apiVersion: apps/v1
kind: Deployment
metadata:
  name: agent-pod
  namespace: agent-pod
spec:
  replicas: 1
  selector:
    matchLabels:
      app: agent-pod
  template:
    metadata:
      labels:
        app: agent-pod
    spec:
      # api.riotpiao.com has no in-cluster DNS record (only resolves from the
      # home network's own resolver) -- pin it to ingress-nginx-controller's
      # ClusterIP so pi's models.json baseUrl works unchanged. TLS still
      # terminates correctly since SNI/Host still say api.riotpiao.com.
      hostAliases:
        - ip: "10.101.128.185"
          hostnames:
            - "api.riotpiao.com"
      containers:
        # hub.js runs in the same container as pi (not a sidecar) so it can
        # spawn `pi -p --mode json` directly via child_process -- a separate
        # container can't exec into another container's filesystem/PATH.
        # It IS the container's long-running process now; no more `sleep
        # infinity` placeholder.
        - name: pi
          image: node:22-slim
          command:
            - sh
            - -c
            - |
              set -e
              apt-get update && apt-get install -y git curl jq openssh-client tmux
              ssh-keygen -y -f /root/.ssh/id_forgejo > /root/.ssh/id_forgejo.pub
              eval "$(ssh-agent -s)"
              ssh-add /root/.ssh/id_forgejo
              npm install -g @earendil-works/pi-coding-agent@0.84.2
              npm install --prefix /root ws
              node /root/hub.js
          env:
            - name: PI_BIN
              value: pi
          ports:
            - containerPort: 9090
          resources:
            requests:
              cpu: "4"
              memory: 8Gi
            limits:
              cpu: "8"
              memory: 16Gi
          volumeMounts:
            - name: pi-config
              mountPath: /root/.pi/agent/settings.json
              subPath: settings.json
            - name: pi-models
              mountPath: /root/.pi/agent/models.json
              subPath: models.json
            - name: pi-skills
              mountPath: /root/.pi/agent/skills
            - name: hub-src
              mountPath: /root/hub.js
              subPath: hub.js
            - name: ssh-key
              mountPath: /root/.ssh/id_forgejo
              subPath: id_forgejo
            - name: ssh-config
              mountPath: /root/.ssh/config
              subPath: config
      volumes:
        - name: pi-config
          configMap:
            name: pi-config
        - name: pi-models
          secret:
            secretName: pi-models
        - name: pi-skills
          configMap:
            name: pi-skills
            items:
              - key: planner-SKILL.md
                path: planner/SKILL.md
              - key: investigator-SKILL.md
                path: investigator/SKILL.md
              - key: info-collector-SKILL.md
                path: info-collector/SKILL.md
              - key: implementer-SKILL.md
                path: implementer/SKILL.md
              - key: judge-SKILL.md
                path: judge/SKILL.md
              - key: resolver-SKILL.md
                path: resolver/SKILL.md
              - key: brave-search-SKILL.md
                path: brave-search/SKILL.md
        - name: hub-src
          configMap:
            name: hub-src
        - name: ssh-key
          secret:
            secretName: agent-pod-ssh-key
            defaultMode: 0600
        - name: ssh-config
          configMap:
            name: agent-pod-ssh-config