added mcpacks application to server packwiz pack.toml files. initial

apps/mcpacks/deployment.yaml

@@ -0,0 +1,83 @@
+# SWS (Static Web Server) serves an image containing only committed Packwiz
+# files. There is no writable volume to drift from Git and no database to back
+# up; publishing a new image is the complete deployment operation.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mcpacks
+  namespace: mcpacks
+spec:
+  # Two copies allow one Pod to keep serving Minecraft clients while the other
+  # is replaced during an image rollout or rescheduled after a node failure.
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: mcpacks
+  template:
+    metadata:
+      labels:
+        app: mcpacks
+    spec:
+      # SWS only reads files from its image and never calls the Kubernetes API,
+      # so do not inject the namespace's default API credential into its Pods.
+      automountServiceAccountToken: false
+      # Keep normal replica placement balanced across nodes. maxSkew 1 still
+      # permits one temporary surge Pod during a zero-downtime rollout; strict
+      # anti-affinity would deadlock that rollout when only two workers exist.
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: mcpacks
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: mcpacks
+          # The publishing workflow replaces this bootstrap tag with an
+          # immutable OCI digest. Never deploy the mutable latest tag after
+          # bootstrap: recording the digest makes rollbacks and audits reliable.
+          image: tea.ahmza.com/ahmza/mcpacks-site:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            # The upstream image does not declare USER itself. Set an explicit
+            # unprivileged identity so runAsNonRoot is enforceable rather than
+            # causing Kubernetes to reject the container as potentially root.
+            runAsUser: 10001
+            runAsGroup: 10001
+            capabilities:
+              drop:
+                - ALL
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 250m
+              memory: 64Mi

apps/mcpacks/ingress.yaml

@@ -0,0 +1,28 @@
+# Route the public Packwiz URLs through ingress-nginx's shared MetalLB address
+# (10.10.60.12). mc.ahmza.com already resolves to that address on the LAN.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mcpacks
+  namespace: mcpacks
+  annotations:
+    # Prove DNS-01 issuance with Let's Encrypt's untrusted staging service
+    # first. Change this to letsencrypt-prod only after the staging Certificate
+    # is Ready; production has strict rate limits for repeated mistakes.
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+spec:
+  tls:
+    - hosts:
+        - mc.ahmza.com
+      secretName: mcpacks-tls
+  rules:
+    - host: mc.ahmza.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: mcpacks
+                port:
+                  name: http

apps/mcpacks/namespace.yaml

@@ -0,0 +1,6 @@
+# Keep the pack-serving resources separate from applications with unrelated
+# lifecycles, permissions, and troubleshooting commands.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mcpacks

apps/mcpacks/service.yaml

@@ -0,0 +1,14 @@
+# A ClusterIP Service gives ingress-nginx a stable in-cluster destination even
+# while Deployment rollouts replace the individual Pods and their addresses.
+apiVersion: v1
+kind: Service
+metadata:
+  name: mcpacks
+  namespace: mcpacks
+spec:
+  selector:
+    app: mcpacks
+  ports:
+    - name: http
+      port: 80
+      targetPort: http