decommission(F4): retirar polymarket-bot — Application y manifests

Fase final de la decomisión: namespace y Application borrados del cluster,
manifests fuera de git. Dump definitivo verificado y offsite en
/data/backups/backups/polymarket-decommission/ (espejo en mega:k3s-backups/).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

argocd/application-polymarket-bot.yaml

@@ -1,18 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: polymarket-bot
-  namespace: argocd
-spec:
-  destination:
-    namespace: polymarket-bot
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: polymarket-bot
-    repoURL: https://git.chemavx.xyz/chemavx/k8s-manifests
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

polymarket-bot/configmap-bot-config.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: bot-config
-  namespace: polymarket-bot
-# Non-secret config split out of the old bot-secrets Secret. PAPER_* are plain
-# operating params; WALLET_PRIVATE_KEY and COINGECKO_API_KEY are kept here as
-# empty placeholders (preserving the "present-but-empty" env semantics the bot
-# was started with — avoids a KeyError if the code reads them unconditionally).
-data:
-  PAPER_BANKROLL: "10000"
-  PAPER_MODE: "true"
-  WALLET_PRIVATE_KEY: ""
-  COINGECKO_API_KEY: ""

polymarket-bot/cronjob-metrics-retention.yaml

@@ -1,55 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: metrics-retention
-  namespace: polymarket-bot
-spec:
-  # Daily at 00:10 UTC: collapse every past UTC day in metrics_daily to its
-  # last snapshot (the "daily close"). The bot writes one snapshot per cycle
-  # (~1,300/day); only the close of past days is read back (DISTINCT ON in
-  # get_metrics_history / get_daily_pnl_closes), so intraday rows of past
-  # days are dead weight. Today's rows are never touched: the latest one
-  # feeds /api/summary and the close is still evolving.
-  schedule: "10 0 * * *"
-  suspend: true
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      backoffLimit: 2
-      template:
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: prune
-              image: postgres:16-alpine
-              env:
-                - name: DATABASE_URL
-                  valueFrom:
-                    secretKeyRef:
-                      name: bot-secrets-infisical
-                      key: DATABASE_URL
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  set -e
-                  psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -c "
-                    DELETE FROM metrics_daily m
-                    USING (
-                        SELECT timestamp::date AS day, MAX(timestamp) AS keep_ts
-                        FROM metrics_daily
-                        WHERE timestamp::date < CURRENT_DATE
-                        GROUP BY 1
-                    ) k
-                    WHERE m.timestamp::date = k.day
-                      AND m.timestamp < k.keep_ts;
-                  "
-                  psql "$DATABASE_URL" -c "VACUUM ANALYZE metrics_daily;"
-              resources:
-                requests:
-                  cpu: 10m
-                  memory: 32Mi
-                limits:
-                  memory: 128Mi

polymarket-bot/cronjob-outcomes.yaml

@@ -1,47 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: outcomes-joiner
-  namespace: polymarket-bot
-spec:
-  # Daily at 00:30 UTC (after metrics-retention at 00:10, no overlap): fetch
-  # UMA-final resolutions for archived markets from the Gamma API into
-  # market_outcomes, then print the calibration report (Brier/log-loss of the
-  # model vs the market price). Replay R2 joiner — analysis only: reads the
-  # signals archive, writes only market_outcomes, never touches trading
-  # tables. Safe to also run by hand any time (kubectl create job --from=...):
-  # the upsert is idempotent per market_id (ON CONFLICT DO UPDATE) and the
-  # fetch only queries markets that still lack an outcome.
-  schedule: "30 0 * * *"
-  suspend: true
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      backoffLimit: 2
-      # A hung Gamma call must not block tomorrow's run through Forbid
-      activeDeadlineSeconds: 900
-      template:
-        spec:
-          restartPolicy: OnFailure
-          imagePullSecrets:
-            - name: gitea-registry-infisical
-          containers:
-            - name: outcomes
-              # Same image as the bot deployment; CI bumps this tag on every
-              # bot image build (see polymarket-bot repo .gitea/workflows/ci.yml)
-              image: git.chemavx.xyz/chemavx/polymarket-bot:2b326ad5
-              imagePullPolicy: Always
-              command: ["python3", "-m", "bot.outcomes"]
-              envFrom:
-                - secretRef:
-                    name: bot-secrets-infisical
-                - configMapRef:
-                    name: bot-config
-              resources:
-                requests:
-                  cpu: 25m
-                  memory: 64Mi
-                limits:
-                  memory: 256Mi

polymarket-bot/deployment-api.yaml

@@ -1,57 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: api
-  namespace: polymarket-bot
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 0
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: api
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: api
-    spec:
-      imagePullSecrets:
-      - name: gitea-registry-infisical
-      containers:
-      - command:
-        - uvicorn
-        - api.main:app
-        - --host
-        - 0.0.0.0
-        - --port
-        - "8000"
-        envFrom:
-        - secretRef:
-            name: bot-secrets-infisical
-        - configMapRef:
-            name: bot-config
-        image: git.chemavx.xyz/chemavx/polymarket-bot-api:7804d25c
-        imagePullPolicy: Always
-        name: api
-        ports:
-        - containerPort: 8000
-          protocol: TCP
-        resources:
-          limits:
-            cpu: 500m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 256Mi
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30

polymarket-bot/deployment-bot.yaml

@@ -1,51 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bot
-  namespace: polymarket-bot
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 0
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: bot
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: bot
-    spec:
-      imagePullSecrets:
-      - name: gitea-registry-infisical
-      containers:
-      - command:
-        - python3
-        - -m
-        - bot.main
-        envFrom:
-        - secretRef:
-            name: bot-secrets-infisical
-        - configMapRef:
-            name: bot-config
-        image: git.chemavx.xyz/chemavx/polymarket-bot:7804d25c
-        imagePullPolicy: Always
-        name: bot
-        resources:
-          limits:
-            cpu: 500m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 256Mi
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30

polymarket-bot/deployment-dashboard.yaml

@@ -1,45 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: dashboard
-  namespace: polymarket-bot
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 0
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: dashboard
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: dashboard
-    spec:
-      imagePullSecrets:
-      - name: gitea-registry-infisical
-      containers:
-      - image: git.chemavx.xyz/chemavx/polymarket-bot-dashboard:7804d25c
-        imagePullPolicy: Always
-        name: dashboard
-        ports:
-        - containerPort: 80
-          protocol: TCP
-        resources:
-          limits:
-            cpu: 200m
-            memory: 128Mi
-          requests:
-            cpu: 50m
-            memory: 64Mi
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30

polymarket-bot/infisical-bot-secrets.yaml

@@ -1,30 +0,0 @@
-apiVersion: secrets.infisical.com/v1beta1
-kind: InfisicalStaticSecret
-metadata:
-  name: bot-secrets
-  namespace: polymarket-bot
-spec:
-  # Shared, read-only machine identity (no write grant, no PushSecret).
-  infisicalAuthRef:
-    name: infisical-auth
-    namespace: infisical-operator
-  sources:
-    # App-specific secrets (4): DATABASE_URL, POLYMARKET_API_KEY/SECRET/PASSPHRASE
-    - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0   # project "homelab"
-      environmentSlug: prod
-      secretPath: /polymarket-bot
-    # Telegram (2): TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID — reused from the shared
-    # /telegram path (deduplicated; same token as the other 5 namespaces).
-    - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0
-      environmentSlug: prod
-      secretPath: /telegram
-  syncOptions:
-    refreshInterval: 60s
-  targets:
-    - kind: Secret
-      name: bot-secrets-infisical          # parallel name — old bot-secrets stays live until 3c
-      namespace: polymarket-bot
-      creationPolicy: Owner
-      # key passthrough: synced Secret carries all 6 keys verbatim.
-      # PAPER_* and the empty WALLET_PRIVATE_KEY/COINGECKO_API_KEY are config,
-      # not secrets — they live in the bot-config ConfigMap, not here.

polymarket-bot/infisical-gitea-registry.yaml

@@ -1,27 +0,0 @@
-apiVersion: secrets.infisical.com/v1beta1
-kind: InfisicalStaticSecret
-metadata:
-  name: gitea-registry
-  namespace: polymarket-bot
-spec:
-  # References the SHARED auth layer in infisical-operator (cross-namespace).
-  infisicalAuthRef:
-    name: infisical-auth
-    namespace: infisical-operator
-  sources:
-    - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0   # project "homelab"
-      environmentSlug: prod
-      secretPath: /registry                              # shared /registry v3 fields (same as researchowl)
-  syncOptions:
-    refreshInterval: 60s
-  targets:
-    - kind: Secret
-      name: gitea-registry-infisical          # parallel name — old gitea-registry stays live until cutover
-      namespace: polymarket-bot
-      creationPolicy: Owner
-      secretType: kubernetes.io/dockerconfigjson
-      template:
-        engineVersion: v1
-        data:
-          # Reconstruct the docker pull-secret blob from the two discrete /registry fields.
-          .dockerconfigjson: '{"auths":{"git.chemavx.xyz":{"username":"{{ .GITEA_REGISTRY_USERNAME.Value }}","password":"{{ .GITEA_REGISTRY_TOKEN.Value }}","auth":"{{ printf "%s:%s" .GITEA_REGISTRY_USERNAME.Value .GITEA_REGISTRY_TOKEN.Value | encodeBase64 }}"}}}'

polymarket-bot/infisical-telegram-notify.yaml

@@ -1,24 +0,0 @@
-apiVersion: secrets.infisical.com/v1beta1
-kind: InfisicalStaticSecret
-metadata:
-  name: telegram-notify
-  namespace: polymarket-bot
-spec:
-  # Shared, read-only machine identity (no write grant, no PushSecret).
-  # NOTE: this migrates only the STANDALONE telegram-notify secret. The same
-  # Telegram token also embedded in bot-secrets is migration #3 — not touched here.
-  infisicalAuthRef:
-    name: infisical-auth
-    namespace: infisical-operator
-  sources:
-    - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0   # project "homelab"
-      environmentSlug: prod
-      secretPath: /telegram                              # shared across all 5 namespaces
-  syncOptions:
-    refreshInterval: 60s
-  targets:
-    - kind: Secret
-      name: telegram-notify-infisical          # parallel name — old telegram-notify stays live until 3c
-      namespace: polymarket-bot
-      creationPolicy: Owner
-      # key passthrough: synced Secret carries TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID verbatim

polymarket-bot/ingress-polymarket-bot.yaml

@@ -1,33 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: polymarket-bot
-  namespace: polymarket-bot
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  ingressClassName: traefik
-  rules:
-  - host: polymarket.chemavx.xyz
-    http:
-      paths:
-      - backend:
-          service:
-            name: api
-            port:
-              number: 8000
-        path: /api
-        pathType: Prefix
-      - backend:
-          service:
-            name: dashboard
-            port:
-              number: 80
-        path: /
-        pathType: Prefix
-  tls:
-  - hosts:
-    - polymarket.chemavx.xyz
-    secretName: polymarket-tls

polymarket-bot/pvc-data-postgres-0.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  annotations:
-    # Never let ArgoCD prune this PVC: it holds the paper-trading postgres data.
-    argocd.argoproj.io/sync-options: Prune=false
-    pv.kubernetes.io/bind-completed: 'yes'
-    pv.kubernetes.io/bound-by-controller: 'yes'
-    volume.beta.kubernetes.io/storage-provisioner: rancher.io/local-path
-    volume.kubernetes.io/selected-node: chemavx-k8
-    volume.kubernetes.io/storage-provisioner: rancher.io/local-path
-  labels:
-    app: postgres
-  name: data-postgres-0
-  namespace: polymarket-bot
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: local-path
-  volumeMode: Filesystem
-  volumeName: pvc-327bbc6d-dcc6-46b4-9d78-db950f71eb98
-

polymarket-bot/service-api.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: api
-  namespace: polymarket-bot
-spec:
-  clusterIP: 10.43.201.4
-  clusterIPs:
-  - 10.43.201.4
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 8000
-    protocol: TCP
-    targetPort: 8000
-  selector:
-    app: api
-  sessionAffinity: None
-  type: ClusterIP
-

polymarket-bot/service-dashboard.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: dashboard
-  namespace: polymarket-bot
-spec:
-  clusterIP: 10.43.62.6
-  clusterIPs:
-  - 10.43.62.6
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: dashboard
-  sessionAffinity: None
-  type: ClusterIP
-

polymarket-bot/service-postgres.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: postgres
-  namespace: polymarket-bot
-spec:
-  clusterIP: 10.43.238.53
-  clusterIPs:
-  - 10.43.238.53
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 5432
-    protocol: TCP
-    targetPort: 5432
-  selector:
-    app: postgres
-  sessionAffinity: None
-  type: ClusterIP
-

polymarket-bot/statefulset-postgres.yaml

@@ -1,76 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: postgres
-  namespace: polymarket-bot
-spec:
-  persistentVolumeClaimRetentionPolicy:
-    whenDeleted: Retain
-    whenScaled: Retain
-  podManagementPolicy: OrderedReady
-  replicas: 0
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: postgres
-  serviceName: postgres
-  template:
-    metadata:
-      labels:
-        app: postgres
-    spec:
-      containers:
-      - env:
-        - name: POSTGRES_USER
-          value: bot
-        - name: POSTGRES_PASSWORD
-          value: bot
-        - name: POSTGRES_DB
-          value: polymarket
-        image: postgres:16-alpine
-        imagePullPolicy: IfNotPresent
-        name: postgres
-        ports:
-        - containerPort: 5432
-          protocol: TCP
-        readinessProbe:
-          exec:
-            command:
-            - pg_isready
-            - -U
-            - bot
-          failureThreshold: 3
-          initialDelaySeconds: 5
-          periodSeconds: 5
-          successThreshold: 1
-          timeoutSeconds: 1
-        resources: {}
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - mountPath: /var/lib/postgresql/data
-          name: data
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
-  updateStrategy:
-    rollingUpdate:
-      partition: 0
-    type: RollingUpdate
-  volumeClaimTemplates:
-  - apiVersion: v1
-    kind: PersistentVolumeClaim
-    metadata:
-      name: data
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 5Gi
-      volumeMode: Filesystem
-    status:
-      phase: Pending
-