poimenandrock
d7a36ce9e8
## Optimize CI/CD Workflows ### Changes #### build.yaml - **Merge 3 cargo steps → 1 compile pass**: `cargo build`, `cargo test`, `cargo clippy` now run in single invocation, reusing compiled artifacts - **Remove `cargo clean`**: Eliminated wasteful step that deleted artifacts before Docker build - **Add secret validation**: Registry credentials checked before login (fail-fast) #### deploy.yaml - **Skip checkout**: Removed unnecessary git clone - **Fetch SHA via Gitea API**: Query latest commit directly instead of cloning - **Reuse existing token**: Use `FORGEJO_REGISTRY_TOKEN` for Gitea API auth (already has privileges) - **Validate image exists**: Check SHA image exists before tagging as latest (prevents tagging non-existent images) - **Add secret validation**: Registry credentials checked before login (fail-fast) #### migrate.yaml - **Merge schema verification**: Schema inspect result reused in both changed + manual paths - **Fix manual trigger errors**: Manual mode now fails on first migration error (was silently masking with `|| true`) - **Track failures**: Explicit FAILED flag tracks migration errors across loop ### Benefits - **Speed**: Fewer compiles, no unnecessary clones, reuse artifacts - **Reliability**: Secret validation catches configuration issues early - **Safety**: Image existence check prevents tagging phantom images - **Clarity**: Merged steps have descriptive names, explicit error handling ### Testing - Branch: `ci/optimize-workflows` - Ready to merge to `main` after review --------- Co-authored-by: rock <[email protected]> Reviewed-on: #51 Co-authored-by: poimen <[email protected]>
50 lines
1.6 KiB
YAML
50 lines
1.6 KiB
YAML
# Production environment configuration for poimen-memory
|
|
# All services use cluster-internal DNS names
|
|
# This file is encrypted with SOPS in production
|
|
# For local dev, use plaintext version with external URLs
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: poimen-memory-config
|
|
namespace: poimen
|
|
labels:
|
|
app.kubernetes.io/name: poimen-memory
|
|
app.kubernetes.io/component: config
|
|
data:
|
|
# Auth mode: jwt | apikey | none
|
|
MEM_AUTH_MODE: "jwt"
|
|
|
|
# Rate limiting
|
|
MEM_RATE_LIMIT_INGEST: "100"
|
|
MEM_RATE_LIMIT_QUERY: "1000"
|
|
MEM_IDEMPOTENCY_TTL_SECS: "86400"
|
|
|
|
# Embeddings
|
|
MEM_EMBEDDING_BATCH_SIZE: "32"
|
|
|
|
# Downstream services - read by application from ENV
|
|
# Internal cluster DNS (prod) / external URLs (local)
|
|
|
|
# LLM Service (entity extraction, fact extraction)
|
|
LLM_ENDPOINT: "http://reasoning-predictor.llm-serving.svc.cluster.local:8000/v1/chat/completions"
|
|
LLM_API_BASE: "http://reasoning-predictor.llm-serving.svc.cluster.local:8000/v1"
|
|
LLM_MODEL: "ornith:35b"
|
|
LLM_TIMEOUT_SECS: "30"
|
|
ENABLE_LLM_EXTRACTION: "true"
|
|
|
|
# OpenSearch (vector store, BM25 retrieval)
|
|
OPENSEARCH_HOST: "opensearch.poimen.svc.cluster.local:9200"
|
|
OPENSEARCH_SCHEME: "http"
|
|
OPENSEARCH_VERIFY_CERTS: "false"
|
|
|
|
# Authentik (OIDC provider)
|
|
AUTHENTIK_ISSUER: "https://authentik.auth.svc.cluster.local:9443/application/o/poimen/"
|
|
AUTHENTIK_VERIFY_SSL: "false"
|
|
|
|
# Temporal (workflow orchestration - future)
|
|
TEMPORAL_ENDPOINT: "temporal-frontend.temporal.svc.cluster.local:7233"
|
|
TEMPORAL_NAMESPACE: "poimen"
|
|
|
|
# API Gateway (external queue, route optimization - future)
|
|
GATEWAY_URL: "http://api-gw.poimen.svc.cluster.local:8080"
|