infrastructure/servers/legion/neuron.tf

# Neuron — MCP server + Axon webhook hub
# MCP: https://neuron.nook.family (internal, Traefik)
# Webhooks: https://axon.neuralplatform.ai (external, Cloudflare tunnel)
#
# Image: registry.nook.family/neural-platform/neuron:latest
# Built by GitHub Actions runner on Legion — see neural-platform/neuron ci.yml
#
# TODO: Migrate SQLite → Postgres once neuron db migration is ready
# TODO: Wire Gmail OAuth credentials via k8s Secret (currently unauthenticated)

resource "kubernetes_namespace" "neuron" {
  metadata {
    name = "neuron"
    labels = {
      managed-by = "terraform"
      tier       = "platform"
    }
  }
}

resource "kubernetes_persistent_volume_claim" "neuron_data" {
  metadata {
    name      = "neuron-data"
    namespace = kubernetes_namespace.neuron.metadata[0].name
  }

  spec {
    access_modes = ["ReadWriteOnce"]
    resources {
      requests = {
        storage = "5Gi"
      }
    }
  }
}

resource "kubernetes_config_map" "neuron_config" {
  metadata {
    name      = "neuron-config"
    namespace = kubernetes_namespace.neuron.metadata[0].name
  }

  data = {
    MCP_PORT       = "8001"
    MCP_HOST       = "0.0.0.0"
    WEBHOOK_PORT   = "3847"
    NEURON_DB_PATH = "/data/neuron.db"
    AXON_DB_PATH   = "/data/axon.db"
    TUNNEL_NAME    = "neural-platform"

    "default.yaml" = <<-EOT
      runtime:
        name: neuron
        version: 0.1.0
      storage:
        db_path: /data/neuron.db
      cache:
        max_l1_size: 1000
      gc:
        gen0_threshold: 3
        gen1_threshold: 5
      knowledge:
        base_path: /data/knowledge
      synapse:
        path: /data/synapse
    EOT
  }
}

resource "kubernetes_secret" "neuron_secrets" {
  metadata {
    name      = "neuron-secrets"
    namespace = kubernetes_namespace.neuron.metadata[0].name
  }

  data = {
    GITHUB_WEBHOOK_SECRET = var.github_webhook_secret
    GITEA_WEBHOOK_SECRET  = var.gitea_webhook_secret
    SLACK_BOT_TOKEN       = var.slack_bot_token
    SLACK_SIGNING_SECRET  = var.slack_signing_secret
  }
}

# Deployment + Service + cloudflared managed by Argo CD — see servers/legion/apps/neuron.yaml

resource "kubernetes_secret" "cloudflared_secret" {
  metadata {
    name      = "cloudflared-secret"
    namespace = kubernetes_namespace.neuron.metadata[0].name
  }
  data = {
    TUNNEL_TOKEN = var.cloudflared_tunnel_token
  }
}

# Internal MCP ingress — accessible within nook.family network
resource "kubernetes_ingress_v1" "neuron" {
  metadata {
    name      = "neuron"
    namespace = kubernetes_namespace.neuron.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints"  = "websecure"
      "cert-manager.io/cluster-issuer"                    = "letsencrypt-prod"
    }
  }

  spec {
    ingress_class_name = "traefik"

    tls {
      secret_name = "neuron-tls"
      hosts       = ["neuron.${var.infra_domain}"]
    }

    rule {
      host = "neuron.${var.infra_domain}"
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "neuron"
              port {
                number = 8001
              }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.cert_manager]
}