mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-10-15 19:56:15 +00:00
70 lines
3.5 KiB
YAML
70 lines
3.5 KiB
YAML
# The rhema claw — the resident agent daemon from ../rhema.
|
|
# Single-node by design (one SQLite store, one dispatcher): the chart
|
|
# fails the render past one replica.
|
|
image:
|
|
repository: git.vhaudiquet.fr/vhaudiquet/rhema-claw
|
|
# Empty: follows the chart's appVersion — the commit SHA CI stamped on
|
|
# the pushed images.
|
|
tag: ""
|
|
# Bearer token for the /v1 routes (/healthz stays open). The daemon
|
|
# shells out through the coding agent, so the surface must not sit open
|
|
# on the LAN. Encrypted at rest: the .sops.yaml creation rule scoped to
|
|
# this file adds `token` to the values encrypted_regex.
|
|
token: ENC[AES256_GCM,data:fZKJzLy8FjN+0ONrHn40Tgb1/uTtYdAWTJwY7BfFltsGCPnuMx1F8KIPfQbzliyH,iv:yzaHrdDrSBbnT01aJmv8537D1lVe4kwIDINiuOgXPKU=,tag:dT7Z5v3CUhJg/+BqcjAWIA==,type:str]
|
|
# No provider, model, or credentials: the backend is selected
|
|
# dynamically (nothing injected, nothing pinned) — when a dispatch or a
|
|
# chat turn needs a key, the daemon resolves it through the rhema
|
|
# config seam, not through this release. The nulls erase the chart's
|
|
# built-in anthropic/claude defaults from the rendered claw.yaml.
|
|
config:
|
|
provider: null
|
|
model: null
|
|
watches: null
|
|
# The chart's own ingress, rendered from these values. Plain HTTP on
|
|
# purpose: kosmos.lan is LAN-internal and token-auth-only, like every
|
|
# other .lan surface here (no TLS story for .lan hosts).
|
|
ingress:
|
|
enabled: true
|
|
host: kosmos.lan
|
|
className: traefik
|
|
annotations:
|
|
external-dns.alpha.kubernetes.io/enabled: "true"
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn
|
|
size: 5Gi
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
sops:
|
|
lastmodified: "2026-10-10T11:49:22Z"
|
|
mac: ENC[AES256_GCM,data:vz3cATCAOEoyXOJCz0u+GfIq06lV5sV3mUoOKa4lUOWnShGOnxxE+v60AslV4KYBfmSCVliTalM0Vm8isuqJSAd9ZdPaI0CZ9F0gkxza22eaESkapIcIYrAhJYcZnRBSyAXjdVHyIzlvVwyTEqWYvEW7F5MJUgc4igHFD1/gMIA=,iv:VxsYzAWGhOiLXCt68Mpu8N9xgjsXXgc2LnInv2BExV8=,tag:rICLpdj4D37QZtTNV91uWA==,type:str]
|
|
pgp:
|
|
- created_at: "2026-10-10T11:49:22Z"
|
|
enc: |-
|
|
-----BEGIN PGP MESSAGE-----
|
|
|
|
hQIMA7uy4qQr71wiAQ//WeO+shUgWwJAu2IdxVteea0IpFCyo93hWqxLWMytqF7+
|
|
3h2s7zXXsNvNCvqndHzNSrZt+OuSQDWSBVIzfxlztw7ga6BdI92OhpOZPCIyKwDT
|
|
LzzUCPrSAGOZVekOkFXKlVDjMFunAiEp/soGda7bbP+VrdHJmeRh8fioTOgd/4qL
|
|
/QmmJk3bMTlMoVcknOW2qI3n79YA9qnI0vjwBL63bDeZnxZ8CiZzd1SDr10K0rDf
|
|
f9ErcmeKAwm+HgehSA3xId0Cph4gnf3xNhNDe2gcZvoFlPIrZT0iU0fBzMRuJPxt
|
|
c9g+TqTAHBfx90H58/NF8Sfr3ScXNUHvHzgzrq4w+ogqmp8NYsdDbzG1C318dV2o
|
|
nITluENiYgR9Qs6gJda94aEc00IYEBp4lNGp5G1SyHiDB+jMMsiHX6w3x286dgNx
|
|
G6DcJ+TabCO+A+Fzq74I2ds+paoEgDegDMCIgK6uSKF0jT2ID579Bf2kRraneOqV
|
|
amgBI2CQZG5FAqdhbtpf4PHAK9YR3b42mgF9nBAc+f/oFeAZm8nFmG7LubwxqbgY
|
|
HLa7+ct38ygp/pwZ0FQcU5I3VwqYyU+JA3HMsL2yspHJAeQuXAvzkCQ8NaDOMpEY
|
|
JRY1pIHl3SwTkV3zh9co8r2Ho8fGYO6KzlNfEdRsx2C6DegM70kpPuYzcCDYAd3S
|
|
XAE6EX2dM+NxYqhHEIwKjFMJlROWwhhRhheFZnyYRMsn75NkeqRfPi2tJgMkIMk9
|
|
OJ1eekhgFbQr8vaWtrIOhjvQG9ieg2ujuyltVcC2XUFxQONCxbfoXC2oYu1Y
|
|
=gTTK
|
|
-----END PGP MESSAGE-----
|
|
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
|
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
|
|
mac_only_encrypted: true
|
|
version: 3.10.2
|