Rename inference endpoint to neuron.neurontechnologies.ai, add wildcard DNS for customer orgs

servers/gcp/cloud-run-soma.tf

@@ -313,10 +313,14 @@ resource "google_compute_backend_service" "soma" {
 # ── SSL Certificate ───────────────────────────────────────────────────────────
 
 resource "google_compute_managed_ssl_certificate" "soma" {
-  name    = "soma-cert-prod"
+  name    = "soma-cert-prod-v2"
   project = var.project_id
 
   managed {
-    domains = ["ai.neurontechnologies.ai"]
+    domains = ["neuron.neurontechnologies.ai"]
+  }
+
+  lifecycle {
+    create_before_destroy = true
   }
 }

servers/gcp/dns-gcp.tf

@@ -5,11 +5,24 @@
 # Cloudflare provider reads CLOUDFLARE_API_TOKEN from env.
 # Zone ID for neurontechnologies.ai is set in terraform.tfvars.
 
-# ── ai.neurontechnologies.ai → Soma inference gateway ────────────────────────
+# ── neuron.neurontechnologies.ai → Soma inference gateway ────────────────────
 
-resource "cloudflare_record" "soma_ai" {
+resource "cloudflare_record" "soma_neuron" {
   zone_id = var.cloudflare_zone_id_neurontechnologies
-  name    = "ai"
+  name    = "neuron"
+  type    = "A"
+  content = google_compute_global_address.prod.address
+  proxied = true
+  ttl     = 1
+}
+
+# ── *.neurontechnologies.ai → Customer org subdomains ────────────────────────
+# Enterprise customers get {org}.neurontechnologies.ai routed to soma.
+# Soma reads the Host header to identify the tenant.
+
+resource "cloudflare_record" "soma_wildcard" {
+  zone_id = var.cloudflare_zone_id_neurontechnologies
+  name    = "*"
   type    = "A"
   content = google_compute_global_address.prod.address
   proxied = true

servers/gcp/load-balancer.tf

@@ -206,7 +206,7 @@ resource "google_compute_url_map" "prod" {
   }
 
   host_rule {
-    hosts        = ["ai.neurontechnologies.ai"]
+    hosts        = ["neuron.neurontechnologies.ai", "*.neurontechnologies.ai"]
     path_matcher = "soma"
   }
 

servers/gcp/terraform.tfvars

@@ -1 +1,3 @@
 cloudflare_zone_id_neurontechnologies = "e844374f203dca4944d77d40ca0710ae"
+cloudflare_api_key = "007bbefe03eac0e502c339423c50dd911776a"
+cloudflare_email   = "andersonwilliam85@gmail.com"

servers/legion/k8s/neuron-technologies/dev/externalsecret.yaml

@@ -16,3 +16,7 @@ spec:
       remoteRef:
         key: secret/data/neuron-technologies/dev
         property: gitea_webhook_secret
+    - secretKey: MARKETPLACE_DB_PASSWORD
+      remoteRef:
+        key: secret/data/legion-db
+        property: postgres_password

servers/legion/k8s/neuron-technologies/stage/externalsecret.yaml

@@ -16,3 +16,7 @@ spec:
       remoteRef:
         key: secret/data/neuron-technologies/stage
         property: gitea_webhook_secret
+    - secretKey: MARKETPLACE_DB_PASSWORD
+      remoteRef:
+        key: secret/data/legion-db
+        property: postgres_password

servers/legion/k8s/neuron-technologies/swarm/externalsecrets.yaml

@@ -51,6 +51,10 @@ spec:
       remoteRef:
         key: secret/data/r2
         property: neuron_bucket
+    - secretKey: MARKETPLACE_DB_PASSWORD
+      remoteRef:
+        key: secret/data/legion-db
+        property: postgres_password
 ---
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
@@ -102,6 +106,10 @@ spec:
       remoteRef:
         key: secret/data/r2
         property: neuron_bucket
+    - secretKey: MARKETPLACE_DB_PASSWORD
+      remoteRef:
+        key: secret/data/legion-db
+        property: postgres_password
 ---
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
@@ -153,3 +161,7 @@ spec:
       remoteRef:
         key: secret/data/r2
         property: neuron_bucket
+    - secretKey: MARKETPLACE_DB_PASSWORD
+      remoteRef:
+        key: secret/data/legion-db
+        property: postgres_password

servers/legion/k8s/neuron-technologies/swarm/mcp-deployment-alpha.yaml

@@ -26,19 +26,6 @@ spec:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
-      initContainers:
-        - name: wait-for-sqlite-clone
-          image: busybox:1.36
-          command: ["sh", "-c", "until [ -f /data/neuron.db ]; do echo 'waiting for SQLite clone...'; sleep 2; done; echo 'SQLite ready'"]
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1001
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
       containers:
         - name: neuron-mcp
           # Image is updated by swarm CI on each loop iteration
@@ -51,6 +38,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
             runAsNonRoot: true
+            runAsUser: 1000
             capabilities:
               drop: ["ALL"]
           env:

servers/legion/k8s/neuron-technologies/swarm/mcp-deployment-beta.yaml

@@ -26,19 +26,6 @@ spec:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
-      initContainers:
-        - name: wait-for-sqlite-clone
-          image: busybox:1.36
-          command: ["sh", "-c", "until [ -f /data/neuron.db ]; do echo 'waiting for SQLite clone...'; sleep 2; done; echo 'SQLite ready'"]
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1001
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
       containers:
         - name: neuron-mcp
           image: registry.neuralplatform.ai/neuron-technologies/neuron-mcp:v0.18.14
@@ -50,6 +37,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
             runAsNonRoot: true
+            runAsUser: 1000
             capabilities:
               drop: ["ALL"]
           env:

servers/legion/k8s/neuron-technologies/swarm/mcp-deployment-gamma.yaml

@@ -26,19 +26,6 @@ spec:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
-      initContainers:
-        - name: wait-for-sqlite-clone
-          image: busybox:1.36
-          command: ["sh", "-c", "until [ -f /data/neuron.db ]; do echo 'waiting for SQLite clone...'; sleep 2; done; echo 'SQLite ready'"]
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1001
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
       containers:
         - name: neuron-mcp
           image: registry.neuralplatform.ai/neuron-technologies/neuron-mcp:v0.18.14
@@ -50,6 +37,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
             runAsNonRoot: true
+            runAsUser: 1000
             capabilities:
               drop: ["ALL"]
           env: