Pull via registry.local, IngressClass nginx

.github/workflows/deploy.yml

@@ -0,0 +1,106 @@
+name: MT5 Helm GitOps Deploy
+
+on:
+  push:
+    branches: [ "main" ]
+    tags: [ "*" ]
+  workflow_dispatch:
+
+env:
+  # Gleiche Registry wie im boday_tf-Projekt, zwei Namen:
+  #   PUSH_REGISTRY: wie der Runner sie erreicht
+  #   PULL_REGISTRY: wie k3s/containerd sie erreicht (registries.yaml, CA unter certs.d)
+  PUSH_REGISTRY: localhost:3005
+  PULL_REGISTRY: registry.local
+  # Host-Header für Traefik-Ingress des Web-UI (leer = kein Ingress, kein Health-Check per HTTP)
+  INGRESS_HOST: mt5.local
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      # HINWEIS: Terraform-Binary kommt wie bei boday_tf über das globale Runner-Volume (:ro)
+
+      - name: Trust Local Nginx Certificate Inside Container
+        run: |
+          mkdir -p /usr/local/share/ca-certificates/
+          cp nginx_ssl/nginx.crt /usr/local/share/ca-certificates/nginx-sandbox.crt 2>/dev/null || echo "Nutze Workspace-Zertifikat"
+          update-ca-certificates
+
+      # Docker verlangt Image-Namen in Kleinbuchstaben – "MetaTrader5-Docker-Image" würde sonst scheitern
+      - name: Compute Image Name
+        run: |
+          IMAGE_PATH="$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
+          echo "IMAGE=${PUSH_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV"
+          echo "PULL_IMAGE=${PULL_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV"
+          echo "Push: ${PUSH_REGISTRY}/${IMAGE_PATH}"
+          echo "Pull: ${PULL_REGISTRY}/${IMAGE_PATH}"
+
+      - name: Log in to Local Registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${PUSH_REGISTRY} -u ${{ github.actor }} --password-stdin
+
+      # Ein Build, zwei Tags (das Image ist ~4 GB – doppelt bauen kostet unnötig Zeit)
+      - name: Build MT5 Image
+        run: |
+          docker build --platform linux/amd64 \
+            -t ${IMAGE}:${{ github.sha }} \
+            -t ${IMAGE}:latest \
+            .
+
+      - name: Push MT5 Image
+        run: |
+          docker push ${IMAGE}:${{ github.sha }}
+          docker push ${IMAGE}:latest
+
+      - name: Prepare Kubernetes Access
+        run: |
+          echo "${{ secrets.KUBECONFIG_DATA }}" > ./kind_kubeconfig
+          chmod 600 ./kind_kubeconfig
+
+      # Erster Rollout kann bis 15 Min dauern (Wine + MT5 Installation nach /config)
+      # init mit Retry, weil der DNS-Resolver sporadisch "server misbehaving" liefert
+      - name: Terraform Deploy
+        env:
+          TF_VAR_vnc_password: ${{ secrets.MT5_VNC_PASSWORD }}
+        run: |
+          terraform --version
+          for i in 1 2 3; do
+            terraform init && break
+            if [ "$i" = "3" ]; then echo "terraform init nach 3 Versuchen fehlgeschlagen"; exit 1; fi
+            echo "init fehlgeschlagen, Versuch $i – neuer Anlauf in 10s"
+            sleep 10
+          done
+          terraform apply -auto-approve \
+            -var="image_repository=${PULL_IMAGE}" \
+            -var="app_version=${{ github.sha }}" \
+            -var="vnc_user=${{ secrets.MT5_VNC_USER || 'trader' }}" \
+            -var="ingress_host=${INGRESS_HOST}"
+
+      # KasmVNC antwortet ohne Login mit 401 – daher mit Basic Auth prüfen und auf den Erststart warten
+      - name: Verify App Health
+        if: env.INGRESS_HOST != ''
+        env:
+          VNC_USER: ${{ secrets.MT5_VNC_USER || 'trader' }}
+          VNC_PASS: ${{ secrets.MT5_VNC_PASSWORD }}
+        run: |
+          for i in $(seq 1 40); do
+            CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 \
+              -u "${VNC_USER}:${VNC_PASS}" -H "Host: ${INGRESS_HOST}" \
+              http://local-k3s-platform:80/ || true)
+            echo "Versuch ${i}: HTTP ${CODE}"
+            if [ "${CODE}" = "200" ]; then
+              echo "Erfolg: MetaTrader 5 Web-UI läuft via Helm im GitOps-Standard!"
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "MT5 Web-UI nach 10 Minuten nicht erreichbar"
+          exit 1
+
+      - name: Cleanup Kubeconfig
+        if: always()
+        run: rm -f ./kind_kubeconfig

.github/workflows/docker-publish.yml

@@ -7,8 +7,11 @@ on:
   workflow_dispatch:
 
 env:
-  # Gleicher Registry-Prefix wie im boday_tf-Projekt
+  # Gleiche Registry wie im boday_tf-Projekt, zwei Namen:
-  REGISTRY: localhost:3005
+  #   PUSH_REGISTRY: wie der Runner sie erreicht
+  #   PULL_REGISTRY: wie k3s/containerd sie erreicht (registries.yaml, CA unter certs.d)
+  PUSH_REGISTRY: localhost:3005
+  PULL_REGISTRY: registry.local
   # Host-Header für Traefik-Ingress des Web-UI (leer = kein Ingress, kein Health-Check per HTTP)
   INGRESS_HOST: mt5.local
 
@@ -31,12 +34,14 @@ jobs:
       # Docker verlangt Image-Namen in Kleinbuchstaben – "MetaTrader5-Docker-Image" würde sonst scheitern
       - name: Compute Image Name
         run: |
-          IMAGE="${REGISTRY}/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
+          IMAGE_PATH="$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
-          echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
+          echo "IMAGE=${PUSH_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV"
-          echo "Image: ${IMAGE}"
+          echo "PULL_IMAGE=${PULL_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV"
+          echo "Push: ${PUSH_REGISTRY}/${IMAGE_PATH}"
+          echo "Pull: ${PULL_REGISTRY}/${IMAGE_PATH}"
 
       - name: Log in to Local Registry
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${REGISTRY} -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${PUSH_REGISTRY} -u ${{ github.actor }} --password-stdin
 
       # Ein Build, zwei Tags (das Image ist ~4 GB – doppelt bauen kostet unnötig Zeit)
       - name: Build MT5 Image
@@ -70,7 +75,7 @@ jobs:
             sleep 10
           done
           terraform apply -auto-approve \
-            -var="image_repository=${IMAGE}" \
+            -var="image_repository=${PULL_IMAGE}" \
             -var="app_version=${{ github.sha }}" \
             -var="vnc_user=${{ secrets.MT5_VNC_USER || 'trader' }}" \
             -var="ingress_host=${INGRESS_HOST}"

charts/mt5/values.yaml

@@ -27,9 +27,13 @@ service:
 # Nur das Web-UI wird über Ingress exponiert, RPyC bewusst nicht
 ingress:
   enabled: false
-  className: traefik   # k3s-Default
+  className: nginx
   host: ""
-  annotations: {}
+  # KasmVNC nutzt WebSockets – lange Timeouts, damit die Session nicht nach 60s abreißt
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
   tls: []
   #  - secretName: mt5-tls
   #    hosts: [mt5.example.ch]