version: 1
kind: pikaoa-platform-delivery

metadata:
  id: pikaoa-enterprise
  owner: unidesk
  repository: pikainc/pikaoa
  spec: PJ2026-03
  relatedIssues:
    - 1952

defaults:
  targetId: NC01

modules:
  builtIn:
    - identity
    - partners
    - contracts
    - invoices
    - audit
  extensionContract:
    registration: module-descriptor
    persistence: schema-owned-migrations
    api: versioned-http-routes
    events: transactional-outbox
    workers: named-consumer

delivery:
  targets:
    NC01:
      node: NC01
      lane: pikaoa
      route: NC01:k3s
      namespace: pikaoa
      ci:
        namespace: pikaoa-ci
        pipeline: pikaoa-nc01-pac
        pipelineRunPrefix: pikaoa-nc01
        serviceAccountName: pikaoa-nc01-tekton-runner
        serviceAccountAutomount: false
        roleBindingName: pikaoa-nc01-tekton-runner
        workspaceSize: 8Gi
        pipelineTimeout: 20m0s
        toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
        buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
      source:
        repository: pikainc/pikaoa
        worktreeRemote: https://github.com/pikainc/pikaoa.git
        branch: master
        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
        snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01
      build:
        dockerfiles:
          api: deploy/api.Dockerfile
          worker: deploy/worker.Dockerfile
          web: deploy/web.Dockerfile
        images:
          api: 127.0.0.1:5000/pikaoa/api
          worker: 127.0.0.1:5000/pikaoa/worker
          web: 127.0.0.1:5000/pikaoa/web
        networkMode: host
        proxy:
          http: http://127.0.0.1:10808
          https: http://127.0.0.1:10808
          all: http://127.0.0.1:10808
          noProxy:
            - localhost
            - 127.0.0.1
            - "::1"
            - 127.0.0.1:5000
            - localhost:5000
            - .svc
            - .svc.cluster.local
            - .cluster.local
            - hyueapi.com
            - .hyueapi.com
      gitops:
        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
        writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
        branch: nc01-pikaoa-gitops
        manifestPath: deploy/gitops/nc01/resources.yaml
        releaseStatePath: deploy/gitops-state/nc01/release.json
        credentialSecretName: pac-gitea-pikaoa-nc01
        credentialTokenKey: token
        credentialUsername: unidesk-admin
        author:
          name: PikaOA NC01 CI
          email: pikaoa-nc01-ci@unidesk.local
      runtime:
        workloads:
          api:
            kind: Deployment
            name: pikaoa-api
            replicas: 2
            serviceName: pikaoa-api
            port: 8080
            healthPath: /healthz
            metricsPath: /metrics
          worker:
            kind: Deployment
            name: pikaoa-worker
            replicas: 1
            healthPort: 8081
            healthPath: /healthz
            metricsPath: /metrics
          web:
            kind: Deployment
            name: pikaoa-web
            replicas: 2
            serviceName: pikaoa-web
            port: 8080
            healthPath: /healthz
        secret:
          configRef: config/secrets-distribution.yaml
          declarationId: pikaoa-runtime
        database:
          configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-database-url
        observability:
          configRef: config/platform-infra/observability.yaml
          otlpHttpEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318
          prometheusScrape: true
          propagation:
            - tracecontext
            - baggage
          exporterFailure:
            warning: true
            blocking: false
      bootstrapUsers:
        administrator:
          username: admin
          passwordSourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
        employee:
          username: employee
          passwordSourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
      publicExposure:
        enabled: true
        publicBaseUrl: https://oa.pikapython.com
        dns:
          hostname: oa.pikapython.com
          expectedA: 82.156.23.220
          resolvers:
            - 1.1.1.1
            - 8.8.8.8
            - 223.5.5.5
            - 114.114.114.114
        frpc:
          deploymentName: pikaoa-frpc
          configMapName: pikaoa-frpc-config
          configKey: frpc.toml
          image: 127.0.0.1:5000/hwlab/frpc:v0.68.1
          serverAddr: 82.156.23.220
          serverPort: 22000
          proxyName: pikaoa-nc01-web
          remotePort: 22096
          localIP: pikaoa-web.pikaoa.svc.cluster.local
          localPort: 8080
          tokenEnvName: FRP_TOKEN
          tokenTargetKey: FRP_TOKEN
        pk01:
          route: PK01
          caddyConfigPath: /etc/caddy/Caddyfile
          caddyServiceName: caddy
          responseHeaderTimeoutSeconds: 60