From aa6b2ae9c3dec90214f17d07df45819c2e54f76d Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Sat, 22 Aug 2026 21:46:59 -0700
Subject: [PATCH] Add Poimen Memory to ArgoCD wave 2 deployment (namespace:
 poimen)

---
 k8s/argocd/apps/71-poimen-memory.yaml         | 36 ++++++++++++++++
 k8s/argocd/projects/homelab-project.yaml      |  2 +
 .../secrets/forgejo-registry-token.enc.yaml   |  0
 k8s/infra/databases/kustomization.yaml        |  4 +-
 k8s/infra/databases/memory-db.yaml            | 41 +++++++++++++++++++
 k8s/infra/databases/namespaces.yaml           |  1 +
 6 files changed, 83 insertions(+), 1 deletion(-)
 create mode 100644 k8s/argocd/apps/71-poimen-memory.yaml
 create mode 100644 k8s/argocd/secrets/forgejo-registry-token.enc.yaml
 create mode 100644 k8s/infra/databases/memory-db.yaml

diff --git a/k8s/argocd/apps/71-poimen-memory.yaml b/k8s/argocd/apps/71-poimen-memory.yaml
new file mode 100644
index 0000000..5459e6c
--- /dev/null
+++ b/k8s/argocd/apps/71-poimen-memory.yaml
@@ -0,0 +1,36 @@
+# Poimen Memory — LLM-powered gated memory system
+# Tracks k8s/argocd/ apps from Poimen Memory repo
+# Wave 7: Same as other Poimen services, syncs after core infra
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: poimen-memory-root
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: poimen-memory
+    app.kubernetes.io/component: memory-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "7"
+spec:
+  project: homelab
+  source:
+    repoURL: https://github.com/Riotpiaole/Poimen-memory.git
+    targetRevision: main
+    path: k8s/argocd
+    directory:
+      recurse: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
diff --git a/k8s/argocd/projects/homelab-project.yaml b/k8s/argocd/projects/homelab-project.yaml
index 3673708..5419ff7 100644
--- a/k8s/argocd/projects/homelab-project.yaml
+++ b/k8s/argocd/projects/homelab-project.yaml
@@ -12,6 +12,8 @@ spec:
   description: Homelab GitOps — single-repo, in-cluster destinations only
   sourceRepos:
     - https://github.com/Riotpiaole/riotpiao.homelab.com.git
+    # Poimen Memory repository
+    - https://github.com/Riotpiaole/Poimen-memory.git
     # In-cluster Forgejo wildcard — all rock/* repos can be onboarded without
     # touching this AppProject. Enabled by Stage 1 (A1).
     - https://forgejo.riotpiao.com/rock/*
diff --git a/k8s/argocd/secrets/forgejo-registry-token.enc.yaml b/k8s/argocd/secrets/forgejo-registry-token.enc.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/k8s/infra/databases/kustomization.yaml b/k8s/infra/databases/kustomization.yaml
index 40312a9..ebb3151 100644
--- a/k8s/infra/databases/kustomization.yaml
+++ b/k8s/infra/databases/kustomization.yaml
@@ -1,8 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # Dedicated per-app CNPG clusters. NO top-level `namespace:` — each Cluster
-# carries its own ns (iam / temporal); a transformer would wrongly collapse them.
+# carries its own ns (iam / temporal / poimen); a transformer would wrongly collapse them.
+# poimen ns created by poimen-root app, memory-db deployed into it.
 resources:
   - namespaces.yaml
   - authentik-db.yaml
   - temporal-db.yaml
+  - memory-db.yaml
diff --git a/k8s/infra/databases/memory-db.yaml b/k8s/infra/databases/memory-db.yaml
new file mode 100644
index 0000000..ed2ddd5
--- /dev/null
+++ b/k8s/infra/databases/memory-db.yaml
@@ -0,0 +1,41 @@
+# Dedicated CNPG Postgres for Poimen Memory (GitOps, wave 2 — before poimen w3).
+# Includes pgvector extension for semantic search (768-dim embeddings).
+# CNPG generates secret `memory-db-app` + service `memory-db-rw` in ns poimen;
+# poimen reads them locally (no cross-ns secret copy).
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: memory-db
+  namespace: poimen
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
+  bootstrap:
+    initdb:
+      database: memory
+      owner: app
+      encoding: UTF8
+      localeCollate: C
+      localeCType: C
+      postInitApplicationSQL:
+        - "CREATE EXTENSION vector;"
+  enableSuperuserAccess: false
+  resources:
+    requests: { memory: "512Mi", cpu: "250m" }
+    limits: { memory: "2Gi", cpu: "1" }
+  storage:
+    size: 10Gi
+    storageClass: longhorn-cnpg
+  monitoring:
+    enablePodMonitor: true
+  affinity:
+    # preferred + tolerations: HA across nodes without deadlocking a partly-
+    # schedulable 3-CP (same as temporal/authentik-db).
+    podAntiAffinityType: preferred
+    topologyKey: kubernetes.io/hostname
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
diff --git a/k8s/infra/databases/namespaces.yaml b/k8s/infra/databases/namespaces.yaml
index a1da89d..e9b0e7a 100644
--- a/k8s/infra/databases/namespaces.yaml
+++ b/k8s/infra/databases/namespaces.yaml
@@ -1,6 +1,7 @@
 # DB clusters are wave 2 — their namespaces must exist first (their apps that
 # would CreateNamespace run later, w3/w8). Declared here so the databases App
 # creates them. authentik/vault/temporal CreateNamespace=true then no-ops.
+# poimen namespace created by poimen-root app (wave 7).
 apiVersion: v1
 kind: Namespace
 metadata: