Deploy infisical-standalone 1.9.0 (Infisical v0.158.0) in a dedicated
'infisical' namespace via a multi-source ArgoCD app (chart + values).
Bundled Postgres (dedicated local-path PVC, 8Gi) + Redis. Ingress via
Traefik + cert-manager (letsencrypt-prod) at infisical.chemavx.xyz.
Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are injected
out-of-band via the 'infisical-secrets' Secret (kubectl, IgnoreExtraneous),
NOT in git. Postgres/Redis passwords guard ClusterIP-only in-cluster
services holding ciphertext; acceptable in values per design review.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The dockerconfigjson held the old account password (now rotated/revoked)
in plaintext. Manage this image-pull secret out-of-band via kubectl
(like researchowl), so no registry credential lives in git going forward.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A ConfigMap volume is read-only at the FS level, so the Ghost entrypoint's
chown -R on content/ failed ("Read-only file system") and crash-looped.
Copy redirects.yaml onto the writable PVC with an initContainer instead;
still GitOps-sourced and refreshed on every pod start.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Recover ~454 GSC impressions stranded on a 404. Adds a ghost-en-redirects
ConfigMap (content/data/redirects.yaml) 301-redirecting the old slug
/pentagon-second-uap-declassification-may-2026-apollo-12-sandia/ to the
live /pentagon-uap-second-release-may-2026/. Mounted read-only via subPath
so it survives content PVC recreation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Same protection already given to polymarket-bot postgres and n8n: without
it, removing a PVC manifest from git (rename, multi-doc refactor) would
make ArgoCD destroy the volume and its data.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The real manifest is researchowl/argocd-app.yaml, self-managed inside the
app's own synced path; edits to this copy get silently reverted by selfHeal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
researchowl/argocd-app.yaml lives inside the app's own synced path, so it is
the source of truth: annotations applied only to the live object (or to the
argocd/ dump copy) get reverted by selfHeal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Notifications via generic webhook to the Telegram Bot API: the engine's
native telegram service only supports channels and negative group IDs,
so a positive private chat_id never worked ("chat not found").
- Only on-sync-failed and on-health-degraded triggers; on-sync-succeeded
dropped (CI already reports successful deploys).
- Subscribe annotations on polymarket-bot, researchowl and n8n.
- prune: true on polymarket-bot, guarded by Prune=false on the postgres
PVC so removing the manifest from git can never destroy the data.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Brings the existing manually-applied ghost-en (theexclusionzone.com)
into the GitOps repo. Adds redirect-to-www-https middleware to fix the
Google Search Console redirect issue: non-www now 301s to https://www
instead of serving duplicate content.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Extract readyReplicas OR availableReplicas (k8s omits readyReplicas when 0)
- Also accept MinimumReplicasAvailable condition as ready signal
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Create telegram-notify secret in n8n, portfolio, polymarket-bot, researchowl, openclaw
namespaces (values mirrored from monitoring/grafana-telegram)
- Update existing smoke tests (n8n, portfolio, polymarket-bot) to send [OK]/[FAIL]
Telegram notifications on success/failure
- Add postsync-smoke-test for openclaw (curl GET / on port 18789)
- Add postsync-smoke-test for researchowl (no HTTP port; checks readyReplicas via
k8s API using a smoke-test-reader ServiceAccount + Role + RoleBinding)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add ze-manual-html ConfigMap serving ze-manual.html at /ze/index.html
- Mount ze-manual-html in nginx at /usr/share/nginx/html/ze
- Add Projects section in portfolio index with ze card linking to /ze
ArgoCD sobreescribía zona-exclusion-secrets con REPLACE_ME.
El secret se gestiona manualmente con annotation Prune=false.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Añade ignoreDifferences para /data del Secret y
RespectIgnoreDifferences=true para que el sync no aplique
el recurso cuando la única diferencia es en los datos del secret.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add ANTHROPIC_API_KEY from secret for Claude Haiku relevance scoring
- Fix OLLAMA_URL to internal k8s DNS (ollama.ollama.svc.cluster.local)
- Remove Secret resource (was causing ArgoCD to overwrite with REPLACE_ME)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Deleted open-webui namespace, deployment, service, ingress, and PVC
from cluster (replaced by OpenClaw using Claude API)
- Removed openclaw PVC and RBAC manifests no longer needed
- Removed Uptime Kuma monitor for chat.chemavx.xyz
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Each alert rule's summary annotation now renders a formatted Telegram
message with emoji and multiline context. The contact point passes the
pre-rendered summary through, adding "✅ Resuelto" on resolution.
Also restores the == 1 filter on Pod Failed/Unknown lost in prior rebase.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add hostPath volume for /var/lib/rancher/k3s/server/db (readOnly)
- Script copies state.db + WAL files → k3s-db_<date>.tar.gz in /data/backups/backups/
- Rotation: keeps last 7 copies (same policy as other services)
- rclone-mega-backup picks it up automatically (syncs full /data/backups/backups/)
- Also tracks the CronJob manifest in git (was previously untracked)
Note: k3s uses SQLite/kine (not embedded etcd). etcd-snapshot is disabled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Configure argocd-notifications-cm with Telegram service, templates and triggers
for sync-succeeded, sync-failed, and app-degraded events
- Add application-polymarket-bot.yaml and application-n8n.yaml with notification
subscription annotations (chat_id: 5138407666)
Note: requires kubectl patch of argocd-notifications-secret with telegram-token
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
El config dir de OpenClaw es /home/node/.openclaw, no /data.
Monta el PVC en la ruta correcta para que openclaw.json persista.
Elimina OPENCLAW_DATA_DIR (no era el config dir).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Manifiestos limpios: namespace, rbac, pvc (5Gi local-path), deployment, service, ingress
- nodeSelector chemavx-k8 en deployment para fijar PVC en el nodo correcto
- Imagen fijada a ghcr.io/openclaw/openclaw:2026.4.12
- Sin initContainers ni secrets en el deployment (config post-arranque via exec)
- Elimina artefactos: configmap-kube-root-ca.crt.yaml, serviceaccount-default.yaml, pvc-openclaw-pvc.yaml, rbac-openclaw-agent.yaml
- Añade argocd/application-openclaw.yaml para gestión GitOps
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Deploy registry:2 as Docker Hub pull-through cache on chemavx-k8 (hostPort 5000,
ClusterIP 10.43.163.56:5000). Configures dind runner to use local mirror via
daemon.json to eliminate Docker Hub rate limit failures in CI/CD.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
RollingUpdate caused rollout deadlocks because the PVC (ReadWriteOnce)
cannot be mounted by two pods simultaneously.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Switch from ollama/ollama:rocm + amd.com/gpu to standard CUDA image + nvidia.com/gpu.
RTX 3060 (GA106, 12GB) now used via NVIDIA GPU Operator on chemavx-k8.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Delete 26 secret manifests containing REDACTED placeholder values
(15 cert-manager TLS + 11 app secrets across 8 namespaces)
- REDACTED is valid base64 that decodes to non-UTF-8 bytes — ArgoCD
applying these manifests corrupts live secrets in the cluster
- Add .githooks/pre-commit that rejects any .yaml with REDACTED
- Add README.md documenting secret management policy and manual
creation commands for each service
- n8n secret manifests already fixed in previous commits (618b1e8, db04fd2)
ArgoCD was overwriting the polymarket-tls secret with REDACTED values,
corrupting the TLS cert. This secret is managed by cert-manager and
must not be tracked in git.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix bot-secrets: replace corrupted REDACTED base64 values with correct ones
- Update deployment-api and deployment-bot to use git.chemavx.xyz registry images
- Add imagePullSecrets (gitea-registry) to api and bot deployments
- Add secret-gitea-registry.yaml manifest for ArgoCD to manage
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
chemavxandClaude Opus 4.8