feat: setup phase 3 agent infrastructure + enable docker ci on prs

- Enable docker build, sha extraction on PRs (validate Dockerfile) - Add SOPS encrypted memory-agent credentials - Plan 15 tasks: 5 memory service + 10 temporal workflow - Milestone: monitoring-agent (due 2025-03-15) - Ready: Forgejo API token needed for PR automation ``` Co-authored-by: rock <[email protected]>
2026-09-08 23:16:31 +00:00
parent 83a50844c5
commit 1e5c3d1433
20 changed files with 2538 additions and 218 deletions
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: poimen-memory-auth
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: poimen-memory
+type: Opaque
+stringData:
+  # Authentik Service Account - OAuth2 client credentials
+  # These are obtained from Authentik admin panel:
+  # Settings → Applications → poimen-memory → Service Account
+  AUTHENTIK_ISSUER: "https://authentik.riotpiao.com/application/o/memory"
+  AUTHENTIK_AUDIENCE: "poimen-memory"
+  AUTHENTIK_CLIENT_ID: "${AUTHENTIK_SERVICE_ACCOUNT_CLIENT_ID}"
+  AUTHENTIK_CLIENT_SECRET: "${AUTHENTIK_SERVICE_ACCOUNT_SECRET}"
+  
+  # LLM API Key
+  # Generated by Authentik service account with permissions to LLM gateway
+  LLM_API_KEY: "${LLM_API_KEY_FROM_AUTHENTIK}"
+  
+  # S3 Credentials for backups (Velero)
+  S3_ACCESS_KEY: "${MINIO_ACCESS_KEY}"
+  S3_SECRET_KEY: "${MINIO_SECRET_KEY}"