version: 1
kind: selfmedia-platform-delivery
metadata:
  id: selfmedia-factory
  owner: unidesk
  repository: pikainc/selfmedia
  description: 自媒体工厂在 NC01 的构建、GitOps、运行时与一次性切换真相。
defaults:
  targetId: NC01
delivery:
  targets:
    NC01:
      node: NC01
      lane: selfmedia
      route: NC01:k3s
      ci:
        namespace: selfmedia-ci
        pipeline: selfmedia-nc01-pac
        pipelineRunPrefix: selfmedia-nc01
        serviceAccountName: selfmedia-nc01-tekton-runner
        serviceAccountAutomount: false
        roleBindingName: selfmedia-nc01-tekton-runner
        workspaceSize: 16Gi
        pipelineTimeout: 2h0m0s
        toolImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
        buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
      source:
        repository: pikainc/selfmedia
        worktreeRemote: https://github.com/pikainc/selfmedia.git
        branch: master
        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
        snapshotPrefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
      build:
        dockerfile: deploy/Dockerfile
        imageRepository: 127.0.0.1:5000/selfmedia/newsroom
        networkMode: host
        proxy:
          http: http://127.0.0.1:10808
          https: http://127.0.0.1:10808
          all: http://127.0.0.1:10808
          noProxy:
            - localhost
            - 127.0.0.1
            - "::1"
            - 127.0.0.1:5000
            - localhost:5000
            - .svc
            - .svc.cluster.local
            - .cluster.local
            - hyueapi.com
            - .hyueapi.com
      gitops:
        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
        writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
        branch: nc01-selfmedia-gitops
        manifestPath: deploy/gitops/nc01/resources.yaml
        releaseStatePath: deploy/gitops-state/nc01/release.json
        credentialSecretName: pac-gitea-selfmedia-nc01
        credentialTokenKey: token
        credentialUsername: unidesk-admin
        author:
          name: SelfMedia NC01 CI
          email: selfmedia-nc01-ci@unidesk.local
      deployment:
        version: selfmedia.pikapython.com/v1
        kind: SelfMediaDeployment
        metadata:
          name: selfmedia-nc01
          owner: unidesk
        target:
          id: NC01
          route: NC01:k3s
          namespace: selfmedia
          publicHost: 152.53.229.148
        runtime:
          replicas: 1
          serviceAccountName: selfmedia
          imagePullPolicy: IfNotPresent
          command:
            - /usr/bin/tini
            - --
            - bun
            - scripts/selfmedia-cli.ts
            - server
            - foreground
          service:
            name: selfmedia
            type: ClusterIP
            port: 4317
            targetPort: 4317
          health:
            path: /healthz
            startupFailureThreshold: 30
            startupPeriodSeconds: 5
            readinessPeriodSeconds: 10
            livenessPeriodSeconds: 20
          resources:
            requests:
              cpu: 250m
              memory: 768Mi
            limits:
              cpu: "4"
              memory: 6Gi
          securityContext:
            runAsUser: 10001
            runAsGroup: 10001
            fsGroup: 10001
            runAsNonRoot: true
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            seccompProfile: RuntimeDefault
            dropCapabilities:
              - ALL
          writablePaths:
            tmp:
              mountPath: /tmp
              sizeLimit: 2Gi
            codexHome:
              mountPath: /home/codex/.codex
              sizeLimit: 2Gi
            cache:
              mountPath: /home/codex/.cache
              sizeLimit: 2Gi
            toolCache:
              mountPath: /app/.tools/cache
              sizeLimit: 1Gi
        publicExposure:
          enabled: true
          mode: hostPort-http-edge
          address: http://152.53.229.148:4317
          hostPort: 4317
          edge:
            name: selfmedia-public-edge
            image: caddy:2.10.2-alpine
            containerPort: 8080
            upstream: selfmedia.selfmedia.svc.cluster.local:4317
            resources:
              requests:
                cpu: 20m
                memory: 32Mi
              limits:
                cpu: 200m
                memory: 128Mi
        storage:
          media:
            claimName: selfmedia-data
            storageClassName: local-path
            accessModes:
              - ReadWriteOnce
            size: 40Gi
            mounts:
              data:
                mountPath: /app/data
                subPath: data
              state:
                mountPath: /app/.state
                subPath: state
              logs:
                mountPath: /app/logs
                subPath: logs
          codexSessions:
            claimName: selfmedia-codex-sessions
            storageClassName: local-path
            accessModes:
              - ReadWriteOnce
            size: 5Gi
            mounts:
              sessions:
                mountPath: /home/codex/.codex/sessions
                subPath: sessions
              state:
                mountPath: /home/codex/.codex/state
                subPath: state
        secrets:
          access:
            sourceRef: /root/.unidesk/.env/selfmedia-access.env
            target:
              secretName: selfmedia-access
              readOnly: true
              files:
                - targetKey: admin-username
                  mountPath: /run/secrets/selfmedia-access/admin-username
                - targetKey: admin-password
                  mountPath: /run/secrets/selfmedia-access/admin-password
                - targetKey: api-key
                  mountPath: /run/secrets/selfmedia-access/api-key
                - targetKey: session-secret
                  mountPath: /run/secrets/selfmedia-access/session-secret
          runtime:
            sourceRef: ~/.env/TOKEN
            target:
              secretName: selfmedia-runtime
              targetKey: TOKEN
              mountPath: /home/codex/.env/TOKEN
          codex:
            sources:
              - sourceRef: ~/.codex/config.toml.pika
                targetKey: config.toml
              - sourceRef: ~/.codex/auth.json.pika
                targetKey: auth.json
            target:
              secretName: selfmedia-codex
              files:
                - targetKey: config.toml
                  mountPath: /home/codex/.codex/config.toml.pika
                - targetKey: auth.json
                  mountPath: /home/codex/.codex/auth.json.pika
        networkPolicy:
          enabled: true
          dnsNamespace: kube-system
          dnsPort: 53
          blockedCidrs:
            - 10.0.0.0/8
            - 172.16.0.0/12
            - 192.168.0.0/16
            - 169.254.169.254/32
            - 152.53.229.148/32
        codex:
          package: "@openai/codex"
          version: 0.144.1
          executable: codex
          home: /home/codex
          codexHome: /home/codex/.codex
          sessionsPath: /home/codex/.codex/sessions
          supervisorStatePath: /home/codex/.codex/state/selfmedia-supervisor.json
          resumeArgs:
            - resume
            - --last
          sourcePath: /app
          skillsPath: /home/codex/.codex/skills
cutover:
  targets:
    NC01:
      mode: host-process-to-kubernetes
      source:
        workspace: /root/selfmedia
        publicAddress: http://152.53.229.148:4317
        healthUrl: http://127.0.0.1:4317/healthz
        stopCommand:
          - bun
          - scripts/selfmedia-cli.ts
          - server
          - stop
        startCommand:
          - bun
          - scripts/selfmedia-cli.ts
          - server
          - start
        dataPaths:
          - data
          - .state
          - logs
        excludes:
          - .state/server.json
      destination:
        route: NC01:k3s
        namespace: selfmedia
        application: selfmedia-nc01
        publicAddress: http://152.53.229.148:4317
        healthUrl: http://152.53.229.148:4317/healthz
        dataClaim: selfmedia-data
        codexClaim: selfmedia-codex-sessions
      prepare:
        requiresFinalConfirmation: true
        phases:
          - 校验源服务健康、Secret presence/fingerprint 与目标 PVC
          - 在线种子复制并记录文件数和字节数
          - 停止旧服务、执行最终增量并确认宿主 4317 已释放
          - 允许 Argo 首次同步并验证公网健康
      rollback:
        phases:
          - 暂停 selfmedia-nc01 Argo 自动同步
          - 缩容 selfmedia 与 selfmedia-public-edge
          - 确认宿主 4317 已释放
          - 启动旧服务并验证原公网地址
        dataPolicy: 回滚默认不反向覆盖旧数据，需单独的数据恢复决策。
