6 Commits

Include renames

Author	SHA1	Message	Date
Admin Bot	4341b1109b	security: restore old public key in .sops.yaml for cluster decryption ... Keep both public keys in .sops.yaml: - Old key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (existing cluster secrets are encrypted with this) - New key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp (new secrets will be encrypted with this) Private keys remain secure in cluster (sops-age secret). Public key history cleaned from git (see prior commits).	2026-09-13 11:10:34 +09:00
Admin Bot	b8f95506ca	feat: add Temporal config and update routing with memory service integration ... - Add TemporalConfig struct to internal/config - Update gateway config with Temporal frontend service (port 7233) - Update router with memory service adapter support - Add config.local.yaml with memory service configuration - Encrypt production config with SOPS (AES256_GCM) - Support X-Service header routing pattern for service discovery - Keep legacy path-based routes with deprecation warnings - All 5 adapters preserved: workflow, memory, sqs, s3, iam	2026-09-13 10:56:18 +09:00
rock	e61885254b	feat: route qwen2.5:3b-instruct to CPU service (#20) ... Route `qwen2.5:3b-instruct` to `qwen-cpu.llm-serving:80` (CPU on cp-2) instead of `ornith-predictor` (GPU on worker-1). Companion to homelab GPU rebalance PR.	2026-09-09 02:10:59 +00:00
poimenandrock	1c64d8ff0e	feat(config): add tokenUrl, clientId, clientSecret to auth config (#17) ... Closes homelab#12 (P3.7) ## Changes - `AuthConfig`: added `TokenURL`, `ClientID`, `ClientSecret` fields - `loader.go`: reads `tokenUrl`/`clientId` from YAML, `ClientSecret` from `AUTH_CLIENT_SECRET` env - `deployment.yaml`: `AUTH_CLIENT_SECRET` from `api-gw-client-secret` Secret (optional) - `gateway-config-secret.enc.yaml` + `configmap.yaml`: added `tokenUrl` and `clientId` ## Secret never in YAML `clientSecret` deliberately omitted from YAML struct. Loaded from env only. ## Tests 3 tests: full config load, env-only secret, backward compat (missing fields = zero). Co-authored-by: poimen <[email protected]>	2026-09-08 23:43:29 +00:00
Admin Bot	c2fa3445bd	fix(s3): correct MinIO service port and allow egress ... MinIO ClusterIP service listens on port 80 (targetPort 9000). Config had port 9000 which caused 30s timeout then 502 — gateway connected to service port 9000 which doesn't exist on the ClusterIP. Changes: - configmap.yaml: S3 upstream :9000 → :80 - gateway-config-secret.enc.yaml: same - network-policy.yaml: add port 80 egress to storage namespace Verified: S3 adapter now reaches MinIO (403 AccessDenied = auth issue, not connectivity).	2026-09-08 09:58:36 -07:00
Admin Bot	2bcf6c82fc	fix: move gateway config from plaintext ConfigMap to SOPS-encrypted Secret	2026-09-05 00:28:45 -07:00