CI/CD & Docker

name: Preview with Ngris
on: [pull_request]
jobs:
  preview:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build && npm start &
      - name: Install Ngris
        run: curl -fsSL https://ngris.com/install.sh | sh
      - name: Launch tunnel
        run: |
          ngris http 3000 \
            --url pr-${ github.event.number }.preview.ngris.com \
            --json &> tunnel.json
      - name: Post URL to PR
        env:
          GITHUB_TOKEN: ${ secrets.GITHUB_TOKEN }
        run: |
          URL=$(jq -r '.public_url' tunnel.json)
          gh pr comment ${ github.event.pull_request.url } --body "🚀 Preview: $URL"
      - name: Cleanup on failure
        if: failure()
        run: |
          TUNNEL_ID=$(jq -r '.tunnel_id' tunnel.json)
          ngris stop $TUNNEL_ID || true

# 1. Operator namespace + token Secret
kubectl create namespace ngris-operator-system

kubectl -n ngris-operator-system create secret generic ngris-operator-config \
  --from-literal=NGRIS_API="https://api.ngris.com" \
  --from-literal=NGRIS_TOKEN="$NGRIS_TOKEN" \
  --from-literal=NGRIS_SERVER="tunnel.ngris.io:443"

# 2. Helm install
helm install ngris-operator oci://ghcr.io/ngris/charts/ngris-operator \
  --namespace ngris-operator-system \
  --version 0.1.0

kubectl -n ngris-operator-system rollout status deploy/ngris-operator

apiVersion: ngris.io/v1alpha1
kind: Tunnel
metadata:
  name: hello-api
spec:
  serviceRef: { name: hello-api, port: 8080 }
  host: hello.example.com   # longest-suffix-match → parent NgrisDomain + subdomain
  protocol: http
  region: eu-north-1

apiVersion: ngris.io/v1alpha1
kind: TunnelMatrix
metadata: { name: hello-api }
spec:
  template:
    serviceRef: { name: hello-api, port: 8080 }
    protocol: http
    region: eu-north-1
  environments:
    - { name: dev,     host: hello-dev.example.com }
    - { name: staging, host: hello-staging.example.com }
    - { name: prod,    host: hello.example.com, region: us-east-1 }

apiVersion: ngris.io/v1alpha1
kind: NgrisTrafficPolicy
metadata: { name: anon-rate-limit }
spec:
  endpointRef: { name: hello-api }
  on_http_request:
    - type: rate-limit
      config: { requests_per_minute: 60, burst: 100, key: ip }
    - type: jwt-validation
      config: { jwks_url: "https://issuer/.well-known/jwks.json" }
  on_http_response:
    - type: add-headers
      config: { headers: { x-served-by: ngris } }
---
apiVersion: ngris.io/v1alpha1
kind: NgrisMTLSAttachment
metadata: { name: hello-api-mtls }
spec:
  endpointRef: { name: hello-api }
  mode: required
  caRefs: [{ name: internal-corp-ca }]

# docker-compose.yaml
version: '3.8'
services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
  tunnel:
    image: ghcr.io/ngris-edge/ngris:latest
    command: >
      sh -c "
      while ! nc -z app 3000; do
        echo 'Waiting for app to start...';
        sleep 2;
      done;
      ngris http app:3000 --url myapp.ngris.com --log-level debug
      "
    environment:
      - NGRIS_AUTHTOKEN=${NGRIS_AUTHTOKEN}
    depends_on:
      - app
    networks:
      - app-network

networks:
  app-network:
    driver: bridge

# Add the Ngris Helm repository
helm repo add ngris https://charts.ngris.com
helm repo update

# Install the agent with custom values
helm upgrade --install ngris-agent ngris/agent \
  --namespace ngris \
  --create-namespace \
  --set agent.authToken='your-auth-token' \
  --set agent.tunnels[0].type=http \
  --set agent.tunnels[0].addr=3000 \
  --set agent.tunnels[0].subdomain=myapp \
  --set agent.region=us-east \
  --set agent.logLevel=info

# k8s-ngris.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ngris-agent
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ngris-agent
  template:
    metadata:
      labels:
        app: ngris-agent
    spec:
      containers:
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        command: ["ngris", "start"]
        env:
        - name: NGRIS_AUTHTOKEN
          valueFrom:
            secretKeyRef:
              name: ngris-secrets
              key: auth-token
        - name: NGRIS_REGION
          value: "us-east"
        volumeMounts:
        - name: config
          mountPath: /etc/ngris
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: ngris-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ngris-config
data:
  ngris.yaml: |
    agent:
      region: us-east
    tunnels:
      - name: web-service
        type: http
        addr: web-service:8080
        url: prod-api
---
apiVersion: v1
kind: Secret
metadata:
  name: ngris-secrets
type: Opaque
data:
  auth-token: BASE64_ENCODED_TOKEN_HERE

# deployment-with-sidecar.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      initContainers:
      - name: wait-for-db
        image: busybox
        command: ['sh', '-c', 'until nc -z myapp-db 5432; do echo "Waiting for database..."; sleep 2; done;']
      containers:
      - name: myapp
        image: myorg/myapp:latest
        ports:
        - containerPort: 3000
          name: http
        env:
        - name: DATABASE_URL
          value: "postgresql://user:pass@myapp-db:5432/mydb"
        readinessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 10
          periodSeconds: 5
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        command:
        - sh
        - -c
        - |
          while ! wget -qO- http://localhost:3000/health >/dev/null 2>&1; do
            echo "Waiting for myapp to start..."
            sleep 2
          done
          ngris http 3000 \
            --url $(SUBDOMAIN).ngris.com \
            --name $(POD_NAME) \
            --log-level info
        env:
        - name: SUBDOMAIN
          value: myapp-${SHARD}
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: SHARD
          value: "prod"
        - name: NGRIS_AUTHTOKEN
          valueFrom:
            secretKeyRef:
              name: ngris-secrets
              key: auth-token
        resources:
          requests:
            memory: "64Mi"
            cpu: "100m"
          limits:
            memory: "128Mi"
            cpu: "200m"

# advanced-sidecar.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: ngris-config
data:
  ngris.yaml: |
    agent:
      region: us-east
      log_level: debug
      stats_server: true
      http_port: 9000
    tunnels:
      - name: primary
        type: http
        addr: 3000
        url: ${NGRIS_SUBDOMAIN}
        access:
          password: "${NGRIS_PASSWORD}"
        inspector:
          capture_bodies: true
      - name: admin
        type: http
        addr: 3001
        url: admin-${NGRIS_SUBDOMAIN}
        require_sso: true
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-advanced
spec:
  template:
    spec:
      containers:
      - name: myapp
        # ... application container config ...
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        command: ["ngris", "start", "--config", "/etc/ngris/ngris.yaml"]
        env:
        - name: NGRIS_SUBDOMAIN
          value: "myapp-prod"
        - name: NGRIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: myapp-secrets
              key: tunnel-password
        volumeMounts:
        - name: config
          mountPath: /etc/ngris
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: ngris-config