chore: retire obsidian service

- Remove obsidian.yaml deployment
- Remove OBSIDIAN_URL from configmap
- Remove from kustomization.yaml
- obsidian_ref_source.rs kept as dead code (no callers)
- Reference docs now handled via memory graph entities
- Scaled obsidian-server to 0 in cluster

k8s/app/config.yaml

@@ -20,7 +20,6 @@ data:
   # OpenSearch
   OPENSEARCH_HOST: "opensearch.poimen.svc.cluster.local:9200"
   # Obsidian
-  OBSIDIAN_URL: "http://obsidian-server.poimen.svc.cluster.local:8080"
   # LLM Configuration (for entity extraction)
   LLM_ENDPOINT: "http://api-internal.riotpiao.com:8000/v1/chat/completions"
   LLM_MODEL: "qwen:7b"

k8s/app/kustomization.yaml

@@ -6,7 +6,7 @@ resources:
   - deployment.yaml
   - service.yaml
   - config.yaml
-  - obsidian.yaml
+  # obsidian.yaml retired — reference docs now via memory graph
   # Legacy secret managed separately
   # - secrets.yaml
 generators:

k8s/app/obsidian.yaml

@@ -1,159 +0,0 @@
----
-# Obsidian server deployment
-# Serves local vault with web UI and API
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: obsidian-server
-  namespace: poimen
-  labels:
-    app.kubernetes.io/name: obsidian-server
-    app.kubernetes.io/part-of: poimen-memory
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: obsidian-server
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: obsidian-server
-        app.kubernetes.io/part-of: poimen-memory
-    spec:
-      serviceAccountName: obsidian-server
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      initContainers:
-      - name: git-sync-init
-        image: alpine/git:latest
-        securityContext:
-          runAsNonRoot: false
-          runAsUser: 0
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-              - ALL
-            add:
-              - CHOWN
-              - DAC_OVERRIDE
-        command:
-        - sh
-        - -c
-        - |
-          export GIT_SSH_COMMAND="ssh -i /root/.ssh/id_ed25519 -o StrictHostKeyChecking=no"
-          git config --global --add safe.directory /vault
-          if [ -d /vault/.git ]; then
-            cd /vault && git pull origin main || true
-          else
-            # Clone into temp, move contents into vault
-            rm -rf /tmp/repo
-            git clone ssh://[email protected]:2222/rock/poimen-obesdient-memory.git /tmp/repo
-            cp -a /tmp/repo/. /vault/
-            rm -rf /tmp/repo
-          fi
-          chown -R 1000:1000 /vault
-        volumeMounts:
-        - name: vault
-          mountPath: /vault
-        - name: ssh-key
-          mountPath: /root/.ssh
-          readOnly: true
-      containers:
-      - name: obsidian-server
-        image: ppatlabs/obsidian:latest
-        imagePullPolicy: IfNotPresent
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-              - ALL
-        ports:
-        - name: http
-          containerPort: 27124
-          protocol: TCP
-        env:
-        - name: VAULT_NAME
-          value: poimen-vault
-        - name: VAULT_PATH
-          value: /vault
-        - name: REST_API_ENABLED
-          value: "true"
-        - name: REST_API_PORT
-          value: "8080"
-        volumeMounts:
-        - name: vault
-          mountPath: /vault
-        - name: config
-          mountPath: /config
-        resources:
-          requests:
-            cpu: 100m
-            memory: 256Mi
-          limits:
-            cpu: 500m
-            memory: 512Mi
-        livenessProbe:
-          httpGet:
-            path: /
-            port: http
-            scheme: HTTPS
-          initialDelaySeconds: 30
-          periodSeconds: 10
-          timeoutSeconds: 5
-        readinessProbe:
-          httpGet:
-            path: /
-            port: http
-            scheme: HTTPS
-          initialDelaySeconds: 15
-          periodSeconds: 5
-          timeoutSeconds: 5
-      volumes:
-      - name: vault
-        persistentVolumeClaim:
-          claimName: obsidian-vault
-      - name: config
-        emptyDir: {}
-      - name: ssh-key
-        secret:
-          secretName: obsidian-git-ssh
-          defaultMode: 0400
-
-# PVC managed by homelab repo (k8s/infra/databases/obsidian-vault-pvc.yaml)
-
----
-# Service for Obsidian server
-apiVersion: v1
-kind: Service
-metadata:
-  name: obsidian-server
-  namespace: poimen
-  labels:
-    app.kubernetes.io/name: obsidian-server
-spec:
-  type: ClusterIP
-  ports:
-  - name: http
-    port: 80
-    targetPort: 27124
-    protocol: TCP
-  selector:
-    app.kubernetes.io/name: obsidian-server
-
----
-# ServiceAccount for Obsidian
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: obsidian-server
-  namespace: poimen
-  labels:
-    app.kubernetes.io/name: obsidian-server
-
-# Ingress managed by homelab repo (obsidian.riotpiao.com)
-# See: homelab/k8s/bootstrap/ingress/ingress.yaml