Will Anderson
3daf615dd2
Stand up the elb-built native El landing server on Legion k3s alongside the existing Cloud Run prod marketing site. Image is built on gitea-runner-1 from elb-emitted .c files + native cc and pushed to registry.neuralplatform.ai/neuron-web:dev-dfe41234. Deployment exposes web-stage.neuralplatform.ai via Traefik + Cloudflare tunnel. The point is to have a working local instance we can iterate against while we redesign the CI/CD pipeline; nothing here replaces the Cloud Run deploy yet. * k8s/neuron-technologies/web/ — namespace, deployment, service, ingress, registry-pull-secret + externalsecret pulling anthropic/supabase keys from Vault * apps/neuron-web.yaml — Argo CD Application * dns-neuralplatform.tf, main.tf — CNAME + tunnel ingress for web-stage.neuralplatform.ai
31 lines
1.0 KiB
YAML
31 lines
1.0 KiB
YAML
# registry-pull-secret — credentials for registry.neuralplatform.ai
|
|
# pulled from Vault by ESO. Lets the deployment fetch
|
|
# registry.neuralplatform.ai/neuron-web:* without baking creds into the manifest.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: registry-pull-secret
|
|
namespace: neuron-web
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: registry-pull-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
type: kubernetes.io/dockerconfigjson
|
|
data:
|
|
.dockerconfigjson: |
|
|
{"auths":{"registry.neuralplatform.ai":{"username":"{{ .registry_user }}","password":"{{ .registry_docker_token }}","auth":"{{ list .registry_user .registry_docker_token | join ":" | b64enc }}"}}}
|
|
data:
|
|
- secretKey: registry_user
|
|
remoteRef:
|
|
key: secret/data/mudcraft
|
|
property: registry_user
|
|
- secretKey: registry_docker_token
|
|
remoteRef:
|
|
key: secret/data/mudcraft
|
|
property: registry_docker_token
|