will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate all app deployments from Terraform to Argo CD

Browse Source 
Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio,
devpi, registry, and registry-ui deployments+services to apps/*.yaml
so Argo CD manages the app layer. Terraform retains namespaces, PVCs,
ConfigMaps, Secrets, and Ingresses.

New Secrets in Terraform:
- kubernetes_secret.github_runner_secret (ci/github-runner-secret)
- kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret)

Hardcoded service names in ingress.tf and neuron.tf to remove
dependency on removed kubernetes_service resources.
This commit is contained in:
Will Anderson
2026-03-23 08:15:17 -05:00
parent b2b04c231c
commit afe01d2ad9
13 changed files with 588 additions and 885 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/apps/gitea.yaml
+102
View File
@@ -0,0 +1,102 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: gitea
namespace: git
labels:
app: gitea
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: gitea
template:
metadata:
labels:
app: gitea
spec:
containers:
- name: gitea
image: gitea/gitea:1.22
ports:
- name: http
containerPort: 3000
- name: ssh
containerPort: 22
env:
- name: GITEA__database__DB_TYPE
value: postgres
- name: GITEA__database__HOST
value: postgres-postgresql.platform.svc.cluster.local:5432
- name: GITEA__database__NAME
value: gitea
- name: GITEA__database__USER
value: gitea
- name: GITEA__database__PASSWD
valueFrom:
secretKeyRef:
name: gitea-db
key: password
- name: GITEA__server__DOMAIN
value: git.neuralplatform.dev
- name: GITEA__server__ROOT_URL
value: https://git.neuralplatform.dev
- name: GITEA__server__SSH_DOMAIN
value: git.neuralplatform.dev
- name: GITEA__server__SSH_PORT
value: "30022"
- name: GITEA__server__START_SSH_SERVER
value: "false"
- name: GITEA__service__DISABLE_REGISTRATION
value: "true"
- name: GITEA__service__REQUIRE_SIGNIN_VIEW
value: "true"
- name: GITEA__security__INSTALL_LOCK
value: "true"
- name: GITEA__packages__ENABLED
value: "true"
- name: GITEA__webhook__ALLOWED_HOST_LIST
value: 192.168.0.0/24,10.0.0.0/8
volumeMounts:
- name: data
mountPath: /data
- name: custom-css
mountPath: /data/gitea/custom/public/assets/css/custom.css
subPath: custom.css
- name: custom-css
mountPath: /data/gitea/custom/templates/custom/header.tmpl
subPath: header.tmpl
resources:
requests:
memory: 256Mi
cpu: 100m
limits:
memory: 512Mi
cpu: 500m
volumes:
- name: data
persistentVolumeClaim:
claimName: gitea-data
- name: custom-css
configMap:
name: gitea-custom-css
---
apiVersion: v1
kind: Service
metadata:
name: gitea
namespace: git
spec:
selector:
app: gitea
ports:
- name: http
port: 3000
targetPort: 3000
- name: ssh
port: 22
targetPort: 22
nodePort: 30022
type: NodePort
servers/legion/apps/github-runner.yaml
+53
View File
@@ -0,0 +1,53 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: github-runner
namespace: ci
labels:
app: github-runner
spec:
replicas: 1
selector:
matchLabels:
app: github-runner
template:
metadata:
labels:
app: github-runner
spec:
containers:
- name: runner
image: myoung34/github-runner:latest
env:
- name: ACCESS_TOKEN
valueFrom:
secretKeyRef:
name: github-runner-secret
key: ACCESS_TOKEN
- name: RUNNER_SCOPE
value: org
- name: ORG_NAME
value: harmonic-framework
- name: RUNNER_NAME
value: legion
- name: RUNNER_WORKDIR
value: /tmp/runner
- name: LABELS
value: self-hosted,linux,x64,legion
- name: DISABLE_AUTO_UPDATE
value: "true"
volumeMounts:
- name: docker-sock
mountPath: /var/run/docker.sock
resources:
requests:
memory: 512Mi
cpu: 250m
limits:
memory: 4Gi
cpu: "4"
volumes:
- name: docker-sock
hostPath:
path: /var/run/docker.sock
type: Socket
servers/legion/apps/neuron.yaml
+132
View File
@@ -0,0 +1,132 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: neuron
namespace: neuron
labels:
app: neuron
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: neuron
template:
metadata:
labels:
app: neuron
spec:
containers:
- name: neuron
image: registry.nook.family/neural-platform/neuron:latest
imagePullPolicy: Always
command:
- bash
- -c
- mkdir -p /root/.neuron && ln -sf /data/neuron.db /root/.neuron/neuron.db && python -m synapse platform serve --mcp-host 0.0.0.0 --mcp-port 8001 --webhook-port 3847
ports:
- name: mcp
containerPort: 8001
- name: webhook
containerPort: 3847
envFrom:
- configMapRef:
name: neuron-config
- secretRef:
name: neuron-secrets
volumeMounts:
- name: data
mountPath: /data
- name: app-config
mountPath: /app/config/default.yaml
subPath: default.yaml
resources:
requests:
memory: 256Mi
cpu: 100m
limits:
memory: 1Gi
cpu: 500m
livenessProbe:
httpGet:
path: /health
port: mcp
initialDelaySeconds: 10
periodSeconds: 30
readinessProbe:
httpGet:
path: /health
port: mcp
initialDelaySeconds: 5
periodSeconds: 10
volumes:
- name: data
persistentVolumeClaim:
claimName: neuron-data
- name: app-config
configMap:
name: neuron-config
items:
- key: default.yaml
path: default.yaml
---
apiVersion: v1
kind: Service
metadata:
name: neuron
namespace: neuron
spec:
selector:
app: neuron
ports:
- name: mcp
port: 8001
targetPort: 8001
- name: webhook
port: 3847
targetPort: 3847
type: ClusterIP
---
# cloudflared — Cloudflare tunnel for external Axon webhook access
# Routes: axon.neuralplatform.ai → neuron:3847
apiVersion: apps/v1
kind: Deployment
metadata:
name: cloudflared
namespace: neuron
labels:
app: cloudflared
spec:
replicas: 1
selector:
matchLabels:
app: cloudflared
template:
metadata:
labels:
app: cloudflared
spec:
containers:
- name: cloudflared
image: cloudflare/cloudflared:latest
args: ["tunnel", "--no-autoupdate", "run"]
env:
- name: TUNNEL_TOKEN
valueFrom:
secretKeyRef:
name: cloudflared-secret
key: TUNNEL_TOKEN
resources:
requests:
memory: 64Mi
cpu: 50m
limits:
memory: 128Mi
cpu: 200m
livenessProbe:
httpGet:
path: /ready
port: 20241
initialDelaySeconds: 10
periodSeconds: 30
servers/legion/apps/ollama.yaml
+55
View File
@@ -0,0 +1,55 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: ollama
namespace: ollama
labels:
app: ollama
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: ollama
template:
metadata:
labels:
app: ollama
spec:
containers:
- name: ollama
image: ollama/ollama:latest
ports:
- containerPort: 11434
env:
- name: NVIDIA_VISIBLE_DEVICES
value: all
volumeMounts:
- name: models
mountPath: /root/.ollama
resources:
requests:
memory: 2Gi
cpu: 500m
limits:
memory: 8Gi
cpu: "4"
volumes:
- name: models
persistentVolumeClaim:
claimName: ollama-models
---
apiVersion: v1
kind: Service
metadata:
name: ollama
namespace: ollama
spec:
selector:
app: ollama
ports:
- port: 11434
targetPort: 11434
nodePort: 31434
type: NodePort
servers/legion/apps/packages.yaml
+118
View File
@@ -0,0 +1,118 @@
# Verdaccio — npm proxy/cache
apiVersion: apps/v1
kind: Deployment
metadata:
name: verdaccio
namespace: packages
spec:
replicas: 1
selector:
matchLabels:
app: verdaccio
template:
metadata:
labels:
app: verdaccio
spec:
securityContext:
fsGroup: 101
containers:
- name: verdaccio
image: verdaccio/verdaccio:5
ports:
- containerPort: 4873
env:
- name: VERDACCIO_PORT
value: "4873"
volumeMounts:
- name: config
mountPath: /verdaccio/conf/config.yaml
subPath: config.yaml
- name: data
mountPath: /verdaccio/storage
resources:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 512Mi
volumes:
- name: config
configMap:
name: verdaccio-config
- name: data
persistentVolumeClaim:
claimName: verdaccio-data
---
apiVersion: v1
kind: Service
metadata:
name: verdaccio
namespace: packages
spec:
selector:
app: verdaccio
ports:
- port: 4873
targetPort: 4873
---
# devpi — PyPI proxy/cache
apiVersion: apps/v1
kind: Deployment
metadata:
name: devpi
namespace: packages
spec:
replicas: 1
selector:
matchLabels:
app: devpi
template:
metadata:
labels:
app: devpi
spec:
initContainers:
- name: devpi-init
image: python:3.12-slim
command:
- sh
- -c
- pip install -q devpi-server devpi-web && if [ ! -f /data/.serverversion ]; then devpi-init --serverdir /data; fi && chmod 600 /data/.secret 2>/dev/null || true
volumeMounts:
- name: data
mountPath: /data
containers:
- name: devpi
image: python:3.12-slim
command:
- sh
- -c
- pip install -q devpi-server devpi-web && exec devpi-server --serverdir /data --host 0.0.0.0 --port 3141 --outside-url https://pypi.neuralplatform.ai
ports:
- containerPort: 3141
volumeMounts:
- name: data
mountPath: /data
resources:
requests:
memory: 512Mi
cpu: 100m
limits:
memory: 2Gi
volumes:
- name: data
persistentVolumeClaim:
claimName: devpi-data
---
apiVersion: v1
kind: Service
metadata:
name: devpi
namespace: packages
spec:
selector:
app: devpi
ports:
- port: 3141
targetPort: 3141
servers/legion/apps/registry.yaml
+103
View File
@@ -0,0 +1,103 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: registry
namespace: registry
labels:
app: registry
spec:
replicas: 1
selector:
matchLabels:
app: registry
template:
metadata:
labels:
app: registry
spec:
containers:
- name: registry
image: registry:2
ports:
- containerPort: 5000
volumeMounts:
- name: data
mountPath: /var/lib/registry
resources:
requests:
memory: 64Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
volumes:
- name: data
persistentVolumeClaim:
claimName: registry-data
---
apiVersion: v1
kind: Service
metadata:
name: registry
namespace: registry
spec:
selector:
app: registry
ports:
- port: 5000
targetPort: 5000
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: registry-ui
namespace: registry
labels:
app: registry-ui
spec:
replicas: 1
selector:
matchLabels:
app: registry-ui
template:
metadata:
labels:
app: registry-ui
spec:
containers:
- name: registry-ui
image: joxit/docker-registry-ui:latest
ports:
- containerPort: 80
env:
- name: REGISTRY_TITLE
value: Nook Registry
- name: NGINX_PROXY_PASS_URL
value: http://registry:5000
- name: SINGLE_REGISTRY
value: "true"
- name: SHOW_CONTENT_DIGEST
value: "true"
- name: DELETE_IMAGES
value: "true"
resources:
requests:
memory: 32Mi
cpu: 20m
limits:
memory: 64Mi
cpu: 100m
---
apiVersion: v1
kind: Service
metadata:
name: registry-ui
namespace: registry
spec:
selector:
app: registry-ui
ports:
- port: 80
targetPort: 80
type: ClusterIP