From 8f19643bfb85001f078dbf5a78c90936a557b9cb Mon Sep 17 00:00:00 2001
From: rohow <admin@dev.cm>
Date: Wed, 26 Aug 2026 10:17:42 +0800
Subject: [PATCH] feat(k3s): add CN proxy for Fillcode

---
 flux/apps/deployment-fillcode-cn.yaml | 86 +++++++++++++++++++++++++++
 flux/apps/ingress-fillcode.yaml       | 22 -------
 flux/apps/kustomization.yaml          |  2 +-
 3 files changed, 87 insertions(+), 23 deletions(-)
 create mode 100644 flux/apps/deployment-fillcode-cn.yaml
 delete mode 100644 flux/apps/ingress-fillcode.yaml

diff --git a/flux/apps/deployment-fillcode-cn.yaml b/flux/apps/deployment-fillcode-cn.yaml
new file mode 100644
index 0000000..f058aed
--- /dev/null
+++ b/flux/apps/deployment-fillcode-cn.yaml
@@ -0,0 +1,86 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cn-fillcode-proxy
+  namespace: apps
+data:
+  default.conf: |
+    server {
+      listen 80;
+      server_name cn.fillcode.com;
+      return 308 https://cn.fillcode.com$request_uri;
+    }
+
+    server {
+      listen 443 ssl;
+      server_name cn.fillcode.com;
+
+      ssl_certificate /etc/nginx/tls/tls.crt;
+      ssl_certificate_key /etc/nginx/tls/tls.key;
+      ssl_protocols TLSv1.2 TLSv1.3;
+
+      resolver 169.254.20.10 10.43.0.10 valid=30s ipv6=off;
+
+      location / {
+        set $fillcode_origin https://fillcode.com;
+        proxy_pass $fillcode_origin$request_uri;
+        proxy_ssl_server_name on;
+        proxy_ssl_name fillcode.com;
+        proxy_set_header Host fillcode.com;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_redirect https://fillcode.com/ https://cn.fillcode.com/;
+      }
+    }
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cn-fillcode-proxy
+  namespace: apps
+spec:
+  replicas: 1
+  revisionHistoryLimit: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cn-fillcode-proxy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: cn-fillcode-proxy
+    spec:
+      automountServiceAccountToken: false
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      nodeSelector:
+        kubernetes.io/hostname: hwa
+      containers:
+        - name: nginx
+          image: docker.io/library/nginx:1.31.4-alpine
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+            - name: https
+              containerPort: 443
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /etc/nginx/conf.d
+              readOnly: true
+            - name: tls
+              mountPath: /etc/nginx/tls
+              readOnly: true
+      volumes:
+        - name: config
+          configMap:
+            name: cn-fillcode-proxy
+        - name: tls
+          secret:
+            secretName: fillcode-com-crt
diff --git a/flux/apps/ingress-fillcode.yaml b/flux/apps/ingress-fillcode.yaml
deleted file mode 100644
index cd1c630..0000000
--- a/flux/apps/ingress-fillcode.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: fillcode
-  namespace: apps
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: fillcode.com
-      http:
-        paths:
-          - path: /docs/fillcode
-            pathType: Prefix
-            backend:
-              service:
-                name: halo
-                port:
-                  number: 80
-  tls:
-    - hosts:
-        - fillcode.com
-      secretName: fillcode-com-crt
diff --git a/flux/apps/kustomization.yaml b/flux/apps/kustomization.yaml
index 4c4bd3d..15ef065 100644
--- a/flux/apps/kustomization.yaml
+++ b/flux/apps/kustomization.yaml
@@ -3,7 +3,7 @@ kind: Kustomization
 resources:
   - certificate-fillcode-com.yaml
   - certificate-sinceai-com.yaml
-  - ingress-fillcode.yaml
+  - deployment-fillcode-cn.yaml
   - ingress-halo-www.yaml
   - ingress-halo-static.yaml
   - ingress-sinceai-shop.yaml