5 Commits

Include renames

Author	SHA1	Message	Date
rock	c538397db4	fix: extract auth config to ConfigMap + SOPS secret, update slug to poimen ... - Add k8s/app/config.yaml (ConfigMap) for non-sensitive env vars - Add k8s/app/auth.enc.yaml (SOPS-encrypted) for AUTHENTIK_ISSUER, AUDIENCE - Add k8s/app/secret-generator.yaml (KSOPS generator for ArgoCD) - Deployment uses envFrom instead of inline env vars - Update Authentik slug from poimen-memory to poimen (404 on OIDC discovery) - Update OpenSearch JWKS/issuer URLs to match new slug - Reloader (auto-reload-all=true) triggers rollout on config change	2026-09-07 22:25:44 -07:00
rock	92458e643c	fix: remove unused vault PVC from memory deployment ... Memory service stores in pgvector, not local files. PVC was RWO causing multi-node scheduling failures with 2 replicas. MEM_HOME points to /tmp (emptyDir) for any scratch needs.	2026-08-30 07:23:18 -07:00
rock	2501a68528	fix: add PodSecurity contexts to all poimen deployments ... - runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault - Drop ALL capabilities, no privilege escalation - readOnlyRootFilesystem on memory (with /tmp emptyDir) - git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps - All pods use their service accounts	2026-08-30 07:20:08 -07:00
rock	46d993824f	feat: add Obsidian vault projection with Longhorn storage (#13)	2026-08-24 01:58:39 +00:00
Story Crater Bot	eaed7fc42a	Add K8s app deployment, Dockerfile, and CI workflow (Option A)	2026-08-23 00:01:30 -07:00