74dd054a36
feat(swarm): add swarm self-improvement loop infrastructure
...
Adds complete k8s manifests, ArgoCD app, and Terraform namespace
resources for the Neuron swarm self-improvement loop system.
Each variant (alpha, beta, gamma) gets its own isolated namespace,
PVC, MCP/REST deployments, ExternalSecrets from Vault, RBAC for CI,
and a SQLite clone Job template for session startup.
2026-04-26 00:58:43 -05:00
7adab317d4
fix: restore postgres chart to 18.x (was wrongly pinned to 16.x)
...
Chart 16.x deploys PG17 images that do not exist on Docker Hub.
Existing data directory is PG18. Restoring >=18.0.0,<19.0.0 range.
2026-04-26 04:51:07 +00:00
93358505fc
Harden prod: security, autoscaling, observability, BuildKit CI
...
Security:
- Drop ALL capabilities, enforce non-root, RuntimeDefault seccomp on
neuron-mcp, neuron-rest, neuron-marketing pods
- Add startup probes (150s window for JVM) so liveness doesn't fire early
- Replace docker-sock hostPath with BuildKit rootless TCP endpoint
(moby/buildkit:v0.19.0-rootless) — removes node root access from CI
- Document full ESO AppRole migration path in cluster-secret-store.yaml
Autoscaling & availability:
- HPAs on mcp (1–6), rest (1–4), marketing (2–8) at 65–70% CPU
- PodDisruptionBudgets (minAvailable: 1) on all three services
- NetworkPolicy: default-deny-all in neuron-prod, explicit allow rules
for Traefik ingress, intra-namespace, and egress to DNS/platform/vault
Observability:
- ServiceMonitors for mcp, rest, marketing (cross-namespace enabled in
kube-prometheus-stack with serviceMonitorSelectorNilUsesHelmValues:false)
- PrometheusRules: high error rate, high latency, crash loops, replica
shortage, Postgres down/connections, backup failure, backup staleness
Chart version pinning:
- kube-prometheus-stack, loki, tempo, redis, alloy, postgres — all pinned
to major-version ranges to block silent breaking upgrades
Backup hardening:
- restic:latest → restic:0.17.3 (deterministic image)
- Weekly backup-verify CronJob: restores latest snapshot and validates
SQL dump structure (≥5 CREATE TABLE, pg_dump header check)
ArgoCD:
- neuron-prod AppProject: scopes deploys to neuron-prod + platform ns,
blacklists ClusterRole/ClusterRoleBinding/Namespace creation,
automated sync window 2–6am UTC, manual always allowed
2026-04-25 22:54:18 -05:00
5d4cc17829
chore(neuron): retire Python backend — keep cloudflared only
...
Remove neuron/neuron-alpha/neuron-beta/neuron-gamma Deployments and
Services, the slot LB service, Python ingress, slot PVCs, snapshot job,
neuron-config ConfigMap, and neuron-secrets ExternalSecret. The Python
MCP backend has been superseded by the Spring Boot backend in neuron-prod.
Cloudflared Deployment and cloudflared-secret ExternalSecret are
retained in the neuron namespace. The neuron-data PVC is preserved
for data safety.
2026-04-24 20:39:17 -05:00
91bfc42989
ops: scale down all non-critical services — dedicate resources to Neuron
...
Scaled to replicas: 0: fornax (coordinator/ui/workers), jellyfin via media,
overseerr, plex, radarr, sonarr, bazarr, prowlarr, flaresolverr, ollama,
harmonic-wordpress, docuseal, listmonk, memos, plane, redpanda, wp-coordinator
2026-04-24 20:07:41 -05:00
2d98df75ad
Deploy Plane project management to k8s with Cloudflare Access gate
...
Adds all k8s manifests (namespace, postgres, redis, api, worker, beat,
web, ingress, externalsecret, configmap, kustomization), Argo CD Application,
and Cloudflare Zero Trust access policy for plane.neuralplatform.ai.
2026-04-24 14:21:02 -05:00
0f9448e8ea
deploy neuron marketing site to neurontechnologies.ai
...
Add marketing/ manifests (Deployment, Service, ExternalSecret) for the
Next.js marketing site in neuron-prod namespace, an Argo CD app pointing
to the new path, and update the prod ingress to serve / from neuron-marketing
instead of neuron-rest.
2026-04-24 13:09:29 -05:00
336a9333a2
prepare neuron-tim namespace for Tim's future Neuron instance
...
Adds the neuron-tim namespace (via Terraform) and a full Argo CD
app + k8s manifests mirroring neuron-prod. All deployments set to
replicas=0 — nothing runs until Tim's imprint is ready and Vault
secrets are populated at secret/neuron-technologies/tim.
2026-04-24 12:52:36 -05:00
92743b1efc
add redpanda to legion cluster
...
Deploy single-broker Redpanda in dedicated namespace with 20Gi storage,
1 CPU / 2Gi memory limits, and a one-shot topic init job for neuron.swarm,
neuron.ci, neuron.vcs, and neuron.webhooks with appropriate retention.
2026-04-24 12:39:02 -05:00
cd0cb30933
ci: add neuron-technologies runner for Gitea Actions
2026-04-23 21:19:26 -05:00
b2c25e4e0f
chore(neuron): promote 617dcd1d to prod (fix begin_work NOT NULL data column)
2026-04-24 00:26:24 +00:00
c30da5d1a8
chore(neuron): deploy 617dcd1d5c1d148838b8e73df1bba8296257c0b6 to alpha/beta/gamma
2026-04-24 00:21:40 +00:00
48964eccac
chore(neuron): deploy 3e230d550235599d21edaa1df0a22949ccbf695a to alpha/beta/gamma
2026-04-23 19:35:30 +00:00
3d739b6c5b
chore(neuron): deploy 539fc9e7f333dfa0cd31772fc09a976b3079090c to alpha
2026-04-23 19:30:27 +00:00
a8ef7e1782
feat(neuron): set NEURON_SERVER_NAME per slot so each advertises a unique MCP identity
2026-04-23 14:27:03 -05:00
cc4db4dc11
feat(neuron): gamma zone, all-slot ingress, snapshot job, self-improvement loop script
2026-04-23 13:57:13 -05:00
a9758b6eda
chore(neuron): deploy 7d29e699c061c3cdb907fc2326b67ad6601298a9 to alpha
2026-04-23 18:51:52 +00:00
27b4b1e066
feat(neuron): add alpha slot + lb Service; standardize all slots to port 8001
2026-04-23 13:47:21 -05:00
6dd67730b7
chore(neuron): deploy bddce6b2bd11428efe3eac0dcb269da5490014c4
2026-04-23 18:36:29 +00:00
882c4a79d4
feat(neuron): add neuron-beta deployment on port 8002 with separate PVC
2026-04-23 13:34:55 -05:00
60d0d81144
chore(ci-runner): roll pod to pick up NodePort URL from updated secret
2026-04-23 13:16:18 -05:00
39808ab964
fix(ci-runner): add extra_hosts for cluster DNS in CI Docker containers
2026-04-23 12:50:53 -05:00
5a62077b99
fix(gitea): allow unauthenticated API ping for runner registration
2026-04-23 12:43:47 -05:00
095d874552
Remove docuseal-old temp instance
2026-04-21 18:15:49 -05:00
0cbb06660a
Add temporary docuseal-old at sign.neuralplatform.ai for license transfer
2026-04-21 17:33:40 -05:00
d40fb8c3f1
Add Docuseal e-signature service at sign.neuralplatform.ai
...
- k8s manifests: Deployment, Service, PVC, Ingress, ExternalSecret
- Argo CD app watching servers/legion/k8s/docuseal
- CF tunnel ingress rule for sign.neuralplatform.ai
- Vault secret at secret/docuseal (secret_key_base seeded)
2026-04-21 14:26:01 -05:00
3b3811942c
Update Legion LAN IP from 192.168.68.77 to 192.168.8.148
...
Static IP assigned on new network segment. Updates:
- variables.tf default legion_ip
- headscale nameserver config
- bootstrap.sh default target
- README/RUNBOOK documentation
- media ingress comment
2026-04-21 10:32:39 -05:00
26c7d2259e
chore(neuron): deploy efc982c605cacc6929f29382f293e2a2d4a4cf95
2026-04-18 20:28:36 +00:00
193bea7f3f
fix(neuron): add ephemeral-storage limits to prevent eviction cascade
2026-04-17 09:59:21 -05:00
1b8ea63541
feat(neuron): add stage and prod k8s manifests + Argo CD apps
...
Completes the three-env setup (dev was added previously). Each env has
deployments, services, ingress, PVC, ConfigMap, and ExternalSecret pulling
from Vault. Prod has larger resource limits and 10Gi PVC. Vault secret at
secret/neuron-technologies/prod seeded separately.
2026-04-17 09:43:23 -05:00
912e129e0d
feat(neuron-dev): add k8s manifests and Argo CD app for neuron-technologies dev environment
2026-04-17 08:46:47 -05:00
ad2a1db3e2
Remove conflicting fornax-worker Argo CD apps — media app is sole owner
...
The fornax-worker-tx253 and fornax-worker-tx34 Argo CD apps were fighting
the media app (which also manages the same Deployments, Services, PVCs,
and ExternalSecrets via fornax-workers.yaml). This caused 73+ rolling
restarts per 2 hours. Since neither app had a cascade-delete finalizer,
removing these Application CRDs leaves existing resources intact and
transfers ownership to the media app.
2026-04-14 22:25:25 -05:00
4f406e13c9
add fornax-ui Argo CD application
...
Deploys fornax/ui:latest (nginx serving React SPA) to the media
namespace. Image is now pushed by the fornax CI pipeline.
2026-04-14 12:48:42 -05:00
bdba692db2
Fornax: COORDINATOR_URL env, port-lease webhook, Grafana dashboard
...
- Worker deployment: add COORDINATOR_URL and WORKER_ID env vars to
portforward-helper; webhook calls coordinator /api/v2/workers/:id/port-lease
after each NAT-PMP renewal so coordinator tracks current forwarded port
- Worker overlays: patch WORKER_ID env var to actual worker ID (tx253/tx34)
- Grafana: fornax-grafana Argo CD app pointing to k8s/fornax/grafana/
ConfigMap with grafana_dashboard=1 label for auto-discovery by sidecar;
7 panels covering bandwidth, active torrents, worker health, request rate,
and error rate
2026-04-14 05:30:01 +00:00
180fb91c95
add fornax coordinator and worker k8s manifests
2026-04-13 23:57:22 +00:00
0aa1f4333c
chore(neuron): deploy e102af6f86599361b911a2e7e5aa0ec737b54527
2026-04-12 19:58:46 +00:00
e1c15205e3
chore(neuron): deploy 61e9d262595be44c6d7956e41f8a9f275c482678
2026-04-12 16:27:34 +00:00
f91a25fd83
chore(neuron): deploy 0091ebfaa13ef4c58d3a88b3bb3be144ea0a2d9c
2026-04-12 16:18:28 +00:00
6a9da6d900
Fix media app: use internal Gitea URL for Argo CD
2026-04-10 22:50:51 -05:00
ba99111753
Add media stack: Plex, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, Overseerr
...
- Namespace: media (created via Terraform)
- Storage: hostPath PV at /media on Legion (movies, tv/shows, tv/anime, downloads)
- VPN: gluetun sidecar with ProtonVPN WireGuard (US-TX#253), all torrent traffic tunneled
- Radarr: movie automation with /media/movies root
- Sonarr: TV/anime automation with /media/tv/{shows,anime} roots
- Prowlarr: indexer aggregator (YTS, 1337x, Nyaa for anime)
- qBittorrent: torrent client, network namespaced behind gluetun VPN
- Bazarr: automatic subtitle downloads (connects to Radarr + Sonarr)
- Overseerr: family request portal at watch.nook.family
- Plex: media server at plex.nook.family
2026-04-10 22:50:13 -05:00
78c1c9750f
Add Memos journaling app at journal.neuralplatform.ai
2026-04-08 15:46:10 -05:00
54b2abf767
chore(neuron): deploy d97b23808e953dccf35d784c47ca003d74bcda61
2026-04-06 14:01:48 +00:00
937e138f7d
chore(neuron): deploy d3d72a5adbdddfd6c18ae674c921469d410dc7da
2026-04-06 13:44:50 +00:00
55f4eab6ae
chore(neuron): deploy bf185a6b19bfce25a3c67d4d13fa4e39b6fc6685
2026-04-06 13:38:05 +00:00
3ba1bf5c08
fix: neuron probes — use tcpSocket, /mcp returns 406 on plain GET
2026-04-06 04:17:11 -05:00
c138982fcf
fix: neuron health probes — /health 404, use /mcp endpoint
2026-04-06 04:14:51 -05:00
49b5604860
chore(neuron): deploy 2476e1167826cf320375143c09e94852b4330114
2026-04-06 07:54:36 +00:00
bf40bd7f15
feat: add Listmonk newsletter platform on Legion k3s
...
- Namespace, ExternalSecrets (Vault), DB init job, deployment, service, PVC, ingress
- Routes newsletter.harmonic-framework.com via existing Cloudflare tunnel
- Uses shared platform postgres with dedicated listmonk DB/user
- Credentials stored at secret/data/listmonk in Vault
2026-04-04 18:43:44 -05:00
6b546b6168
ci: bump runner pod to pick up valid_volumes config change
2026-04-04 10:27:06 -05:00
f3898d4c8e
ci: allow /var/run/docker.sock as valid volume for Docker builds
2026-04-04 10:24:37 -05:00
Will Anderson