homelab-frontend

riotpiao-poimen/homelab-frontend

Fork 0

Files

T

History

Admin Bot 16ddd6d4ad

CI / CI (pull_request) Successful in 2m8s

Details

feat(sessions): sandbox resource — per-session k8s Pod+PVC+Service (§4.15.4)

New X-Resource: sandbox on X-Service: sessions

POST ?session_id=  → CreateOrResume
  1. Ensure PVC workspace-session-<id> (Longhorn 1Gi)
  2. If pod already Running → return DNS (resume path, idempotent)
  3. Ensure pi-session-sandbox NetworkPolicy (shared, created once)
  4. Create Pod pi-session-<id> + Service pi-session-<id>:8787
  5. Wait up to 30s for Pod Ready
  6. Fire-and-forget: merge pod_name/pvc_name/svc_dns/last_active_at
     into session memory_entity summary

DELETE ?session_id= → delete Pod + Service + PVC

Idle reaper goroutine (5min interval, configurable via
SANDBOX_REAPER_INTERVAL_MINUTES): lists pi-session-* pods,
deletes Succeeded/Failed ones, preserves PVCs for resume.

Security: runAsNonRoot/1000, readOnlyRootFilesystem, drop ALL
caps, RuntimeDefault seccomp, automountServiceAccountToken:false.
Resources: 500m/512Mi req, 1/1Gi limit.
NetworkPolicy: egress → DNS + api:8080 only; ingress ← poimen-frontend.

RBAC: Role session-sandbox-manager + RoleBinding in poimen ns.
7 unit tests — all pass (mock k8s server).

Image: forgejo.riotpiao.com/riotpiao-poimen/poimen-pi-session-runtime:latest

2026-09-28 19:53:37 +08:00

adapters.go

feat(sessions): SessionAdapter — REST CRUD for sessions/milestones/episodes (#51 )

2026-09-28 01:53:20 +00:00

memory_adapter.go

feat(cag): CAG integration — memory adapter, warmup semaphore, cache-aware routing (#47 )

2026-09-27 11:16:40 +00:00

poimen_adapter.go

fix: use query params for workflow_id in Poimen endpoints (#42 )

2026-09-26 12:52:19 +00:00

real_integration_test.go

feat: Phase 3.1 - SQS JWT validation against Authentik JWKS