CI/CD & Docker

name: Preview
on: pull_request
permissions:
  contents: read
  pull-requests: write        # lets the action comment the URL
jobs:
  preview:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - uses: ngris-edge/deploy-action@v1
        with:
          api-key: ${{ secrets.NGRIS_API_KEY }}
          build-command: npm ci && npm run build
          dir: dist

# 1. Operator namespace + token Secret
kubectl create namespace ngris-operator-system

kubectl -n ngris-operator-system create secret generic ngris-operator-config \
  --from-literal=NGRIS_API="https://api.ngris.com" \
  --from-literal=NGRIS_TOKEN="$NGRIS_TOKEN"

# 2. Helm install
helm install ngris-operator oci://ghcr.io/ngris-edge/charts/ngris-operator \
  --namespace ngris-operator-system \
  --version 0.1.0

kubectl -n ngris-operator-system rollout status deploy/ngris-operator

apiVersion: ngris.io/v1alpha1
kind: Tunnel
metadata:
  name: hello-api
spec:
  serviceRef: { name: hello-api, port: 8080 }
  host: hello.example.com   # longest-suffix-match → parent NgrisDomain + subdomain
  protocol: http
  region: eu-north-1

apiVersion: ngris.io/v1alpha1
kind: TunnelMatrix
metadata: { name: hello-api }
spec:
  template:
    serviceRef: { name: hello-api, port: 8080 }
    protocol: http
    region: eu-north-1
  environments:
    - { name: dev,     host: hello-dev.example.com }
    - { name: staging, host: hello-staging.example.com }
    - { name: prod,    host: hello.example.com, region: us-east-1 }

apiVersion: ngris.io/v1alpha1
kind: NgrisTrafficPolicy
metadata: { name: anon-rate-limit }
spec:
  endpointRef: { name: hello-api }
  on_http_request:
    - type: rate-limit
      config: { requests_per_minute: 60, burst: 100, key: ip }
    - type: jwt-validation
      config: { jwks_url: "https://issuer/.well-known/jwks.json" }
  on_http_response:
    - type: add-headers
      config: { headers: { x-served-by: ngris } }
---
apiVersion: ngris.io/v1alpha1
kind: NgrisMTLSAttachment
metadata: { name: hello-api-mtls }
spec:
  endpointRef: { name: hello-api }
  mode: required
  caRefs: [{ name: internal-corp-ca }]

# docker-compose.yaml
version: '3.8'
services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
  tunnel:
    image: ghcr.io/ngris-edge/ngris:latest
    command: >
      sh -c "
      while ! nc -z app 3000; do
        echo 'Waiting for app to start...';
        sleep 2;
      done;
      ngris http app:3000 --url myapp.ngris.com --log-level debug
      "
    environment:
      - NGRIS_AUTHTOKEN=${NGRIS_AUTHTOKEN}
    depends_on:
      - app
    networks:
      - app-network

networks:
  app-network:
    driver: bridge

# Install the ngris operator from GHCR — OCI, no `helm repo add` needed
helm install ngris-operator oci://ghcr.io/ngris-edge/charts/ngris-operator \
  --namespace ngris-operator-system --create-namespace \
  --version 0.1.0

# Configure the token Secret first (see the Operator setup above),
# then declare your tunnels/endpoints as CRDs:  kubectl apply -f tunnel.yaml

# k8s-ngris.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ngris-agent
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ngris-agent
  template:
    metadata:
      labels:
        app: ngris-agent
    spec:
      containers:
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        command: ["ngris", "start"]
        env:
        - name: NGRIS_AUTHTOKEN
          valueFrom:
            secretKeyRef:
              name: ngris-secrets
              key: auth-token
        - name: NGRIS_REGION
          value: "us-east"
        volumeMounts:
        - name: config
          mountPath: /etc/ngris
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: ngris-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ngris-config
data:
  ngris.yaml: |
    agent:
      region: us-east
    tunnels:
      - name: web-service
        type: http
        addr: web-service:8080
        url: prod-api
---
apiVersion: v1
kind: Secret
metadata:
  name: ngris-secrets
type: Opaque
data:
  auth-token: BASE64_ENCODED_TOKEN_HERE

# deployment-with-sidecar.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      initContainers:
      - name: wait-for-db
        image: busybox
        command: ['sh', '-c', 'until nc -z myapp-db 5432; do echo "Waiting for database..."; sleep 2; done;']
      containers:
      - name: myapp
        image: myorg/myapp:latest
        ports:
        - containerPort: 3000
          name: http
        env:
        - name: DATABASE_URL
          value: "postgresql://user:pass@myapp-db:5432/mydb"
        readinessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 10
          periodSeconds: 5
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        command:
        - sh
        - -c
        - |
          while ! wget -qO- http://localhost:3000/health >/dev/null 2>&1; do
            echo "Waiting for myapp to start..."
            sleep 2
          done
          ngris http 3000 \
            --url $(SUBDOMAIN).ngris.com \
            --name $(POD_NAME) \
            --log-level info
        env:
        - name: SUBDOMAIN
          value: myapp-${SHARD}
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: SHARD
          value: "prod"
        - name: NGRIS_AUTHTOKEN
          valueFrom:
            secretKeyRef:
              name: ngris-secrets
              key: auth-token
        resources:
          requests:
            memory: "64Mi"
            cpu: "100m"
          limits:
            memory: "128Mi"
            cpu: "200m"

# advanced-sidecar.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: ngris-config
data:
  ngris.yaml: |
    agent:
      region: us-east
      log_level: debug
      stats_server: true
      http_port: 9000
    tunnels:
      - name: primary
        type: http
        addr: 3000
        url: ${NGRIS_SUBDOMAIN}
        access:
          password: "${NGRIS_PASSWORD}"
        inspector:
          capture_bodies: true
      - name: admin
        type: http
        addr: 3001
        url: admin-${NGRIS_SUBDOMAIN}
        require_sso: true
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-advanced
spec:
  template:
    spec:
      containers:
      - name: myapp
        # ... application container config ...
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        command: ["ngris", "start", "--config", "/etc/ngris/ngris.yaml"]
        env:
        - name: NGRIS_SUBDOMAIN
          value: "myapp-prod"
        - name: NGRIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: myapp-secrets
              key: tunnel-password
        volumeMounts:
        - name: config
          mountPath: /etc/ngris
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: ngris-config