CI/CD & Docker

name: ngris
on:
  pull_request:
    types: [opened, synchronize, reopened, closed]   # closed: turns the PR's preview off
  push:
    branches: [main]                                 # your default branch: deploys to production
permissions:
  contents: read
  pull-requests: write        # lets the action comment the URL
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - uses: ngris-edge/deploy-action@v1
        with:
          api-key: ${{ secrets.NGRIS_API_KEY }}
          build-command: npm ci && npm run build
          dir: dist

# 1. Operator namespace + token Secret
kubectl create namespace ngris-operator-system

kubectl -n ngris-operator-system create secret generic ngris-operator-config \
  --from-literal=NGRIS_API="https://api.ngris.com" \
  --from-literal=NGRIS_TOKEN="$NGRIS_TOKEN"

# 2. Helm install
helm install ngris-operator oci://ghcr.io/ngris-edge/charts/ngris-operator \
  --namespace ngris-operator-system \
  --version 0.1.0

kubectl -n ngris-operator-system rollout status deploy/ngris-operator

apiVersion: ngris.io/v1alpha1
kind: Tunnel
metadata:
  name: hello-api
spec:
  serviceRef: { name: hello-api, port: 8080 }
  host: hello.example.com   # longest-suffix-match → parent NgrisDomain + subdomain
  protocol: http
  region: eu-fi

apiVersion: ngris.io/v1alpha1
kind: TunnelMatrix
metadata: { name: hello-api }
spec:
  template:
    serviceRef: { name: hello-api, port: 8080 }
    protocol: http
    region: eu-fi
  environments:
    - { name: dev,     host: hello-dev.example.com }
    - { name: staging, host: hello-staging.example.com }
    - { name: prod,    host: hello.example.com, region: us-va }

apiVersion: ngris.io/v1alpha1
kind: NgrisTrafficPolicy
metadata: { name: anon-rate-limit }
spec:
  endpointRef: { name: hello-api }
  on_http_request:
    - type: rate-limit
      config: { requests_per_minute: 60, burst: 100, key: ip }
    - type: jwt-validation
      config: { jwks_url: "https://issuer/.well-known/jwks.json" }
  on_http_response:
    - type: add-headers
      config: { headers: { x-served-by: ngris } }
---
apiVersion: ngris.io/v1alpha1
kind: NgrisMTLSAttachment
metadata: { name: hello-api-mtls }
spec:
  endpointRef: { name: hello-api }
  mode: required
  caRefs: [{ name: internal-corp-ca }]

# docker-compose.yaml
version: '3.8'
services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
    networks:
      - app-network
  tunnel:
    image: ghcr.io/ngris-edge/ngris:latest
    # The image's entrypoint is ngris: run the wait loop in a shell instead
    entrypoint: ["sh", "-c"]
    command:
      - |
        while ! nc -z app 3000; do
          echo 'Waiting for app to start...'
          sleep 2
        done
        exec ngris http app:3000 --url myapp.ngris.com
    environment:
      - API_TOKEN=${API_TOKEN}
      - AGENT_LOG_LEVEL=debug
    depends_on:
      - app
    networks:
      - app-network

networks:
  app-network:
    driver: bridge

# Install the ngris operator from GHCR — OCI, no `helm repo add` needed
helm install ngris-operator oci://ghcr.io/ngris-edge/charts/ngris-operator \
  --namespace ngris-operator-system --create-namespace \
  --version 0.1.0

# Configure the token Secret first (see the Operator setup above),
# then declare your tunnels/endpoints as CRDs:  kubectl apply -f tunnel.yaml

# k8s-ngris.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ngris-agent
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ngris-agent
  template:
    metadata:
      labels:
        app: ngris-agent
    spec:
      containers:
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        # The entrypoint is ngris: run the tunnel defined in the mounted config
        args: ["--config", "/etc/ngris/config.yaml"]
        env:
        - name: API_TOKEN
          valueFrom:
            secretKeyRef:
              name: ngris-secrets
              key: auth-token
        - name: AGENT_REGION
          value: "us-va"
        volumeMounts:
        - name: config
          mountPath: /etc/ngris
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: ngris-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ngris-config
data:
  config.yaml: |
    tunnel:
      type: http
      local_address: web-service:8080
      url: prod-api.ngris.com
      name: web-service
---
apiVersion: v1
kind: Secret
metadata:
  name: ngris-secrets
type: Opaque
data:
  auth-token: BASE64_ENCODED_TOKEN_HERE

# deployment-with-sidecar.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      initContainers:
      - name: wait-for-db
        image: busybox
        command: ['sh', '-c', 'until nc -z myapp-db 5432; do echo "Waiting for database..."; sleep 2; done;']
      containers:
      - name: myapp
        image: myorg/myapp:latest
        ports:
        - containerPort: 3000
          name: http
        env:
        - name: DATABASE_URL
          value: "postgresql://user:pass@myapp-db:5432/mydb"
        readinessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 10
          periodSeconds: 5
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        command:
        - sh
        - -c
        - |
          while ! wget -qO- http://localhost:3000/health >/dev/null 2>&1; do
            echo "Waiting for myapp to start..."
            sleep 2
          done
          ngris http 3000 \
            --url $(SUBDOMAIN).ngris.com \
            --name $(POD_NAME)
        env:
        - name: SUBDOMAIN
          value: myapp-${SHARD}
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: SHARD
          value: "prod"
        - name: API_TOKEN
          valueFrom:
            secretKeyRef:
              name: ngris-secrets
              key: auth-token
        - name: AGENT_LOG_LEVEL
          value: "info"
        resources:
          requests:
            memory: "64Mi"
            cpu: "100m"
          limits:
            memory: "128Mi"
            cpu: "200m"

# advanced-sidecar.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: ngris-config
data:
  config.yaml: |
    logging:
      level: debug
    observability:
      region: us-va
    tunnel:
      type: http
      local_address: localhost:3000
      url: myapp-prod.ngris.com
      name: primary
    traffic_policy:
      rate_limit: 100/1m
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-advanced
spec:
  selector:
    matchLabels:
      app: myapp-advanced
  template:
    metadata:
      labels:
        app: myapp-advanced
    spec:
      containers:
      - name: myapp
        # ... application container config ...
      - name: ngris
        image: ghcr.io/ngris-edge/ngris:latest
        # The entrypoint is ngris: run the tunnel defined in the mounted config.
        # Kubernetes fills in $(TUNNEL_PASSWORD) (8+ characters) from env.
        args: ["--config", "/etc/ngris/config.yaml",
               "--basic-auth", "admin:$(TUNNEL_PASSWORD)"]
        env:
        - name: API_TOKEN
          valueFrom:
            secretKeyRef:
              name: ngris-secrets
              key: auth-token
        - name: TUNNEL_PASSWORD
          valueFrom:
            secretKeyRef:
              name: myapp-secrets
              key: tunnel-password
        volumeMounts:
        - name: config
          mountPath: /etc/ngris
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: ngris-config