mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
abc461a3bf1ceb072d1d53ceba3f53bdde9848e1
pikasTech-unidesk/config/pikaoa.yaml
T
Codex 4fa0c4fe70 fix: keep Hysteria UDP 443 beside Caddy
2026-07-15 10:58:41 +02:00

503 lines
16 KiB
YAML
Raw Blame History

version: 1
kind: pikaoa-platform-delivery
metadata:
id: pikaoa-enterprise
owner: unidesk
repository: pikainc/pikaoa
spec: PJ2026-03
relatedIssues:
- 1952
defaults:
targetId: NC01
modules:
builtIn:
- identity
- partners
- contracts
- invoices
- audit
extensionContract:
registration: module-descriptor
persistence: schema-owned-initialization
api: versioned-http-routes
events: transactional-outbox
workers: named-consumer
testRuntime:
defaultTargetId: NC01
targets:
NC01:
enabled: true
validationOnly: false
node: NC01
route: NC01:k3s
namespace: pikaoa-test
ttlSeconds: 86400
waitTimeoutSeconds: 300
fieldManager: unidesk-pikaoa-test-target
taskState:
rootPath: /var/lib/unidesk/pikaoa-test-target
statusRequestTimeoutSeconds: 10
logTailLines: 80
cleanup:
mode: delete-namespace
requireOwnershipLabels: true
source:
mode: prebuilt-images
repository: pikainc/pikaoa
commitPolicy: cli-required
branch: master
worktreeRemote: https://github.com/pikainc/pikaoa.git
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-master-nc01
images:
api: 127.0.0.1:5000/pikaoa/api:${commit}
worker: 127.0.0.1:5000/pikaoa/worker:${commit}
web: 127.0.0.1:5000/pikaoa/web:${commit}
initializer: 127.0.0.1:5000/pikaoa/api:${commit}
pullPolicy: IfNotPresent
ci:
lane: pikaoa-test
namespace: pikaoa-ci
pipeline: pikaoa-test-nc01-pac
pipelineRunPrefix: pikaoa-test-nc01
serviceAccountName: pikaoa-test-nc01-tekton-runner
workspaceSize: 8Gi
pipelineTimeout: 20m0s
toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
build:
dockerfiles:
api: deploy/api.Dockerfile
worker: deploy/worker.Dockerfile
web: deploy/web.Dockerfile
images:
api: 127.0.0.1:5000/pikaoa/api
worker: 127.0.0.1:5000/pikaoa/worker
web: 127.0.0.1:5000/pikaoa/web
networkMode: host
gitops:
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
branch: nc01-pikaoa-test-gitops
manifestPath: deploy/gitops/nc01-test/resources.yaml
credential:
secretName: pac-gitea-pikaoa-test-nc01
tokenKey: token
username: unidesk-admin
author:
name: PikaOA Test NC01 CI
email: pikaoa-test-nc01-ci@unidesk.local
database:
configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-test-database-url
name: pikaoa_test
username: pikaoa_test
schema: pikaoa
connection:
sourceRef: /root/.unidesk/.state/secrets/platform-infra/pikaoa-test.env
sourceKey: DATABASE_URL
targetKey: DATABASE_URL
runtime:
replicas:
api: 1
worker: 1
web: 1
resources:
api: { requests: { cpu: 100m, memory: 128Mi }, limits: { cpu: 1, memory: 512Mi } }
worker: { requests: { cpu: 100m, memory: 128Mi }, limits: { cpu: 1, memory: 512Mi } }
web: { requests: { cpu: 50m, memory: 64Mi }, limits: { cpu: 500m, memory: 256Mi } }
initializer: { requests: { cpu: 100m, memory: 128Mi }, limits: { cpu: 1, memory: 512Mi } }
secretName: pikaoa-test-runtime
apiServiceName: pikaoa-api
apiPort: 8080
workerMetricsPort: 8081
webPort: 8080
webApiUpstreamEnv: PIKAOA_API_UPSTREAM
attachment:
storageRoot: /var/lib/pikaoa/attachments
maxBytes: 104857600
claimName: pikaoa-attachments
storageRequest: 10Gi
storageClassName: null
fsGroup: 65532
accessModes:
- ReadWriteOnce
workerInterval: 2s
outbox:
batchSize: 50
maxAttempts: 4
retryDelay: 2s
sessionTTL: 8h
shutdownTimeout: 10s
administrator:
username: admin
password:
sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD
employee:
username: employee
password:
sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD
sessionSecret:
sourceRef: /root/.unidesk/.state/secrets/platform-infra/pikaoa-test.env
sourceKey: PIKAOA_SESSION_SECRET
targetKey: PIKAOA_SESSION_SECRET
initializer:
mode: fresh-database-only
jobName: pikaoa-init
backoffLimit: 2
command:
- /usr/local/bin/pikaoa
- migrate
- up
- --config
- /etc/pikaoa/pikaoa.yaml
exposure:
serviceName: pikaoa-web
serviceType: NodePort
hostIP: 152.53.229.148
port: 32080
publicBaseUrl: https://oa-dev.hwpod.com
observability:
configRef: config/platform-infra/observability.yaml
otlpEndpoint: otel-collector.platform-infra.svc.cluster.local:4317
prometheus:
configRef: config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector
scrape: true
apiPath: /metrics
workerPath: /metrics
exporterFailure:
warning: true
blocking: false
probes:
api:
livenessPath: /healthz
readinessPath: /readyz
worker:
livenessPath: /healthz
readinessPath: /readyz
web:
livenessPath: /healthz
readinessPath: /healthz
releaseRuntime:
defaultTargetId: NC01
targets:
NC01:
enabled: true
validationOnly: false
node: NC01
route: NC01:k3s
namespace: pikaoa
ttlSeconds: 86400
waitTimeoutSeconds: 300
fieldManager: unidesk-pikaoa-release-runtime
taskState:
rootPath: /var/lib/unidesk/pikaoa-release-runtime
statusRequestTimeoutSeconds: 10
logTailLines: 80
cleanup:
mode: delete-namespace
requireOwnershipLabels: true
source:
mode: prebuilt-images
repository: pikainc/pikaoa
commitPolicy: cli-required
branch: release
worktreeRemote: https://github.com/pikainc/pikaoa.git
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-release-nc01
images:
api: 127.0.0.1:5000/pikaoa/api:${commit}
worker: 127.0.0.1:5000/pikaoa/worker:${commit}
web: 127.0.0.1:5000/pikaoa/web:${commit}
initializer: 127.0.0.1:5000/pikaoa/api:${commit}
pullPolicy: IfNotPresent
ci:
lane: pikaoa
namespace: pikaoa-ci
pipeline: pikaoa-nc01-pac
pipelineRunPrefix: pikaoa-nc01
serviceAccountName: pikaoa-nc01-tekton-runner
workspaceSize: 8Gi
pipelineTimeout: 20m0s
toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
build:
dockerfiles:
api: deploy/api.Dockerfile
worker: deploy/worker.Dockerfile
web: deploy/web.Dockerfile
images:
api: 127.0.0.1:5000/pikaoa/api
worker: 127.0.0.1:5000/pikaoa/worker
web: 127.0.0.1:5000/pikaoa/web
networkMode: host
gitops:
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
branch: nc01-pikaoa-gitops
manifestPath: deploy/gitops/nc01/resources.yaml
credential:
secretName: pac-gitea-pikaoa-nc01
tokenKey: token
username: unidesk-admin
author:
name: PikaOA NC01 CI
email: pikaoa-nc01-ci@unidesk.local
database:
configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-database-url
name: pikaoa
username: pikaoa
schema: pikaoa
connection:
sourceRef: /root/.unidesk/.state/secrets/platform-infra/pikaoa.env
sourceKey: DATABASE_URL
targetKey: DATABASE_URL
runtime:
replicas:
api: 1
worker: 1
web: 1
resources:
api: { requests: { cpu: 250m, memory: 256Mi }, limits: { cpu: 1, memory: 1Gi } }
worker: { requests: { cpu: 100m, memory: 256Mi }, limits: { cpu: 1, memory: 1Gi } }
web: { requests: { cpu: 100m, memory: 128Mi }, limits: { cpu: 500m, memory: 512Mi } }
initializer: { requests: { cpu: 250m, memory: 256Mi }, limits: { cpu: 1, memory: 1Gi } }
secretName: pikaoa-runtime
apiServiceName: pikaoa-api
apiPort: 8080
workerMetricsPort: 8081
webPort: 8080
webApiUpstreamEnv: PIKAOA_API_UPSTREAM
attachment:
storageRoot: /var/lib/pikaoa/attachments
maxBytes: 104857600
claimName: pikaoa-attachments
storageRequest: 20Gi
storageClassName: null
fsGroup: 65532
accessModes:
- ReadWriteOnce
workerInterval: 2s
outbox:
batchSize: 50
maxAttempts: 4
retryDelay: 2s
sessionTTL: 8h
shutdownTimeout: 10s
administrator:
username: admin
password:
sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD
employee:
username: employee
password:
sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD
sessionSecret:
sourceRef: /root/.unidesk/.state/secrets/platform-infra/pikaoa.env
sourceKey: PIKAOA_SESSION_SECRET
targetKey: PIKAOA_SESSION_SECRET
initializer:
mode: fresh-database-only
jobName: pikaoa-init
backoffLimit: 2
command:
- /usr/local/bin/pikaoa
- migrate
- up
- --config
- /etc/pikaoa/pikaoa.yaml
exposure:
serviceName: pikaoa-web
serviceType: NodePort
hostIP: 152.53.229.148
port: 32096
publicBaseUrl: https://oa.hwpod.com
observability:
configRef: config/platform-infra/observability.yaml
otlpEndpoint: otel-collector.platform-infra.svc.cluster.local:4317
prometheus:
configRef: config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector
scrape: true
apiPath: /metrics
workerPath: /metrics
exporterFailure:
warning: true
blocking: false
probes:
api:
livenessPath: /healthz
readinessPath: /readyz
worker:
livenessPath: /healthz
readinessPath: /readyz
web:
livenessPath: /healthz
readinessPath: /healthz
publicEdge:
target:
node: NC01
route: NC01
publicAddress: 152.53.229.148
caddy:
image: caddy:2.10.2-alpine
workDir: /opt/unidesk/pikaoa-edge
composePath: /opt/unidesk/pikaoa-edge/docker-compose.yaml
caddyfilePath: /opt/unidesk/pikaoa-edge/Caddyfile
dataDir: /var/lib/unidesk/pikaoa-edge/caddy-data
configDir: /var/lib/unidesk/pikaoa-edge/caddy-config
containerName: pikaoa-edge
httpPort: 80
httpsPort: 443
protocols:
- h1
- h2
responseHeaderTimeoutSeconds: 60
sites:
production:
hostname: oa.hwpod.com
upstream: 127.0.0.1:32096
healthPath: /healthz
development:
hostname: oa-dev.hwpod.com
upstream: 127.0.0.1:32080
healthPath: /healthz
tcpPortRelease:
settingsPath: /root/vpn-server/config/settings.yaml
workDir: /root/vpn-server
service: xray
fromPort: 443
toPort: 8447
applyCommand: npm run apply
legacyExposure:
pk01:
route: PK01
caddyConfigPath: /etc/caddy/Caddyfile
caddyServiceName: caddy
managedBlock: pikaoa
hostname: oa.pikapython.com
frpc:
route: NC01:k3s
namespace: pikaoa
deploymentName: pikaoa-frpc
retirementBlocking: false
delivery:
targets:
NC01:
node: NC01
lane: pikaoa
route: NC01:k3s
namespace: pikaoa
ci:
namespace: pikaoa-ci
pipeline: pikaoa-nc01-pac
pipelineRunPrefix: pikaoa-nc01
serviceAccountName: pikaoa-nc01-tekton-runner
serviceAccountAutomount: false
roleBindingName: pikaoa-nc01-tekton-runner
workspaceSize: 8Gi
pipelineTimeout: 20m0s
toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
source:
repository: pikainc/pikaoa
worktreeRemote: https://github.com/pikainc/pikaoa.git
branch: release
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/pikaoa-release-nc01
build:
dockerfiles:
api: deploy/api.Dockerfile
worker: deploy/worker.Dockerfile
web: deploy/web.Dockerfile
images:
api: 127.0.0.1:5000/pikaoa/api
worker: 127.0.0.1:5000/pikaoa/worker
web: 127.0.0.1:5000/pikaoa/web
networkMode: host
proxy:
http: http://127.0.0.1:10808
https: http://127.0.0.1:10808
all: http://127.0.0.1:10808
noProxy:
- localhost
- 127.0.0.1
- "::1"
- 127.0.0.1:5000
- localhost:5000
- .svc
- .svc.cluster.local
- .cluster.local
- hyueapi.com
- .hyueapi.com
gitops:
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-pikaoa.git
branch: nc01-pikaoa-gitops
manifestPath: deploy/gitops/nc01/resources.yaml
releaseStatePath: deploy/gitops-state/nc01/release.json
credentialSecretName: pac-gitea-pikaoa-nc01
credentialTokenKey: token
credentialUsername: unidesk-admin
author:
name: PikaOA NC01 CI
email: pikaoa-nc01-ci@unidesk.local
runtime:
workloads:
api:
kind: Deployment
name: pikaoa-api
replicas: 2
serviceName: pikaoa-api
port: 8080
healthPath: /healthz
metricsPath: /metrics
worker:
kind: Deployment
name: pikaoa-worker
replicas: 1
healthPort: 8081
healthPath: /healthz
metricsPath: /metrics
web:
kind: Deployment
name: pikaoa-web
replicas: 2
serviceName: pikaoa-web
port: 8080
healthPath: /healthz
secret:
configRef: config/secrets-distribution.yaml
declarationId: pikaoa-runtime
database:
configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-database-url
observability:
configRef: config/platform-infra/observability.yaml
otlpEndpoint: otel-collector.platform-infra.svc.cluster.local:4317
prometheusScrape: true
propagation:
- tracecontext
- baggage
exporterFailure:
warning: true
blocking: false
bootstrapUsers:
administrator:
username: admin
passwordSourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
employee:
username: employee
passwordSourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
publicExposure:
configRef: config/pikaoa.yaml#publicEdge
site: production
Reference in New Issue View Git Blame Copy Permalink