From 01245a62782d6d85b1f031ab9b7394a33a029c15 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sun, 26 Apr 2026 01:35:20 -0500
Subject: [PATCH] Fix Neuron MCP: runAsUser + move to
 neuron.neurontechnologies.ai

Pod was crash-looping: image has no USER directive so kubelet rejected it
with runAsNonRoot. Add runAsUser: 1000 at both pod and container level.

MCP paths moved from neurontechnologies.ai (now a GCP Cloud Run A record,
unreachable on Legion) to private subdomain neuron.neurontechnologies.ai.
Cloudflare tunnel and DNS CNAME updated out-of-band.
---
 servers/legion/k8s/neuron-technologies/prod/ingress.yaml    | 6 +++++-
 .../legion/k8s/neuron-technologies/prod/mcp-deployment.yaml | 4 ++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/servers/legion/k8s/neuron-technologies/prod/ingress.yaml b/servers/legion/k8s/neuron-technologies/prod/ingress.yaml
index 63a50cd..4d8d506 100644
--- a/servers/legion/k8s/neuron-technologies/prod/ingress.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/ingress.yaml
@@ -13,8 +13,9 @@ spec:
       hosts:
         - neurontechnologies.ai
         - www.neurontechnologies.ai
+        - neuron.neurontechnologies.ai
   rules:
-    - host: neurontechnologies.ai
+    - host: neuron.neurontechnologies.ai
       http:
         paths:
           - path: /mcp
@@ -66,6 +67,9 @@ spec:
                 name: neuron-mcp
                 port:
                   number: 8080
+    - host: neurontechnologies.ai
+      http:
+        paths:
           - path: /license
             pathType: Prefix
             backend:
diff --git a/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml b/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
index 05769ef..afe3760 100644
--- a/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
@@ -21,12 +21,11 @@ spec:
         app: neuron-mcp
         slot: blue
         env: prod
-      annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-04-25T08:40:00Z"
     spec:
       terminationGracePeriodSeconds: 30
       securityContext:
         runAsNonRoot: true
+        runAsUser: 1000
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -40,6 +39,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false  # JVM writes temp files; restrict paths via allowedPaths once profiled
             runAsNonRoot: true
+            runAsUser: 1000
             capabilities:
               drop: ["ALL"]
           env: