add neuron-web phase-1 deploy on Legion

Stand up the elb-built native El landing server on Legion k3s alongside the existing Cloud Run prod marketing site. Image is built on gitea-runner-1 from elb-emitted .c files + native cc and pushed to registry.neuralplatform.ai/neuron-web:dev-dfe41234. Deployment exposes web-stage.neuralplatform.ai via Traefik + Cloudflare tunnel. The point is to have a working local instance we can iterate against while we redesign the CI/CD pipeline; nothing here replaces the Cloud Run deploy yet. * k8s/neuron-technologies/web/ — namespace, deployment, service, ingress, registry-pull-secret + externalsecret pulling anthropic/supabase keys from Vault * apps/neuron-web.yaml — Argo CD Application * dns-neuralplatform.tf, main.tf — CNAME + tunnel ingress for web-stage.neuralplatform.ai
2026-05-03 10:45:18 -05:00
parent b3609d6401
commit 3daf615dd2
10 changed files with 305 additions and 0 deletions
@@ -0,0 +1,79 @@
+# neuron-web-secrets — runtime secrets pulled from Vault by ESO.
+#
+# Phase 1 deployment of neuron-web on Legion. Only ANTHROPIC_API_KEY and
+# SUPABASE_ANON_KEY are critical for the page to render and the chat
+# widget to talk to Claude. Stripe + Resend + DocuSeal are pulled from
+# the existing marketing-test path so checkout flows can be exercised in
+# stage; webhook + DocuSeal tokens are present but the public webhook
+# routes still go to the Cloud Run prod URL until we cut over.
+#
+# Vault paths used:
+#   secret/neuron-technologies/anthropic        api_key
+#   secret/neuron-technologies/supabase         anon_key, service_role_key, project_url
+#   secret/neuron-technologies/marketing-test   stripe_*, etc.
+#   secret/neuron-technologies/notifications    resend_api_key
+#
+# To add a new secret without changing the ExternalSecret manifest:
+#   vault kv patch secret/neuron-technologies/<path> key="value"
+# then add a new data: entry below.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: neuron-web-secrets
+  namespace: neuron-web
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: neuron-web-secrets
+    creationPolicy: Owner
+  data:
+    # Critical — chat widget + page render
+    - secretKey: ANTHROPIC_API_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/anthropic
+        property: api_key
+    - secretKey: NEURON_LLM_0_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/anthropic
+        property: api_key
+    - secretKey: SUPABASE_ANON_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/supabase
+        property: anon_key
+    - secretKey: SUPABASE_SERVICE_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/supabase
+        property: service_role_key
+    - secretKey: SUPABASE_URL
+      remoteRef:
+        key: secret/data/neuron-technologies/supabase
+        property: project_url
+    # Stripe — test/stage keys
+    - secretKey: STRIPE_PUBLISHABLE_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing-test
+        property: next_public_stripe_publishable_key
+    - secretKey: STRIPE_SECRET_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing-test
+        property: stripe_secret_key
+    - secretKey: STRIPE_WEBHOOK_SECRET
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing-test
+        property: stripe_webhook_secret
+    - secretKey: STRIPE_PRICE_PROFESSIONAL
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing-test
+        property: stripe_price_professional
+    - secretKey: STRIPE_PRICE_FOUNDING
+      remoteRef:
+        key: secret/data/neuron-technologies/marketing-test
+        property: stripe_price_founding
+    # Notifications
+    - secretKey: RESEND_API_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/notifications
+        property: resend_api_key