fase 1

workloads/ecommerce/commerce/configmap.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: commerce-config
+data:
+  NODE_ENV: production
+  PORT: "9000"
+
+  STORE_CORS: https://shop.cruzcloud.net
+  ADMIN_CORS: https://commerce.cruzcloud.net
+  AUTH_CORS: https://commerce.cruzcloud.net,https://shop.cruzcloud.net
+
+  MEDUSA_BACKEND_URL: https://commerce.cruzcloud.net
+  STOREFRONT_URL: https://shop.cruzcloud.net
+  MEDUSA_WORKER_MODE: shared
+  DISABLE_MEDUSA_ADMIN: "false"
+
+  S3_FILE_URL: https://media.cruzcloud.net/ari-products
+  S3_ENDPOINT: http://minio-svc:9000
+  S3_REGION: us-east-1
+  S3_BUCKET: ari-products

workloads/ecommerce/commerce/ingress-commerce.yaml

@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: commerce-ingress
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: commerce.cruzcloud.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: medusa-svc
+                port:
+                  number: 9000
+
+    - host: media.cruzcloud.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: minio-svc
+                port:
+                  number: 9000

workloads/ecommerce/commerce/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - configmap.yaml
+  - postgres.yaml
+  - redis.yaml
+  - minio.yaml
+  - minio-bootstrap-job.yaml
+  - medusa.yaml
+  - ingress-commerce.yaml

workloads/ecommerce/commerce/medusa.yaml

@@ -0,0 +1,90 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: medusa-deploy
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: medusa
+  template:
+    metadata:
+      labels:
+        app: medusa
+    spec:
+      imagePullSecrets:
+        - name: gitea-registry-secret
+
+      initContainers:
+        - name: migrations
+          image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.0
+          imagePullPolicy: IfNotPresent
+          command:
+            - npx
+            - medusa
+            - db:migrate
+          envFrom:
+            - configMapRef:
+                name: commerce-config
+            - secretRef:
+                name: commerce-secrets
+          resources:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 768Mi
+
+      containers:
+        - name: medusa
+          image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.0
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: commerce-config
+            - secretRef:
+                name: commerce-secrets
+          ports:
+            - name: http
+              containerPort: 9000
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 18
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 150m
+              memory: 384Mi
+            limits:
+              cpu: 750m
+              memory: 1Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: medusa-svc
+spec:
+  selector:
+    app: medusa
+  ports:
+    - name: http
+      port: 9000
+      targetPort: 9000

workloads/ecommerce/commerce/minio-bootstrap-job.yaml

@@ -0,0 +1,54 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: commerce-minio-bootstrap
+spec:
+  backoffLimit: 12
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app: commerce-minio-bootstrap
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: configure
+          image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: MINIO_ROOT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: commerce-secrets
+                  key: MINIO_ROOT_USER
+            - name: MINIO_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: commerce-secrets
+                  key: MINIO_ROOT_PASSWORD
+          command:
+            - sh
+            - -c
+          args:
+            - |
+              set -eu
+
+              until mc alias set local \
+                http://minio-svc:9000 \
+                "$MINIO_ROOT_USER" \
+                "$MINIO_ROOT_PASSWORD"; do
+                echo "Esperando MinIO..."
+                sleep 5
+              done
+
+              mc mb --ignore-existing local/ari-products
+              mc anonymous set download local/ari-products
+
+              echo "Bucket ari-products creado y habilitado para lectura pública."
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi

workloads/ecommerce/commerce/minio.yaml

@@ -0,0 +1,92 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: minio-svc
+spec:
+  selector:
+    app: commerce-minio
+  ports:
+    - name: s3
+      port: 9000
+      targetPort: 9000
+    - name: console
+      port: 9001
+      targetPort: 9001
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: commerce-minio
+spec:
+  serviceName: minio-svc
+  replicas: 1
+  selector:
+    matchLabels:
+      app: commerce-minio
+  template:
+    metadata:
+      labels:
+        app: commerce-minio
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: minio
+          image: quay.io/minio/minio:RELEASE.2025-10-15T17-29-55Z
+          imagePullPolicy: IfNotPresent
+          args:
+            - server
+            - /data
+            - --console-address
+            - ":9001"
+          env:
+            - name: MINIO_ROOT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: commerce-secrets
+                  key: MINIO_ROOT_USER
+            - name: MINIO_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: commerce-secrets
+                  key: MINIO_ROOT_PASSWORD
+          ports:
+            - name: s3
+              containerPort: 9000
+            - name: console
+              containerPort: 9001
+          readinessProbe:
+            httpGet:
+              path: /minio/health/ready
+              port: s3
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 12
+          livenessProbe:
+            httpGet:
+              path: /minio/health/live
+              port: s3
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 768Mi
+          volumeMounts:
+            - name: minio-data
+              mountPath: /data
+  volumeClaimTemplates:
+    - metadata:
+        name: minio-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: local-path
+        resources:
+          requests:
+            storage: 20Gi

workloads/ecommerce/commerce/postgres.yaml

@@ -0,0 +1,94 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-svc
+spec:
+  clusterIP: None
+  selector:
+    app: commerce-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: commerce-postgres
+spec:
+  serviceName: postgres-svc
+  replicas: 1
+  selector:
+    matchLabels:
+      app: commerce-postgres
+  template:
+    metadata:
+      labels:
+        app: commerce-postgres
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: postgres
+          image: postgres:17.10-alpine3.24
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: postgres
+              containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: commerce-secrets
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: commerce-secrets
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: commerce-secrets
+                  key: POSTGRES_DB
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 768Mi
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: local-path
+        resources:
+          requests:
+            storage: 10Gi

workloads/ecommerce/commerce/redis.yaml

@@ -0,0 +1,91 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-svc
+spec:
+  clusterIP: None
+  selector:
+    app: commerce-redis
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: 6379
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: commerce-redis
+spec:
+  serviceName: redis-svc
+  replicas: 1
+  selector:
+    matchLabels:
+      app: commerce-redis
+  template:
+    metadata:
+      labels:
+        app: commerce-redis
+    spec:
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: redis
+          image: redis:7.4-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+          args:
+            - >
+              exec redis-server
+              --appendonly yes
+              --appendfsync everysec
+              --requirepass "$REDIS_PASSWORD"
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: commerce-secrets
+                  key: REDIS_PASSWORD
+          ports:
+            - name: redis
+              containerPort: 6379
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - redis-cli -a "$REDIS_PASSWORD" ping | grep PONG
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - redis-cli -a "$REDIS_PASSWORD" ping | grep PONG
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+  volumeClaimTemplates:
+    - metadata:
+        name: redis-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: local-path
+        resources:
+          requests:
+            storage: 1Gi

workloads/ecommerce/commerce/secrets.template.yaml

@@ -0,0 +1,32 @@
+# NO agregar este archivo al kustomization ni subir valores reales a Gitea.
+# Utiliza scripts/create-commerce-secrets.sh o reemplázalo por Sealed Secrets.
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: commerce-secrets
+type: Opaque
+stringData:
+  POSTGRES_USER: medusa
+  POSTGRES_PASSWORD: CAMBIAR
+  POSTGRES_DB: medusa
+  DATABASE_URL: postgresql://medusa:CAMBIAR@postgres-svc:5432/medusa
+
+  REDIS_PASSWORD: CAMBIAR
+  REDIS_URL: redis://:CAMBIAR@redis-svc:6379
+
+  MINIO_ROOT_USER: ari-minio
+  MINIO_ROOT_PASSWORD: CAMBIAR
+  S3_ACCESS_KEY_ID: ari-minio
+  S3_SECRET_ACCESS_KEY: CAMBIAR
+
+  JWT_SECRET: CAMBIAR
+  COOKIE_SECRET: CAMBIAR
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: commerce-storefront
+type: Opaque
+stringData:
+  MEDUSA_PUBLISHABLE_KEY: pk_CAMBIAR_DESPUES_DE_CREARLA_EN_MEDUSA