From 7a7eecd0b35797bf3f65584154d830e20227af5a Mon Sep 17 00:00:00 2001 From: pikastech Date: Tue, 21 Jul 2026 02:41:24 +0200 Subject: [PATCH 1/2] feat: bootstrap SuperAPI staged delivery --- config/platform-db/postgres-nc01.yaml | 52 ++++++++++- config/platform-infra/gitea.yaml | 92 ++++++++++++++++++++ config/platform-infra/pipelines-as-code.yaml | 89 +++++++++++++++++++ config/platform-infra/public-edge.yaml | 8 ++ config/secrets-distribution.yaml | 66 ++++++++++++++ 5 files changed, 305 insertions(+), 2 deletions(-) diff --git a/config/platform-db/postgres-nc01.yaml b/config/platform-db/postgres-nc01.yaml index cd033dad..826ccd4a 100644 --- a/config/platform-db/postgres-nc01.yaml +++ b/config/platform-db/postgres-nc01.yaml @@ -131,6 +131,11 @@ postgres: user: superapi address: 10.42.0.0/16 method: scram-sha-256 + - type: hostssl + database: superapi_development + user: superapi_development + address: 10.42.0.0/16 + method: scram-sha-256 - type: hostssl database: pikaoa user: pikaoa @@ -227,6 +232,20 @@ secrets: SUPERAPI_DB_NAME: superapi randomHex: SUPERAPI_DB_PASSWORD: 32 + - name: superapi-development-nc01-db-credentials + sourceRef: platform-db/superapi-development-nc01-db.env + type: env + requiredKeys: + - SUPERAPI_DEVELOPMENT_DB_USER + - SUPERAPI_DEVELOPMENT_DB_PASSWORD + - SUPERAPI_DEVELOPMENT_DB_NAME + createIfMissing: + enabled: true + values: + SUPERAPI_DEVELOPMENT_DB_USER: superapi_development + SUPERAPI_DEVELOPMENT_DB_NAME: superapi_development + randomHex: + SUPERAPI_DEVELOPMENT_DB_PASSWORD: 32 - name: pikaoa-nc01-db-credentials sourceRef: platform-db/pikaoa-db.env type: env @@ -352,6 +371,15 @@ objects: createdb: false createrole: false superuser: false + - name: superapi_development + passwordRef: + sourceRef: platform-db/superapi-development-nc01-db.env + key: SUPERAPI_DEVELOPMENT_DB_PASSWORD + login: true + attributes: + createdb: false + createrole: false + superuser: false - name: pikaoa passwordRef: sourceRef: platform-db/pikaoa-db.env @@ -427,6 +455,11 @@ objects: encoding: UTF8 locale: C.UTF-8 extensions: [] + - name: superapi_development + owner: superapi_development + encoding: UTF8 + locale: C.UTF-8 + extensions: [] - name: pikaoa owner: pikaoa encoding: UTF8 @@ -529,8 +562,23 @@ exports: key: DATABASE_URL mode: update-or-insert consumers: - - scope: superapi - secret: superapi-runtime + - scope: superapi-production + secret: superapi-production-runtime + key: DATABASE_URL + - name: superapi-development-nc01-database-url + sourceSecretRef: platform-db/superapi-development-nc01-db.env + render: + envKey: DATABASE_URL + format: postgresql://$(SUPERAPI_DEVELOPMENT_DB_USER):$(SUPERAPI_DEVELOPMENT_DB_PASSWORD)@$(PGHOST):5432/$(SUPERAPI_DEVELOPMENT_DB_NAME)?sslmode=require + variables: + PGHOST: 10.42.0.1 + writeToSecretSource: + sourceRef: platform-infra/superapi-development.env + key: DATABASE_URL + mode: update-or-insert + consumers: + - scope: superapi-development + secret: superapi-development-runtime key: DATABASE_URL - name: pikaoa-database-url sourceSecretRef: platform-db/pikaoa-db.env diff --git a/config/platform-infra/gitea.yaml b/config/platform-infra/gitea.yaml index 846f366c..32e4f44d 100644 --- a/config/platform-infra/gitea.yaml +++ b/config/platform-infra/gitea.yaml @@ -644,6 +644,98 @@ sourceAuthority: naming: gitea-actions-immutable-source prefix: refs/unidesk/snapshots/gitea-actions/pikaoa-release-nc01 legacyGitMirror: null + - key: superapi-development-nc01 + targetId: NC01 + credentialOverride: + github: + transport: https-token + sourceRef: pikainc-selfmedia-gh-token.txt + sourceKey: GH_TOKEN + format: raw-token + requiredFor: + - upstream-mirror + - mirror-sync + - managed-repository-fetch + - github-head-observe + - github-hooks-list + - github-hooks-reconcile + permissions: + contents: read + metadata: read + webhooks: read-write + gitFetchCredential: + apiVersion: unidesk.ai/v1 + kind: GitFetchCredential + authMode: github-https-token + host: github.com + secretRef: + namespace: devops-infra + name: gitea-github-sync-secrets + key: github-token-pikainc-superapi + upstream: + repository: pikainc/superapi + cloneUrl: https://github.com/pikainc/superapi.git + branch: master + visibility: private + gitea: + owner: mirrors + name: pikainc-superapi + mirrorMode: controlled-push + publicRead: false + readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git + gitops: + branch: unidesk-host-gitops + flushDisposition: gitea-writeback + snapshot: + naming: gitea-actions-immutable-source + prefix: refs/unidesk/snapshots/gitea-actions/superapi-master-nc01 + legacyGitMirror: null + - key: superapi-production-nc01 + targetId: NC01 + credentialOverride: + github: + transport: https-token + sourceRef: pikainc-selfmedia-gh-token.txt + sourceKey: GH_TOKEN + format: raw-token + requiredFor: + - upstream-mirror + - mirror-sync + - managed-repository-fetch + - github-head-observe + - github-hooks-list + - github-hooks-reconcile + permissions: + contents: read + metadata: read + webhooks: read-write + gitFetchCredential: + apiVersion: unidesk.ai/v1 + kind: GitFetchCredential + authMode: github-https-token + host: github.com + secretRef: + namespace: devops-infra + name: gitea-github-sync-secrets + key: github-token-pikainc-superapi-release + upstream: + repository: pikainc/superapi + cloneUrl: https://github.com/pikainc/superapi.git + branch: release + visibility: private + gitea: + owner: mirrors + name: pikainc-superapi + mirrorMode: controlled-push + publicRead: false + readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git + gitops: + branch: unidesk-host-gitops + flushDisposition: gitea-writeback + snapshot: + naming: gitea-actions-immutable-source + prefix: refs/unidesk/snapshots/gitea-actions/superapi-release-nc01 + legacyGitMirror: null targets: - id: JD01 diff --git a/config/platform-infra/pipelines-as-code.yaml b/config/platform-infra/pipelines-as-code.yaml index 5181b8d9..3f5e7d8a 100644 --- a/config/platform-infra/pipelines-as-code.yaml +++ b/config/platform-infra/pipelines-as-code.yaml @@ -353,6 +353,35 @@ repositories: runtime_service_port: "8080" health_path: /healthz health_url: http://pikaoa-web.pikaoa-dev.svc.cluster.local:8080/healthz + - id: superapi-development-nc01 + name: superapi-development-nc01 + namespace: devops-infra + providerType: gitea + url: https://gitea.hwpod.com/mirrors/pikainc-superapi + cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git + owner: mirrors + repo: pikainc-superapi + secretName: pac-gitea-superapi-development-nc01 + tokenKey: token + webhookSecretKey: webhook.secret + concurrencyLimit: 1 + params: + git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-superapi.git + source_branch: master + source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/superapi-master-nc01 + node: NC01 + image_repository: 127.0.0.1:5000/superapi/superapi + pipeline_name: superapi-development-nc01-pac + pipeline_run_prefix: superapi-development-nc01 + service_account: superapi-development-nc01-tekton-runner + pipeline_timeout: 900s + workspace_pvc_size: 4Gi + runtime_namespace: superapi-development + runtime_deployment: superapi-gateway + runtime_service: superapi-gateway + runtime_service_port: "8080" + health_path: /health + health_url: http://superapi-gateway.superapi-development.svc.cluster.local:8080/health consumers: - extends: templates.consumers.agentrunV02 variables: @@ -834,6 +863,66 @@ consumers: hostNetwork: true dnsPolicy: ClusterFirstWithHostNet fsGroup: 1000 + - id: superapi-development-nc01 + repositoryRef: superapi-development-nc01 + node: NC01 + lane: superapi-development + namespace: devops-infra + pipeline: superapi-development-nc01-pac + pipelineRunPrefix: superapi-development-nc01 + argoNamespace: argocd + argoApplication: superapi-development-nc01 + deliveryObservation: + runtimeEvidence: required + closeoutGitOpsMirrorFlush: false + argoBootstrap: + project: default + repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git + targetRevision: unidesk-host-gitops + path: deploy/gitops/platform-infra/superapi-development-nc01 + destinationNamespace: superapi-development + automated: true + repositoryCredential: + secretName: argocd-repo-superapi-development-nc01 + username: unidesk-admin + runnerServiceAccount: + name: superapi-development-nc01-tekton-runner + automountServiceAccountToken: false + roleBindingName: superapi-development-nc01-tekton-runner + - id: superapi-production-nc01 + repositoryRef: superapi-development-nc01 + node: NC01 + lane: superapi-production + namespace: devops-infra + pipeline: superapi-production-nc01-pac + pipelineRunPrefix: superapi-production-nc01 + argoNamespace: argocd + argoApplication: superapi-production-nc01 + deliveryObservation: + runtimeEvidence: required + closeoutGitOpsMirrorFlush: false + params: + source_branch: release + source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/superapi-release-nc01 + pipeline_name: superapi-production-nc01-pac + pipeline_run_prefix: superapi-production-nc01 + service_account: superapi-production-nc01-tekton-runner + runtime_namespace: superapi-production + health_url: http://superapi-gateway.superapi-production.svc.cluster.local:8080/health + argoBootstrap: + project: default + repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git + targetRevision: unidesk-host-gitops + path: deploy/gitops/platform-infra/superapi-production-nc01 + destinationNamespace: superapi-production + automated: true + repositoryCredential: + secretName: argocd-repo-superapi-production-nc01 + username: unidesk-admin + runnerServiceAccount: + name: superapi-production-nc01-tekton-runner + automountServiceAccountToken: false + roleBindingName: superapi-production-nc01-tekton-runner templates: repositories: agentrunV02: diff --git a/config/platform-infra/public-edge.yaml b/config/platform-infra/public-edge.yaml index acdd46e0..9e11b97a 100644 --- a/config/platform-infra/public-edge.yaml +++ b/config/platform-infra/public-edge.yaml @@ -151,3 +151,11 @@ targets: configRef: /root/superapi/config/superapi.yaml path: publicExposure sourceCommit: 04caa95a3fd984f81ce9144948b1cc879df04f68 + - id: superapi-development + configRef: /root/superapi/config/superapi.yaml + path: deployment.targets.l2.publicExposure + sourceCommit: ed9dada3ebe61a4d1d376b3e8d8a52f419b83366 + - id: superapi-production + configRef: /root/superapi/config/superapi.yaml + path: deployment.targets.l3.publicExposure + sourceCommit: ed9dada3ebe61a4d1d376b3e8d8a52f419b83366 diff --git a/config/secrets-distribution.yaml b/config/secrets-distribution.yaml index 15580b6b..6c1e5b7e 100644 --- a/config/secrets-distribution.yaml +++ b/config/secrets-distribution.yaml @@ -144,6 +144,18 @@ sources: PIKAOA_SESSION_SECRET: bytes: 32 prefix: poa_ + - sourceRef: platform-infra/superapi.env + type: env + requiredKeys: + - DATABASE_URL + createIfMissing: + enabled: false + - sourceRef: platform-infra/superapi-development.env + type: env + requiredKeys: + - DATABASE_URL + createIfMissing: + enabled: false - sourceRef: hwlab/jd01-v03-opencode.env type: env requiredKeys: @@ -317,6 +329,32 @@ targets: - pikaoa-api timeoutSeconds: 180 pollIntervalSeconds: 5 + - id: superapi-development-nc01 + route: NC01:k3s + namespace: superapi-development + scope: superapi-development + enabled: true + consumerRollout: + deployments: + - superapi-gateway + - superapi-api + - superapi-worker + - superapi-web + timeoutSeconds: 180 + pollIntervalSeconds: 5 + - id: superapi-production-nc01 + route: NC01:k3s + namespace: superapi-production + scope: superapi-production + enabled: true + consumerRollout: + deployments: + - superapi-gateway + - superapi-api + - superapi-worker + - superapi-web + timeoutSeconds: 180 + pollIntervalSeconds: 5 - id: temporal-nc01 route: NC01:k3s namespace: temporal @@ -393,6 +431,34 @@ kubernetesSecrets: - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt sourceKey: contents targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD + - name: superapi-development-runtime + targetId: superapi-development-nc01 + secretName: superapi-development-runtime + type: Opaque + data: + - sourceRef: platform-infra/superapi-development.env + sourceKey: DATABASE_URL + targetKey: DATABASE_URL + - sourceRef: /root/.unidesk/.env/unified-admin-password.txt + sourceKey: contents + targetKey: ADMIN_PASSWORD + - sourceRef: ~/.codex/auth.json.pika + sourceKey: contents + targetKey: BOOTSTRAP_AUTH_JSON + - name: superapi-production-runtime + targetId: superapi-production-nc01 + secretName: superapi-production-runtime + type: Opaque + data: + - sourceRef: platform-infra/superapi.env + sourceKey: DATABASE_URL + targetKey: DATABASE_URL + - sourceRef: /root/.unidesk/.env/unified-admin-password.txt + sourceKey: contents + targetKey: ADMIN_PASSWORD + - sourceRef: ~/.codex/auth.json.pika + sourceKey: contents + targetKey: BOOTSTRAP_AUTH_JSON - name: selfmedia-access targetId: selfmedia-nc01 secretName: selfmedia-access From 7e81371b26c77711ca1fcb285ec35bf44941e62a Mon Sep 17 00:00:00 2001 From: pikastech Date: Tue, 21 Jul 2026 02:47:21 +0200 Subject: [PATCH 2/2] fix: select pikainc token for SuperAPI --- config/unidesk-cli.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/config/unidesk-cli.yaml b/config/unidesk-cli.yaml index 5d6e48d3..61c0e200 100644 --- a/config/unidesk-cli.yaml +++ b/config/unidesk-cli.yaml @@ -34,6 +34,12 @@ github: sourceRef: pikainc-selfmedia-gh-token.txt sourceKey: GH_TOKEN format: raw-token + - repository: pikainc/superapi + priority: before-env + root: /root/.unidesk/.env + sourceRef: pikainc-selfmedia-gh-token.txt + sourceKey: GH_TOKEN + format: raw-token prMerge: unknownRetry: maxAttempts: 5