- dns-neuralplatform.tf: add vault.neuralplatform.ai A record → 34.54.164.21 (GCP LB)
DNS-only (not proxied) so GCP managed TLS cert can provision correctly
- main.tf: remove vault.neuralplatform.ai from Cloudflare tunnel ingress
(now served directly via GCP Global HTTPS LB)
- main.tf: remove watch.nook.family, jellyfin.nook.family, bazarr.nook.family
from tunnel ingress (nook.family media stack retired; infra is Neuron-focused)
GCE Vault cluster already initialized and running (3-node Raft, active since
2026-05-04T16:05). Secrets migrated 48/48 from k3s vault. ESO ClusterSecretStore
validated against new vault. k3s vault-0 is now superseded.
- Dockerfile for Go DHARMA server (registry.neuralplatform.ai/neuron-technologies/dharma)
- k8s manifests: deployment, service, ExternalSecret (Vault), IngressRoute
- Argo CD app: deploys to neuron-prod namespace
- Cloudflare tunnel rule for dharma.neurontechnologies.ai
- DNS CNAME record for dharma.neurontechnologies.ai → legion tunnel
- Vault secrets already populated (api_key, encryption_key, jwt_secret, engram_key, engram_url)
- Connects to neuron-daemon (engram) at neuron-daemon.neuron-prod.svc.cluster.local:7749
Stand up the elb-built native El landing server on Legion k3s alongside
the existing Cloud Run prod marketing site. Image is built on
gitea-runner-1 from elb-emitted .c files + native cc and pushed to
registry.neuralplatform.ai/neuron-web:dev-dfe41234. Deployment exposes
web-stage.neuralplatform.ai via Traefik + Cloudflare tunnel.
The point is to have a working local instance we can iterate against
while we redesign the CI/CD pipeline; nothing here replaces the Cloud
Run deploy yet.
* k8s/neuron-technologies/web/ — namespace, deployment, service, ingress,
registry-pull-secret + externalsecret pulling anthropic/supabase keys
from Vault
* apps/neuron-web.yaml — Argo CD Application
* dns-neuralplatform.tf, main.tf — CNAME + tunnel ingress for
web-stage.neuralplatform.ai
Was missing from tunnel ingress rules, causing 404 on all registry
requests through Cloudflare. Disabled chunked encoding for Docker
push compatibility.
- Add neuron-daemon Argo CD Application (apps/neuron-daemon.yaml) pointing to
k8s/neuron-technologies/daemon/ on main — daemon will deploy once image is built
- Add daemon k8s manifests: StatefulSet (2 replicas, imagePullPolicy: Always),
Service (ClusterIP :7749, session affinity), ExternalSecret (Anthropic API key from Vault)
- Fix neuron-rest runAsNonRoot: remove constraint since v0.15.3 image runs as root,
clears the CreateContainerConfigError on the 11h-old stale pod
- Add NEURON_DAEMON_WS_URL env var to marketing deployment for chat UI connectivity
- Add neuron.neurontechnologies.ai Cloudflare DNS record and tunnel ingress rule (Terraform)
Provision Google Cloud Storage bucket for neuron prod DB backups via Terraform.
Create dedicated backup service account with objectAdmin on the bucket.
Update neuron-prod backup CronJob to run restic against both R2 and GCS hourly —
R2 as primary, GCS as secondary, independent credentials and repositories.
- Tunnel ingress rules for alpha/beta/gamma.neurontechnologies.ai
- DNS CNAME records pointing to legion tunnel
- k8s ingress rules routing to neuron-alpha/beta/gamma services (port 8001)
- TLS certs via cert-manager for new hostnames
Register voidstash.xyz as the private media stack domain.
- DNS delegated from Porkbun to Cloudflare nameservers
- stash.voidstash.xyz and whisparr.voidstash.xyz CNAME to legion tunnel
- Tunnel ingress rules added for both subdomains → Traefik
Tunnel routes were being managed ad-hoc via Cloudflare API. Now codified
in Terraform so they can't drift — neuron.neuralplatform.ai was missing
from the tunnel config, causing 404s for Neuron MCP connections.
Also fix mcp.json: type http → sse (Neuron uses SSE transport, not
streamable HTTP). CF-Access headers were already present and correct.
Will Anderson