will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
613 Commits 10 Branches 0 Tags
fix/remove-duplicate-runner-deployment
Commit Graph

9 Commits

Author SHA1 Message Date
Will Anderson a823b0c1d3 Scale neuron-marketing to 0 — taking site down 2026-04-28 18:55:39 -05:00
Will Anderson e69ecd2240 Scale neuron-marketing to 1 replica for demo launch 2026-04-28 18:52:21 -05:00
Will Anderson 20a4a2c37f Take marketing site offline until launch 2026-04-27 17:58:33 -05:00
Will Anderson 3943ebc204 feat: scale marketing to 1 replica, add notification + turnstile secrets 
Single replica required for in-memory pending leads Map used by SMS
double-opt-in flow. ExternalSecret adds Resend, Twilio, and Turnstile
keys to the marketing pod environment.
 2026-04-27 03:31:45 -05:00
Will Anderson 714a7c7a8d launch: deploy daemon StatefulSet, fix neuron-rest security context, add daemon Argo CD app 
- Add neuron-daemon Argo CD Application (apps/neuron-daemon.yaml) pointing to
  k8s/neuron-technologies/daemon/ on main — daemon will deploy once image is built
- Add daemon k8s manifests: StatefulSet (2 replicas, imagePullPolicy: Always),
  Service (ClusterIP :7749, session affinity), ExternalSecret (Anthropic API key from Vault)
- Fix neuron-rest runAsNonRoot: remove constraint since v0.15.3 image runs as root,
  clears the CreateContainerConfigError on the 11h-old stale pod
- Add NEURON_DAEMON_WS_URL env var to marketing deployment for chat UI connectivity
- Add neuron.neurontechnologies.ai Cloudflare DNS record and tunnel ingress rule (Terraform)
 2026-04-26 10:13:48 -05:00
Will Anderson 93358505fc Harden prod: security, autoscaling, observability, BuildKit CI 
Security:
- Drop ALL capabilities, enforce non-root, RuntimeDefault seccomp on
  neuron-mcp, neuron-rest, neuron-marketing pods
- Add startup probes (150s window for JVM) so liveness doesn't fire early
- Replace docker-sock hostPath with BuildKit rootless TCP endpoint
  (moby/buildkit:v0.19.0-rootless) — removes node root access from CI
- Document full ESO AppRole migration path in cluster-secret-store.yaml

Autoscaling & availability:
- HPAs on mcp (1–6), rest (1–4), marketing (2–8) at 65–70% CPU
- PodDisruptionBudgets (minAvailable: 1) on all three services
- NetworkPolicy: default-deny-all in neuron-prod, explicit allow rules
  for Traefik ingress, intra-namespace, and egress to DNS/platform/vault

Observability:
- ServiceMonitors for mcp, rest, marketing (cross-namespace enabled in
  kube-prometheus-stack with serviceMonitorSelectorNilUsesHelmValues:false)
- PrometheusRules: high error rate, high latency, crash loops, replica
  shortage, Postgres down/connections, backup failure, backup staleness

Chart version pinning:
- kube-prometheus-stack, loki, tempo, redis, alloy, postgres — all pinned
  to major-version ranges to block silent breaking upgrades

Backup hardening:
- restic:latest → restic:0.17.3 (deterministic image)
- Weekly backup-verify CronJob: restores latest snapshot and validates
  SQL dump structure (≥5 CREATE TABLE, pg_dump header check)

ArgoCD:
- neuron-prod AppProject: scopes deploys to neuron-prod + platform ns,
  blacklists ClusterRole/ClusterRoleBinding/Namespace creation,
  automated sync window 2–6am UTC, manual always allowed
 2026-04-25 22:54:18 -05:00
Neuron CI ba716640b4 ci(marketing): deploy marketing@1e94e8ae 2026-04-25 07:46:30 +00:00
Will Anderson c238fbb198 fix(marketing): point license API URL to neuron-license service on correct port 8082 2026-04-24 15:10:08 -05:00
Will Anderson 0f9448e8ea deploy neuron marketing site to neurontechnologies.ai 
Add marketing/ manifests (Deployment, Service, ExternalSecret) for the
Next.js marketing site in neuron-prod namespace, an Argo CD app pointing
to the new path, and update the prod ingress to serve / from neuron-marketing
instead of neuron-rest.
 2026-04-24 13:09:29 -05:00