feat(roswell): despliegue GitOps del corpus — bot+scheduler, backup pg_dump diario, postgres adoptado

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

roswell/deployment.yaml

@@ -0,0 +1,117 @@
+# Bot + scheduler en un pod (PLAN §Fase 6). El Secret roswell-secrets se crea
+# imperativamente (nunca en git):
+#   kubectl create secret generic roswell-secrets -n roswell \
+#     --from-literal=telegram-bot-token=... \
+#     --from-literal=telegram-allowed-users=... \
+#     --from-literal=anthropic-api-key=... \
+#     --from-literal=database-url=postgresql://roswell:<pass>@postgres.roswell.svc.cluster.local:5432/roswell \
+#     --from-literal=podcastindex-key=... \
+#     --from-literal=podcastindex-secret=...
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    # ArgoCD no debe podar este PVC: guarda la caché del modelo Whisper (~3GB)
+    # y los PDFs subidos por Telegram.
+    argocd.argoproj.io/sync-options: Prune=false
+  name: roswell-data
+  namespace: roswell
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 10Gi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: roswell
+  namespace: roswell
+  labels:
+    app: roswell
+spec:
+  replicas: 1
+  # Dos pods haciendo polling del mismo token de Telegram entran en conflicto:
+  # Recreate garantiza que el viejo muere antes de arrancar el nuevo.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: roswell
+  template:
+    metadata:
+      labels:
+        app: roswell
+    spec:
+      containers:
+        - name: roswell
+          # Tag placeholder: el workflow de Gitea Actions lo sustituye por el
+          # sha8 real en cada build (ver .gitea/workflows/build.yml del repo).
+          image: git.chemavx.xyz/chemavx/roswell-corpus:00000000
+          imagePullPolicy: Always
+          env:
+            - name: TELEGRAM_BOT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: roswell-secrets
+                  key: telegram-bot-token
+            - name: TELEGRAM_ALLOWED_USERS
+              valueFrom:
+                secretKeyRef:
+                  name: roswell-secrets
+                  key: telegram-allowed-users
+            - name: ANTHROPIC_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: roswell-secrets
+                  key: anthropic-api-key
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: roswell-secrets
+                  key: database-url
+            - name: PODCASTINDEX_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: roswell-secrets
+                  key: podcastindex-key
+            - name: PODCASTINDEX_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: roswell-secrets
+                  key: podcastindex-secret
+            - name: OLLAMA_URL
+              value: "http://ollama.ollama.svc.cluster.local:11434"
+            - name: SEARXNG_URL
+              value: "http://searxng-svc.researchowl.svc.cluster.local:8080"
+            - name: WHISPER_MODEL
+              value: "large-v3"
+            - name: WHISPER_DEVICE
+              value: "cpu"
+            - name: DATA_DIR
+              value: "/data"
+            - name: FEED_CHECK_HOURS
+              value: "24"
+            # Caché de modelos Whisper en el PVC: la descarga (~3GB) sobrevive
+            # a los redeploys.
+            - name: HF_HOME
+              value: "/data/hf-cache"
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "500m"
+            limits:
+              # Whisper large-v3 en CPU ≈ 3-4 GB (PLAN §10). Sin límite de CPU:
+              # la transcripción aprovecha los cores libres del nodo.
+              memory: "4Gi"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: roswell-data
+      imagePullSecrets:
+        - name: gitea-registry