Single-node k3s cluster cannot schedule a second pod during rolling update
(512Mi request × 2 exceeds available memory). Recreate terminates the old
pod before starting the new one, trading brief downtime for schedulability.
Add marketing/ manifests (Deployment, Service, ExternalSecret) for the
Next.js marketing site in neuron-prod namespace, an Argo CD app pointing
to the new path, and update the prod ingress to serve / from neuron-marketing
instead of neuron-rest.
OAuth discovery endpoints (/.well-known/oauth-protected-resource and
/.well-known/oauth-authorization-server) and the authorization server
paths (/oauth2/*, /login) were routing to neuron-rest, which has none
of those endpoints. MCP also uses /sse and /message directly.
All five path prefixes now route to neuron-mcp on port 8080.
Adds the neuron-tim namespace (via Terraform) and a full Argo CD
app + k8s manifests mirroring neuron-prod. All deployments set to
replicas=0 — nothing runs until Tim's imprint is ready and Vault
secrets are populated at secret/neuron-technologies/tim.
Deploy single-broker Redpanda in dedicated namespace with 20Gi storage,
1 CPU / 2Gi memory limits, and a one-shot topic init job for neuron.swarm,
neuron.ci, neuron.vcs, and neuron.webhooks with appropriate retention.
The Kotlin NeuronModule reads NEURON_DATA_DIR to locate the SQLite file.
The stage configmap only had NEURON_DB_PATH/NEURON_STORAGE_PATH which
the Kotlin code doesn't read, causing it to fall back to a temp file
that was wiped on every pod restart.
Adding NEURON_DATA_DIR=/data ensures the server reads from the persistent
PVC-backed /data/neuron.db going forward.
NeuronModule reads NEURON_DATA_DIR to construct the DB path as
$NEURON_DATA_DIR/neuron.db. Without this env var the app falls
back to a temp file, losing all data on pod restart. Also renamed
the PVC file from neuron-prod.db to neuron.db to match.
Adds license deployment, service, ingress route (/license), and
Unkey + admin token secrets via ExternalSecret. Image built and
pushed by CI on merge of neuron PR #30.
Snapshot via vault operator raft snapshot save using a least-privilege
periodic token. Stored in legion-vault-backup R2 bucket via restic.
Retains 30 daily / 12 weekly / 6 monthly snapshots. Runs at 3am,
offset from the Gitea backup at 2am.
- Tunnel ingress rules for alpha/beta/gamma.neurontechnologies.ai
- DNS CNAME records pointing to legion tunnel
- k8s ingress rules routing to neuron-alpha/beta/gamma services (port 8001)
- TLS certs via cert-manager for new hostnames
Will Anderson