod ready." \ No newline at end of file diff --git a/base/patch-worker-writable-path.yaml b/base/patch-worker-writable-path.yaml new file mode 100644 index 0000000..3e81736 --- /dev/null +++ b/base/patch-worker-writable-path.yaml @@ -0,0 +1,24 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: satusehat-worker +spec: + template: + spec: + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + fsGroupChangePolicy: OnRootMismatch + containers: + - name: satusehat-worker + workingDir: /app + volumeMounts: + - name: satusehat-worker-internal-data + mountPath: /app/internal + volumes: + - name: satusehat-worker-internal-data + persistentVolumeClaim: + claimName: satusehat-worker-data + \ No newline at end of file diff --git a/base/redis-deployment.yaml b/base/redis-deployment.yaml new file mode 100644 index 0000000..ab45743 --- /dev/null +++ b/base/redis-deployment.yaml @@ -0,0 +1,54 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: redis-satusehat + labels: + app: redis-satusehat + app.kubernetes.io/name: redis-satusehat + app.kubernetes.io/component: cache + app.kubernetes.io/part-of: satusehat +spec: + selector: + matchLabels: + app: redis-satusehat + template: + metadata: + labels: + app: redis-satusehat + app.kubernetes.io/name: redis-satusehat + app.kubernetes.io/component: cache + app.kubernetes.io/part-of: satusehat + spec: + containers: + - name: redis-satusehat + image: redis:7-alpine + imagePullPolicy: IfNotPresent + ports: + - name: redis-satusehat + containerPort: 6379 + envFrom: + - configMapRef: + name: redis-env + command: + - sh + - -c + - | + if [ -n "$REDIS_PASSWORD" ]; then + exec redis-server --appendonly yes --requirepass "$REDIS_PASSWORD" + else + exec redis-server --appendonly yes + fi + volumeMounts: + - name: redis-satusehat-data + mountPath: /data + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 250m + memory: 512Mi + volumes: + - name: redis-satusehat-data + persistentVolumeClaim: + claimName: redis-satusehat-data diff --git a/base/redis-pvc.yaml b/base/redis-pvc.yaml new file mode 100644 index 0000000..42d585c --- /dev/null +++ b/base/redis-pvc.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: redis-satusehat-data + labels: + app: redis-satusehat + app.kubernetes.io/name: redis-satusehat + app.kubernetes.io/component: cache + app.kubernetes.io/part-of: satusehat +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + storageClassName: nas-rx300 diff --git a/base/redis-service.yaml b/base/redis-service.yaml new file mode 100644 index 0000000..aaf64ba --- /dev/null +++ b/base/redis-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: redis-satusehat + labels: + app: redis-satusehat + app.kubernetes.io/name: redis-satusehat + app.kubernetes.io/component: cache + app.kubernetes.io/part-of: satusehat +spec: + selector: + app: redis-satusehat + ports: + - name: redis-satusehat + port: 6379 + targetPort: 6379 diff --git a/base/satusehat-service-deployment.yaml b/base/satusehat-service-deployment.yaml new file mode 100644 index 0000000..462dc43 --- /dev/null +++ b/base/satusehat-service-deployment.yaml @@ -0,0 +1,54 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: satusehat-service + labels: + app: satusehat-service + app.kubernetes.io/name: satusehat-service + app.kubernetes.io/component: api + app.kubernetes.io/part-of: satusehat +spec: + selector: + matchLabels: + app: satusehat-service + template: + metadata: + labels: + app: satusehat-service + app.kubernetes.io/name: satusehat-service + app.kubernetes.io/component: api + app.kubernetes.io/part-of: satusehat + spec: + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + containers: + - name: satusehat-service + image: git.rssa.top/ryan/satusehat-service:20260624092651-main + imagePullPolicy: Always + workingDir: /app + ports: + - name: http + containerPort: 8196 + - name: grpc + containerPort: 8197 + envFrom: + - configMapRef: + name: satusehat-service-env + volumeMounts: + - name: service-logs + mountPath: /app/logs + - name: service-tmp + mountPath: /tmp + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumes: + - name: service-logs + emptyDir: {} + - name: service-tmp + emptyDir: {} diff --git a/base/satusehat-service-probes.yaml b/base/satusehat-service-probes.yaml new file mode 100644 index 0000000..acc04ff --- /dev/null +++ b/base/satusehat-service-probes.yaml @@ -0,0 +1,73 @@ +# apiVersion: apps/v1 +# kind: Deployment +# metadata: +# name: satusehat-service +# spec: +# template: +# spec: +# containers: +# - name: satusehat-service +# startupProbe: +# httpGet: +# scheme: HTTP +# port: 8196 +# path: /health +# initialDelaySeconds: 5 +# periodSeconds: 10 +# timeoutSeconds: 10 +# failureThreshold: 30 +# successThreshold: 1 +# readinessProbe: +# httpGet: +# scheme: HTTP +# port: 8196 +# path: /ready +# initialDelaySeconds: 10 +# periodSeconds: 10 +# timeoutSeconds: 10 +# failureThreshold: 5 +# successThreshold: 1 +# livenessProbe: +# httpGet: +# scheme: HTTP +# port: 8196 +# path: /live +# initialDelaySeconds: 90 +# periodSeconds: 30 +# timeoutSeconds: 10 +# failureThreshold: 5 +# successThreshold: 1 + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: satusehat-service +spec: + template: + spec: + containers: + - name: satusehat-service + startupProbe: + tcpSocket: + port: 8196 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 2 + failureThreshold: 18 + successThreshold: 1 + readinessProbe: + tcpSocket: + port: 8196 + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 2 + failureThreshold: 3 + successThreshold: 1 + livenessProbe: + tcpSocket: + port: 8196 + initialDelaySeconds: 60 + periodSeconds: 30 + timeoutSeconds: 2 + failureThreshold: 3 + successThreshold: 1 \ No newline at end of file diff --git a/base/satusehat-service-resources.yaml b/base/satusehat-service-resources.yaml new file mode 100644 index 0000000..cdf578b --- /dev/null +++ b/base/satusehat-service-resources.yaml @@ -0,0 +1,17 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: satusehat-service +spec: + replicas: 2 + template: + spec: + containers: + - name: satusehat-service + resources: + requests: + cpu: 500m + memory: 512Mi + limits: + cpu: 2000m + memory: 2Gi diff --git a/base/satusehat-service-service.yaml b/base/satusehat-service-service.yaml new file mode 100644 index 0000000..febf7fd --- /dev/null +++ b/base/satusehat-service-service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: satusehat-service + labels: + app: satusehat-service + app.kubernetes.io/name: satusehat-service + app.kubernetes.io/component: api + app.kubernetes.io/part-of: satusehat +spec: + selector: + app: satusehat-service + ports: + - name: http + port: 80 + targetPort: 8196 + - name: grpc + port: 8197 + targetPort: 8197 diff --git a/base/satusehat-worker-data-pvc.yaml b/base/satusehat-worker-data-pvc.yaml new file mode 100644 index 0000000..692f5b1 --- /dev/null +++ b/base/satusehat-worker-data-pvc.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: satusehat-worker-data + labels: + app: satusehat-worker + app.kubernetes.io/name: satusehat-worker + app.kubernetes.io/component: worker + app.kubernetes.io/part-of: satusehat +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + storageClassName: nas-rx300 \ No newline at end of file diff --git a/base/satusehat-worker-deployment.yaml b/base/satusehat-worker-deployment.yaml new file mode 100644 index 0000000..ed4931a --- /dev/null +++ b/base/satusehat-worker-deployment.yaml @@ -0,0 +1,52 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: satusehat-worker + labels: + app: satusehat-worker + app.kubernetes.io/name: satusehat-worker + app.kubernetes.io/component: worker + app.kubernetes.io/part-of: satusehat +spec: + selector: + matchLabels: + app: satusehat-worker + template: + metadata: + labels: + app: satusehat-worker + app.kubernetes.io/name: satusehat-worker + app.kubernetes.io/component: worker + app.kubernetes.io/part-of: satusehat + spec: + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + containers: + - name: satusehat-worker + image: git.rssa.top/ryan/satusehat-worker:20260612104704-main + imagePullPolicy: Always + workingDir: /app + ports: + - name: http + containerPort: 8080 + envFrom: + - configMapRef: + name: satusehat-worker-env + volumeMounts: + - name: worker-logs + mountPath: /app/logs + - name: worker-tmp + mountPath: /tmp + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumes: + - name: worker-logs + emptyDir: {} + - name: worker-tmp + emptyDir: {} diff --git a/base/satusehat-worker-probes.yaml b/base/satusehat-worker-probes.yaml new file mode 100644 index 0000000..260acf7 --- /dev/null +++ b/base/satusehat-worker-probes.yaml @@ -0,0 +1,73 @@ +# apiVersion: apps/v1 +# kind: Deployment +# metadata: +# name: satusehat-worker +# spec: +# template: +# spec: +# containers: +# - name: satusehat-worker +# startupProbe: +# httpGet: +# scheme: HTTP +# port: 8080 +# path: /health +# initialDelaySeconds: 5 +# periodSeconds: 10 +# timeoutSeconds: 10 +# failureThreshold: 30 +# successThreshold: 1 +# readinessProbe: +# httpGet: +# scheme: HTTP +# port: 8080 +# path: /ready +# initialDelaySeconds: 10 +# periodSeconds: 10 +# timeoutSeconds: 10 +# failureThreshold: 5 +# successThreshold: 1 +# livenessProbe: +# httpGet: +# scheme: HTTP +# port: 8080 +# path: /live +# initialDelaySeconds: 90 +# periodSeconds: 30 +# timeoutSeconds: 10 +# failureThreshold: 5 +# successThreshold: 1 + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: satusehat-worker +spec: + template: + spec: + containers: + - name: satusehat-worker + startupProbe: + tcpSocket: + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 2 + failureThreshold: 18 + successThreshold: 1 + readinessProbe: + tcpSocket: + port: 8080 + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 2 + failureThreshold: 3 + successThreshold: 1 + livenessProbe: + tcpSocket: + port: 8080 + initialDelaySeconds: 60 + periodSeconds: 30 + timeoutSeconds: 2 + failureThreshold: 3 + successThreshold: 1 \ No newline at end of file diff --git a/base/satusehat-worker-resources.yaml b/base/satusehat-worker-resources.yaml new file mode 100644 index 0000000..0ab9aba --- /dev/null +++ b/base/satusehat-worker-resources.yaml @@ -0,0 +1,17 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: satusehat-worker +spec: + replicas: 1 + template: + spec: + containers: + - name: satusehat-worker + resources: + requests: + cpu: 500m + memory: 1Gi + limits: + cpu: 2000m + memory: 2Gi diff --git a/base/satusehat-worker-service.yaml b/base/satusehat-worker-service.yaml new file mode 100644 index 0000000..5bfeca8 --- /dev/null +++ b/base/satusehat-worker-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: satusehat-worker + labels: + app: satusehat-worker + app.kubernetes.io/name: satusehat-worker + app.kubernetes.io/component: worker + app.kubernetes.io/part-of: satusehat +spec: + selector: + app: satusehat-worker + ports: + - name: http + port: 80 + targetPort: 8080 diff --git a/fleet.yaml b/fleet.yaml new file mode 100644 index 0000000..2692400 --- /dev/null +++ b/fleet.yaml @@ -0,0 +1,2 @@ +kustomize: + dir: "" diff --git a/kustomization.yaml b/kustomization.yaml new file mode 100644 index 0000000..c41dc66 --- /dev/null +++ b/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +- overlays/prod diff --git a/overlays/prod/.env.redis.prod b/overlays/prod/.env.redis.prod new file mode 100644 index 0000000..3cd1208 --- /dev/null +++ b/overlays/prod/.env.redis.prod @@ -0,0 +1,5 @@ +# Redis production env, loaded as ConfigMap +# Generated from uploaded source env and sanitized for Kustomize configMapGenerator. +# Do not use // comments or plain text lines without KEY=VALUE in Kustomize env files. + +REDIS_PASSWORD=zahw@2904 diff --git a/overlays/prod/.env.service.prod b/overlays/prod/.env.service.prod new file mode 100644 index 0000000..2b1d321 --- /dev/null +++ b/overlays/prod/.env.service.prod @@ -0,0 +1,102 @@ +# SatuSehat Service production env, loaded as ConfigMap +# Generated from uploaded source env and sanitized for Kustomize configMapGenerator. +# Do not use // comments or plain text lines without KEY=VALUE in Kustomize env files. + +APP_ENV=production +GIN_MODE=release +LOGGER_LEVEL=info +LOGGER_FORMAT=text +SERVER_PORT=8196 +SERVER_REST_ENABLED=true +SERVER_REST_PORT=8196 +SERVER_GRPC_ENABLED=true +SERVER_GRPC_PORT=8197 +CACHE_REDIS_HOST=redis-satusehat-prod +CACHE_REDIS_PORT=6379 +REDIS_PASSWORD=zahw@2904 +AUTH_TYPE=hybrid +AUTH_STATIC_TOKENS=token5,token6,token7,token8 +AUTH_FALLBACK_TO=jwt +KEYCLOAK_CLIENT_ID=farmasi +KEYCLOAK_CLIENT_SECRET=6ttxZK76N8Q6eCk9BaxHiWOrIXECgNAz +KEYCLOAK_ISSUER=https://auth.rssa.top/realms/Dev +KEYCLOAK_URL=https://auth.rssa.top +KEYCLOAK_REALM=Dev +KEYCLOAK_AUDIENCE=farmasi +KEYCLOAK_JWKS_URL=https://auth.rssa.top/realms/Dev/protocol/openid-connect/certs +KEYCLOAK_ENABLED=true +POSTGRES_DEFAULT_HOST=10.10.123.198 +POSTGRES_DEFAULT_PORT=5100 +POSTGRES_DEFAULT_USERNAME=stim_farmasi_app +POSTGRES_DEFAULT_PASSWORD=mailadmin123 +POSTGRES_DEFAULT_DATABASE=db_farmasi +POSTGRES_DEFAULT_SSLMODE=disable +POSTGRES_DEFAULT_TIMEOUT=5s +POSTGRES_SIMRS_HOST=10.10.123.238 +POSTGRES_SIMRS_PORT=5432 +POSTGRES_SIMRS_USERNAME=brawijaya +POSTGRES_SIMRS_PASSWORD=ub*2025 +POSTGRES_SIMRS_DATABASE=simrs +POSTGRES_SIMRS_SSLMODE=disable +POSTGRES_SIMRS_TIMEOUT=5s +POSTGRES_SATUDATA_CONNECTION=postgres +POSTGRES_SATUDATA_HOST=10.10.123.165 +POSTGRES_SATUDATA_PORT=5000 +POSTGRES_SATUDATA_USERNAME=stim +POSTGRES_SATUDATA_PASSWORD=stim*RS54 +POSTGRES_SATUDATA_DATABASE=satu_db +POSTGRES_SATUDATA_SSLMODE=disable +POSTGRES_SATUDATA_TIMEOUT=5s +SQLSERVER_FARMASI_CONNECTION=sqlserver +SQLSERVER_FARMASI_USERNAME=komfar +SQLSERVER_FARMASI_PASSWORD=Komfar123 +SQLSERVER_FARMASI_HOST=10.10.90.232 +SQLSERVER_FARMASI_DATABASE=DBINV +SQLSERVER_FARMASI_PORT=1433 +SQLSERVER_FARMASI_SSLMODE=disable +SQLSERVER_FARMASI_TIMEOUT=5s +MYSQL_RIS_CONNECTION=mysql +MYSQL_RIS_USERNAME=admin +MYSQL_RIS_PASSWORD=R!suser>S3cured +MYSQL_RIS_HOST=10.10.123.141 +MYSQL_RIS_PORT=3306 +MYSQL_RIS_DATABASE=fk_radiology +MYSQL_RIS_TIMEOUT=5s +BPJS_ENABLED=true +BPJS_KDPPK=1323A036 +BPJS_CONSID=16041 +BPJS_SECRETKEY=8pP3D5431E +BPJS_BASEURL=https://apijkn-dev.bpjs-kesehatan.go.id +BPJS_SERVICE_NAME=vclaim-rest-dev +BPJS_APOTEK_CONSID=16061 +BPJS_APOTEK_SECRETKEY=5dP41F7EAE +BPJS_VCLAIM_USERKEY=467a2817fde5070f66c9a41fbeb8dc2c +BPJS_ANTROL_USERKEY=04a742fc834e0d3dc5b18913c8d46b90 +BPJS_IHS_USERKEY=dc36cb7e2fb9acacad3a4bc5c7423530 +BPJS_APOTEK_USERKEY=e4305670a51dcbd2b857e95c34ad588e +SATUSEHAT_ENABLED=true +SATUSEHAT_ORG_ID=100026555 +SATUSEHAT_FASYAKES_ID=3573011 +SATUSEHAT_CLIENT_ID=l1ZgJGW6K5pnrqGUikWM7fgIoquA2AQ5UUG0U8WqHaq2VEyZ +SATUSEHAT_CLIENT_SECRET=Al3PTYAW6axPiAFwaFlpn8qShLFW5YGMgG8w1qhexgCc7lGTEjjcR6zxa06ThPDy +SATUSEHAT_AUTH_URL=https://api-satusehat.kemkes.go.id/oauth2/v1 +SATUSEHAT_BASE_URL=https://api-satusehat.kemkes.go.id/fhir-r4/v1 +SATUSEHAT_CONSENT_URL=https://api-satusehat.kemkes.go.id/consent/v1 +SATUSEHAT_KFA_URL=https://api-satusehat.kemkes.go.id/kfa-v2 +SATUSEHAT_KYC_URL=https://api-satusehat.kemkes.go.id/kyc/v1 +SATUSEHAT_KYC_CHALLENGE_CODE_URL=https://api-satusehat.kemkes.go.id/kyc/v1/challenge-code +SATUSEHAT_WEBHOOK_SECRET=token_rahasia_webhook_anda_dari_portal_dto +SATUSEHAT_DICOM_URL=https://api-satusehat.kemkes.go.id/dicom/v1/dicomWeb/studies +KYC_PRIVATE_KEY_B64=LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBb01SNDFMVUxabWNiZURBRHVtN2UvQ2dWanRTc3ZNMmJrSHhsS1pwN0VQT2M1UGlICmprMW1MQTBsZ3BqNGg5RkxNY2VHbUZIcnk3QXFmdDlDUThPb0VsUy9HRUJIeFpmRTlndDhERTZxV0lEQW51VXAKeGJQVFVlNEFhVzBsTUZ5ZVF5eXZZaS9PdVR3VXJCN2M3Y1ZlYm0wTnBrREJ3RDJYRjhwdUFPTW1VeGFPdG9LdQpia2g1WWNVcVZ1enBYWStuTXFMK1FqMUF3UGJ3TlowREpyQlp3ejJYQ2EzU3k2bWtqaEJMV3JhZzFtc29oZUM3CmQ0S21oMDZEZ1JGeFBqMDJacVlGU2l2R1FXeWcvYlZ6bFBtSEpwYVMvem1HY0plcUdXTkg0VUMvQU81YThpNVgKbUo4UmJQVTBtVkxoZHpXcmZWNGFMVEVmLzlNQjRtTFc0VnMyTVFJREFRQUJBb0lCQUFXeWlzdnlmZFMvYUJHLwpoVjFOdlRNclhqNjNacWNEQkIybjYrdWdWdmJPQkdBWXR2Q2VDWFk3a2NvTjN1WnN6bFQxZXMyU2Z5aFMvaUdNCml0Z1ZFck55RzRyWjZkVTh4SUVaL1hlZjhORmx3RFhOWGloc2o5dFVJNEY0K2MrN3c0dlN4VVVsOTdYNHRTeVgKcENtY3hGVEdZbnpES0I2bWpDQ09wdXo2LzlaalRJOXBnN2VlMitEL0MxMjM0bTU1OWgvVVVBQjEzczduNytRbAo1MGpkcUE2WHpGZEM1Wlg1TUF3YkNNNU9kM0Y4TXdpM0EvVDlrazdtRTUwL0Z4cVRDQVhFZEUybFJZTnNsRUNBCnQ5d1NQUVNIQmw2OUg5L1Z4VS9oTk5oVkkzeUZMaHFKM0xBRk42b05UVU5VcTZFMzdvVE5ZUlBCbkJ3RkYvRysKRmF2VVA0RUNnWUVBMDdJTEF2MzNoUCsyMms0WHhyakQyMDI0NFJ4MFRJWjI3YXk3bEorT2lTemFtV1FzeGhFOApFN3YvTUpZTHF0T2hzU1VwYUxTZ04vQUxDWTJ1OXJ4WkNtM1JhM1EwZk9jNm5lbEZEUzhoVHJNZ3VVMFNaakgrCkJ2cXNpazM5Nm5uTHlVRFVKR3pITy85ekpxdW1uMHNkd2VsTGd0TFZkQnRGZWVqQnZTb2NJb0VDZ1lFQXdtbmYKRUxuS3pLWlkrZlNzNmptUGtiRWhZYnovWWFuUnFNbzVZK3F3MFN4T1dGVTIveVROOEpKMWh3MXBubytpNkNONQpqd255bTljNThNM3l3MmJkWnkxVmFwWmFJNTBoeE9ldGtYdmJsaGMyZExJVDRTcThzeENvaWM2elhnTi9IWU9rCkh2SExKc2J6YnE3S2d4Nmg3VWxUTjBXUGVHNk9yYnphRXhyajI3RUNnWUVBeGozb3lmaUNubTNKRWs0blBkVXcKdEdIb1RBYVZja1JKZ3ZGTENEY1RCNnFWV3lmUU5mdFZ3elUrR0lXcWoySjMvS2ZNUzEwNjNLZFI3clJic0h0WQo5c2M0WWVRRWN5TW1aVkpaYzZzN0NiUDlaUW1qdlVmN2x4V1FGa1JMRUJUV25iU3o5UmhZeXZyQkh1bUhzNHhvClpYclBWOGVRVkpabFRYQ0dYVnJkMWdFQ2dZRUF0enVoaWRvU1VaL1c3SDYzR21yMTdaTE1xNW05K1FaZEhJQzgKWm5lai93R0xOYVhiRjg1UWF4VWV3QkxjSVIydnBLc0t2czNaWXhnTysrNmZoNXREd1NMeEJteCt1R0k0bWFUaAo2ZVNhcVhOblY4VWZCM0dJT0J6VFBFOGNydGNNejN4ckN0OUpZVnJSeE5mbzludkFraXd4eWo0OVlueVE3UjY1ClNwaGxlWUVDZ1lCd25VQ2dOMnlwWUJ6V2FwaUpKRmwvcHBRS3ZQVjdPSmZHZVVESGgvZVlhWC9IaVlDY3N3LzkKU1IxMVVza1AwMGRSakt5UERtTG1Odlh5QmRaMDFJTHhOZmFpdXBxNkNWNFlXVThRdTFtb1lMYkc4ZHJjTEpVTApuL1pMY3hycitOS2FNUzZOSzZhSWpSd2FFeVhacWUzdEM5d20xWGdRcVcyYmdHV2E4eU5FL2c9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= +KYC_PUBLIC_KEY_B64=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFvTVI0MUxVTFptY2JlREFEdW03ZQovQ2dWanRTc3ZNMmJrSHhsS1pwN0VQT2M1UGlIamsxbUxBMGxncGo0aDlGTE1jZUdtRkhyeTdBcWZ0OUNROE9vCkVsUy9HRUJIeFpmRTlndDhERTZxV0lEQW51VXB4YlBUVWU0QWFXMGxNRnllUXl5dllpL091VHdVckI3YzdjVmUKYm0wTnBrREJ3RDJYRjhwdUFPTW1VeGFPdG9LdWJraDVZY1VxVnV6cFhZK25NcUwrUWoxQXdQYndOWjBESnJCWgp3ejJYQ2EzU3k2bWtqaEJMV3JhZzFtc29oZUM3ZDRLbWgwNkRnUkZ4UGowMlpxWUZTaXZHUVd5Zy9iVnpsUG1ICkpwYVMvem1HY0plcUdXTkg0VUMvQU81YThpNVhtSjhSYlBVMG1WTGhkeldyZlY0YUxURWYvOU1CNG1MVzRWczIKTVFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg== +SWAGGER_HOST=satusehat-service.rssa.id +CORS_ORIGINS=http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3005,http://meninjar.dev.rssa.id:8198,http://localhost:8080,http://localhost:5173,http://localhost:5174,http://10.10.123.143:3001 +CORS_ALLOW_ALL=false +MINIO_ENDPOINT=http://10.10.123.8:9000 +MINIO_ACCESSKEY=tiBiJQ88gd08rMjYl9Nw +MINIO_SECRETKEY=1YXkdicAJbizIJ4vIuEjQwT9kIesImByqTFyphvJ +MINIO_USESSL=false +MINIO_BUCKETNAME=dev-test +CACHE_ENABLED=true +SWAGGER_BASE_PATH=/api/v1 +SWAGGER_SCHEMES=https diff --git a/overlays/prod/.env.worker.prod b/overlays/prod/.env.worker.prod new file mode 100644 index 0000000..70650de --- /dev/null +++ b/overlays/prod/.env.worker.prod @@ -0,0 +1,97 @@ +# SatuSehat Worker production env, loaded as ConfigMap +# Generated from uploaded source env and sanitized for Kustomize configMapGenerator. +# Do not use // comments or plain text lines without KEY=VALUE in Kustomize env files. + +APP_ENV=production +GIN_MODE=release +LOGGER_LEVEL=info +LOGGER_FORMAT=text +SERVER_PORT=8080 +SATU_SEHAT_INTERNAL_FHIR_SERVER_URL=http://satusehat-service-prod/api/v1/ +AUTH_TYPE=hybrid +AUTH_STATIC_TOKENS=token5,token6,token7,token8 +AUTH_FALLBACK_TO=jwt +KEYCLOAK_CLIENT_ID=farmasi +KEYCLOAK_CLIENT_SECRET=6ttxZK76N8Q6eCk9BaxHiWOrIXECgNAz +KEYCLOAK_ISSUER=https://auth.rssa.top/realms/Dev +KEYCLOAK_URL=https://auth.rssa.top +KEYCLOAK_REALM=Dev +KEYCLOAK_AUDIENCE=farmasi +KEYCLOAK_JWKS_URL=https://auth.rssa.top/realms/Dev/protocol/openid-connect/certs +KEYCLOAK_ENABLED=true +POSTGRES_DEFAULT_HOST=10.10.123.198 +POSTGRES_DEFAULT_PORT=5100 +POSTGRES_DEFAULT_USERNAME=stim_farmasi_app +POSTGRES_DEFAULT_PASSWORD=mailadmin123 +POSTGRES_DEFAULT_DATABASE=db_farmasi +POSTGRES_DEFAULT_SSLMODE=disable +POSTGRES_DEFAULT_TIMEOUT=5s +POSTGRES_SIMRS_HOST=10.10.123.163 +POSTGRES_SIMRS_PORT=5432 +POSTGRES_SIMRS_USERNAME=simrs +POSTGRES_SIMRS_PASSWORD=simrs.rssa +POSTGRES_SIMRS_DATABASE=simrs +POSTGRES_SIMRS_SSLMODE=disable +POSTGRES_SIMRS_TIMEOUT=5s +POSTGRES_SATUDATA_CONNECTION=postgres +POSTGRES_SATUDATA_HOST=10.10.123.165 +POSTGRES_SATUDATA_PORT=5000 +POSTGRES_SATUDATA_USERNAME=stim +POSTGRES_SATUDATA_PASSWORD=stim*RS54 +POSTGRES_SATUDATA_DATABASE=satu_db +POSTGRES_SATUDATA_SSLMODE=disable +POSTGRES_SATUDATA_TIMEOUT=5s +SQLSERVER_FARMASI_CONNECTION=sqlserver +SQLSERVER_FARMASI_USERNAME=komfar +SQLSERVER_FARMASI_PASSWORD=Komfar123 +SQLSERVER_FARMASI_HOST=10.10.90.232 +SQLSERVER_FARMASI_DATABASE=DBINV +SQLSERVER_FARMASI_PORT=1433 +SQLSERVER_FARMASI_SSLMODE=disable +SQLSERVER_FARMASI_TIMEOUT=5s +MYSQL_RIS_CONNECTION=mysql +MYSQL_RIS_USERNAME=admin +MYSQL_RIS_PASSWORD=R!suser>S3cured +MYSQL_RIS_HOST=10.10.123.141 +MYSQL_RIS_PORT=3306 +MYSQL_RIS_DATABASE=fk_radiology +MYSQL_RIS_TIMEOUT=5s +SERVER_REST_ENABLED=true +SERVER_REST_PORT=8080 +SERVER_GRPC_ENABLED=false +SERVER_GRPC_PORT=8099 +CACHE_REDIS_HOST=redis-satusehat-prod +CACHE_REDIS_PORT=6379 +REDIS_PASSWORD=zahw@2904 +BPJS_ENABLED=true +BPJS_KDPPK=1323A036 +BPJS_CONSID=16041 +BPJS_SECRETKEY=8pP3D5431E +BPJS_BASEURL=https://apijkn-dev.bpjs-kesehatan.go.id +BPJS_SERVICE_NAME=vclaim-rest-dev +BPJS_APOTEK_CONSID=16061 +BPJS_APOTEK_SECRETKEY=5dP41F7EAE +BPJS_VCLAIM_USERKEY=467a2817fde5070f66c9a41fbeb8dc2c +BPJS_ANTROL_USERKEY=04a742fc834e0d3dc5b18913c8d46b90 +BPJS_IHS_USERKEY=dc36cb7e2fb9acacad3a4bc5c7423530 +BPJS_APOTEK_USERKEY=e4305670a51dcbd2b857e95c34ad588e +SATUSEHAT_ENABLED=true +SATUSEHAT_ORG_ID=100026555 +SATUSEHAT_FASYAKES_ID=3573011 +SATUSEHAT_CLIENT_ID=l1ZgJGW6K5pnrqGUikWM7fgIoquA2AQ5UUG0U8WqHaq2VEyZ +SATUSEHAT_CLIENT_SECRET=Al3PTYAW6axPiAFwaFlpn8qShLFW5YGMgG8w1qhexgCc7lGTEjjcR6zxa06ThPDy +SATUSEHAT_AUTH_URL=https://api-satusehat.kemkes.go.id/oauth2/v1 +SATUSEHAT_BASE_URL=https://api-satusehat.kemkes.go.id/fhir-r4/v1 +SATUSEHAT_CONSENT_URL=https://api-satusehat.dto.kemkes.go.id/consent/v1 +SATUSEHAT_KFA_URL=https://api-satusehat.kemkes.go.id/kfa-v2 +SWAGGER_HOST=satusehat-worker.rssa.id +CORS_ORIGINS=http://localhost:3000,http://localhost:3001,http://localhost:3002,http://localhost:3005,http://meninjar.dev.rssa.id:8093,http://localhost:8080,http://localhost:5173,http://localhost:5174,http://10.10.123.143:3001,http://10.10.123.147:8098 +CORS_ALLOW_ALL=false +MINIO_ENDPOINT=http://10.10.123.8:9000 +MINIO_ACCESSKEY=tiBiJQ88gd08rMjYl9Nw +MINIO_SECRETKEY=1YXkdicAJbizIJ4vIuEjQwT9kIesImByqTFyphvJ +MINIO_USESSL=false +MINIO_BUCKETNAME=dev-test +CACHE_ENABLED=true +SWAGGER_BASE_PATH=/api/v1 +SWAGGER_SCHEMES=https diff --git a/overlays/prod/certificate.yaml b/overlays/prod/certificate.yaml new file mode 100644 index 0000000..9ad9435 --- /dev/null +++ b/overlays/prod/certificate.yaml @@ -0,0 +1,12 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: satusehat-service-rssa-id +spec: + secretName: satusehat-service-rssa-id-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "satusehat-service.rssa.id" + dnsNames: + - "satusehat-service.rssa.id" diff --git a/overlays/prod/hpa-service.yaml b/overlays/prod/hpa-service.yaml new file mode 100644 index 0000000..3a30ac2 --- /dev/null +++ b/overlays/prod/hpa-service.yaml @@ -0,0 +1,12 @@ +apiVersion: autoscaling/v1 +kind: HorizontalPodAutoscaler +metadata: + name: satusehat-service +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: satusehat-service + minReplicas: 2 + maxReplicas: 5 + targetCPUUtilizationPercentage: 70 diff --git a/overlays/prod/hpa-worker.yaml b/overlays/prod/hpa-worker.yaml new file mode 100644 index 0000000..d0be972 --- /dev/null +++ b/overlays/prod/hpa-worker.yaml @@ -0,0 +1,12 @@ +apiVersion: autoscaling/v1 +kind: HorizontalPodAutoscaler +metadata: + name: satusehat-worker +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: satusehat-worker + minReplicas: 1 + maxReplicas: 1 + targetCPUUtilizationPercentage: 70 diff --git a/overlays/prod/ingress-route.yaml b/overlays/prod/ingress-route.yaml new file mode 100644 index 0000000..60c79a5 --- /dev/null +++ b/overlays/prod/ingress-route.yaml @@ -0,0 +1,35 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: satusehat-service-local + annotations: + kubernetes.io/ingress.class: traefik-internal +spec: + entryPoints: + - web + routes: + - kind: Rule + match: Host(`satusehat-service.rssa.id`) + services: + - name: satusehat-service-prod + port: 80 +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: satusehat-service + annotations: + kubernetes.io/ingress.class: traefik-external +spec: + entryPoints: + - websecure + routes: + - kind: Rule + match: Host(`satusehat-service.rssa.id`) + middlewares: + - name: default-headers + services: + - name: satusehat-service-prod + port: 80 + tls: + secretName: satusehat-service-rssa-id-tls diff --git a/overlays/prod/kustomization.yaml b/overlays/prod/kustomization.yaml new file mode 100644 index 0000000..feb76c7 --- /dev/null +++ b/overlays/prod/kustomization.yaml @@ -0,0 +1,36 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +- ../../base +- ingress-route.yaml +- certificate.yaml +- hpa-service.yaml +- hpa-worker.yaml + +namespace: rssa-apps-prod +nameSuffix: -prod +commonLabels: + environment: prod + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/part-of: satusehat + +images: +- name: git.rssa.top/ryan/satusehat-service + newTag: 20260624092651-main +- name: git.rssa.top/ryan/satusehat-worker + newTag: 20260612104704-main + +configMapGenerator: +- name: satusehat-service-env + envs: + - .env.service.prod +- name: satusehat-worker-env + envs: + - .env.worker.prod +- name: redis-env + envs: + - .env.redis.prod + +generatorOptions: + disableNameSuffixHash: true