prepare neuron-tim namespace for Tim's future Neuron instance

Adds the neuron-tim namespace (via Terraform) and a full Argo CD app + k8s manifests mirroring neuron-prod. All deployments set to replicas=0 — nothing runs until Tim's imprint is ready and Vault secrets are populated at secret/neuron-technologies/tim.
2026-04-24 12:52:36 -05:00
parent 92743b1efc
commit 336a9333a2
10 changed files with 316 additions and 0 deletions
@@ -0,0 +1,57 @@
+# ExternalSecret for Tim's Neuron instance.
+#
+# Before Tim's instance can start, populate these Vault paths:
+#   vault kv put secret/neuron-technologies/tim \
+#     api_key=<Tim's NEURON_API_KEY> \
+#     gitea_webhook_secret=<Tim's webhook secret>
+#
+# Required Vault secrets:
+#   secret/data/neuron-technologies/tim:
+#     - api_key              → NEURON_API_KEY
+#     - gitea_webhook_secret → NEURON_WEBHOOK_SECRET
+#
+#   secret/data/neuron-technologies/license:
+#     - admin_token          → NEURON_LICENSE_ADMIN_TOKEN  (shared with prod)
+#
+#   secret/data/neuron-technologies/unkey:
+#     - root_key             → UNKEY_ROOT_KEY              (shared with prod)
+#     - api_id               → UNKEY_API_ID                (shared with prod)
+#
+# Tim's instance-specific secrets that should be scoped under secret/neuron-technologies/tim:
+#   - anthropic_api_key      (Tim's own Anthropic API key)
+#   - neuron_license_key     (Tim's license key issued by the license server)
+#   - db_encryption_key      (encryption key for Tim's SQLite DB)
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: neuron-tim-secrets
+  namespace: neuron-tim
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: neuron-tim-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: NEURON_API_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/tim
+        property: api_key
+    - secretKey: NEURON_WEBHOOK_SECRET
+      remoteRef:
+        key: secret/data/neuron-technologies/tim
+        property: gitea_webhook_secret
+    - secretKey: NEURON_LICENSE_ADMIN_TOKEN
+      remoteRef:
+        key: secret/data/neuron-technologies/license
+        property: admin_token
+    - secretKey: UNKEY_ROOT_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/unkey
+        property: root_key
+    - secretKey: UNKEY_API_ID
+      remoteRef:
+        key: secret/data/neuron-technologies/unkey
+        property: api_id