From 005b13bd9139b050460888b58b849616124660fc Mon Sep 17 00:00:00 2001 From: chemavx Date: Mon, 13 Jul 2026 17:37:14 +0000 Subject: [PATCH] =?UTF-8?q?feat(roswell):=20corte=20a=20secretos=20Infisic?= =?UTF-8?q?al=20=E2=80=94=20refs=20*-infisical=20en=20deployment,=20postgr?= =?UTF-8?q?es=20y=20backup?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- roswell/backup-cronjob.yaml | 2 +- roswell/deployment.yaml | 25 +++++++++---------------- roswell/postgres.yaml | 2 +- 3 files changed, 11 insertions(+), 18 deletions(-) diff --git a/roswell/backup-cronjob.yaml b/roswell/backup-cronjob.yaml index d5159b2..ed8b3f8 100644 --- a/roswell/backup-cronjob.yaml +++ b/roswell/backup-cronjob.yaml @@ -48,7 +48,7 @@ spec: - name: PGPASSWORD valueFrom: secretKeyRef: - name: roswell-pg-secret + name: roswell-pg-secret-infisical key: password command: - /bin/sh diff --git a/roswell/deployment.yaml b/roswell/deployment.yaml index d33b055..a468484 100644 --- a/roswell/deployment.yaml +++ b/roswell/deployment.yaml @@ -1,12 +1,5 @@ -# Bot + scheduler en un pod (PLAN §Fase 6). El Secret roswell-secrets se crea -# imperativamente (nunca en git): -# kubectl create secret generic roswell-secrets -n roswell \ -# --from-literal=telegram-bot-token=... \ -# --from-literal=telegram-allowed-users=... \ -# --from-literal=anthropic-api-key=... \ -# --from-literal=database-url=postgresql://roswell:@postgres.roswell.svc.cluster.local:5432/roswell \ -# --from-literal=podcastindex-key=... \ -# --from-literal=podcastindex-secret=... +# Bot + scheduler en un pod (PLAN §Fase 6). Los secretos vienen de Infisical +# (carpeta /roswell del proyecto homelab) vía infisical-roswell-secrets.yaml. --- apiVersion: v1 kind: PersistentVolumeClaim @@ -55,32 +48,32 @@ spec: - name: TELEGRAM_BOT_TOKEN valueFrom: secretKeyRef: - name: roswell-secrets + name: roswell-secrets-infisical key: telegram-bot-token - name: TELEGRAM_ALLOWED_USERS valueFrom: secretKeyRef: - name: roswell-secrets + name: roswell-secrets-infisical key: telegram-allowed-users - name: ANTHROPIC_API_KEY valueFrom: secretKeyRef: - name: roswell-secrets + name: roswell-secrets-infisical key: anthropic-api-key - name: DATABASE_URL valueFrom: secretKeyRef: - name: roswell-secrets + name: roswell-secrets-infisical key: database-url - name: PODCASTINDEX_KEY valueFrom: secretKeyRef: - name: roswell-secrets + name: roswell-secrets-infisical key: podcastindex-key - name: PODCASTINDEX_SECRET valueFrom: secretKeyRef: - name: roswell-secrets + name: roswell-secrets-infisical key: podcastindex-secret - name: OLLAMA_URL value: "http://ollama.ollama.svc.cluster.local:11434" @@ -111,7 +104,7 @@ spec: # Sin límite de CPU: la transcripción usa los cores libres. memory: "6Gi" # Nodo grande (16 cores / 29Gi): transcribe a ~1x tiempo real y comparte - # nodo con postgres y los PVC de backups. El nodo pequeño (4 cores/12Gi) + # nodo con los PVC de datos y backups. El nodo pequeño (4 cores/12Gi) # se saturaba con Whisper. nodeSelector: kubernetes.io/hostname: chemavx-k8 diff --git a/roswell/postgres.yaml b/roswell/postgres.yaml index eb8d031..9ad9301 100644 --- a/roswell/postgres.yaml +++ b/roswell/postgres.yaml @@ -51,7 +51,7 @@ spec: - name: POSTGRES_PASSWORD valueFrom: secretKeyRef: - name: roswell-pg-secret + name: roswell-pg-secret-infisical key: password - name: PGDATA value: /var/lib/postgresql/data/pgdata