rock
58bf245920
poimen-memory is a ClusterIP service on :8080, so a local pi session had no route to the API. This adds an edge Ingress on the same nginx class and the same Cloudflare-terminated shape as the frontend ingress. Auth stays ZITADEL JWT (MEM_AUTH_MODE=jwt): a request without a valid bearer token gets 401, so exposing the route does not expose the data. Requires one Cloudflare proxied A record: api-poimen.riotpiao.com -> 192.168.1.160
39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
---
|
|
# Public entry point for the poimen-memory HTTP API.
|
|
#
|
|
# The API was reachable only inside the cluster (ClusterIP :8080), so a local pi
|
|
# session had no way to use it. This Ingress exposes the same handler set the
|
|
# in-cluster clients use: /mcp, /memory/*, /graphql, /health, /ready.
|
|
#
|
|
# Cloudflare terminates TLS in front of the nginx ingress, which is why this rule
|
|
# carries no `tls:` section — the same shape as ingress.yaml next to it.
|
|
#
|
|
# Auth: poimen-memory validates ZITADEL JWTs (MEM_AUTH_MODE=jwt). A caller
|
|
# without a valid bearer token gets 401, so exposing the route does not expose
|
|
# the data.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: poimen-api
|
|
namespace: poimen
|
|
annotations:
|
|
# MCP calls and ingest can be slow; the provider may stream. Match the
|
|
# frontend ingress so a long tool call is not cut at 60s.
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-buffering: "off"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "50m"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: api-poimen.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: poimen-memory
|
|
port:
|
|
number: 8080
|