version: 1 kind: pikaoa-platform-delivery metadata: id: pikaoa-enterprise owner: unidesk repository: pikainc/pikaoa spec: PJ2026-03 relatedIssues: - 1952 defaults: targetId: NC01 modules: builtIn: - identity - partners - contracts - invoices - audit extensionContract: registration: module-descriptor persistence: schema-owned-initialization api: versioned-http-routes events: transactional-outbox workers: named-consumer testRuntime: defaultTargetId: NC01 targets: NC01: enabled: true validationOnly: false node: NC01 route: NC01:k3s namespace: pikaoa-test ttlSeconds: 86400 waitTimeoutSeconds: 300 fieldManager: unidesk-pikaoa-test-target taskState: rootPath: /var/lib/unidesk/pikaoa-test-target statusRequestTimeoutSeconds: 10 logTailLines: 80 cleanup: mode: delete-namespace requireOwnershipLabels: true source: mode: prebuilt-images repository: pikainc/pikaoa commitPolicy: cli-required branch: master worktreeRemote: https://github.com/pikainc/pikaoa.git readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01 images: api: 127.0.0.1:5000/pikaoa/api:${commit} worker: 127.0.0.1:5000/pikaoa/worker:${commit} web: 127.0.0.1:5000/pikaoa/web:${commit} initializer: 127.0.0.1:5000/pikaoa/api:${commit} pullPolicy: IfNotPresent ci: lane: pikaoa-test namespace: pikaoa-ci pipeline: pikaoa-test-nc01-pac pipelineRunPrefix: pikaoa-test-nc01 serviceAccountName: pikaoa-test-nc01-tekton-runner workspaceSize: 8Gi pipelineTimeout: 20m0s toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless build: dockerfiles: api: deploy/api.Dockerfile worker: deploy/worker.Dockerfile web: deploy/web.Dockerfile images: api: 127.0.0.1:5000/pikaoa/api worker: 127.0.0.1:5000/pikaoa/worker web: 127.0.0.1:5000/pikaoa/web networkMode: host gitops: readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git branch: nc01-pikaoa-test-gitops manifestPath: deploy/gitops/nc01-test/resources.yaml credential: secretName: pac-gitea-pikaoa-test-nc01 tokenKey: token username: unidesk-admin author: name: PikaOA Test NC01 CI email: pikaoa-test-nc01-ci@unidesk.local database: configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-test-database-url name: pikaoa_test username: pikaoa_test schema: pikaoa connection: sourceRef: /root/.unidesk/.state/secrets/platform-infra/pikaoa-test.env sourceKey: DATABASE_URL targetKey: DATABASE_URL runtime: replicas: api: 1 worker: 1 web: 1 resources: api: { requests: { cpu: 100m, memory: 128Mi }, limits: { cpu: 1, memory: 512Mi } } worker: { requests: { cpu: 100m, memory: 128Mi }, limits: { cpu: 1, memory: 512Mi } } web: { requests: { cpu: 50m, memory: 64Mi }, limits: { cpu: 500m, memory: 256Mi } } initializer: { requests: { cpu: 100m, memory: 128Mi }, limits: { cpu: 1, memory: 512Mi } } secretName: pikaoa-test-runtime apiServiceName: pikaoa-api apiPort: 8080 workerMetricsPort: 8081 webPort: 8080 webApiUpstreamEnv: PIKAOA_API_UPSTREAM attachment: storageRoot: /var/lib/pikaoa/attachments maxBytes: 104857600 claimName: pikaoa-attachments storageRequest: 10Gi storageClassName: null fsGroup: 65532 accessModes: - ReadWriteOnce workerInterval: 2s outbox: batchSize: 50 maxAttempts: 4 retryDelay: 2s sessionTTL: 8h shutdownTimeout: 10s administrator: username: admin password: sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD employee: username: employee password: sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD sessionSecret: sourceRef: /root/.unidesk/.state/secrets/platform-infra/pikaoa-test.env sourceKey: PIKAOA_SESSION_SECRET targetKey: PIKAOA_SESSION_SECRET initializer: mode: fresh-database-only jobName: pikaoa-init backoffLimit: 2 command: - /usr/local/bin/pikaoa - migrate - up - --config - /etc/pikaoa/pikaoa.yaml exposure: serviceName: pikaoa-web serviceType: NodePort hostIP: 152.53.229.148 port: 32080 observability: configRef: config/platform-infra/observability.yaml otlpEndpoint: otel-collector.platform-infra.svc.cluster.local:4317 prometheus: configRef: config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector scrape: true apiPath: /metrics workerPath: /metrics exporterFailure: warning: true blocking: false probes: api: livenessPath: /healthz readinessPath: /readyz worker: livenessPath: /healthz readinessPath: /readyz web: livenessPath: /healthz readinessPath: /healthz releaseRuntime: defaultTargetId: NC01 targets: NC01: enabled: true validationOnly: false node: NC01 route: NC01:k3s namespace: pikaoa ttlSeconds: 86400 waitTimeoutSeconds: 300 fieldManager: unidesk-pikaoa-release-runtime taskState: rootPath: /var/lib/unidesk/pikaoa-release-runtime statusRequestTimeoutSeconds: 10 logTailLines: 80 cleanup: mode: delete-namespace requireOwnershipLabels: true source: mode: prebuilt-images repository: pikainc/pikaoa commitPolicy: cli-required branch: release worktreeRemote: https://github.com/pikainc/pikaoa.git readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-release-nc01 images: api: 127.0.0.1:5000/pikaoa/api:${commit} worker: 127.0.0.1:5000/pikaoa/worker:${commit} web: 127.0.0.1:5000/pikaoa/web:${commit} initializer: 127.0.0.1:5000/pikaoa/api:${commit} pullPolicy: IfNotPresent ci: lane: pikaoa namespace: pikaoa-ci pipeline: pikaoa-nc01-pac pipelineRunPrefix: pikaoa-nc01 serviceAccountName: pikaoa-nc01-tekton-runner workspaceSize: 8Gi pipelineTimeout: 20m0s toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless build: dockerfiles: api: deploy/api.Dockerfile worker: deploy/worker.Dockerfile web: deploy/web.Dockerfile images: api: 127.0.0.1:5000/pikaoa/api worker: 127.0.0.1:5000/pikaoa/worker web: 127.0.0.1:5000/pikaoa/web networkMode: host gitops: readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git branch: nc01-pikaoa-gitops manifestPath: deploy/gitops/nc01/resources.yaml credential: secretName: pac-gitea-pikaoa-nc01 tokenKey: token username: unidesk-admin author: name: PikaOA NC01 CI email: pikaoa-nc01-ci@unidesk.local database: configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-database-url name: pikaoa username: pikaoa schema: pikaoa connection: sourceRef: /root/.unidesk/.state/secrets/platform-infra/pikaoa.env sourceKey: DATABASE_URL targetKey: DATABASE_URL runtime: replicas: api: 1 worker: 1 web: 1 resources: api: { requests: { cpu: 250m, memory: 256Mi }, limits: { cpu: 1, memory: 1Gi } } worker: { requests: { cpu: 100m, memory: 256Mi }, limits: { cpu: 1, memory: 1Gi } } web: { requests: { cpu: 100m, memory: 128Mi }, limits: { cpu: 500m, memory: 512Mi } } initializer: { requests: { cpu: 250m, memory: 256Mi }, limits: { cpu: 1, memory: 1Gi } } secretName: pikaoa-runtime apiServiceName: pikaoa-api apiPort: 8080 workerMetricsPort: 8081 webPort: 8080 webApiUpstreamEnv: PIKAOA_API_UPSTREAM attachment: storageRoot: /var/lib/pikaoa/attachments maxBytes: 104857600 claimName: pikaoa-attachments storageRequest: 20Gi storageClassName: null fsGroup: 65532 accessModes: - ReadWriteOnce workerInterval: 2s outbox: batchSize: 50 maxAttempts: 4 retryDelay: 2s sessionTTL: 8h shutdownTimeout: 10s administrator: username: admin password: sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD employee: username: employee password: sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD sessionSecret: sourceRef: /root/.unidesk/.state/secrets/platform-infra/pikaoa.env sourceKey: PIKAOA_SESSION_SECRET targetKey: PIKAOA_SESSION_SECRET initializer: mode: fresh-database-only jobName: pikaoa-init backoffLimit: 2 command: - /usr/local/bin/pikaoa - migrate - up - --config - /etc/pikaoa/pikaoa.yaml exposure: serviceName: pikaoa-web serviceType: NodePort hostIP: 152.53.229.148 port: 32096 observability: configRef: config/platform-infra/observability.yaml otlpEndpoint: otel-collector.platform-infra.svc.cluster.local:4317 prometheus: configRef: config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector scrape: true apiPath: /metrics workerPath: /metrics exporterFailure: warning: true blocking: false probes: api: livenessPath: /healthz readinessPath: /readyz worker: livenessPath: /healthz readinessPath: /readyz web: livenessPath: /healthz readinessPath: /healthz delivery: targets: NC01: node: NC01 lane: pikaoa route: NC01:k3s namespace: pikaoa ci: namespace: pikaoa-ci pipeline: pikaoa-nc01-pac pipelineRunPrefix: pikaoa-nc01 serviceAccountName: pikaoa-nc01-tekton-runner serviceAccountAutomount: false roleBindingName: pikaoa-nc01-tekton-runner workspaceSize: 8Gi pipelineTimeout: 20m0s toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless source: repository: pikainc/pikaoa worktreeRemote: https://github.com/pikainc/pikaoa.git branch: release readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-release-nc01 build: dockerfiles: api: deploy/api.Dockerfile worker: deploy/worker.Dockerfile web: deploy/web.Dockerfile images: api: 127.0.0.1:5000/pikaoa/api worker: 127.0.0.1:5000/pikaoa/worker web: 127.0.0.1:5000/pikaoa/web networkMode: host proxy: http: http://127.0.0.1:10808 https: http://127.0.0.1:10808 all: http://127.0.0.1:10808 noProxy: - localhost - 127.0.0.1 - "::1" - 127.0.0.1:5000 - localhost:5000 - .svc - .svc.cluster.local - .cluster.local - hyueapi.com - .hyueapi.com gitops: readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git branch: nc01-pikaoa-gitops manifestPath: deploy/gitops/nc01/resources.yaml releaseStatePath: deploy/gitops-state/nc01/release.json credentialSecretName: pac-gitea-pikaoa-nc01 credentialTokenKey: token credentialUsername: unidesk-admin author: name: PikaOA NC01 CI email: pikaoa-nc01-ci@unidesk.local runtime: workloads: api: kind: Deployment name: pikaoa-api replicas: 2 serviceName: pikaoa-api port: 8080 healthPath: /healthz metricsPath: /metrics worker: kind: Deployment name: pikaoa-worker replicas: 1 healthPort: 8081 healthPath: /healthz metricsPath: /metrics web: kind: Deployment name: pikaoa-web replicas: 2 serviceName: pikaoa-web port: 8080 healthPath: /healthz secret: configRef: config/secrets-distribution.yaml declarationId: pikaoa-runtime database: configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-database-url observability: configRef: config/platform-infra/observability.yaml otlpEndpoint: otel-collector.platform-infra.svc.cluster.local:4317 prometheusScrape: true propagation: - tracecontext - baggage exporterFailure: warning: true blocking: false bootstrapUsers: administrator: username: admin passwordSourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt employee: username: employee passwordSourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt publicExposure: enabled: true publicBaseUrl: https://oa.pikapython.com dns: hostname: oa.pikapython.com expectedA: 82.156.23.220 resolvers: - 1.1.1.1 - 8.8.8.8 - 223.5.5.5 - 114.114.114.114 frpc: deploymentName: pikaoa-frpc configMapName: pikaoa-frpc-config configKey: frpc.toml image: 127.0.0.1:5000/hwlab/frpc:v0.68.1 serverAddr: 82.156.23.220 serverPort: 22000 proxyName: pikaoa-nc01-web remotePort: 22096 localIP: pikaoa-web.pikaoa.svc.cluster.local localPort: 8080 tokenEnvName: FRP_TOKEN tokenTargetKey: FRP_TOKEN pk01: route: PK01 caddyConfigPath: /etc/caddy/Caddyfile caddyServiceName: caddy responseHeaderTimeoutSeconds: 60