diff --git a/docs/pre-launch-checklist.md b/docs/pre-launch-checklist.md index 272f8ec..9da83f8 100644 --- a/docs/pre-launch-checklist.md +++ b/docs/pre-launch-checklist.md @@ -11,6 +11,7 @@ Use this checklist as the final go-live gate — run through every item the day - [ ] `zip-enrichment` pod `READY=1/1` (`kubectl get pods -n zip-enrichment`) - [ ] `holidays` pod `READY=1/1` (`kubectl get pods -n holidays`) - [ ] `air-quality` pod `READY=1/1` (`kubectl get pods -n air-quality`) + - [ ] `vin-decoder` pod `READY=1/1` (`kubectl get pods -n vin-decoder`) - [ ] `docs-site` pod Running and READY (`kubectl get pods -n docs-site`) - [ ] Prometheus scraping all three API services (check Prometheus Targets UI) - [ ] Grafana dashboard accessible at `grafana.leeworks.dev` @@ -25,8 +26,9 @@ Use this checklist as the final go-live gate — run through every item the day - [ ] `docs.leeworks.dev` → cluster ingress IP - [ ] `status.leeworks.dev` → cluster ingress IP - [ ] `registry.leeworks.dev` → cluster ingress IP +- [ ] `vin.leeworks.dev` → cluster ingress IP (`dig vin.leeworks.dev +short` + `curl -I https://vin.leeworks.dev`) - [ ] `grafana.leeworks.dev` → cluster ingress IP -- [ ] TLS certificates issued for all 7 subdomains (`kubectl get certificates -A`) +- [ ] TLS certificates issued for all 8 subdomains (`kubectl get certificates -A`) --- @@ -38,9 +40,12 @@ Use this checklist as the final go-live gate — run through every item the day - [ ] `GET /zip/{zip}` returns correct data for a sample ZIP code (e.g. `curl https://zip.leeworks.dev/zip/10001`) - [ ] `GET /holidays/{year}` returns correct data (e.g. `curl https://holidays.leeworks.dev/holidays/2026`) - [ ] `GET /aqi/{city}` returns correct data (e.g. `curl https://aqi.leeworks.dev/aqi/New%20York`) +- [ ] `GET /v1/health` returns HTTP 200 on **vin-decoder** (`curl https://vin.leeworks.dev/v1/health`) +- [ ] `GET /v1/decode?vin=1HGCM82633A004352` returns correct make/model/year data +- [ ] Request **without** `X-RapidAPI-Proxy-Secret` returns HTTP 403 on **vin-decoder** (`curl https://vin.leeworks.dev/v1/decode?vin=1HGCM82633A004352`) - [ ] Request **without** `X-RapidAPI-Proxy-Secret` returns HTTP 403 on all three APIs - [ ] `docs.leeworks.dev/pricing` loads correctly -- [ ] `status.leeworks.dev` shows all three APIs as **UP** +- [ ] `status.leeworks.dev` shows all **four** APIs as **UP** --- @@ -50,6 +55,8 @@ Use this checklist as the final go-live gate — run through every item the day - [ ] `docs/legal/privacy-policy.md` committed and reachable at `docs.leeworks.dev/legal/privacy-policy` - [ ] `docs/legal/acceptable-use-policy.md` committed and reachable at `docs.leeworks.dev/legal/acceptable-use-policy` - [ ] All three APIs listed on RapidAPI with **Free + 3 paid tiers** (leeworks-agents/api-company#44) +- [ ] VIN Decoder listed on RapidAPI with Free + 3 paid tiers (leeworks-agents/api-company#131) +- [ ] `rapidapi-proxy-secret` updated with real RapidAPI value in `vin-decoder` namespace (leeworks-agents/api-company#128) - [ ] PayPal linked to RapidAPI (leeworks-agents/api-company#19) - [ ] `rapidapi-proxy-secret` updated with **real** RapidAPI values in all 3 namespaces (leeworks-agents/api-company#81) diff --git a/docs/secrets-checklist.md b/docs/secrets-checklist.md index 7b6f2c1..997aa08 100644 --- a/docs/secrets-checklist.md +++ b/docs/secrets-checklist.md @@ -19,6 +19,9 @@ Follow this list top-to-bottom; each step unblocks the next. - [ ] 8. `gitea-registry` (zip-enrichment, holidays, air-quality, docs-site) — imagePullSecret for pods pulling from `registry.leeworks.dev` - [ ] 9. `gitea-image-automation-token` (flux-system) — write-scoped token for Flux ImageUpdateAutomation to push image-tag commits - [ ] 10. `rapidapi-proxy-secret` (zip-enrichment, holidays, air-quality) — RapidAPI Proxy Secret for server-side request validation +- [ ] 11. `GITEA_TOKEN` Actions secret in `leeworks-agents/vin-decoder` repo — enables CI image push for VIN Decoder (leeworks-agents/api-company#126) +- [ ] 12. `gitea-registry` imagePullSecret in `vin-decoder` namespace — enables pod image pulls from `registry.leeworks.dev` (leeworks-agents/api-company#127) +- [ ] 13. `rapidapi-proxy-secret` in `vin-decoder` namespace — enables RapidAPI proxy-secret header validation (leeworks-agents/api-company#128) --- @@ -194,6 +197,68 @@ done ``` +### 11. `GITEA_TOKEN` Actions secret in `leeworks-agents/vin-decoder` + +| Field | Value | +|----------|-------| +| Name | `GITEA_TOKEN` | +| Scope | Gitea Actions Secret — set in repo Settings | +| Purpose | CI workflow pushes container image to `registry.leeworks.dev/vin-decoder/api:` | +| Source | Gitea token with `write:packages` scope (reuse from item #5 if it has `write:packages`) | +| Tracked | leeworks-agents/api-company#126 | +| Unblocks | CI image push for VIN Decoder | + +Path: **Gitea → leeworks-agents/vin-decoder → Settings → Secrets → `GITEA_TOKEN`** + +--- + +### 12. `gitea-registry` imagePullSecret in `vin-decoder` namespace + +| Field | Value | +|-----------|-------| +| Name | `gitea-registry` | +| Namespace | `vin-decoder` | +| Type | `kubernetes.io/dockerconfigjson` | +| Purpose | Allows VIN Decoder pods to pull images from `registry.leeworks.dev` without ImagePullBackOff | +| Tracked | leeworks-agents/api-company#127 | + +```bash +kubectl create namespace vin-decoder --dry-run=client -o yaml | kubectl apply -f - +kubectl create secret docker-registry gitea-registry \ + --namespace=vin-decoder \ + --docker-server=registry.leeworks.dev \ + --docker-username=leeworks-agents \ + --docker-password= \ + --docker-email=agent@leeworks.dev +``` + +--- + +### 13. `rapidapi-proxy-secret` in `vin-decoder` namespace + +| Field | Value | +|-----------|-------| +| Name | `rapidapi-proxy-secret` | +| Namespace | `vin-decoder` | +| Purpose | VIN Decoder validates `X-RapidAPI-Proxy-Secret` header; returns HTTP 403 if missing/wrong | +| Source | RapidAPI dashboard → VIN Decoder listing → Settings → Security → Proxy Secret | +| Tracked | leeworks-agents/api-company#128 | + +```bash +# Placeholder (unblocks deploy testing): +kubectl create secret generic rapidapi-proxy-secret \ + --namespace=vin-decoder \ + --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING + +# Update with real value after RapidAPI listing (#131) is live: +kubectl create secret generic rapidapi-proxy-secret \ + -n vin-decoder \ + --from-literal=X-RapidAPI-Proxy-Secret= \ + --save-config --dry-run=client -o yaml | kubectl apply -f - +``` + +--- + ## Dependency Order ``` diff --git a/flux/image-automation/imagepolicies.yaml b/flux/image-automation/imagepolicies.yaml index 64ad196..e198804 100644 --- a/flux/image-automation/imagepolicies.yaml +++ b/flux/image-automation/imagepolicies.yaml @@ -40,6 +40,18 @@ spec: --- apiVersion: image.toolkit.fluxcd.io/v1beta2 kind: ImagePolicy +metadata: + name: vin-decoder + namespace: flux-system +spec: + imageRepositoryRef: + name: vin-decoder + policy: + semver: + range: ">=0.1.0" +--- +apiVersion: image.toolkit.fluxcd.io/v1beta2 +kind: ImagePolicy metadata: name: docs-site namespace: flux-system diff --git a/flux/image-automation/imagerepositories.yaml b/flux/image-automation/imagerepositories.yaml index f6bf4b4..3091c67 100644 --- a/flux/image-automation/imagerepositories.yaml +++ b/flux/image-automation/imagerepositories.yaml @@ -35,6 +35,17 @@ spec: --- apiVersion: image.toolkit.fluxcd.io/v1beta2 kind: ImageRepository +metadata: + name: vin-decoder + namespace: flux-system +spec: + image: registry.leeworks.dev/vin-decoder/api + interval: 5m + secretRef: + name: gitea-leeworks-agents-token +--- +apiVersion: image.toolkit.fluxcd.io/v1beta2 +kind: ImageRepository metadata: name: docs-site namespace: flux-system diff --git a/flux/monitoring/gatus-helmrelease.yaml b/flux/monitoring/gatus-helmrelease.yaml index 5692d05..544c7ac 100644 --- a/flux/monitoring/gatus-helmrelease.yaml +++ b/flux/monitoring/gatus-helmrelease.yaml @@ -68,6 +68,15 @@ spec: description: "Air Quality API is down" send-on-resolved: true + + - name: VIN Decoder API + url: https://vin.leeworks.dev/v1/health + interval: 1m + conditions: + - "[STATUS] == 200" + - "[RESPONSE_TIME] < 1000" + alerts: + - type: slack - name: Docs Site url: https://docs.leeworks.dev interval: 5m