From 9b6921adebe554e2ff209900d34037fd3d90672b Mon Sep 17 00:00:00 2001 From: Codex Date: Mon, 13 Jul 2026 20:56:31 +0200 Subject: [PATCH] =?UTF-8?q?feat:=20=E5=A3=B0=E6=98=8E=20PikaOA=20=E4=BC=81?= =?UTF-8?q?=E4=B8=9A=E5=B9=B3=E5=8F=B0=E4=BA=A4=E4=BB=98=E5=9F=BA=E7=BA=BF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- config/pikaoa.yaml | 164 +++++++++++++++++++ config/platform-db/postgres-pk01.yaml | 62 +++++++ config/platform-infra/gitea.yaml | 46 ++++++ config/platform-infra/pipelines-as-code.yaml | 63 +++++++ config/secrets-distribution.yaml | 52 ++++++ 5 files changed, 387 insertions(+) create mode 100644 config/pikaoa.yaml diff --git a/config/pikaoa.yaml b/config/pikaoa.yaml new file mode 100644 index 00000000..9e55d3e9 --- /dev/null +++ b/config/pikaoa.yaml @@ -0,0 +1,164 @@ +version: 1 +kind: pikaoa-platform-delivery + +metadata: + id: pikaoa-enterprise + owner: unidesk + repository: pikaInc/pikaoa + spec: PJ2026-03 + relatedIssues: + - 1952 + +defaults: + targetId: NC01 + +modules: + builtIn: + - identity + - partners + - contracts + - invoices + - audit + extensionContract: + registration: module-descriptor + persistence: schema-owned-migrations + api: versioned-http-routes + events: transactional-outbox + workers: named-consumer + +delivery: + targets: + NC01: + node: NC01 + lane: pikaoa + route: NC01:k3s + namespace: pikaoa + ci: + namespace: pikaoa-ci + pipeline: pikaoa-nc01-pac + pipelineRunPrefix: pikaoa-nc01 + serviceAccountName: pikaoa-nc01-tekton-runner + serviceAccountAutomount: false + roleBindingName: pikaoa-nc01-tekton-runner + workspaceSize: 8Gi + pipelineTimeout: 20m0s + toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 + buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless + source: + repository: pikaInc/pikaoa + worktreeRemote: https://github.com/pikaInc/pikaoa.git + branch: master + readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01 + build: + dockerfiles: + api: deploy/api.Dockerfile + worker: deploy/worker.Dockerfile + web: deploy/web.Dockerfile + images: + api: 127.0.0.1:5000/pikaoa/api + worker: 127.0.0.1:5000/pikaoa/worker + web: 127.0.0.1:5000/pikaoa/web + networkMode: host + proxy: + http: http://127.0.0.1:10808 + https: http://127.0.0.1:10808 + all: http://127.0.0.1:10808 + noProxy: + - localhost + - 127.0.0.1 + - "::1" + - 127.0.0.1:5000 + - localhost:5000 + - .svc + - .svc.cluster.local + - .cluster.local + - hyueapi.com + - .hyueapi.com + gitops: + readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + branch: nc01-pikaoa-gitops + manifestPath: deploy/gitops/nc01/resources.yaml + releaseStatePath: deploy/gitops-state/nc01/release.json + credentialSecretName: pac-gitea-pikaoa-nc01 + credentialTokenKey: token + credentialUsername: unidesk-admin + author: + name: PikaOA NC01 CI + email: pikaoa-nc01-ci@unidesk.local + runtime: + workloads: + api: + kind: Deployment + name: pikaoa-api + replicas: 2 + serviceName: pikaoa-api + port: 8080 + healthPath: /healthz + metricsPath: /metrics + worker: + kind: Deployment + name: pikaoa-worker + replicas: 1 + healthPort: 8081 + healthPath: /healthz + metricsPath: /metrics + web: + kind: Deployment + name: pikaoa-web + replicas: 2 + serviceName: pikaoa-web + port: 8080 + healthPath: /healthz + secret: + configRef: config/secrets-distribution.yaml + declarationId: pikaoa-runtime + database: + configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-database-url + observability: + configRef: config/platform-infra/observability.yaml + otlpHttpEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318 + prometheusScrape: true + propagation: + - tracecontext + - baggage + exporterFailure: + warning: true + blocking: false + bootstrapUsers: + administrator: + username: admin + passwordSourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt + employee: + username: employee + passwordSourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt + publicExposure: + enabled: true + publicBaseUrl: https://oa.pikapython.com + dns: + hostname: oa.pikapython.com + expectedA: 82.156.23.220 + resolvers: + - 1.1.1.1 + - 8.8.8.8 + - 223.5.5.5 + - 114.114.114.114 + frpc: + deploymentName: pikaoa-frpc + configMapName: pikaoa-frpc-config + configKey: frpc.toml + image: 127.0.0.1:5000/hwlab/frpc:v0.68.1 + serverAddr: 82.156.23.220 + serverPort: 22000 + proxyName: pikaoa-nc01-web + remotePort: 22096 + localIP: pikaoa-web.pikaoa.svc.cluster.local + localPort: 8080 + tokenEnvName: FRP_TOKEN + tokenTargetKey: FRP_TOKEN + pk01: + route: PK01 + caddyConfigPath: /etc/caddy/Caddyfile + caddyServiceName: caddy + responseHeaderTimeoutSeconds: 60 diff --git a/config/platform-db/postgres-pk01.yaml b/config/platform-db/postgres-pk01.yaml index 949b05c9..8795f1c6 100644 --- a/config/platform-db/postgres-pk01.yaml +++ b/config/platform-db/postgres-pk01.yaml @@ -359,6 +359,21 @@ postgres: user: hwlab_jd01_v03_app address: 74.48.78.17/32 method: scram-sha-256 + - type: hostssl + database: pikaoa + user: pikaoa + address: 10.0.8.0/22 + method: scram-sha-256 + - type: hostssl + database: pikaoa + user: pikaoa + address: 74.48.78.17/32 + method: scram-sha-256 + - type: hostssl + database: pikaoa + user: pikaoa + address: 152.53.229.148/32 + method: scram-sha-256 secrets: source: master-local @@ -462,6 +477,20 @@ secrets: HWLAB_JD01_V03_DB_NAME: hwlab_jd01_v03 randomHex: HWLAB_JD01_V03_DB_PASSWORD: 32 + - name: pikaoa-db-credentials + sourceRef: platform-db/pikaoa-db.env + type: env + requiredKeys: + - PIKAOA_DB_USER + - PIKAOA_DB_PASSWORD + - PIKAOA_DB_NAME + createIfMissing: + enabled: true + values: + PIKAOA_DB_USER: pikaoa + PIKAOA_DB_NAME: pikaoa + randomHex: + PIKAOA_DB_PASSWORD: 32 objects: roles: - name: sub2api @@ -527,6 +556,15 @@ objects: createdb: false createrole: false superuser: false + - name: pikaoa + passwordRef: + sourceRef: platform-db/pikaoa-db.env + key: PIKAOA_DB_PASSWORD + login: true + attributes: + createdb: false + createrole: false + superuser: false databases: - name: sub2api owner: sub2api @@ -563,6 +601,11 @@ objects: encoding: UTF8 locale: C.UTF-8 extensions: [] + - name: pikaoa + owner: pikaoa + encoding: UTF8 + locale: C.UTF-8 + extensions: [] exports: connectionStrings: @@ -705,6 +748,22 @@ exports: - scope: hwlab-jd01-v03 secret: hwlab-v03-openfga key: DATASTORE_URI + - name: pikaoa-database-url + sourceSecretRef: platform-db/pikaoa-db.env + render: + envKey: DATABASE_URL + format: postgresql://$(PIKAOA_DB_USER):$(PIKAOA_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(PIKAOA_DB_NAME)?sslmode=require + variables: + PGHOST: 82.156.23.220 + PGPORT: "5432" + writeToSecretSource: + sourceRef: platform-infra/pikaoa.env + key: DATABASE_URL + mode: update-or-insert + consumers: + - scope: pikaoa + secret: pikaoa-runtime + key: DATABASE_URL backup: phase: minimum-restoreable @@ -750,6 +809,9 @@ observability: - kind: psql-app-role database: hwlab_d601_v03 user: hwlab_d601_v03_app + - kind: psql-app-role + database: pikaoa + user: pikaoa - kind: disk-free path: /var/lib/postgresql/16/main minFreeGiB: 10 diff --git a/config/platform-infra/gitea.yaml b/config/platform-infra/gitea.yaml index 684cf036..75de5401 100644 --- a/config/platform-infra/gitea.yaml +++ b/config/platform-infra/gitea.yaml @@ -400,6 +400,52 @@ sourceAuthority: naming: gitea-actions-immutable-source prefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01 legacyGitMirror: null + - key: pikaoa-nc01 + targetId: NC01 + credentialOverride: + github: + transport: https-token + sourceRef: pikainc-selfmedia-gh-token.txt + sourceKey: GH_TOKEN + format: raw-token + requiredFor: + - upstream-mirror + - mirror-sync + - managed-repository-fetch + - github-head-observe + - github-hooks-list + - github-hooks-reconcile + permissions: + contents: read + metadata: read + webhooks: read-write + gitFetchCredential: + apiVersion: unidesk.ai/v1 + kind: GitFetchCredential + authMode: github-https-token + host: github.com + secretRef: + namespace: devops-infra + name: gitea-github-sync-secrets + key: github-token-pikainc-pikaoa + upstream: + repository: pikaInc/pikaoa + cloneUrl: https://github.com/pikaInc/pikaoa.git + branch: master + visibility: private + gitea: + owner: mirrors + name: pikainc-pikaoa + mirrorMode: controlled-push + publicRead: false + readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + gitops: + branch: nc01-pikaoa-gitops + flushDisposition: gitea-writeback + snapshot: + naming: gitea-actions-immutable-source + prefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01 + legacyGitMirror: null targets: - id: JD01 diff --git a/config/platform-infra/pipelines-as-code.yaml b/config/platform-infra/pipelines-as-code.yaml index b798ac44..a7cc847e 100644 --- a/config/platform-infra/pipelines-as-code.yaml +++ b/config/platform-infra/pipelines-as-code.yaml @@ -211,6 +211,45 @@ repositories: runtime_service_port: "4317" health_path: /healthz health_url: http://selfmedia.selfmedia.svc.cluster.local:4317/healthz + - id: pikaoa-nc01 + name: pikaoa-nc01 + namespace: pikaoa-ci + providerType: gitea + url: https://gitea.pikapython.com/mirrors/pikainc-pikaoa + cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + owner: mirrors + repo: pikainc-pikaoa + secretName: pac-gitea-pikaoa-nc01 + tokenKey: token + webhookSecretKey: webhook.secret + concurrencyLimit: 1 + params: + git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + source_branch: master + source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01 + node: NC01 + pipeline_name: pikaoa-nc01-pac + pipeline_run_prefix: pikaoa-nc01 + service_account: pikaoa-nc01-tekton-runner + pipeline_timeout: 20m0s + workspace_pvc_size: 8Gi + image_repository: 127.0.0.1:5000/pikaoa/api + api_image_repository: 127.0.0.1:5000/pikaoa/api + worker_image_repository: 127.0.0.1:5000/pikaoa/worker + web_image_repository: 127.0.0.1:5000/pikaoa/web + registry_probe_base: http://127.0.0.1:5000 + gitops_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + gitops_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + gitops_branch: nc01-pikaoa-gitops + gitops_username: unidesk-admin + gitops_secret_name: pac-gitea-pikaoa-nc01 + gitops_manifest_path: deploy/gitops/nc01/resources.yaml + runtime_namespace: pikaoa + runtime_deployment: pikaoa-api + runtime_service: pikaoa-web + runtime_service_port: "8080" + health_path: /healthz + health_url: http://pikaoa-web.pikaoa.svc.cluster.local:8080/healthz consumers: - extends: templates.consumers.agentrunV02 variables: @@ -372,6 +411,30 @@ consumers: hostNetwork: true dnsPolicy: ClusterFirstWithHostNet fsGroup: 1000 + - id: pikaoa-nc01 + repositoryRef: pikaoa-nc01 + node: NC01 + lane: pikaoa + namespace: pikaoa-ci + pipeline: pikaoa-nc01-pac + pipelineRunPrefix: pikaoa-nc01 + argoNamespace: argocd + argoApplication: pikaoa-nc01 + closeoutGitOpsMirrorFlush: false + argoBootstrap: + project: default + repoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git + targetRevision: nc01-pikaoa-gitops + path: deploy/gitops/nc01 + destinationNamespace: pikaoa + automated: true + repositoryCredential: + secretName: argocd-repo-pikaoa-nc01 + username: unidesk-admin + runnerServiceAccount: + name: pikaoa-nc01-tekton-runner + automountServiceAccountToken: false + roleBindingName: pikaoa-nc01-tekton-runner templates: repositories: agentrunV02: diff --git a/config/secrets-distribution.yaml b/config/secrets-distribution.yaml index 763323c0..ae2a973a 100644 --- a/config/secrets-distribution.yaml +++ b/config/secrets-distribution.yaml @@ -87,6 +87,17 @@ sources: SUB2RANK_ADMIN_TOKEN: bytes: 32 prefix: srk_ + - sourceRef: platform-infra/pikaoa.env + type: env + requiredKeys: + - DATABASE_URL + - PIKAOA_SESSION_SECRET + createIfMissing: + enabled: true + randomBase64Url: + PIKAOA_SESSION_SECRET: + bytes: 32 + prefix: poa_ - sourceRef: hwlab/jd01-v03-opencode.env type: env requiredKeys: @@ -120,6 +131,22 @@ sources: createIfMissing: enabled: false externalFiles: + - sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt + type: raw-file + required: true + createIfMissing: + enabled: true + randomBase64Url: + bytes: 24 + prefix: poa_ + - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt + type: raw-file + required: true + createIfMissing: + enabled: true + randomBase64Url: + bytes: 24 + prefix: poa_ - sourceRef: ~/.env/TOKEN type: raw-file required: true @@ -165,8 +192,33 @@ targets: namespace: selfmedia scope: selfmedia enabled: true + - id: pikaoa-nc01 + route: NC01:k3s + namespace: pikaoa + scope: pikaoa + enabled: true kubernetesSecrets: + - name: pikaoa-runtime + targetId: pikaoa-nc01 + secretName: pikaoa-runtime + type: Opaque + data: + - sourceRef: platform-infra/pikaoa.env + sourceKey: DATABASE_URL + targetKey: DATABASE_URL + - sourceRef: platform-infra/pikaoa.env + sourceKey: PIKAOA_SESSION_SECRET + targetKey: PIKAOA_SESSION_SECRET + - sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt + sourceKey: contents + targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD + - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt + sourceKey: contents + targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD + - sourceRef: platform-infra/pk01-frp.env + sourceKey: FRP_TOKEN + targetKey: FRP_TOKEN - name: selfmedia-runtime targetId: selfmedia-nc01 secretName: selfmedia-runtime