Will Anderson
3daf615dd2
Stand up the elb-built native El landing server on Legion k3s alongside the existing Cloud Run prod marketing site. Image is built on gitea-runner-1 from elb-emitted .c files + native cc and pushed to registry.neuralplatform.ai/neuron-web:dev-dfe41234. Deployment exposes web-stage.neuralplatform.ai via Traefik + Cloudflare tunnel. The point is to have a working local instance we can iterate against while we redesign the CI/CD pipeline; nothing here replaces the Cloud Run deploy yet. * k8s/neuron-technologies/web/ — namespace, deployment, service, ingress, registry-pull-secret + externalsecret pulling anthropic/supabase keys from Vault * apps/neuron-web.yaml — Argo CD Application * dns-neuralplatform.tf, main.tf — CNAME + tunnel ingress for web-stage.neuralplatform.ai
80 lines
2.9 KiB
YAML
80 lines
2.9 KiB
YAML
# neuron-web-secrets — runtime secrets pulled from Vault by ESO.
|
|
#
|
|
# Phase 1 deployment of neuron-web on Legion. Only ANTHROPIC_API_KEY and
|
|
# SUPABASE_ANON_KEY are critical for the page to render and the chat
|
|
# widget to talk to Claude. Stripe + Resend + DocuSeal are pulled from
|
|
# the existing marketing-test path so checkout flows can be exercised in
|
|
# stage; webhook + DocuSeal tokens are present but the public webhook
|
|
# routes still go to the Cloud Run prod URL until we cut over.
|
|
#
|
|
# Vault paths used:
|
|
# secret/neuron-technologies/anthropic api_key
|
|
# secret/neuron-technologies/supabase anon_key, service_role_key, project_url
|
|
# secret/neuron-technologies/marketing-test stripe_*, etc.
|
|
# secret/neuron-technologies/notifications resend_api_key
|
|
#
|
|
# To add a new secret without changing the ExternalSecret manifest:
|
|
# vault kv patch secret/neuron-technologies/<path> key="value"
|
|
# then add a new data: entry below.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: neuron-web-secrets
|
|
namespace: neuron-web
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: neuron-web-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
# Critical — chat widget + page render
|
|
- secretKey: ANTHROPIC_API_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/anthropic
|
|
property: api_key
|
|
- secretKey: NEURON_LLM_0_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/anthropic
|
|
property: api_key
|
|
- secretKey: SUPABASE_ANON_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/supabase
|
|
property: anon_key
|
|
- secretKey: SUPABASE_SERVICE_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/supabase
|
|
property: service_role_key
|
|
- secretKey: SUPABASE_URL
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/supabase
|
|
property: project_url
|
|
# Stripe — test/stage keys
|
|
- secretKey: STRIPE_PUBLISHABLE_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/marketing-test
|
|
property: next_public_stripe_publishable_key
|
|
- secretKey: STRIPE_SECRET_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/marketing-test
|
|
property: stripe_secret_key
|
|
- secretKey: STRIPE_WEBHOOK_SECRET
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/marketing-test
|
|
property: stripe_webhook_secret
|
|
- secretKey: STRIPE_PRICE_PROFESSIONAL
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/marketing-test
|
|
property: stripe_price_professional
|
|
- secretKey: STRIPE_PRICE_FOUNDING
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/marketing-test
|
|
property: stripe_price_founding
|
|
# Notifications
|
|
- secretKey: RESEND_API_KEY
|
|
remoteRef:
|
|
key: secret/data/neuron-technologies/notifications
|
|
property: resend_api_key
|