chore(deps): update node.js to v24.22.0 (#1020)

.gitea/workflows/ci.yaml

@@ -83,30 +83,16 @@ jobs:
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod-frostmoln:
+  deploy-prod:
     needs: build
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
-      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
       - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Install fm
-        run: |
-          sudo install -d -m 0755 /etc/apt/keyrings
-          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
-          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
-          sudo apt-get update && sudo apt-get install -y fm
-      - name: Deploy to Frostmoln production
-        env:
-          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
-        # The cluster API is private: the kubeconfig's exec plugin opens an fm
-        # tunnel on demand. fm reads the key from its config file, not the env.
-        run: |
-          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
-          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
-          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n schemas
+      - name: Deploy to production
+        run: deploy prod

Dockerfile

@@ -24,7 +24,7 @@ RUN GOOS=linux GOARCH=amd64 go build \
 FROM scratch as export
 COPY --from=build /build/coverage.txt /
 
-FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1
+FROM node:24.22.0-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f
 ENV TZ Europe/Stockholm
 
 # Install wgc CLI globally for Cosmo Router composition
@@ -42,8 +42,4 @@ COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 # Copy the service binary
 COPY --from=build /release/service /
 
-# The image's own non-root user: Frostmoln enforces restricted Pod Security.
-# The service only writes under /tmp (cosmo composition).
-USER node
-
 CMD ["/service"]

k8s/deploy.yaml

@@ -26,11 +26,6 @@ spec:
       labels:
         app.kubernetes.io/name: schemas
     spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -45,10 +40,6 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: schemas
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop: ["ALL"]
         resources:
           requests:
             cpu: "100m"

k8s/ingress-prod-frostmoln.yaml

@@ -1,20 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: schemas
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
-spec:
-  ingressClassName: traefik
-  rules:
-  - host: "schemas.unbound.se"
-    http:
-      paths:
-      - path: /query
-        pathType: Prefix
-        backend:
-          service:
-            name: schemas
-            port:
-              name: api

k8s/ingress-prod.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: schemas-ingress
+  annotations:
+    alb.ingress.kubernetes.io/group.name: "default"
+    alb.ingress.kubernetes.io/scheme: internet-facing
+    alb.ingress.kubernetes.io/target-type: instance
+    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
+    alb.ingress.kubernetes.io/ssl-redirect: "443"
+    alb.ingress.kubernetes.io/healthcheck-path: '/health'
+spec:
+  ingressClassName: "alb"
+  rules:
+  - host: "schemas.unbound.se"
+    http:
+      paths:
+      - path: /query
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: schemas
+            port:
+              name: api

k8s/secrets-prod-frostmoln.yaml

@@ -1,17 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: schemas
-spec:
-  refreshInterval: 1h
-  # The namespace's store (infra frostmoln/production/schemas.tf); the
-  # Frostmoln Secret holds POSTGRES_URL, AMQP_URL and API_KEY
-  # (infra frostmoln/production/scripts/seed-schemas.sh).
-  secretStoreRef:
-    name: frostmoln
-    kind: SecretStore
-  target:
-    name: schemas
-  dataFrom:
-  - extract:
-      key: schemas

k8s/secrets.yaml

@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: schemas
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: external-secrets
+    kind: ClusterSecretStore
+  target:
+    creationPolicy: Owner
+    template:
+      mergePolicy: Merge
+      engineVersion: 'v2'
+      data:
+        POSTGRES_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_HOST }}:{{ .DB_PORT }}/schemas?sslmode=disable"
+        API_KEY: "{{ .API_KEY }}"
+  dataFrom:
+  - extract:
+      key: services/schemas
+  - extract:
+      key: rds/postgres/prod-psql
+  - extract:
+      key: mq/rabbit/prod