feat: 声明 SelfMedia Temporal 运行拓扑

config/selfmedia.yaml

@@ -104,6 +104,25 @@ delivery:
             - scripts/selfmedia-cli.ts
             - server
             - foreground
+            - --runtime
+          worker:
+            name: selfmedia-worker
+            replicas: 1
+            command:
+              - /usr/bin/tini
+              - --
+              - node
+              - --import
+              - tsx
+              - scripts/temporal-worker.ts
+              - --runtime
+            resources:
+              requests:
+                cpu: 250m
+                memory: 768Mi
+              limits:
+                cpu: "4"
+                memory: 6Gi
           service:
             name: selfmedia
             type: ClusterIP
@@ -145,6 +164,51 @@ delivery:
             toolCache:
               mountPath: /app/.tools/cache
               sizeLimit: 1Gi
+        temporal:
+          namespace: selfmedia
+          taskQueue: selfmedia-pipeline
+          image: temporalio/temporal:1.8.0@sha256:2c344b4a39b4489fc6944db095f628f0c30659836faf11780a4dc435599e80e3
+          replicas: 1
+          command:
+            - temporal
+            - server
+            - start-dev
+            - --headless
+            - --ip
+            - 0.0.0.0
+            - --port
+            - "7233"
+            - --namespace
+            - selfmedia
+            - --db-filename
+            - /var/lib/temporal/temporal.db
+          service:
+            name: selfmedia-temporal
+            port: 7233
+          persistence:
+            claimName: selfmedia-temporal
+            storageClassName: local-path
+            accessModes:
+              - ReadWriteOnce
+            size: 5Gi
+            mountPath: /var/lib/temporal
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            seccompProfile: RuntimeDefault
+            dropCapabilities:
+              - ALL
         publicExposure:
           enabled: true
           mode: hostPort-http-edge

scripts/src/selfmedia-delivery-renderer.ts

@@ -404,8 +404,8 @@ function validateRuntimeRender(sourceWorktree: string, effectiveDeployment: Reco
     for (const marker of forbidden) {
       if (output.includes(marker)) throw new Error(`selfmedia service renderer output contains forbidden ${marker.trim()}`);
     }
-    if ((output.match(/kind: PersistentVolumeClaim/gu) ?? []).length !== 2) throw new Error("selfmedia service renderer must produce exactly two PVCs");
-    if ((output.match(/kind: NetworkPolicy/gu) ?? []).length < 3) throw new Error("selfmedia service renderer must produce at least three NetworkPolicies");
+    if ((output.match(/kind: PersistentVolumeClaim/gu) ?? []).length !== 3) throw new Error("selfmedia service renderer must produce exactly three PVCs");
+    if ((output.match(/kind: NetworkPolicy/gu) ?? []).length < 5) throw new Error("selfmedia service renderer must produce at least five NetworkPolicies");
   } finally {
     rmSync(temporary, { recursive: true, force: true });
   }