test local dns

Author: Mateus Medeiros

src/host/WriteFluency.AppHost/aspirate-overlays/coredns-rewrite.yaml

@@ -0,0 +1,40 @@
+---
+# CoreDNS ConfigMap patch to rewrite external API hostname to internal Kubernetes service
+# This solves the Angular SSR + hydration duplicate HTTP request issue by:
+# 1. SSR pod and browser both use the same external URL (api.writefluency.com)
+# 2. Inside the cluster, CoreDNS rewrites api.writefluency.com -> wf-api.writefluency.svc.cluster.local
+# 3. This avoids hairpin NAT timeouts and ensures Angular transfer cache works correctly
+#
+# Apply with: kubectl apply -f coredns-rewrite.yaml
+# Then restart CoreDNS: kubectl -n kube-system rollout restart deployment coredns
+#
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system
+data:
+  Corefile: |
+    .:53 {
+        errors
+        health {
+            lameduck 5s
+        }
+        ready
+        # Rewrite external API hostname to internal service for in-cluster requests
+        # This enables SSR and browser to use the same URL while avoiding hairpin NAT
+        rewrite name api.writefluency.com wf-api.writefluency.svc.cluster.local
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+            pods insecure
+            fallthrough in-addr.arpa ip6.arpa
+            ttl 30
+        }
+        prometheus :9153
+        forward . /etc/resolv.conf {
+            max_concurrent 1000
+        }
+        cache 30
+        loop
+        reload
+        loadbalance
+    }

src/host/WriteFluency.AppHost/deploy-k8s.sh

@@ -4,6 +4,9 @@ set -e
 
 KUBE_CONTEXT=$1
 
+# Create cert-manager namespace first (required before applying cert-manager resources)
+kubectl create namespace cert-manager --dry-run=client -o yaml | kubectl apply -f -
+
 ./generate-k8s-secret.sh
 
 kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml
@@ -13,5 +16,15 @@ kubectl rollout status deployment cert-manager -n cert-manager --timeout=120s
 kubectl rollout status deployment cert-manager-webhook -n cert-manager --timeout=120s
 kubectl rollout status deployment cert-manager-cainjector -n cert-manager --timeout=120s
 
+# Apply CoreDNS rewrite configuration to resolve external API URL to internal service
+# This prevents duplicate HTTP requests in Angular SSR by ensuring both SSR and browser use the same URL
+echo "🔧 Applying CoreDNS rewrite configuration..."
+kubectl apply -f ./aspirate-overlays/coredns-rewrite.yaml
+
+echo "🔄 Restarting CoreDNS to apply configuration..."
+kubectl -n kube-system rollout restart deployment coredns
+kubectl -n kube-system rollout status deployment coredns --timeout=60s
+
+echo "✅ CoreDNS configuration applied successfully"
 
 aspirate apply -i ./aspirate-overlays --non-interactive --kube-context "$KUBE_CONTEXT"

src/host/WriteFluency.AppHost/generate-k8s-secret.sh

@@ -21,15 +21,8 @@ if [ "$GITHUB_ACTIONS" = "true" ]; then
   propositions_daily_requests_limit="${Propositions__DailyRequestsLimit}"
   propositions_limit_per_topic="${Propositions__LimitPerTopic}"
   propositions_news_request_limit="${Propositions__NewsRequestLimit}"
-
-  # Create image pull secret for GHCR
-  echo "🔑 Creating GHCR image pull secret..."
-  kubectl create secret docker-registry ghcr-secret \
-    --docker-server=ghcr.io \
-    --docker-username="${GHCR_USERNAME}" \
-    --docker-password="${GHCR_TOKEN}" \
-    --namespace=writefluency \
-    --dry-run=client -o yaml | kubectl apply -f -
+  ghcr_username="${GHCR_USERNAME}"
+  ghcr_token="${GHCR_TOKEN}"
 
 else
   echo "🔐 Running locally — using .NET user secrets"
@@ -48,8 +41,19 @@ else
   propositions_daily_requests_limit=$(jq -r '.["Propositions:DailyRequestsLimit"]' "$USER_SECRETS")
   propositions_limit_per_topic=$(jq -r '.["Propositions:LimitPerTopic"]' "$USER_SECRETS")
   propositions_news_request_limit=$(jq -r '.["Propositions:NewsRequestLimit"]' "$USER_SECRETS")
+  ghcr_username=$(jq -r '.["GHCR_USERNAME"]' "$USER_SECRETS")
+  ghcr_token=$(jq -r '.["GHCR_TOKEN"]' "$USER_SECRETS")
 fi
 
+# Create image pull secret for GHCR
+echo "🔑 Creating GHCR image pull secret..."
+kubectl create secret docker-registry ghcr-secret \
+  --docker-server=ghcr.io \
+  --docker-username="${ghcr_username}" \
+  --docker-password="${ghcr_token}" \
+  --namespace=writefluency \
+  --dry-run=client -o yaml | kubectl apply -f -
+
 kubectl apply -f - <<EOF
 apiVersion: v1
 kind: Secret

src/webapp/src/app/app.config.server.ts

@@ -2,22 +2,15 @@ import { mergeApplicationConfig, ApplicationConfig } from '@angular/core';
 import { provideServerRendering, withRoutes } from '@angular/ssr';
 import { appConfig } from './app.config';
 import { serverRoutes } from './app.routes.server';
-import { provideApi } from 'src/api/listen-and-write/provide-api';
-import { environment } from '../enviroments/enviroment';
 
-// Server-side API URL - uses Aspire service discovery in Kubernetes
-// Aspire sets: services__wf-api__http__0=http://wf-api:8080
-// Falls back to build-time environment for local development
-const aspireApiUrl = process.env['services__wf-api__http__0'];
-const serverApiUrl = aspireApiUrl || environment.apiUrl;
-
-console.log(`[SSR] Using API URL: ${serverApiUrl}`);
+// SSR now uses the same external API URL as the browser (from environment)
+// CoreDNS rewrite rule in Kubernetes will resolve api.writefluency.com to internal service
+// This ensures Angular transfer cache works correctly (no duplicate HTTP requests)
 
 const serverConfig: ApplicationConfig = {
   providers: [
-    provideServerRendering(withRoutes(serverRoutes)),
-    // Override the API URL for server-side rendering
-    provideApi(serverApiUrl)
+    provideServerRendering(withRoutes(serverRoutes))
+    // No API URL override - uses the same provideApi from appConfig
   ]
 };
 

src/webapp/src/server.ts

@@ -10,12 +10,9 @@ import { environment } from './enviroments/enviroment';
 
 const browserDistFolder = join(import.meta.dirname, '../browser');
 
-// Use Aspire service discovery environment variables for SSR
-// Aspire sets: services__wf-api__http__0=http://wf-api:8080
-// In Kubernetes: Uses Aspire service discovery
-// In local dev: Falls back to environment.apiUrl
-const aspireApiUrl = process.env['services__wf-api__http__0'];
-const apiUrl = aspireApiUrl || environment.apiUrl;
+// Server now uses the same external API URL as the browser
+// CoreDNS rewrite in k8s resolves api.writefluency.com to wf-api service internally
+const apiUrl = environment.apiUrl;
 
 console.log(`[Server] Using API URL: ${apiUrl}`);