feat(zhishiku): publish financial HTTPS ingress

apps/ljwx-zhishiku/overlays/dev/ingress.yaml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ljwx-zhishiku-ingress
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 100m
+    nginx.ingress.kubernetes.io/proxy-read-timeout: '600'
+    nginx.ingress.kubernetes.io/proxy-send-timeout: '600'
+    nginx.ingress.kubernetes.io/proxy-buffering: 'off'
+    nginx.ingress.kubernetes.io/proxy-request-buffering: 'off'
+    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
+    cert-manager.io/cluster-issuer: cloudflare-letsencrypt
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: financial.omniverseai.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: simple-ima-web
+            port:
+              number: 8787
+  tls:
+  - hosts:
+    - financial.omniverseai.net
+    secretName: financial-omniverseai-net-tls

apps/ljwx-zhishiku/overlays/dev/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 namespace: ljwx-dify-dev
 resources:
 - ../../base
+- ingress.yaml
 images:
 - name: ghcr.io/lingjingwanxiang/ljwx-zhishiku/simple-ima-web
   newName: harbor.omniverseai.net/ljwx/ljwx-zhishiku-simple-ima-web

apps/ljwx-zhishiku/overlays/dev/runtime-contract/README.md

@@ -15,6 +15,15 @@
 - harbor_pull (namespace): Bind Harbor pull secret regcred to the namespace baseline.
 - runtime_app_secret (application): Standardize service-specific runtime secret as runtime-app.
 
+## Public endpoint
+
+- ingress profile: `nginx-cloudflare-public`
+- host: `https://financial.omniverseai.net`
+- ingress class: `nginx`
+- cluster issuer: `cloudflare-letsencrypt`
+- tls secret: `financial-omniverseai-net-tls`
+- ingress artifact generation: `enabled`
+
 ## Bootstrap commands
 
 ```bash

apps/ljwx-zhishiku/overlays/dev/runtime-contract/contract.yaml

@@ -2,12 +2,12 @@ service: ljwx-zhishiku
 environment: dev
 namespace: ljwx-dify-dev
 cluster_bootstrap: false
-ingress_profile: none
-public_host: ''
+ingress_profile: nginx-cloudflare-public
+public_host: financial.omniverseai.net
 generate_ingress: true
-ingress_class_name: ''
-cluster_issuer: ''
-tls_secret_name: ''
+ingress_class_name: nginx
+cluster_issuer: cloudflare-letsencrypt
+tls_secret_name: financial-omniverseai-net-tls
 namespace_profile: dev-default
 registry_profile: harbor-only
 runtime_secret_profile: none

factory/onboarding/ingress-profiles.yaml

@@ -9,6 +9,21 @@ profiles:
     path: /
     path_type: Prefix
     service_port: 80
+  nginx-cloudflare-public:
+    description: Publish a public HTTPS endpoint through nginx and Cloudflare DNS-01.
+    ingress_class_name: nginx
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+      nginx.ingress.kubernetes.io/proxy-buffering: "off"
+      nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    tls_enabled: true
+    cluster_issuer: cloudflare-letsencrypt
+    path: /
+    path_type: Prefix
+    service_port: 80
   traefik-letsencrypt-public:
     description: Publish a public HTTPS endpoint through Traefik and cert-manager.
     ingress_class_name: traefik

factory/onboarding/services.catalog.yaml

@@ -168,6 +168,11 @@ services:
   - local-k3s
   registry_profile: harbor-only
   runtime_secret_profile: none
+  ingress_profile: nginx-cloudflare-public
+  public_host: financial.omniverseai.net
+  generate_ingress: true
+  public_service_name: simple-ima-web
+  public_service_port: '8787'
   capabilities: []
   image_repo: simple-ima-web
   kustomize_image_name: ghcr.io/lingjingwanxiang/ljwx-zhishiku/simple-ima-web