fix: migrate code queue control plane to k3s

2026-05-16 12:01:09 +00:00
parent 83ed99f659
commit 111ec9f1eb
40 changed files with 419 additions and 366 deletions
@@ -0,0 +1,738 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: unidesk
+  labels:
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/k3s-cluster: unidesk-k3s
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: d601-provider-egress-proxy
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: provider-egress-proxy
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/provider-id: D601
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 18789
+      targetPort: 18789
+      protocol: TCP
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: d601-provider-egress-proxy
+  namespace: unidesk
+  labels:
+    kubernetes.io/service-name: d601-provider-egress-proxy
+    app.kubernetes.io/name: provider-egress-proxy
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/provider-id: D601
+addressType: IPv4
+ports:
+  - name: http
+    protocol: TCP
+    port: 18789
+endpoints:
+  - addresses:
+      - "172.25.0.3"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: d601-tcp-egress-gateway
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: tcp-egress-gateway
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/provider-id: D601
+data:
+  tcp-egress-gateway.js: |
+    const net = require("node:net");
+
+    const proxyUrl = new URL(process.env.TCP_EGRESS_HTTP_PROXY || "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789");
+    const proxyHost = proxyUrl.hostname;
+    const proxyPort = Number(proxyUrl.port || 80);
+    const healthPort = Number(process.env.TCP_EGRESS_HEALTH_PORT || 18080);
+    const rawRoutes = process.env.TCP_EGRESS_ROUTES || "";
+    const startedAt = new Date().toISOString();
+
+    function parseRoute(text) {
+      const parts = text.trim().split("=");
+      if (parts.length !== 3) throw new Error(`invalid route: ${text}`);
+      const [name, listenPortText, target] = parts;
+      const [targetHost, targetPortText] = target.split(":");
+      const listenPort = Number(listenPortText);
+      const targetPort = Number(targetPortText);
+      if (!name || !targetHost || !Number.isInteger(listenPort) || !Number.isInteger(targetPort)) throw new Error(`invalid route: ${text}`);
+      return { name, listenPort, targetHost, targetPort };
+    }
+
+    const routes = rawRoutes.split(",").map((item) => item.trim()).filter(Boolean).map(parseRoute);
+    if (routes.length === 0) throw new Error("TCP_EGRESS_ROUTES must define at least one route");
+
+    function findHeaderEnd(buffer) {
+      for (let index = 0; index <= buffer.length - 4; index += 1) {
+        if (buffer[index] === 13 && buffer[index + 1] === 10 && buffer[index + 2] === 13 && buffer[index + 3] === 10) return index + 4;
+      }
+      return -1;
+    }
+
+    function log(level, message, data = {}) {
+      console.log(JSON.stringify({ ts: new Date().toISOString(), service: "tcp-egress-gateway", level, message, data }));
+    }
+
+    function pipeViaHttpConnect(client, route) {
+      const proxy = net.connect({ host: proxyHost, port: proxyPort });
+      const earlyClientChunks = [];
+      const proxyHeaderChunks = [];
+      let tunnelReady = false;
+      let closed = false;
+
+      const closeBoth = () => {
+        if (closed) return;
+        closed = true;
+        client.destroy();
+        proxy.destroy();
+      };
+
+      client.on("data", (chunk) => {
+        if (tunnelReady) proxy.write(chunk);
+        else earlyClientChunks.push(chunk);
+      });
+      client.on("error", closeBoth);
+      client.on("close", closeBoth);
+
+      proxy.on("connect", () => {
+        proxy.write(`CONNECT ${route.targetHost}:${route.targetPort} HTTP/1.1\r\nHost: ${route.targetHost}:${route.targetPort}\r\n\r\n`);
+      });
+      proxy.on("data", (chunk) => {
+        if (tunnelReady) {
+          client.write(chunk);
+          return;
+        }
+        proxyHeaderChunks.push(chunk);
+        const headerBuffer = Buffer.concat(proxyHeaderChunks);
+        const headerEnd = findHeaderEnd(headerBuffer);
+        if (headerEnd < 0) return;
+        const header = headerBuffer.subarray(0, headerEnd).toString("latin1");
+        if (!/^HTTP\/1\.[01] 200\b/u.test(header)) {
+          log("warn", "connect_rejected", { route: route.name, header: header.slice(0, 200) });
+          closeBoth();
+          return;
+        }
+        tunnelReady = true;
+        const remaining = headerBuffer.subarray(headerEnd);
+        if (remaining.length > 0) client.write(remaining);
+        for (const early of earlyClientChunks) proxy.write(early);
+        earlyClientChunks.length = 0;
+      });
+      proxy.on("error", (error) => {
+        log("warn", "proxy_error", { route: route.name, error: String(error?.message || error) });
+        closeBoth();
+      });
+      proxy.on("close", closeBoth);
+    }
+
+    for (const route of routes) {
+      net.createServer((client) => pipeViaHttpConnect(client, route)).listen(route.listenPort, "0.0.0.0", () => {
+        log("info", "route_listening", { route: route.name, listenPort: route.listenPort, target: `${route.targetHost}:${route.targetPort}`, proxy: `${proxyHost}:${proxyPort}` });
+      });
+    }
+
+    Bun.serve({
+      hostname: "0.0.0.0",
+      port: healthPort,
+      fetch() {
+        return Response.json({ ok: true, service: "tcp-egress-gateway", startedAt, proxy: `${proxyHost}:${proxyPort}`, routes });
+      },
+    });
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: d601-tcp-egress-gateway
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: tcp-egress-gateway
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/provider-id: D601
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tcp-egress-gateway
+      unidesk.ai/provider-id: D601
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tcp-egress-gateway
+        app.kubernetes.io/part-of: unidesk
+        unidesk.ai/provider-id: D601
+        unidesk.ai/node-id: D601
+    spec:
+      nodeSelector:
+        unidesk.ai/node-id: D601
+      containers:
+        - name: tcp-egress-gateway
+          image: unidesk-code-queue:d601
+          imagePullPolicy: IfNotPresent
+          command:
+            - bun
+            - /etc/unidesk-tcp-egress/tcp-egress-gateway.js
+          ports:
+            - name: pg
+              containerPort: 15432
+            - name: oa
+              containerPort: 4255
+            - name: health
+              containerPort: 18080
+          env:
+            - name: TCP_EGRESS_HTTP_PROXY
+              value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+            - name: TCP_EGRESS_ROUTES
+              value: "postgres=15432=74.48.78.17:15432,oa-event-flow=4255=74.48.78.17:4255"
+            - name: TCP_EGRESS_HEALTH_PORT
+              value: "18080"
+          volumeMounts:
+            - name: script
+              mountPath: /etc/unidesk-tcp-egress
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: health
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 12
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: health
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+      volumes:
+        - name: script
+          configMap:
+            name: d601-tcp-egress-gateway
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: d601-tcp-egress-gateway
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: tcp-egress-gateway
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/provider-id: D601
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: tcp-egress-gateway
+    unidesk.ai/provider-id: D601
+  ports:
+    - name: pg
+      port: 15432
+      targetPort: pg
+    - name: oa
+      port: 4255
+      targetPort: oa
+    - name: health
+      port: 18080
+      targetPort: health
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: code-queue
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: code-queue
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/deployment-mode: k3sctl-managed
+    unidesk.ai/instance-id: D601
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: code-queue
+      unidesk.ai/instance-id: D601
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: code-queue
+        app.kubernetes.io/part-of: unidesk
+        unidesk.ai/deployment-mode: k3sctl-managed
+        unidesk.ai/instance-id: D601
+        unidesk.ai/node-id: D601
+    spec:
+      nodeSelector:
+        unidesk.ai/node-id: D601
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: code-queue
+          image: unidesk-code-queue:d601
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 4222
+          envFrom:
+            - secretRef:
+                name: code-queue-env
+                optional: true
+          env:
+            - name: HOST
+              value: "0.0.0.0"
+            - name: PORT
+              value: "4222"
+            - name: DATABASE_URL
+              value: "postgres://unidesk:unidesk_dev_password@d601-tcp-egress-gateway.unidesk.svc.cluster.local:15432/unidesk"
+            - name: CODE_QUEUE_INSTANCE_ID
+              value: "D601"
+            - name: CODE_QUEUE_SCHEDULER_ENABLED
+              value: "true"
+            - name: CODE_QUEUE_STARTUP_OA_BACKFILL_ENABLED
+              value: "false"
+            - name: CODE_QUEUE_DATA_DIR
+              value: "/var/lib/unidesk/code-queue"
+            - name: CODE_QUEUE_WORKDIR
+              value: "/workspace"
+            - name: CODE_QUEUE_CODEX_HOME
+              value: "/var/lib/unidesk/code-queue/codex-home"
+            - name: CODE_QUEUE_OPENCODE_XDG_DIR
+              value: "/var/lib/unidesk/code-queue/opencode-xdg"
+            - name: CODE_QUEUE_SOURCE_CODEX_CONFIG
+              value: "/root/.codex/config.toml"
+            - name: CODE_QUEUE_DEFAULT_MODEL
+              value: "gpt-5.5"
+            - name: CODE_QUEUE_MODELS
+              value: "gpt-5.5,gpt-5.4-mini,gpt-5.4,minimax-m2.7"
+            - name: CODE_QUEUE_MODEL_REASONING_EFFORTS
+              value: "gpt-5.5=xhigh"
+            - name: CODE_QUEUE_SANDBOX
+              value: "danger-full-access"
+            - name: CODE_QUEUE_APPROVAL_POLICY
+              value: "never"
+            - name: CODE_QUEUE_MAX_ACTIVE_QUEUES
+              value: "0"
+            - name: CODE_QUEUE_DATABASE_POOL_MAX
+              value: "2"
+            - name: NODE_OPTIONS
+              value: "--max-old-space-size=1024"
+            - name: GIT_CONFIG_COUNT
+              value: "1"
+            - name: GIT_CONFIG_KEY_0
+              value: "safe.directory"
+            - name: GIT_CONFIG_VALUE_0
+              value: "*"
+            - name: CODE_QUEUE_IN_MEMORY_OUTPUT_RECORDS
+              value: "10"
+            - name: CODE_QUEUE_IN_MEMORY_EVENT_RECORDS
+              value: "10"
+            - name: CODE_QUEUE_MAIN_PROVIDER_ID
+              value: "D601"
+            - name: CODE_QUEUE_REMOTE_WORKDIR
+              value: "/home/ubuntu"
+            - name: CODE_QUEUE_EXECUTION_PROVIDER_IDS
+              value: "D601"
+            - name: CODE_QUEUE_DEV_CONTAINER_MASTER_HOST
+              value: "74.48.78.17"
+            - name: CODE_QUEUE_DEV_CONTAINER_DEFAULT_PROVIDER_ID
+              value: "D601"
+            - name: CODE_QUEUE_DEV_CONTAINER_WORKDIR
+              value: "/home/ubuntu"
+            - name: CODE_QUEUE_EGRESS_PROXY_ENABLED
+              value: "true"
+            - name: CODE_QUEUE_EGRESS_PROXY_URL
+              value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+            - name: CODE_QUEUE_EGRESS_PROXY_NO_PROXY
+              value: "localhost,127.0.0.1,::1,host.docker.internal,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,172.25.0.3,unidesk-provider-gateway-D601,backend-core,oa-event-flow,database,hyueapi.com,.hyueapi.com"
+            - name: HTTP_PROXY
+              value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+            - name: HTTPS_PROXY
+              value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+            - name: ALL_PROXY
+              value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+            - name: http_proxy
+              value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+            - name: https_proxy
+              value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+            - name: all_proxy
+              value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+            - name: NO_PROXY
+              value: "localhost,127.0.0.1,::1,host.docker.internal,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,172.25.0.3,unidesk-provider-gateway-D601,backend-core,oa-event-flow,database,hyueapi.com,.hyueapi.com"
+            - name: no_proxy
+              value: "localhost,127.0.0.1,::1,host.docker.internal,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,172.25.0.3,unidesk-provider-gateway-D601,backend-core,oa-event-flow,database,hyueapi.com,.hyueapi.com"
+            - name: OA_EVENT_FLOW_BASE_URL
+              value: "http://d601-tcp-egress-gateway.unidesk.svc.cluster.local:4255"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_ENABLED
+              value: "true"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_BASE_URL
+              value: "http://host.docker.internal:3290"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_TARGET_TYPE
+              value: "private"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_USER_ID
+              value: "645275593"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_MAX_RESPONSE_CHARS
+              value: "12000"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_TIMEOUT_MS
+              value: "15000"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_SEND_ATTEMPTS
+              value: "3"
+            - name: LOG_FILE
+              value: "/var/log/unidesk/code-queue.jsonl"
+            - name: UNIDESK_LOG_RETENTION_BYTES
+              value: "1GiB"
+          volumeMounts:
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+            - name: workspace
+              mountPath: /workspace
+            - name: repo
+              mountPath: /root/unidesk
+            - name: repo
+              mountPath: /app
+            - name: codex-config
+              mountPath: /root/.codex/config.toml
+              readOnly: true
+            - name: codex-auth
+              mountPath: /root/.codex/auth.json
+              readOnly: true
+            - name: ssh-dir
+              mountPath: /root/.ssh
+              readOnly: true
+            - name: logs
+              mountPath: /var/log/unidesk
+            - name: state
+              mountPath: /var/lib/unidesk/code-queue
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 20
+          livenessProbe:
+            httpGet:
+              path: /live
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          startupProbe:
+            httpGet:
+              path: /live
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 60
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              memory: 4Gi
+      volumes:
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+        - name: workspace
+          hostPath:
+            path: /home/ubuntu
+            type: Directory
+        - name: repo
+          hostPath:
+            path: /home/ubuntu/cq-deploy
+            type: Directory
+        - name: codex-config
+          hostPath:
+            path: /home/ubuntu/.codex/config.toml
+            type: File
+        - name: codex-auth
+          hostPath:
+            path: /home/ubuntu/.codex/auth.json
+            type: File
+        - name: ssh-dir
+          hostPath:
+            path: /home/ubuntu/.ssh
+            type: Directory
+        - name: logs
+          hostPath:
+            path: /home/ubuntu/cq-deploy/.state/code-queue/logs
+            type: DirectoryOrCreate
+        - name: state
+          hostPath:
+            path: /home/ubuntu/cq-deploy/.state/code-queue
+            type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: code-queue
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: code-queue
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/deployment-mode: k3sctl-managed
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: code-queue
+    unidesk.ai/instance-id: D601
+  ports:
+    - name: http
+      port: 4222
+      targetPort: http
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: code-queue-d518
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: code-queue
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/deployment-mode: k3sctl-managed
+    unidesk.ai/instance-id: D518
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: code-queue
+      unidesk.ai/instance-id: D518
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: code-queue
+        app.kubernetes.io/part-of: unidesk
+        unidesk.ai/deployment-mode: k3sctl-managed
+        unidesk.ai/instance-id: D518
+        unidesk.ai/node-id: D518
+    spec:
+      nodeSelector:
+        unidesk.ai/node-id: D518
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: code-queue
+          image: unidesk-code-queue:d601
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 4222
+          envFrom:
+            - secretRef:
+                name: code-queue-env
+                optional: true
+          env:
+            - name: HOST
+              value: "0.0.0.0"
+            - name: PORT
+              value: "4222"
+            - name: DATABASE_URL
+              value: "postgres://unidesk:unidesk_dev_password@d601-tcp-egress-gateway.unidesk.svc.cluster.local:15432/unidesk"
+            - name: CODE_QUEUE_INSTANCE_ID
+              value: "D518"
+            - name: CODE_QUEUE_SCHEDULER_ENABLED
+              value: "false"
+            - name: CODE_QUEUE_STARTUP_OA_BACKFILL_ENABLED
+              value: "false"
+            - name: CODE_QUEUE_DATA_DIR
+              value: "/var/lib/unidesk/code-queue"
+            - name: CODE_QUEUE_WORKDIR
+              value: "/workspace"
+            - name: CODE_QUEUE_CODEX_HOME
+              value: "/var/lib/unidesk/code-queue/codex-home"
+            - name: CODE_QUEUE_OPENCODE_XDG_DIR
+              value: "/var/lib/unidesk/code-queue/opencode-xdg"
+            - name: CODE_QUEUE_SOURCE_CODEX_CONFIG
+              value: "/root/.codex/config.toml"
+            - name: CODE_QUEUE_DEFAULT_MODEL
+              value: "gpt-5.5"
+            - name: CODE_QUEUE_MODELS
+              value: "gpt-5.5,gpt-5.4-mini,gpt-5.4,minimax-m2.7"
+            - name: CODE_QUEUE_MODEL_REASONING_EFFORTS
+              value: "gpt-5.5=xhigh"
+            - name: CODE_QUEUE_SANDBOX
+              value: "danger-full-access"
+            - name: CODE_QUEUE_APPROVAL_POLICY
+              value: "never"
+            - name: CODE_QUEUE_MAX_ACTIVE_QUEUES
+              value: "0"
+            - name: CODE_QUEUE_DATABASE_POOL_MAX
+              value: "2"
+            - name: NODE_OPTIONS
+              value: "--max-old-space-size=1024"
+            - name: GIT_CONFIG_COUNT
+              value: "1"
+            - name: GIT_CONFIG_KEY_0
+              value: "safe.directory"
+            - name: GIT_CONFIG_VALUE_0
+              value: "*"
+            - name: CODE_QUEUE_IN_MEMORY_OUTPUT_RECORDS
+              value: "10"
+            - name: CODE_QUEUE_IN_MEMORY_EVENT_RECORDS
+              value: "10"
+            - name: CODE_QUEUE_MAIN_PROVIDER_ID
+              value: "D518"
+            - name: CODE_QUEUE_REMOTE_WORKDIR
+              value: "/home/ubuntu"
+            - name: CODE_QUEUE_EXECUTION_PROVIDER_IDS
+              value: "D518"
+            - name: CODE_QUEUE_DEV_CONTAINER_MASTER_HOST
+              value: "74.48.78.17"
+            - name: CODE_QUEUE_DEV_CONTAINER_DEFAULT_PROVIDER_ID
+              value: "D518"
+            - name: CODE_QUEUE_DEV_CONTAINER_WORKDIR
+              value: "/home/ubuntu"
+            - name: CODE_QUEUE_EGRESS_PROXY_ENABLED
+              value: "false"
+            - name: CODE_QUEUE_EGRESS_PROXY_URL
+              value: ""
+            - name: CODE_QUEUE_EGRESS_PROXY_NO_PROXY
+              value: "localhost,127.0.0.1,::1,host.docker.internal,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,backend-core,oa-event-flow,database"
+            - name: HTTP_PROXY
+              value: ""
+            - name: HTTPS_PROXY
+              value: ""
+            - name: ALL_PROXY
+              value: ""
+            - name: http_proxy
+              value: ""
+            - name: https_proxy
+              value: ""
+            - name: all_proxy
+              value: ""
+            - name: NO_PROXY
+              value: "localhost,127.0.0.1,::1,host.docker.internal,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,backend-core,oa-event-flow,database"
+            - name: no_proxy
+              value: "localhost,127.0.0.1,::1,host.docker.internal,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,backend-core,oa-event-flow,database"
+            - name: OA_EVENT_FLOW_BASE_URL
+              value: "http://d601-tcp-egress-gateway.unidesk.svc.cluster.local:4255"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_ENABLED
+              value: "false"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_BASE_URL
+              value: ""
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_TARGET_TYPE
+              value: "private"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_USER_ID
+              value: "645275593"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_MAX_RESPONSE_CHARS
+              value: "12000"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_TIMEOUT_MS
+              value: "15000"
+            - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_SEND_ATTEMPTS
+              value: "3"
+            - name: LOG_FILE
+              value: "/var/log/unidesk/code-queue-d518.jsonl"
+            - name: UNIDESK_LOG_RETENTION_BYTES
+              value: "1GiB"
+          volumeMounts:
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+            - name: workspace
+              mountPath: /workspace
+            - name: repo
+              mountPath: /root/unidesk
+            - name: repo
+              mountPath: /app
+            - name: codex-config
+              mountPath: /root/.codex/config.toml
+              readOnly: true
+            - name: codex-auth
+              mountPath: /root/.codex/auth.json
+              readOnly: true
+            - name: ssh-dir
+              mountPath: /root/.ssh
+              readOnly: true
+            - name: logs
+              mountPath: /var/log/unidesk
+            - name: state
+              mountPath: /var/lib/unidesk/code-queue
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 20
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 60
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              memory: 4Gi
+      volumes:
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+        - name: workspace
+          hostPath:
+            path: /home/ubuntu
+            type: Directory
+        - name: repo
+          hostPath:
+            path: /home/ubuntu/cq-deploy
+            type: Directory
+        - name: codex-config
+          hostPath:
+            path: /home/ubuntu/.codex/config.toml
+            type: File
+        - name: codex-auth
+          hostPath:
+            path: /home/ubuntu/.codex/auth.json
+            type: File
+        - name: ssh-dir
+          hostPath:
+            path: /home/ubuntu/.ssh
+            type: Directory
+        - name: logs
+          hostPath:
+            path: /home/ubuntu/cq-deploy/.state/code-queue/logs
+            type: DirectoryOrCreate
+        - name: state
+          hostPath:
+            path: /home/ubuntu/cq-deploy/.state/code-queue
+            type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: code-queue-d518
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: code-queue
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/deployment-mode: k3sctl-managed
+    unidesk.ai/instance-id: D518
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: code-queue
+    unidesk.ai/instance-id: D518
+  ports:
+    - name: http
+      port: 4222
+      targetPort: http