From a1ce8d3880beeff3c926f48d09f86a91a1baf01e Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Sat, 10 Oct 2026 13:49:22 +0200 Subject: [PATCH] rhema-claw(kube): deploy --- .sops.yaml | 2 +- kubernetes/kustomization.yaml | 1 + .../personal/rhema-claw/kustomization.yaml | 13 ++++ .../personal/rhema-claw/kustomizeconfig.yaml | 6 ++ kubernetes/personal/rhema-claw/namespace.yaml | 7 ++ kubernetes/personal/rhema-claw/release.yaml | 24 +++++++ .../personal/rhema-claw/repository.yaml | 11 +++ kubernetes/personal/rhema-claw/values.yaml | 69 +++++++++++++++++++ 8 files changed, 132 insertions(+), 1 deletion(-) create mode 100644 kubernetes/personal/rhema-claw/kustomization.yaml create mode 100644 kubernetes/personal/rhema-claw/kustomizeconfig.yaml create mode 100644 kubernetes/personal/rhema-claw/namespace.yaml create mode 100644 kubernetes/personal/rhema-claw/release.yaml create mode 100644 kubernetes/personal/rhema-claw/repository.yaml create mode 100644 kubernetes/personal/rhema-claw/values.yaml diff --git a/.sops.yaml b/.sops.yaml index 8c83a46..74405f2 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,6 +1,6 @@ creation_rules: - path_regex: .*values.yaml$ - encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$ mac_only_encrypted: true pgp: DC6910268E657FF70BA7EC289974494E76938DDC - path_regex: .*.yaml diff --git a/kubernetes/kustomization.yaml b/kubernetes/kustomization.yaml index 2f80112..b3b10ff 100644 --- a/kubernetes/kustomization.yaml +++ b/kubernetes/kustomization.yaml @@ -36,6 +36,7 @@ resources: # Personal (apps storing my own content, grouped by content type) - personal/paperless - personal/radicale + - personal/rhema-claw - personal/syncthing - personal/media/photoprism - personal/notes/notesnook diff --git a/kubernetes/personal/rhema-claw/kustomization.yaml b/kubernetes/personal/rhema-claw/kustomization.yaml new file mode 100644 index 0000000..5887c1d --- /dev/null +++ b/kubernetes/personal/rhema-claw/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: rhema-claw +resources: + - namespace.yaml + - repository.yaml + - release.yaml +secretGenerator: + - name: rhema-claw-values + files: + - values.yaml=values.yaml +configurations: + - kustomizeconfig.yaml diff --git a/kubernetes/personal/rhema-claw/kustomizeconfig.yaml b/kubernetes/personal/rhema-claw/kustomizeconfig.yaml new file mode 100644 index 0000000..4ea8252 --- /dev/null +++ b/kubernetes/personal/rhema-claw/kustomizeconfig.yaml @@ -0,0 +1,6 @@ +nameReference: + - kind: Secret + version: v1 + fieldSpecs: + - path: spec/valuesFrom/name + kind: HelmRelease diff --git a/kubernetes/personal/rhema-claw/namespace.yaml b/kubernetes/personal/rhema-claw/namespace.yaml new file mode 100644 index 0000000..d00237c --- /dev/null +++ b/kubernetes/personal/rhema-claw/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: rhema-claw + labels: + app.kubernetes.io/name: rhema-claw + app.kubernetes.io/component: ai-agent diff --git a/kubernetes/personal/rhema-claw/release.yaml b/kubernetes/personal/rhema-claw/release.yaml new file mode 100644 index 0000000..761b1e9 --- /dev/null +++ b/kubernetes/personal/rhema-claw/release.yaml @@ -0,0 +1,24 @@ +# Tracks the rhema-claw chart as CI publishes it on main: the timestamp +# pre-releases (0.1.0-YYYYMMDD-HHMMSS) all sort above 0.1.0-0, and the +# chart's appVersion carries the commit SHA the image was tagged with — +# values.image.tag stays empty to ride it. Same rolling scheme as the +# saggar release. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: rhema-claw + namespace: rhema-claw +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: vhaudiquet + namespace: rhema-claw + chart: rhema-claw + version: ">=0.1.0-0" + interval: 1m + valuesFrom: + - kind: Secret + name: rhema-claw-values diff --git a/kubernetes/personal/rhema-claw/repository.yaml b/kubernetes/personal/rhema-claw/repository.yaml new file mode 100644 index 0000000..94d7e23 --- /dev/null +++ b/kubernetes/personal/rhema-claw/repository.yaml @@ -0,0 +1,11 @@ +# The vhaudiquet package repository on the home Gitea — where the rhema +# CI publishes the rhema-claw chart on every main push (base version + +# timestamp, ordered by SemVer pre-release rules). Public: no auth. +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: vhaudiquet + namespace: rhema-claw +spec: + interval: 1m + url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm diff --git a/kubernetes/personal/rhema-claw/values.yaml b/kubernetes/personal/rhema-claw/values.yaml new file mode 100644 index 0000000..fba0b7c --- /dev/null +++ b/kubernetes/personal/rhema-claw/values.yaml @@ -0,0 +1,69 @@ +# The rhema claw — the resident agent daemon from ../rhema. +# Single-node by design (one SQLite store, one dispatcher): the chart +# fails the render past one replica. +image: + repository: git.vhaudiquet.fr/vhaudiquet/rhema-claw + # Empty: follows the chart's appVersion — the commit SHA CI stamped on + # the pushed images. + tag: "" +# Bearer token for the /v1 routes (/healthz stays open). The daemon +# shells out through the coding agent, so the surface must not sit open +# on the LAN. Encrypted at rest: the .sops.yaml creation rule scoped to +# this file adds `token` to the values encrypted_regex. +token: ENC[AES256_GCM,data:fZKJzLy8FjN+0ONrHn40Tgb1/uTtYdAWTJwY7BfFltsGCPnuMx1F8KIPfQbzliyH,iv:yzaHrdDrSBbnT01aJmv8537D1lVe4kwIDINiuOgXPKU=,tag:dT7Z5v3CUhJg/+BqcjAWIA==,type:str] +# No provider, model, or credentials: the backend is selected +# dynamically (nothing injected, nothing pinned) — when a dispatch or a +# chat turn needs a key, the daemon resolves it through the rhema +# config seam, not through this release. The nulls erase the chart's +# built-in anthropic/claude defaults from the rendered claw.yaml. +config: + provider: null + model: null + watches: null +# The chart's own ingress, rendered from these values. Plain HTTP on +# purpose: kosmos.lan is LAN-internal and token-auth-only, like every +# other .lan surface here (no TLS story for .lan hosts). +ingress: + enabled: true + host: kosmos.lan + className: traefik + annotations: + external-dns.alpha.kubernetes.io/enabled: "true" +persistence: + enabled: true + storageClass: longhorn + size: 5Gi +resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: "1" + memory: 1Gi +sops: + lastmodified: "2026-10-10T11:49:22Z" + mac: ENC[AES256_GCM,data:vz3cATCAOEoyXOJCz0u+GfIq06lV5sV3mUoOKa4lUOWnShGOnxxE+v60AslV4KYBfmSCVliTalM0Vm8isuqJSAd9ZdPaI0CZ9F0gkxza22eaESkapIcIYrAhJYcZnRBSyAXjdVHyIzlvVwyTEqWYvEW7F5MJUgc4igHFD1/gMIA=,iv:VxsYzAWGhOiLXCt68Mpu8N9xgjsXXgc2LnInv2BExV8=,tag:rICLpdj4D37QZtTNV91uWA==,type:str] + pgp: + - created_at: "2026-10-10T11:49:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ//WeO+shUgWwJAu2IdxVteea0IpFCyo93hWqxLWMytqF7+ + 3h2s7zXXsNvNCvqndHzNSrZt+OuSQDWSBVIzfxlztw7ga6BdI92OhpOZPCIyKwDT + LzzUCPrSAGOZVekOkFXKlVDjMFunAiEp/soGda7bbP+VrdHJmeRh8fioTOgd/4qL + /QmmJk3bMTlMoVcknOW2qI3n79YA9qnI0vjwBL63bDeZnxZ8CiZzd1SDr10K0rDf + f9ErcmeKAwm+HgehSA3xId0Cph4gnf3xNhNDe2gcZvoFlPIrZT0iU0fBzMRuJPxt + c9g+TqTAHBfx90H58/NF8Sfr3ScXNUHvHzgzrq4w+ogqmp8NYsdDbzG1C318dV2o + nITluENiYgR9Qs6gJda94aEc00IYEBp4lNGp5G1SyHiDB+jMMsiHX6w3x286dgNx + G6DcJ+TabCO+A+Fzq74I2ds+paoEgDegDMCIgK6uSKF0jT2ID579Bf2kRraneOqV + amgBI2CQZG5FAqdhbtpf4PHAK9YR3b42mgF9nBAc+f/oFeAZm8nFmG7LubwxqbgY + HLa7+ct38ygp/pwZ0FQcU5I3VwqYyU+JA3HMsL2yspHJAeQuXAvzkCQ8NaDOMpEY + JRY1pIHl3SwTkV3zh9co8r2Ho8fGYO6KzlNfEdRsx2C6DegM70kpPuYzcCDYAd3S + XAE6EX2dM+NxYqhHEIwKjFMJlROWwhhRhheFZnyYRMsn75NkeqRfPi2tJgMkIMk9 + OJ1eekhgFbQr8vaWtrIOhjvQG9ieg2ujuyltVcC2XUFxQONCxbfoXC2oYu1Y + =gTTK + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$ + mac_only_encrypted: true + version: 3.10.2