version: 1 kind: selfmedia-platform-delivery metadata: id: selfmedia-factory owner: unidesk repository: pikainc/selfmedia description: 自媒体工厂在 NC01 的构建、GitOps、运行时与一次性切换真相。 defaults: targetId: NC01 delivery: targets: NC01: node: NC01 lane: selfmedia route: NC01:k3s ci: namespace: selfmedia-ci pipeline: selfmedia-nc01-pac pipelineRunPrefix: selfmedia-nc01 serviceAccountName: selfmedia-nc01-tekton-runner serviceAccountAutomount: false roleBindingName: selfmedia-nc01-tekton-runner workspaceSize: 16Gi pipelineTimeout: 2h0m0s toolImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless source: repository: pikainc/selfmedia worktreeRemote: https://github.com/pikainc/selfmedia.git branch: master readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git snapshotPrefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01 build: dockerfile: deploy/Dockerfile imageRepository: 127.0.0.1:5000/selfmedia/newsroom networkMode: host proxy: http: http://127.0.0.1:10808 https: http://127.0.0.1:10808 all: http://127.0.0.1:10808 noProxy: - localhost - 127.0.0.1 - "::1" - 127.0.0.1:5000 - localhost:5000 - .svc - .svc.cluster.local - .cluster.local - hyueapi.com - .hyueapi.com gitops: readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git branch: nc01-selfmedia-gitops manifestPath: deploy/gitops/nc01/resources.yaml releaseStatePath: deploy/gitops-state/nc01/release.json credentialSecretName: pac-gitea-selfmedia-nc01 credentialTokenKey: token credentialUsername: unidesk-admin author: name: SelfMedia NC01 CI email: selfmedia-nc01-ci@unidesk.local deployment: version: selfmedia.pikapython.com/v1 kind: SelfMediaDeployment metadata: name: selfmedia-nc01 owner: unidesk target: id: NC01 route: NC01:k3s namespace: selfmedia publicHost: 152.53.229.148 runtime: replicas: 1 serviceAccountName: selfmedia imagePullPolicy: IfNotPresent command: - /usr/bin/tini - -- - bun - scripts/selfmedia-cli.ts - server - foreground service: name: selfmedia type: ClusterIP port: 4317 targetPort: 4317 health: path: /healthz startupFailureThreshold: 30 startupPeriodSeconds: 5 readinessPeriodSeconds: 10 livenessPeriodSeconds: 20 resources: requests: cpu: 250m memory: 768Mi limits: cpu: "4" memory: 6Gi securityContext: runAsUser: 10001 runAsGroup: 10001 fsGroup: 10001 runAsNonRoot: true readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: RuntimeDefault dropCapabilities: - ALL writablePaths: tmp: mountPath: /tmp sizeLimit: 2Gi codexHome: mountPath: /home/codex/.codex sizeLimit: 2Gi cache: mountPath: /home/codex/.cache sizeLimit: 2Gi toolCache: mountPath: /app/.tools/cache sizeLimit: 1Gi publicExposure: enabled: true mode: hostPort-http-edge address: http://152.53.229.148:4317 hostPort: 4317 edge: name: selfmedia-public-edge image: caddy:2.10.2-alpine containerPort: 8080 upstream: selfmedia.selfmedia.svc.cluster.local:4317 resources: requests: cpu: 20m memory: 32Mi limits: cpu: 200m memory: 128Mi storage: media: claimName: selfmedia-data storageClassName: local-path accessModes: - ReadWriteOnce size: 40Gi mounts: data: mountPath: /app/data subPath: data state: mountPath: /app/.state subPath: state logs: mountPath: /app/logs subPath: logs codexSessions: claimName: selfmedia-codex-sessions storageClassName: local-path accessModes: - ReadWriteOnce size: 5Gi mounts: sessions: mountPath: /home/codex/.codex/sessions subPath: sessions state: mountPath: /home/codex/.codex/state subPath: state secrets: access: sourceRef: /root/.unidesk/.env/selfmedia-access.env target: secretName: selfmedia-access readOnly: true files: - targetKey: admin-username mountPath: /run/secrets/selfmedia-access/admin-username - targetKey: admin-password mountPath: /run/secrets/selfmedia-access/admin-password - targetKey: api-key mountPath: /run/secrets/selfmedia-access/api-key - targetKey: session-secret mountPath: /run/secrets/selfmedia-access/session-secret runtime: sourceRef: ~/.env/TOKEN target: secretName: selfmedia-runtime targetKey: TOKEN mountPath: /home/codex/.env/TOKEN codex: sources: - sourceRef: ~/.codex/config.toml.pika targetKey: config.toml - sourceRef: ~/.codex/auth.json.pika targetKey: auth.json target: secretName: selfmedia-codex files: - targetKey: config.toml mountPath: /home/codex/.codex/config.toml.pika - targetKey: auth.json mountPath: /home/codex/.codex/auth.json.pika networkPolicy: enabled: true dnsNamespace: kube-system dnsPort: 53 blockedCidrs: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.169.254/32 - 152.53.229.148/32 codex: package: "@openai/codex" version: 0.144.1 executable: codex home: /home/codex codexHome: /home/codex/.codex sessionsPath: /home/codex/.codex/sessions supervisorStatePath: /home/codex/.codex/state/selfmedia-supervisor.json resumeArgs: - resume - --last sourcePath: /app skillsPath: /home/codex/.codex/skills cutover: targets: NC01: mode: host-process-to-kubernetes source: workspace: /root/selfmedia publicAddress: http://152.53.229.148:4317 healthUrl: http://127.0.0.1:4317/healthz stopCommand: - bun - scripts/selfmedia-cli.ts - server - stop startCommand: - bun - scripts/selfmedia-cli.ts - server - start dataPaths: - data - .state - logs excludes: - .state/server.json destination: route: NC01:k3s namespace: selfmedia application: selfmedia-nc01 publicAddress: http://152.53.229.148:4317 healthUrl: http://152.53.229.148:4317/healthz dataClaim: selfmedia-data codexClaim: selfmedia-codex-sessions prepare: requiresFinalConfirmation: true phases: - 校验源服务健康、Secret presence/fingerprint 与目标 PVC - 在线种子复制并记录文件数和字节数 - 停止旧服务、执行最终增量并确认宿主 4317 已释放 - 允许 Argo 首次同步并验证公网健康 rollback: phases: - 暂停 selfmedia-nc01 Argo 自动同步 - 缩容 selfmedia 与 selfmedia-public-edge - 确认宿主 4317 已释放 - 启动旧服务并验证原公网地址 dataPolicy: 回滚默认不反向覆盖旧数据，需单独的数据恢复决策。