k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+    name: pi-code-agent-api-keys
+    namespace: poimen-sandbox
+stringData:
+    ANTHROPIC_API_KEY: ENC[AES256_GCM,data:TBcno/dzj3qykHjeX96UKZekuA/WMQT2E7a1ziPyYo5J6lWLPydgli84KeJZhH62/8CnnFtFOhVIe4FWCGPGjvqKH6M8WbiQHaP9y7FN0qQUpFHKNVAQ2R+s0wInhw0eUmANvd7bRx8aIZ2X,iv:oex19yVtWUevoJ0A3mkMLCfWu85o1gPSNp43x1iV0LE=,tag:BW3zQnwvagPceeNird9CZg==,type:str]
+    DEEPSEEK_API_KEY: ENC[AES256_GCM,data:vq/5gOsMVjlVMd0oXiBtHFHFEr+IF2YR2iP2OBFWx3ZFNoQ=,iv:QhLU/BRIJb/7QKDCRyw+HWPphZifVEhIOLywYDgOb20=,tag:BZdtXw+WsuK+P4E0caTa0Q==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqNm1LNE5nWktnd3c3STg3
+            UlVWbWJxWElxUHMwa0JVMk81Z0c4d0JaQm1vCnpLQWJWV3hxOU00NzJIaG51Mmlr
+            ZWpNTFJWcmdtV0w4YndQeHpvSUx2MTAKLS0tIDVnNkNuVWhPUFZ5V2hFOEt1eitG
+            blVqRy8yNnYzSU1FNzZGNkxrRElvWVEKL3J77INje75+CvKXaJHC3CvONgHv7d0a
+            a10MITvfreFr6M4AN3Z/mno49SDMp15Q4oQRagHHxSTS1K54mWHo8g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-06T01:19:49Z"
+    mac: ENC[AES256_GCM,data:GpYl8IRefms36GvO3RW41c0US7SOgoOhd4rumxsCdEf5ME9kJ0eOxPx8klMgnlYrkBnwHmad8jj7C+HcA5Eim7mdUaYOZZWPFohvC6N4GLHX85aH78P09CelqG5tdm/Gm+1QfxYu0vANYGCAVjLK7YbBbZjbZmbvVfQvAbs3mOY=,iv:y3lglGu8FhTHQpO1poSIKgGYJFu5J9yjIaOjulda6fY=,tag:5Sgh4TbtNFMw7xOJjYRn0g==,type:str]
+    version: 3.13.2

k8s/argocd/secrets/secret-generator.yaml

@@ -7,32 +7,33 @@ metadata:
       exec:
         path: ksops
 files:
-  - agent-pod-models.enc.yaml
+    - agent-pod-models.enc.yaml
-  - agent-pod-ssh-key.enc.yaml
+    - agent-pod-ssh-key.enc.yaml
-  - authentik-secrets.enc.yaml
+    - authentik-secrets.enc.yaml
-  - cloudflare-secrets.enc.yaml
+    - cloudflare-secrets.enc.yaml
-  - forgejo-registry-pat.enc.yaml
+    - forgejo-registry-pat.enc.yaml
-  - forgejo-registry-pat-api.enc.yaml
+    - forgejo-registry-pat-api.enc.yaml
-  - forgejo-registry-pull.enc.yaml
+    - forgejo-registry-pull.enc.yaml
-  - forgejo-runner-token.enc.yaml
+    - forgejo-runner-token.enc.yaml
-  - forgejo-secrets.enc.yaml
+    - forgejo-secrets.enc.yaml
-  - grafana-oidc-secrets.enc.yaml
+    - grafana-oidc-secrets.enc.yaml
-  - grafana-secrets.enc.yaml
+    - grafana-secrets.enc.yaml
-  - homarr-auth-oidc.enc.yaml
+    - homarr-auth-oidc.enc.yaml
-  - homarr-db-encryption.enc.yaml
+    - homarr-db-encryption.enc.yaml
-  - homarr-secrets.enc.yaml
+    - homarr-secrets.enc.yaml
-  - homelab-ca-secrets.enc.yaml
+    - homelab-ca-secrets.enc.yaml
-  - loki-secrets.enc.yaml
+    - loki-secrets.enc.yaml
-  - minio-secrets.enc.yaml
+    - minio-secrets.enc.yaml
-  - paperless-secrets.enc.yaml
+    - paperless-secrets.enc.yaml
-  - vault-secrets.enc.yaml
+    - vault-secrets.enc.yaml
-  - vault-unseal-keys.enc.yaml
+    - vault-unseal-keys.enc.yaml
-  - portfolio-secrets.enc.yaml
+    - portfolio-secrets.enc.yaml
-  - gotify-admin-secrets.enc.yaml
+    - gotify-admin-secrets.enc.yaml
-  - gotify-tokens-secrets.enc.yaml
+    - gotify-tokens-secrets.enc.yaml
-  - gotify-smtp-secrets.enc.yaml
+    - gotify-smtp-secrets.enc.yaml
-  - forgejo-smtp-secrets.enc.yaml
+    - forgejo-smtp-secrets.enc.yaml
-  - paperless-ai-secrets.enc.yaml
+    - paperless-ai-secrets.enc.yaml
     - memory-agent-oidc.enc.yaml
     - oauth2-credentials.enc.yaml
     - forgejo-registry-token.enc.yaml
+    - pi-sandbox-secrets.enc.yaml

k8s/infra/minio/minio-tenant.yaml

@@ -11,7 +11,12 @@ metadata:
     prometheus.io/port: "9000"
     prometheus.io/scrape: "true"
 spec:
-  image: minio/minio:RELEASE.2025-07-23T15-54-02Z
+  # Was minio/minio:RELEASE.2025-07-23T15-54-02Z — that Docker Hub repository no longer
+  # exists (404 for every tag), so the tenant sat in ImagePullBackOff and Vault's S3
+  # backend could not resolve minio-cluster-hl. Official images now need registry auth
+  # (quay.io/minio/minio returns 401), so this pins a public mirror of the same upstream
+  # release; swap it for the official image once MinIO registry credentials exist.
+  image: coollabsio/minio:RELEASE.2025-10-15T17-29-55Z
 
   # Disable operator auto-TLS: MinIO serves plain HTTP internally on 9000.
   # External TLS is terminated at nginx ingress (wildcard riotpiao-com-tls cert).

k8s/infra/poimen/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - poimen-sandbox-namespace.yaml
   - poimen-sandbox-quota.yaml
   - pi-session-netpol.yaml
+  - pi-agent-workspace-pv.yaml

k8s/infra/poimen/pi-agent-workspace-pv.yaml

@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  finalizers:
+  - kubernetes.io/pv-protection
+  labels:
+    app: pi-coding-agent-sandbox
+    part-of: poimen-toolkit
+  name: pi-agent-workspace-pv
+  annotations:
+    argocd.argoproj.io/sync-wave: '-1'
+spec:
+  accessModes:
+  - ReadWriteOnce
+  capacity:
+    storage: 10Gi
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: pi-agent-workspace
+    namespace: poimen-sandbox
+  hostPath:
+    path: /var/lib/pi-agent-sandbox
+    type: DirectoryOrCreate
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: kubernetes.io/hostname
+          operator: In
+          values:
+          - talos-cp-2
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    pv.kubernetes.io/bind-completed: 'yes'
+    argocd.argoproj.io/sync-wave: '-1'
+  finalizers:
+  - kubernetes.io/pvc-protection
+  labels:
+    app: pi-coding-agent-sandbox
+    part-of: poimen-toolkit
+  name: pi-agent-workspace
+  namespace: poimen-sandbox
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: ''
+  volumeMode: Filesystem
+  volumeName: pi-agent-workspace-pv

terraform/files/coredns/Corefile

@@ -39,6 +39,7 @@
     rewrite name comfy.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name comfyui.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name gotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name pi.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name igotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local