feat: 声明 PikaOA 企业平台交付基线

config/pikaoa.yaml

@@ -0,0 +1,164 @@
+version: 1
+kind: pikaoa-platform-delivery
+
+metadata:
+  id: pikaoa-enterprise
+  owner: unidesk
+  repository: pikaInc/pikaoa
+  spec: PJ2026-03
+  relatedIssues:
+    - 1952
+
+defaults:
+  targetId: NC01
+
+modules:
+  builtIn:
+    - identity
+    - partners
+    - contracts
+    - invoices
+    - audit
+  extensionContract:
+    registration: module-descriptor
+    persistence: schema-owned-migrations
+    api: versioned-http-routes
+    events: transactional-outbox
+    workers: named-consumer
+
+delivery:
+  targets:
+    NC01:
+      node: NC01
+      lane: pikaoa
+      route: NC01:k3s
+      namespace: pikaoa
+      ci:
+        namespace: pikaoa-ci
+        pipeline: pikaoa-nc01-pac
+        pipelineRunPrefix: pikaoa-nc01
+        serviceAccountName: pikaoa-nc01-tekton-runner
+        serviceAccountAutomount: false
+        roleBindingName: pikaoa-nc01-tekton-runner
+        workspaceSize: 8Gi
+        pipelineTimeout: 20m0s
+        toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
+        buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
+      source:
+        repository: pikaInc/pikaoa
+        worktreeRemote: https://github.com/pikaInc/pikaoa.git
+        branch: master
+        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+        snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01
+      build:
+        dockerfiles:
+          api: deploy/api.Dockerfile
+          worker: deploy/worker.Dockerfile
+          web: deploy/web.Dockerfile
+        images:
+          api: 127.0.0.1:5000/pikaoa/api
+          worker: 127.0.0.1:5000/pikaoa/worker
+          web: 127.0.0.1:5000/pikaoa/web
+        networkMode: host
+        proxy:
+          http: http://127.0.0.1:10808
+          https: http://127.0.0.1:10808
+          all: http://127.0.0.1:10808
+          noProxy:
+            - localhost
+            - 127.0.0.1
+            - "::1"
+            - 127.0.0.1:5000
+            - localhost:5000
+            - .svc
+            - .svc.cluster.local
+            - .cluster.local
+            - hyueapi.com
+            - .hyueapi.com
+      gitops:
+        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+        writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+        branch: nc01-pikaoa-gitops
+        manifestPath: deploy/gitops/nc01/resources.yaml
+        releaseStatePath: deploy/gitops-state/nc01/release.json
+        credentialSecretName: pac-gitea-pikaoa-nc01
+        credentialTokenKey: token
+        credentialUsername: unidesk-admin
+        author:
+          name: PikaOA NC01 CI
+          email: pikaoa-nc01-ci@unidesk.local
+      runtime:
+        workloads:
+          api:
+            kind: Deployment
+            name: pikaoa-api
+            replicas: 2
+            serviceName: pikaoa-api
+            port: 8080
+            healthPath: /healthz
+            metricsPath: /metrics
+          worker:
+            kind: Deployment
+            name: pikaoa-worker
+            replicas: 1
+            healthPort: 8081
+            healthPath: /healthz
+            metricsPath: /metrics
+          web:
+            kind: Deployment
+            name: pikaoa-web
+            replicas: 2
+            serviceName: pikaoa-web
+            port: 8080
+            healthPath: /healthz
+        secret:
+          configRef: config/secrets-distribution.yaml
+          declarationId: pikaoa-runtime
+        database:
+          configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-database-url
+        observability:
+          configRef: config/platform-infra/observability.yaml
+          otlpHttpEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318
+          prometheusScrape: true
+          propagation:
+            - tracecontext
+            - baggage
+          exporterFailure:
+            warning: true
+            blocking: false
+      bootstrapUsers:
+        administrator:
+          username: admin
+          passwordSourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
+        employee:
+          username: employee
+          passwordSourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
+      publicExposure:
+        enabled: true
+        publicBaseUrl: https://oa.pikapython.com
+        dns:
+          hostname: oa.pikapython.com
+          expectedA: 82.156.23.220
+          resolvers:
+            - 1.1.1.1
+            - 8.8.8.8
+            - 223.5.5.5
+            - 114.114.114.114
+        frpc:
+          deploymentName: pikaoa-frpc
+          configMapName: pikaoa-frpc-config
+          configKey: frpc.toml
+          image: 127.0.0.1:5000/hwlab/frpc:v0.68.1
+          serverAddr: 82.156.23.220
+          serverPort: 22000
+          proxyName: pikaoa-nc01-web
+          remotePort: 22096
+          localIP: pikaoa-web.pikaoa.svc.cluster.local
+          localPort: 8080
+          tokenEnvName: FRP_TOKEN
+          tokenTargetKey: FRP_TOKEN
+        pk01:
+          route: PK01
+          caddyConfigPath: /etc/caddy/Caddyfile
+          caddyServiceName: caddy
+          responseHeaderTimeoutSeconds: 60

config/platform-db/postgres-pk01.yaml

@@ -359,6 +359,21 @@ postgres:
         user: hwlab_jd01_v03_app
         address: 74.48.78.17/32
         method: scram-sha-256
+      - type: hostssl
+        database: pikaoa
+        user: pikaoa
+        address: 10.0.8.0/22
+        method: scram-sha-256
+      - type: hostssl
+        database: pikaoa
+        user: pikaoa
+        address: 74.48.78.17/32
+        method: scram-sha-256
+      - type: hostssl
+        database: pikaoa
+        user: pikaoa
+        address: 152.53.229.148/32
+        method: scram-sha-256
 
 secrets:
   source: master-local
@@ -462,6 +477,20 @@ secrets:
           HWLAB_JD01_V03_DB_NAME: hwlab_jd01_v03
         randomHex:
           HWLAB_JD01_V03_DB_PASSWORD: 32
+    - name: pikaoa-db-credentials
+      sourceRef: platform-db/pikaoa-db.env
+      type: env
+      requiredKeys:
+        - PIKAOA_DB_USER
+        - PIKAOA_DB_PASSWORD
+        - PIKAOA_DB_NAME
+      createIfMissing:
+        enabled: true
+        values:
+          PIKAOA_DB_USER: pikaoa
+          PIKAOA_DB_NAME: pikaoa
+        randomHex:
+          PIKAOA_DB_PASSWORD: 32
 objects:
   roles:
     - name: sub2api
@@ -527,6 +556,15 @@ objects:
         createdb: false
         createrole: false
         superuser: false
+    - name: pikaoa
+      passwordRef:
+        sourceRef: platform-db/pikaoa-db.env
+        key: PIKAOA_DB_PASSWORD
+      login: true
+      attributes:
+        createdb: false
+        createrole: false
+        superuser: false
   databases:
     - name: sub2api
       owner: sub2api
@@ -563,6 +601,11 @@ objects:
       encoding: UTF8
       locale: C.UTF-8
       extensions: []
+    - name: pikaoa
+      owner: pikaoa
+      encoding: UTF8
+      locale: C.UTF-8
+      extensions: []
 
 exports:
   connectionStrings:
@@ -705,6 +748,22 @@ exports:
         - scope: hwlab-jd01-v03
           secret: hwlab-v03-openfga
           key: DATASTORE_URI
+    - name: pikaoa-database-url
+      sourceSecretRef: platform-db/pikaoa-db.env
+      render:
+        envKey: DATABASE_URL
+        format: postgresql://$(PIKAOA_DB_USER):$(PIKAOA_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(PIKAOA_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 82.156.23.220
+          PGPORT: "5432"
+      writeToSecretSource:
+        sourceRef: platform-infra/pikaoa.env
+        key: DATABASE_URL
+        mode: update-or-insert
+      consumers:
+        - scope: pikaoa
+          secret: pikaoa-runtime
+          key: DATABASE_URL
 
 backup:
   phase: minimum-restoreable
@@ -750,6 +809,9 @@ observability:
     - kind: psql-app-role
       database: hwlab_d601_v03
       user: hwlab_d601_v03_app
+    - kind: psql-app-role
+      database: pikaoa
+      user: pikaoa
     - kind: disk-free
       path: /var/lib/postgresql/16/main
       minFreeGiB: 10

config/platform-infra/gitea.yaml

@@ -400,6 +400,52 @@ sourceAuthority:
         naming: gitea-actions-immutable-source
         prefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
       legacyGitMirror: null
+    - key: pikaoa-nc01
+      targetId: NC01
+      credentialOverride:
+        github:
+          transport: https-token
+          sourceRef: pikainc-selfmedia-gh-token.txt
+          sourceKey: GH_TOKEN
+          format: raw-token
+          requiredFor:
+            - upstream-mirror
+            - mirror-sync
+            - managed-repository-fetch
+            - github-head-observe
+            - github-hooks-list
+            - github-hooks-reconcile
+          permissions:
+            contents: read
+            metadata: read
+            webhooks: read-write
+          gitFetchCredential:
+            apiVersion: unidesk.ai/v1
+            kind: GitFetchCredential
+            authMode: github-https-token
+            host: github.com
+            secretRef:
+              namespace: devops-infra
+              name: gitea-github-sync-secrets
+              key: github-token-pikainc-pikaoa
+      upstream:
+        repository: pikaInc/pikaoa
+        cloneUrl: https://github.com/pikaInc/pikaoa.git
+        branch: master
+        visibility: private
+      gitea:
+        owner: mirrors
+        name: pikainc-pikaoa
+        mirrorMode: controlled-push
+        publicRead: false
+        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+      gitops:
+        branch: nc01-pikaoa-gitops
+        flushDisposition: gitea-writeback
+      snapshot:
+        naming: gitea-actions-immutable-source
+        prefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01
+      legacyGitMirror: null
 
 targets:
   - id: JD01

config/platform-infra/pipelines-as-code.yaml

@@ -211,6 +211,45 @@ repositories:
       runtime_service_port: "4317"
       health_path: /healthz
       health_url: http://selfmedia.selfmedia.svc.cluster.local:4317/healthz
+  - id: pikaoa-nc01
+    name: pikaoa-nc01
+    namespace: pikaoa-ci
+    providerType: gitea
+    url: https://gitea.pikapython.com/mirrors/pikainc-pikaoa
+    cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+    owner: mirrors
+    repo: pikainc-pikaoa
+    secretName: pac-gitea-pikaoa-nc01
+    tokenKey: token
+    webhookSecretKey: webhook.secret
+    concurrencyLimit: 1
+    params:
+      git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+      source_branch: master
+      source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01
+      node: NC01
+      pipeline_name: pikaoa-nc01-pac
+      pipeline_run_prefix: pikaoa-nc01
+      service_account: pikaoa-nc01-tekton-runner
+      pipeline_timeout: 20m0s
+      workspace_pvc_size: 8Gi
+      image_repository: 127.0.0.1:5000/pikaoa/api
+      api_image_repository: 127.0.0.1:5000/pikaoa/api
+      worker_image_repository: 127.0.0.1:5000/pikaoa/worker
+      web_image_repository: 127.0.0.1:5000/pikaoa/web
+      registry_probe_base: http://127.0.0.1:5000
+      gitops_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+      gitops_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+      gitops_branch: nc01-pikaoa-gitops
+      gitops_username: unidesk-admin
+      gitops_secret_name: pac-gitea-pikaoa-nc01
+      gitops_manifest_path: deploy/gitops/nc01/resources.yaml
+      runtime_namespace: pikaoa
+      runtime_deployment: pikaoa-api
+      runtime_service: pikaoa-web
+      runtime_service_port: "8080"
+      health_path: /healthz
+      health_url: http://pikaoa-web.pikaoa.svc.cluster.local:8080/healthz
 consumers:
   - extends: templates.consumers.agentrunV02
     variables:
@@ -372,6 +411,30 @@ consumers:
         hostNetwork: true
         dnsPolicy: ClusterFirstWithHostNet
         fsGroup: 1000
+  - id: pikaoa-nc01
+    repositoryRef: pikaoa-nc01
+    node: NC01
+    lane: pikaoa
+    namespace: pikaoa-ci
+    pipeline: pikaoa-nc01-pac
+    pipelineRunPrefix: pikaoa-nc01
+    argoNamespace: argocd
+    argoApplication: pikaoa-nc01
+    closeoutGitOpsMirrorFlush: false
+    argoBootstrap:
+      project: default
+      repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
+      targetRevision: nc01-pikaoa-gitops
+      path: deploy/gitops/nc01
+      destinationNamespace: pikaoa
+      automated: true
+      repositoryCredential:
+        secretName: argocd-repo-pikaoa-nc01
+        username: unidesk-admin
+    runnerServiceAccount:
+      name: pikaoa-nc01-tekton-runner
+      automountServiceAccountToken: false
+      roleBindingName: pikaoa-nc01-tekton-runner
 templates:
   repositories:
     agentrunV02:

config/secrets-distribution.yaml

@@ -87,6 +87,17 @@ sources:
           SUB2RANK_ADMIN_TOKEN:
             bytes: 32
             prefix: srk_
+    - sourceRef: platform-infra/pikaoa.env
+      type: env
+      requiredKeys:
+        - DATABASE_URL
+        - PIKAOA_SESSION_SECRET
+      createIfMissing:
+        enabled: true
+        randomBase64Url:
+          PIKAOA_SESSION_SECRET:
+            bytes: 32
+            prefix: poa_
     - sourceRef: hwlab/jd01-v03-opencode.env
       type: env
       requiredKeys:
@@ -120,6 +131,22 @@ sources:
       createIfMissing:
         enabled: false
   externalFiles:
+    - sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
+      type: raw-file
+      required: true
+      createIfMissing:
+        enabled: true
+        randomBase64Url:
+          bytes: 24
+          prefix: poa_
+    - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
+      type: raw-file
+      required: true
+      createIfMissing:
+        enabled: true
+        randomBase64Url:
+          bytes: 24
+          prefix: poa_
     - sourceRef: ~/.env/TOKEN
       type: raw-file
       required: true
@@ -165,8 +192,33 @@ targets:
     namespace: selfmedia
     scope: selfmedia
     enabled: true
+  - id: pikaoa-nc01
+    route: NC01:k3s
+    namespace: pikaoa
+    scope: pikaoa
+    enabled: true
 
 kubernetesSecrets:
+  - name: pikaoa-runtime
+    targetId: pikaoa-nc01
+    secretName: pikaoa-runtime
+    type: Opaque
+    data:
+      - sourceRef: platform-infra/pikaoa.env
+        sourceKey: DATABASE_URL
+        targetKey: DATABASE_URL
+      - sourceRef: platform-infra/pikaoa.env
+        sourceKey: PIKAOA_SESSION_SECRET
+        targetKey: PIKAOA_SESSION_SECRET
+      - sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
+        sourceKey: contents
+        targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD
+      - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
+        sourceKey: contents
+        targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD
+      - sourceRef: platform-infra/pk01-frp.env
+        sourceKey: FRP_TOKEN
+        targetKey: FRP_TOKEN
   - name: selfmedia-runtime
     targetId: selfmedia-nc01
     secretName: selfmedia-runtime