ui/ntk.yaml at main · vllnt/ui · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# ntk.yaml — vllnt/ui deploy config (ntk CLI / vllnt platform deployer).
#
# Public repo: this file is declarative and PUBLIC-SAFE only.
#   - No secrets, tokens, or credentials (the deploy token is passed via the
#     NTK_TOKEN env at deploy time, never committed).
#   - No internal infra identifiers (registry host, tailnet IDs, node names, IPs).
#   - Secrets + per-env private vars are injected by the deployer from the
#     platform vault at deploy time — they are never declared here.
# Preview hostnames are tailnet-only and derived by the deployer per-PR; they
# are intentionally not declared in this file. See docs/specs/ntk.md.

project: ui                          # token-scope + allowlist key (granted server-side)

apps:
  # Component registry / docs site → ui.vllnt.ai
  - name: ui-registry
    cell: apps   # T1 (vllnt-apps) — prod promote MUST target the cell, else defaults to mgmt
    path: apps/registry
    paths:
      # Trigger-scope: rebuild the registry preview when ITS dir OR the shared
      # @vllnt/ui library changes (a packages/ui change is a registry change).
      # Without packages/ui here, a PR touching only packages/ui fell outside scope
      # → the deployer posted a fake-pass `ntk / preview` with no build (#452).
      - apps/registry
      - packages/ui
      - ntk.yaml
    port: 3000
    healthcheck: /
    domains:
      production: ui.vllnt.ai
    tls:
      # T1 cell (ADR-090e) has no shared *.vllnt.ai wildcard secret;
      # without this the renderer defaults to the absent
      # wildcard-vllnt-ai-tls and Traefik serves its default cert
      # (site DOWN — incident 2026-06-10). Per-host DNS-01 cert,
      # in-ns + auto-renewing.
      production:
        secretName: ui-registry-tls
    visibility:                      # previews are tailnet-only (hostname derived by deployer)
      production: public
      preview:    tailnet
    replicas:
      production: 1
      preview:    1
    resources:
      requests: { cpu: 100m, memory: 256Mi }
      limits:   { cpu: 1000m, memory: 1024Mi }
    env:
      production:
        SITE_URL: https://ui.vllnt.com
        NEXT_PUBLIC_SITE_URL: https://ui.vllnt.com
    build:
      dockerfile: Dockerfile         # repo-root Dockerfile builds @vllnt/ui-registry
      context: .
      args:
        # Registry inlines the storybook URL at build time (Next.js bakes
        # NEXT_PUBLIC_* during `next build`) so it can embed live component
        # previews. {url:storybook} is resolved per-env by the deployer:
        #   production → https://storybook.vllnt.ai
        #   preview    → the matching pr-<N> storybook (tailnet)
        # so a preview registry links to its own preview storybook. The tailnet
        # base stays in the deployer, never this public file. ntk.yaml token
        # reference: vllnt/infra docs/specs/ntk.md.
        NEXT_PUBLIC_STORYBOOK_URL: "{url:storybook}"
    e2e:
      # Promote gate: ntk runs this against the live preview URL before a prod
      # promote (blocks prod on failure). The registry ships a real Playwright
      # e2e suite (apps/registry/e2e); its playwright.config reads
      # PLAYWRIGHT_BASE_URL to target the deployed preview (and skip the local
      # dev server) so the gate tests the built artifact, not localhost.
      command: "PLAYWRIGHT_BASE_URL=$NTK_PREVIEW_URL pnpm --filter @vllnt/ui-registry test:e2e"

  # Component workshop → storybook.vllnt.ai
  - name: storybook
    cell: apps   # T1 (vllnt-apps) — prod promote MUST target the cell, else defaults to mgmt
    path: apps/storybook
    paths:
      # Rebuild the storybook preview on its dir OR a shared @vllnt/ui change
      # (storybook renders @vllnt/ui components, so packages/ui IS in scope).
      - apps/storybook
      - packages/ui
      - ntk.yaml
    port: 8080
    healthcheck: /healthz
    domains:
      production: storybook.vllnt.com
    tls:
      # T1 cell (ADR-090e) has no shared *.vllnt.ai wildcard secret;
      # without this the renderer defaults to the absent
      # wildcard-vllnt-ai-tls and Traefik serves its default cert
      # (site DOWN — incident 2026-06-10). Per-host DNS-01 cert,
      # in-ns + auto-renewing.
      production:
        secretName: storybook-vllnt-com-tls
    visibility:
      production: public
      preview:    tailnet
    replicas:
      production: 1
      preview:    1
    resources:
      requests: { cpu: 50m, memory: 64Mi }
      limits:   { cpu: 500m, memory: 256Mi }
    build:
      dockerfile: apps/storybook/Dockerfile
      context: .
    e2e:
      # Promote gate: ntk runs this against the live preview URL before a prod
      # promote (blocks prod on failure). storybook is a static nginx export of
      # packages/ui (no app-local test harness; its component/visual tests run in
      # CI via storybook.yml against a local static server, not the preview URL).
      # The honest preview-URL gate here is a smoke: the deployed instance must
      # serve its healthcheck AND the built Storybook index, proving the artifact
      # is live before authorizing prod.
      command: "curl -fsS \"$NTK_PREVIEW_URL/healthz\" && curl -fsS \"$NTK_PREVIEW_URL/\" >/dev/null"