Will Anderson
336a9333a2
Adds the neuron-tim namespace (via Terraform) and a full Argo CD app + k8s manifests mirroring neuron-prod. All deployments set to replicas=0 — nothing runs until Tim's imprint is ready and Vault secrets are populated at secret/neuron-technologies/tim.
58 lines
2.0 KiB
YAML
58 lines
2.0 KiB
YAML
# ExternalSecret for Tim's Neuron instance.
|
|
#
|
|
# Before Tim's instance can start, populate these Vault paths:
|
|
# vault kv put secret/neuron-technologies/tim \
|
|
# api_key=<Tim's NEURON_API_KEY> \
|
|
# gitea_webhook_secret=<Tim's webhook secret>
|
|
#
|
|
# Required Vault secrets:
|
|
# secret/data/neuron-technologies/tim:
|
|
# - api_key → NEURON_API_KEY
|
|
# - gitea_webhook_secret → NEURON_WEBHOOK_SECRET
|
|
#
|
|
# secret/data/neuron-technologies/license:
|
|
# - admin_token → NEURON_LICENSE_ADMIN_TOKEN (shared with prod)
|
|
#
|
|
# secret/data/neuron-technologies/unkey:
|
|
# - root_key → UNKEY_ROOT_KEY (shared with prod)
|
|
# - api_id → UNKEY_API_ID (shared with prod)
|
|
#
|
|
# Tim's instance-specific secrets that should be scoped under secret/neuron-technologies/tim:
|
|
# - anthropic_api_key (Tim's own Anthropic API key)
|
|
# - neuron_license_key (Tim's license key issued by the license server)
|
|
# - db_encryption_key (encryption key for Tim's SQLite DB)
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: neuron-tim-secrets
|
|
namespace: neuron-tim
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: neuron-tim-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: NEURON_API_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/tim
|
|
property: api_key
|
|
- secretKey: NEURON_WEBHOOK_SECRET
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/tim
|
|
property: gitea_webhook_secret
|
|
- secretKey: NEURON_LICENSE_ADMIN_TOKEN
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/license
|
|
property: admin_token
|
|
- secretKey: UNKEY_ROOT_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/unkey
|
|
property: root_key
|
|
- secretKey: UNKEY_API_ID
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/unkey
|
|
property: api_id
|