feat(roswell): corte a secretos Infisical — refs *-infisical en deployment, postgres y backup

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

roswell/backup-cronjob.yaml

@@ -48,7 +48,7 @@ spec:
                 - name: PGPASSWORD
                   valueFrom:
                     secretKeyRef:
-                      name: roswell-pg-secret
+                      name: roswell-pg-secret-infisical
                       key: password
               command:
                 - /bin/sh

roswell/deployment.yaml

@@ -1,12 +1,5 @@
-# Bot + scheduler en un pod (PLAN §Fase 6). El Secret roswell-secrets se crea
+# Bot + scheduler en un pod (PLAN §Fase 6). Los secretos vienen de Infisical
-# imperativamente (nunca en git):
+# (carpeta /roswell del proyecto homelab) vía infisical-roswell-secrets.yaml.
-#   kubectl create secret generic roswell-secrets -n roswell \
-#     --from-literal=telegram-bot-token=... \
-#     --from-literal=telegram-allowed-users=... \
-#     --from-literal=anthropic-api-key=... \
-#     --from-literal=database-url=postgresql://roswell:<pass>@postgres.roswell.svc.cluster.local:5432/roswell \
-#     --from-literal=podcastindex-key=... \
-#     --from-literal=podcastindex-secret=...
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -55,32 +48,32 @@ spec:
             - name: TELEGRAM_BOT_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: roswell-secrets
+                  name: roswell-secrets-infisical
                   key: telegram-bot-token
             - name: TELEGRAM_ALLOWED_USERS
               valueFrom:
                 secretKeyRef:
-                  name: roswell-secrets
+                  name: roswell-secrets-infisical
                   key: telegram-allowed-users
             - name: ANTHROPIC_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: roswell-secrets
+                  name: roswell-secrets-infisical
                   key: anthropic-api-key
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: roswell-secrets
+                  name: roswell-secrets-infisical
                   key: database-url
             - name: PODCASTINDEX_KEY
               valueFrom:
                 secretKeyRef:
-                  name: roswell-secrets
+                  name: roswell-secrets-infisical
                   key: podcastindex-key
             - name: PODCASTINDEX_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: roswell-secrets
+                  name: roswell-secrets-infisical
                   key: podcastindex-secret
             - name: OLLAMA_URL
               value: "http://ollama.ollama.svc.cluster.local:11434"
@@ -111,7 +104,7 @@ spec:
               # Sin límite de CPU: la transcripción usa los cores libres.
               memory: "6Gi"
       # Nodo grande (16 cores / 29Gi): transcribe a ~1x tiempo real y comparte
-      # nodo con postgres y los PVC de backups. El nodo pequeño (4 cores/12Gi)
+      # nodo con los PVC de datos y backups. El nodo pequeño (4 cores/12Gi)
       # se saturaba con Whisper.
       nodeSelector:
         kubernetes.io/hostname: chemavx-k8

roswell/postgres.yaml

@@ -51,7 +51,7 @@ spec:
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: roswell-pg-secret
+                  name: roswell-pg-secret-infisical
                   key: password
             - name: PGDATA
               value: /var/lib/postgresql/data/pgdata