diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..fe53824 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,11 @@ +.git +.gitignore +*.md +.env.local +.env +tests/ +*.test.go +coverage/ +.DS_Store +k8s/ +migrations/ diff --git a/Dockerfile b/Dockerfile index 8f7ea14..45291be 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,385 +1,22 @@ -# Multi-stage build for Poimen Temporal Worker -# Stage 1: Builder - Compile Go binary and set up tools -FROM golang:1.25-alpine AS builder - -WORKDIR /build - -# Install system dependencies (ast-grep, git, build essentials) -RUN apk add --no-cache \ - git \ - curl \ - wget \ - ca-certificates \ - gcc \ - musl-dev \ - bash \ - && echo "[builder] System dependencies installed" - -# Install ast-grep CLI tool -RUN curl -fsSL https://github.com/ast-grep/ast-grep/releases/download/0.24.0/sg-x86_64-unknown-linux-musl.tar.gz \ - | tar xzf - -C /usr/local/bin \ - && chmod +x /usr/local/bin/sg \ - && sg --version \ - && echo "[builder] ast-grep installed" - -# Install Node.js for pi CLI and browser-use -RUN apk add --no-cache nodejs npm \ - && echo "[builder] Node.js installed" - -# Install pi CLI globally -RUN npm install -g @earendil-works/pi-coding-agent --unsafe-perm \ - && pi --version \ - && echo "[builder] pi CLI installed" - -# Install browser-use CLI for browser automation -RUN npm install -g browser-use --unsafe-perm \ - && browser-use --version \ - && echo "[builder] browser-use CLI installed" - -# Set up pi home directory and skills -RUN mkdir -p ~/.pi/agent/skills ~/.pi/agent/agents \ - && echo "[builder] pi directories created" - -# Stage 2: Download pi skills (caveman & andrej karpathy) -# Clone caveman skill from pi-agent repo -RUN cd /tmp && git clone https://github.com/earendil-works/pi-agent.git pi-repo \ - && mkdir -p ~/.pi/agent/skills/caveman \ - && cp -r pi-repo/examples/skills/caveman/* ~/.pi/agent/skills/caveman/ 2>/dev/null || true \ - && echo "[builder] caveman skill installed" - -# Create andrej karpathy skill manually (reference/training patterns) -RUN mkdir -p ~/.pi/agent/skills/andrej-karpathy && cat > ~/.pi/agent/skills/andrej-karpathy/SKILL.md << 'EOF' -# Andrej Karpathy LLM & AI Principles Skill - -Build neural networks and LLM systems with proven patterns from Andrej Karpathy. -Topics: attention mechanisms, transformer training, inference optimization, edge cases. - -## Key Principles - -### 1. Simplicity First -- Start with minimal implementation -- Add complexity only when justified -- Test each component independently -- Use debugging tools effectively - -### 2. Neural Network Architecture -- Understand backward pass deeply -- Implement from scratch when possible -- Use visualization for debugging -- Profile before optimizing - -### 3. LLM Training Patterns -- Quality data > quantity -- Curriculum learning for complex tasks -- Loss landscape visualization -- Checkpoint strategy matters - -### 4. Inference Optimization -- Quantization without quality loss -- KV cache management -- Batch processing strategies -- Latency profiling - -### 5. Failure Analysis -- Log intermediate activations -- Check gradient flow -- Validate data pipeline -- Test edge cases explicitly - -## Usage in Poimen - -Apply when: -- Designing workflow stages (like training curricula) -- Optimizing inference (planner/judge/implementer prompts) -- Debugging convergence issues (retry patterns) -- Scaling to production (quantization patterns) - -## Resources -- github.com/karpathy/minGPT - Minimal GPT implementation -- youtube: "Neural Networks: Zero to Hero" series -- Papers: Attention Is All You Need, GPT series whitepapers -EOF - && echo "[builder] andrej-karpathy skill created" - -# Create browser-use skill for web testing & automation -RUN mkdir -p ~/.pi/agent/skills/browser-use && cat > ~/.pi/agent/skills/browser-use/SKILL.md << 'EOF' -# browser-use: Browser Automation Skill - -Automate web browser interactions for testing, verification, and UI validation. -Topics: headless browser control, visual testing, form automation, screenshot capture. - -## Key Capabilities - -### 1. Browser Control -- Launch headless Chrome/Firefox -- Navigate to URLs -- Wait for elements/navigation -- Handle popups/dialogs - -### 2. Interaction Patterns -- Click buttons/links -- Fill forms (text, dropdown, checkbox) -- Drag & drop -- Keyboard input - -### 3. Verification & Capture -- Screenshot capture -- Element inspection -- Accessibility checks -- Network monitoring - -### 4. Wait Strategies -- Wait for element visible -- Wait for navigation -- Wait for condition (custom JS) -- Timeout handling - -### 5. Error Recovery -- Retry failed actions -- Handle stale elements -- Browser crash recovery -- Memory leak prevention - -## Usage in Poimen Phases - -### Phase T2 (Implementation) -- Test generated UI code in real browser -- Verify visual layout matches spec -- Validate form inputs work correctly - -### Phase T3 (Verification) -- Visual regression testing -- Accessibility validation (ARIA, keyboard nav) -- Cross-browser verification - -### Phase T6 (Integration) -- End-to-end workflow testing -- External service integration testing -- User journey verification - -### Phase T9 (Release) -- Pre-release smoke tests -- Deployment verification -- Production canary testing - -## Example Workflows - -```bash -# Launch browser and take screenshot -browser-use screenshot "https://example.com" --file output.png - -# Fill form and submit -browser-use interact "https://example.com" \ - --click "#submit-btn" \ - --type "#email" "test@example.com" \ - --type "#password" "secretpass" \ - --click ".submit" - -# Wait for dynamic content and extract data -browser-use extract "https://example.com" \ - --wait ".dynamic-content" \ - --selector ".data-row" \ - --output json - -# Accessibility audit -browser-use audit "https://example.com" \ - --check wcag2a \ - --report a11y-report.html -``` - -## Integration with Poimen - -Pre-generated code can be tested: -```bash -# Generate code (T2) -implementer_output = "function handleClick() { ... }" - -# Verify in browser (T3) -browser-use interact "http://localhost:3000" \ - --click ".test-button" \ - --screenshot result.png - -# Compare with expected -verify_visual_match(result.png, expected.png) -``` - -## Performance Notes - -- Startup: ~2-5s per browser -- Action latency: 100-500ms per interaction -- Screenshot: 500ms-2s (depends on page size) -- Keep browser alive for batch operations (pool management) - -## Error Handling - -- Transient: Network timeout → retry with backoff -- Permanent: Element not found → fail and log -- Flaky: Wait strategies → increase timeout gradually -- Memory: Reuse browser instances → kill after 10 uses - -## Resources -- docs.browseruse.com - Official documentation -- github.com/browser-use/browser-use - Source code -- Chrome DevTools Protocol - Advanced browser control -EOF - && echo "[builder] browser-use skill created" - -# Copy Go source code -COPY . /build/ - -# Download Go dependencies -RUN go mod download \ - && echo "[builder] Go dependencies downloaded" - -# Build worker binary -RUN CGO_ENABLED=1 GOOS=linux go build -o /build/worker ./cmd/worker \ - && echo "[builder] Worker binary built" - -# Verify binary -RUN file /build/worker && ls -lh /build/worker - -# Stage 3: Runtime - Minimal base image with runtime dependencies -FROM alpine:3.20 - -LABEL maintainer="Poimen Team" -LABEL description="Poimen Temporal Worker with memory service, ast-grep, and browser automation" +FROM golang:1.21-alpine as builder WORKDIR /app +COPY go.mod go.sum ./ +RUN go mod download -# Install runtime dependencies (including Chromium for browser-use) -RUN apk add --no-cache \ - ca-certificates \ - git \ - bash \ - curl \ - jq \ - chromium \ - chromium-chromedriver \ - && echo "[runtime] Runtime dependencies installed" +COPY . . +RUN CGO_ENABLED=0 GOOS=linux go build -o workflows ./cmd/poimen/main.go -# Install Node.js for pi CLI and browser-use -RUN apk add --no-cache nodejs npm \ - && echo "[runtime] Node.js installed" +FROM alpine:latest -# Install pi CLI in runtime image -RUN npm install -g @earendil-works/pi-coding-agent --unsafe-perm \ - && pi --version \ - && echo "[runtime] pi CLI installed" +RUN apk --no-cache add ca-certificates -# Install browser-use CLI in runtime image -RUN npm install -g browser-use --unsafe-perm \ - && browser-use --version \ - && echo "[runtime] browser-use CLI installed" +WORKDIR /app +COPY --from=builder /app/workflows . -# Copy ast-grep binary from builder -COPY --from=builder /usr/local/bin/sg /usr/local/bin/sg -RUN chmod +x /usr/local/bin/sg && sg --version \ - && echo "[runtime] ast-grep copied" +EXPOSE 8080 -# Copy pi skills from builder -COPY --from=builder /root/.pi /root/.pi -RUN ls -la /root/.pi/agent/skills/ \ - && echo "[runtime] pi skills configured" +HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=3 \ + CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1 -# Copy worker binary from builder -COPY --from=builder /build/worker /app/worker -RUN chmod +x /app/worker && file /app/worker \ - && echo "[runtime] Worker binary copied" - -# Create app directory structure -RUN mkdir -p /app/work /app/logs /app/screenshots \ - && chmod 755 /app/work /app/logs /app/screenshots \ - && echo "[runtime] App directories created" - -# Health check endpoint -EXPOSE 8081 - -# Worker task queue listener -ENV TEMPORAL_NAMESPACE=poimen-harness \ - TEMPORAL_HOSTPORT=temporal-frontend.temporal:7233 \ - MEMORY_SERVICE_URL=http://memory-service.poimen:5000 \ - MEMORY_SERVICE_TOKEN= \ - ANTHROPIC_API_KEY= \ - PI_SKILLS_PATH=/root/.pi/agent/skills \ - AST_GREP_BIN=/usr/local/bin/sg \ - BROWSER_USE_BIN=/usr/local/bin/browser-use \ - CHROMIUM_BIN=/usr/bin/chromium-browser \ - SCREENSHOTS_DIR=/app/screenshots - -# Entrypoint script with startup diagnostics -COPY --chmod=755 << 'EOF' /app/entrypoint.sh -#!/bin/bash -set -e - -echo "[$(date)] ========== POIMEN WORKER STARTUP ==========" -echo "[$(date)] Container: $HOSTNAME" -echo "[$(date)] Image: $(cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2)" - -# Verify CLI tools -echo "[$(date)] ✓ Checking CLI tools..." -echo " - Go version: $(go version 2>/dev/null || echo 'N/A')" -echo " - ast-grep: $(sg --version 2>&1 | head -1)" -echo " - pi: $(pi --version 2>&1 | head -1)" -echo " - browser-use: $(browser-use --version 2>&1 | head -1)" -echo " - chromium: $(chromium-browser --version 2>&1 || echo 'Not found')" -echo " - git: $(git --version)" -echo " - node: $(node --version)" -echo " - npm: $(npm --version)" - -# Verify pi skills -echo "[$(date)] ✓ Checking pi skills..." -if [ -d "$PI_SKILLS_PATH" ]; then - echo " - Skills path: $PI_SKILLS_PATH" - ls -1 "$PI_SKILLS_PATH" | sed 's/^/ ✓ /' -else - echo " - WARNING: Skills path not found: $PI_SKILLS_PATH" -fi - -# Verify browser tools -echo "[$(date)] ✓ Checking browser automation tools..." -echo " - Chromium binary: $CHROMIUM_BIN" -echo " - Screenshots directory: $SCREENSHOTS_DIR" -if [ -d "$SCREENSHOTS_DIR" ]; then - echo " - Screenshots dir ready ($(du -sh $SCREENSHOTS_DIR 2>/dev/null | cut -f1 || echo '0B'))" -fi - -# Check environment variables -echo "[$(date)] ✓ Configuration loaded:" -echo " - TEMPORAL_NAMESPACE: $TEMPORAL_NAMESPACE" -echo " - TEMPORAL_HOSTPORT: $TEMPORAL_HOSTPORT" -echo " - MEMORY_SERVICE_URL: ${MEMORY_SERVICE_URL:-(not set)}" -echo " - PI_SKILLS_PATH: $PI_SKILLS_PATH" -echo " - CHROMIUM_BIN: $CHROMIUM_BIN" - -# Verify memory service connectivity (optional, non-blocking) -if [ ! -z "$MEMORY_SERVICE_URL" ]; then - echo "[$(date)] ✓ Testing memory service connectivity..." - if curl -sf "$MEMORY_SERVICE_URL/health" > /dev/null 2>&1; then - echo " - Memory service: HEALTHY" - else - echo " - Memory service: UNREACHABLE (will retry in worker)" - fi -fi - -# Test browser automation (optional, non-blocking) -echo "[$(date)] ✓ Testing browser automation..." -if command -v chromium-browser &> /dev/null && command -v browser-use &> /dev/null; then - echo " - Chromium available: YES" - echo " - browser-use available: YES" - echo " - Browser automation: READY" -else - echo " - Browser automation: WARNING - missing dependencies" -fi - -echo "[$(date)] ========== STARTING WORKER ==========" -exec /app/worker -EOF - -RUN chmod +x /app/entrypoint.sh - -# Run worker with diagnostics -ENTRYPOINT ["/app/entrypoint.sh"] - -# Health check -HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \ - CMD curl -f http://localhost:8081/health || exit 1 +ENTRYPOINT ["./workflows"] diff --git a/build-push.sh b/build-push.sh new file mode 100755 index 0000000..de730ea --- /dev/null +++ b/build-push.sh @@ -0,0 +1,34 @@ +#!/bin/bash +set -e + +REGISTRY="forgejo.riotpiao.com/rock" +TAG="${1:-latest}" + +echo "🔨 Building Poimen Application Images" +echo " Registry: $REGISTRY" +echo " Tag: $TAG" +echo "" + +# Build memory service +echo "📦 Building poimen-memory..." +docker build -t $REGISTRY/poimen-memory:$TAG ./memory +docker push $REGISTRY/poimen-memory:$TAG +echo "✓ Pushed poimen-memory:$TAG" + +# Build workflows service +echo "📦 Building poimen-workflows..." +docker build -t $REGISTRY/poimen-workflows:$TAG ./workflows +docker push $REGISTRY/poimen-workflows:$TAG +echo "✓ Pushed poimen-workflows:$TAG" + +# Build frontend service +echo "📦 Building poimen-frontend..." +docker build -t $REGISTRY/poimen-frontend:$TAG ./poimen-frontend +docker push $REGISTRY/poimen-frontend:$TAG +echo "✓ Pushed poimen-frontend:$TAG" + +echo "" +echo "✅ All images built and pushed" +echo "" +echo "To deploy:" +echo " cd k8s && ./deploy.sh -a" diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..4daf34e --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,138 @@ +version: '3.8' + +services: + postgres: + image: postgres:15-alpine + environment: + POSTGRES_USER: poimen + POSTGRES_PASSWORD: poimen + POSTGRES_INITDB_ARGS: -c max_connections=200 + ports: + - "5432:5432" + volumes: + - postgres-data:/var/lib/postgresql/data + healthcheck: + test: ["CMD-SHELL", "pg_isready -U poimen"] + interval: 5s + timeout: 5s + retries: 5 + + redis: + image: redis:7-alpine + ports: + - "6379:6379" + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 5s + timeout: 5s + retries: 5 + + temporal: + image: temporalio/auto-setup:latest + ports: + - "7233:7233" + - "8233:8233" + environment: + DB: postgresql + DB_PORT: 5432 + POSTGRES_USER: poimen + POSTGRES_PASSWORD: poimen + POSTGRES_SEEDS: postgres + depends_on: + postgres: + condition: service_healthy + healthcheck: + test: ["CMD", "tctl", "workflow", "list"] + interval: 10s + timeout: 5s + retries: 5 + + poimen-memory: + build: + context: ./memory + dockerfile: Dockerfile + ports: + - "8000:8000" + environment: + DATABASE_URL: postgresql://poimen:poimen@postgres:5432/poimen_memory + REDIS_URL: redis://redis:6379 + JWT_SECRET: dev-secret-key + LOG_LEVEL: debug + depends_on: + postgres: + condition: service_healthy + redis: + condition: service_healthy + volumes: + - ./memory:/app + + poimen-workflows: + build: + context: ./workflows + dockerfile: Dockerfile + ports: + - "8080:8080" + environment: + DATABASE_URL: postgresql://poimen:poimen@postgres:5432/poimen_workflows + TEMPORAL_HOST: temporal:7233 + MEMORY_SERVICE_URL: http://poimen-memory:8000 + JWT_SECRET: dev-secret-key + LOG_LEVEL: debug + depends_on: + postgres: + condition: service_healthy + temporal: + condition: service_healthy + poimen-memory: + condition: service_started + volumes: + - ./workflows:/app + command: /app/workflows server + + poimen-workflows-worker: + build: + context: ./workflows + dockerfile: Dockerfile + environment: + DATABASE_URL: postgresql://poimen:poimen@postgres:5432/poimen_workflows + TEMPORAL_HOST: temporal:7233 + MEMORY_SERVICE_URL: http://poimen-memory:8000 + JWT_SECRET: dev-secret-key + LOG_LEVEL: debug + depends_on: + postgres: + condition: service_healthy + temporal: + condition: service_healthy + poimen-memory: + condition: service_started + volumes: + - ./workflows:/app + command: /app/workflows worker + + poimen-frontend: + build: + context: ./poimen-frontend + dockerfile: Dockerfile + ports: + - "3000:3000" + environment: + NEXT_PUBLIC_WORKFLOWS_API: http://localhost:8080 + NEXT_PUBLIC_MEMORY_API: http://localhost:8000 + NEXT_PUBLIC_AUTH_URL: http://localhost:8000/auth + OAUTH_CLIENT_ID: dev-client-id + OAUTH_CLIENT_SECRET: dev-client-secret + NODE_ENV: development + depends_on: + - poimen-workflows + - poimen-memory + volumes: + - ./poimen-frontend:/app + - /app/node_modules + +volumes: + postgres-data: + +networks: + default: + name: poimen-network diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml index 9c8ef72..6408d63 100644 --- a/k8s/kustomization.yaml +++ b/k8s/kustomization.yaml @@ -4,15 +4,19 @@ kind: Kustomization namespace: poimen resources: - - worker-deployment.yaml - - configmap.yaml + - poimen-application.yaml commonLabels: app.kubernetes.io/name: poimen app.kubernetes.io/component: worker -secretGenerator: - - name: poimen-secrets - envs: - - secrets.env - behavior: create +images: + - name: forgejo.riotpiao.com/rock/poimen-memory + newName: forgejo.riotpiao.com/rock/poimen-memory + newTag: latest + - name: forgejo.riotpiao.com/rock/poimen-workflows + newName: forgejo.riotpiao.com/rock/poimen-workflows + newTag: latest + - name: forgejo.riotpiao.com/rock/poimen-frontend + newName: forgejo.riotpiao.com/rock/poimen-frontend + newTag: latest diff --git a/k8s/poimen-application.yaml b/k8s/poimen-application.yaml new file mode 100644 index 0000000..fac1d56 --- /dev/null +++ b/k8s/poimen-application.yaml @@ -0,0 +1,283 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: poimen +--- +apiVersion: v1 +kind: Secret +metadata: + name: poimen-registry + namespace: poimen +type: kubernetes.io/dockercfg +data: + .dockercfg: eyJmb3JnZWpvLnJpb3RwaWFvLmNvbSI6eyJhdXRoIjoiYmFzZTY0LWVuY29kZWQtY3JlZGVudGlhbHMifX0= +--- +# Poimen Memory Service +apiVersion: apps/v1 +kind: Deployment +metadata: + name: poimen-memory + namespace: poimen +spec: + replicas: 1 + selector: + matchLabels: + app: poimen-memory + template: + metadata: + labels: + app: poimen-memory + spec: + imagePullSecrets: + - name: poimen-registry + containers: + - name: memory + image: forgejo.riotpiao.com/rock/poimen-memory:latest + imagePullPolicy: Always + ports: + - containerPort: 8000 + env: + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: poimen-db-credentials + key: memory-url + - name: REDIS_URL + valueFrom: + configMapKeyRef: + name: poimen-config + key: redis-url + - name: JWT_SECRET + valueFrom: + secretKeyRef: + name: poimen-secrets + key: jwt-secret + livenessProbe: + httpGet: + path: /health + port: 8000 + initialDelaySeconds: 10 + periodSeconds: 10 + readinessProbe: + httpGet: + path: /ready + port: 8000 + initialDelaySeconds: 5 + periodSeconds: 5 +--- +apiVersion: v1 +kind: Service +metadata: + name: poimen-memory + namespace: poimen +spec: + selector: + app: poimen-memory + ports: + - port: 8000 + targetPort: 8000 + type: ClusterIP +--- +# Poimen Workflows Service +apiVersion: apps/v1 +kind: Deployment +metadata: + name: poimen-workflows + namespace: poimen +spec: + replicas: 2 + selector: + matchLabels: + app: poimen-workflows + template: + metadata: + labels: + app: poimen-workflows + spec: + imagePullSecrets: + - name: poimen-registry + containers: + - name: workflows-server + image: forgejo.riotpiao.com/rock/poimen-workflows:latest + imagePullPolicy: Always + command: ["/app/workflows", "server"] + ports: + - containerPort: 8080 + env: + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: poimen-db-credentials + key: workflows-url + - name: TEMPORAL_HOST + valueFrom: + configMapKeyRef: + name: poimen-config + key: temporal-host + - name: MEMORY_SERVICE_URL + valueFrom: + configMapKeyRef: + name: poimen-config + key: memory-service-url + - name: JWT_SECRET + valueFrom: + secretKeyRef: + name: poimen-secrets + key: jwt-secret + livenessProbe: + httpGet: + path: /health + port: 8080 + initialDelaySeconds: 10 + periodSeconds: 10 + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 5 + - name: workflows-worker + image: forgejo.riotpiao.com/rock/poimen-workflows:latest + imagePullPolicy: Always + command: ["/app/workflows", "worker"] + env: + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: poimen-db-credentials + key: workflows-url + - name: TEMPORAL_HOST + valueFrom: + configMapKeyRef: + name: poimen-config + key: temporal-host + - name: MEMORY_SERVICE_URL + valueFrom: + configMapKeyRef: + name: poimen-config + key: memory-service-url +--- +apiVersion: v1 +kind: Service +metadata: + name: poimen-workflows + namespace: poimen +spec: + selector: + app: poimen-workflows + ports: + - port: 8080 + targetPort: 8080 + type: ClusterIP +--- +# Poimen Frontend Service +apiVersion: apps/v1 +kind: Deployment +metadata: + name: poimen-frontend + namespace: poimen +spec: + replicas: 2 + selector: + matchLabels: + app: poimen-frontend + template: + metadata: + labels: + app: poimen-frontend + spec: + imagePullSecrets: + - name: poimen-registry + containers: + - name: frontend + image: forgejo.riotpiao.com/rock/poimen-frontend:latest + imagePullPolicy: Always + ports: + - containerPort: 3000 + env: + - name: NEXT_PUBLIC_WORKFLOWS_API + valueFrom: + configMapKeyRef: + name: poimen-config + key: workflows-api-url + - name: NEXT_PUBLIC_MEMORY_API + valueFrom: + configMapKeyRef: + name: poimen-config + key: memory-api-url + - name: NEXT_PUBLIC_AUTH_URL + valueFrom: + configMapKeyRef: + name: poimen-config + key: auth-url + - name: OAUTH_CLIENT_ID + valueFrom: + secretKeyRef: + name: poimen-secrets + key: oauth-client-id + - name: OAUTH_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: poimen-secrets + key: oauth-client-secret + livenessProbe: + httpGet: + path: / + port: 3000 + initialDelaySeconds: 10 + periodSeconds: 10 + readinessProbe: + httpGet: + path: / + port: 3000 + initialDelaySeconds: 5 + periodSeconds: 5 +--- +apiVersion: v1 +kind: Service +metadata: + name: poimen-frontend + namespace: poimen +spec: + selector: + app: poimen-frontend + ports: + - port: 80 + targetPort: 3000 + type: LoadBalancer +--- +# ConfigMap for shared configuration +apiVersion: v1 +kind: ConfigMap +metadata: + name: poimen-config + namespace: poimen +data: + temporal-host: "temporal:7233" + redis-url: "redis://redis:6379" + workflows-api-url: "http://poimen-workflows:8080" + memory-api-url: "http://poimen-memory:8000" + auth-url: "https://auth.riotpiao.com" + memory-service-url: "http://poimen-memory:8000" +--- +# Secrets placeholder - should be created separately +apiVersion: v1 +kind: Secret +metadata: + name: poimen-db-credentials + namespace: poimen +type: Opaque +stringData: + memory-url: "postgresql://user:pass@postgres:5432/poimen_memory" + workflows-url: "postgresql://user:pass@postgres:5432/poimen_workflows" +--- +apiVersion: v1 +kind: Secret +metadata: + name: poimen-secrets + namespace: poimen +type: Opaque +stringData: + jwt-secret: "your-jwt-secret-here" + oauth-client-id: "your-oauth-client-id" + oauth-client-secret: "your-oauth-client-secret"