From 384c3e45424a4b0e160dd9743e9c619cf46199f6 Mon Sep 17 00:00:00 2001
From: chemavx <chemavx@git.chemavx.xyz>
Date: Mon, 22 Jun 2026 06:40:21 +0000
Subject: [PATCH] researchowl: repoint to Infisical secret + flip to Recreate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

3b of the centralization. All 5 secretKeyRefs now reference
researchowl-secrets-infisical (synced from /researchowl). Also adds
strategy: Recreate (single-replica RWO SQLite/WAL — avoids two pods
briefly sharing /data/researchowl.db during a roll), permanent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 researchowl/deployment.yaml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/researchowl/deployment.yaml b/researchowl/deployment.yaml
index ed71940..2336c15 100644
--- a/researchowl/deployment.yaml
+++ b/researchowl/deployment.yaml
@@ -30,6 +30,10 @@ metadata:
     app: researchowl
 spec:
   replicas: 1
+  # Single-replica bot on a RWO local-path SQLite DB (WAL): Recreate avoids two pods
+  # briefly opening /data/researchowl.db during a roll (double-writer corruption risk).
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: researchowl
@@ -46,12 +50,12 @@ spec:
             - name: TELEGRAM_BOT_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: telegram-bot-token
             - name: TELEGRAM_ALLOWED_USERS
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: telegram-allowed-users
             - name: OLLAMA_URL
               value: "http://ollama.ollama.svc.cluster.local:11434"
@@ -70,21 +74,21 @@ spec:
             - name: ANTHROPIC_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: anthropic-api-key
             - name: GHOST_URL
               value: "https://zonadeexclusion.com"
             - name: GHOST_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: ghost-api-key
             - name: GHOST_URL_EN
               value: "https://www.theexclusionzone.com"
             - name: GHOST_API_KEY_EN
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: ghost-api-key-en
           volumeMounts:
             - name: data