Codex
489 lines
16 KiB
YAML
489 lines
16 KiB
YAML
version: 1
|
|
kind: selfmedia-platform-delivery
|
|
metadata:
|
|
id: selfmedia-factory
|
|
owner: unidesk
|
|
repository: pikainc/selfmedia
|
|
description: 自媒体工厂在 NC01 的构建、GitOps、运行时与一次性切换真相。
|
|
defaults:
|
|
targetId: NC01
|
|
delivery:
|
|
targets:
|
|
NC01:
|
|
node: NC01
|
|
lane: selfmedia
|
|
route: NC01:k3s
|
|
ci:
|
|
namespace: selfmedia-ci
|
|
pipeline: selfmedia-nc01-pac
|
|
pipelineRunPrefix: selfmedia-nc01
|
|
serviceAccountName: selfmedia-nc01-tekton-runner
|
|
serviceAccountAutomount: false
|
|
roleBindingName: selfmedia-nc01-tekton-runner
|
|
parameterBinding: repository
|
|
workspaceSize: 16Gi
|
|
pipelineTimeout: 2h0m0s
|
|
toolImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
|
|
buildkitImage: 127.0.0.1:5000/hwlab/buildkit:rootless
|
|
source:
|
|
repository: pikainc/selfmedia
|
|
worktreeRemote: https://github.com/pikainc/selfmedia.git
|
|
branch: master
|
|
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
|
|
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/selfmedia-master-nc01
|
|
build:
|
|
dockerfile: deploy/Dockerfile
|
|
imageRepository: 127.0.0.1:5000/selfmedia/newsroom
|
|
networkMode: host
|
|
envReuse:
|
|
enabled: true
|
|
mode: buildkit-state-host-path
|
|
statePath: /var/lib/unidesk/selfmedia-ci/buildkit-state
|
|
identityFiles:
|
|
- bun.lock
|
|
- web/bun.lock
|
|
- config/tools.yaml
|
|
- deploy/Dockerfile
|
|
- deploy/scripts/install-open-source-tools.ts
|
|
- scripts/src/io.ts
|
|
- scripts/src/tool-runner.ts
|
|
- scripts/src/tools-config.ts
|
|
- scripts/src/tools-install.ts
|
|
- scripts/src/types.ts
|
|
semanticPackageManifests:
|
|
policyFile: config/env-identity.yaml
|
|
renderer: deploy/scripts/render-install-manifests.ts
|
|
proxy:
|
|
http: http://127.0.0.1:10808
|
|
https: http://127.0.0.1:10808
|
|
all: http://127.0.0.1:10808
|
|
noProxy:
|
|
- localhost
|
|
- 127.0.0.1
|
|
- "::1"
|
|
- 127.0.0.1:5000
|
|
- localhost:5000
|
|
- .svc
|
|
- .svc.cluster.local
|
|
- .cluster.local
|
|
- hyueapi.com
|
|
- .hyueapi.com
|
|
gitops:
|
|
readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
|
|
writeUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikainc-selfmedia.git
|
|
branch: nc01-selfmedia-gitops
|
|
manifestPath: deploy/gitops/nc01/resources.yaml
|
|
releaseStatePath: deploy/gitops-state/nc01/release.json
|
|
credentialSecretName: pac-gitea-selfmedia-nc01
|
|
credentialTokenKey: token
|
|
credentialUsername: unidesk-admin
|
|
author:
|
|
name: SelfMedia NC01 CI
|
|
email: selfmedia-nc01-ci@unidesk.local
|
|
deployment:
|
|
version: selfmedia.pikapython.com/v1
|
|
kind: SelfMediaDeployment
|
|
metadata:
|
|
name: selfmedia-nc01
|
|
owner: unidesk
|
|
target:
|
|
id: NC01
|
|
route: NC01:k3s
|
|
namespace: selfmedia
|
|
publicHost: 152.53.229.148
|
|
runtime:
|
|
replicas: 1
|
|
serviceAccountName: selfmedia
|
|
imagePullPolicy: IfNotPresent
|
|
environment:
|
|
SELFMEDIA_TTS_BASE_URL: http://10.42.0.1:24318
|
|
command:
|
|
- /usr/bin/tini
|
|
- --
|
|
- bun
|
|
- scripts/selfmedia-cli.ts
|
|
- server
|
|
- foreground
|
|
- --runtime
|
|
worker:
|
|
name: selfmedia-worker
|
|
replicas: 1
|
|
command:
|
|
- /usr/bin/tini
|
|
- --
|
|
- node
|
|
- --import
|
|
- tsx
|
|
- scripts/temporal-worker.ts
|
|
- --runtime
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 768Mi
|
|
limits:
|
|
cpu: "4"
|
|
memory: 6Gi
|
|
service:
|
|
name: selfmedia
|
|
type: ClusterIP
|
|
port: 4317
|
|
targetPort: 4317
|
|
health:
|
|
path: /healthz
|
|
startupFailureThreshold: 30
|
|
startupPeriodSeconds: 5
|
|
readinessPeriodSeconds: 10
|
|
livenessPeriodSeconds: 20
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 768Mi
|
|
limits:
|
|
cpu: "4"
|
|
memory: 6Gi
|
|
securityContext:
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
runAsNonRoot: true
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
seccompProfile: RuntimeDefault
|
|
dropCapabilities:
|
|
- ALL
|
|
writablePaths:
|
|
tmp:
|
|
mountPath: /tmp
|
|
sizeLimit: 2Gi
|
|
codexHome:
|
|
mountPath: /home/codex/.codex
|
|
sizeLimit: 2Gi
|
|
cache:
|
|
mountPath: /home/codex/.cache
|
|
sizeLimit: 2Gi
|
|
toolCache:
|
|
mountPath: /app/.tools/cache
|
|
sizeLimit: 1Gi
|
|
temporal:
|
|
namespace: selfmedia
|
|
taskQueue: selfmedia-pipeline
|
|
image: temporalio/temporal:1.8.0@sha256:2c344b4a39b4489fc6944db095f628f0c30659836faf11780a4dc435599e80e3
|
|
replicas: 1
|
|
command:
|
|
- temporal
|
|
- server
|
|
- start-dev
|
|
- --headless
|
|
- --ip
|
|
- 0.0.0.0
|
|
- --port
|
|
- "7233"
|
|
- --namespace
|
|
- selfmedia
|
|
- --db-filename
|
|
- /var/lib/temporal/temporal.db
|
|
service:
|
|
name: selfmedia-temporal
|
|
port: 7233
|
|
persistence:
|
|
claimName: selfmedia-temporal
|
|
storageClassName: local-path
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 5Gi
|
|
mountPath: /var/lib/temporal
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
runAsNonRoot: true
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
seccompProfile: RuntimeDefault
|
|
dropCapabilities:
|
|
- ALL
|
|
publicExposure:
|
|
enabled: true
|
|
mode: hostPort-http-edge
|
|
address: http://152.53.229.148:4317
|
|
hostPort: 4317
|
|
edge:
|
|
name: selfmedia-public-edge
|
|
image: caddy:2.10.2-alpine
|
|
containerPort: 8080
|
|
hostname: media-dev.hwpod.com
|
|
expectedA: 152.53.229.148
|
|
upstream: selfmedia.selfmedia.svc.cluster.local:4317
|
|
healthPath: /healthz
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
storage:
|
|
media:
|
|
claimName: selfmedia-data
|
|
storageClassName: local-path
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 40Gi
|
|
mounts:
|
|
data:
|
|
mountPath: /app/data
|
|
subPath: data
|
|
state:
|
|
mountPath: /app/.state
|
|
subPath: state
|
|
logs:
|
|
mountPath: /app/logs
|
|
subPath: logs
|
|
codexSessions:
|
|
claimName: selfmedia-codex-sessions
|
|
storageClassName: local-path
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 5Gi
|
|
mounts:
|
|
sessions:
|
|
mountPath: /home/codex/.codex/sessions
|
|
subPath: sessions
|
|
state:
|
|
mountPath: /home/codex/.codex/state
|
|
subPath: state
|
|
secrets:
|
|
access:
|
|
sourceRef: /root/.unidesk/.env/selfmedia-access.env
|
|
target:
|
|
secretName: selfmedia-access
|
|
readOnly: true
|
|
files:
|
|
- targetKey: admin-username
|
|
mountPath: /run/secrets/selfmedia-access/admin-username
|
|
- targetKey: admin-password
|
|
mountPath: /run/secrets/selfmedia-access/admin-password
|
|
- targetKey: api-key
|
|
mountPath: /run/secrets/selfmedia-access/api-key
|
|
- targetKey: session-secret
|
|
mountPath: /run/secrets/selfmedia-access/session-secret
|
|
runtime:
|
|
sourceRef: ~/.env/TOKEN
|
|
target:
|
|
secretName: selfmedia-runtime
|
|
targetKey: TOKEN
|
|
mountPath: /home/codex/.env/TOKEN
|
|
codex:
|
|
sources:
|
|
- sourceRef: ~/.codex/config.toml.pika
|
|
targetKey: config.toml
|
|
- sourceRef: ~/.codex/auth.json.pika
|
|
targetKey: auth.json
|
|
target:
|
|
secretName: selfmedia-codex
|
|
files:
|
|
- targetKey: config.toml
|
|
mountPath: /home/codex/.codex/config.toml.pika
|
|
- targetKey: auth.json
|
|
mountPath: /home/codex/.codex/auth.json.pika
|
|
networkPolicy:
|
|
enabled: true
|
|
dnsNamespace: kube-system
|
|
dnsPort: 53
|
|
blockedCidrs:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
- 169.254.169.254/32
|
|
- 152.53.229.148/32
|
|
allowedTcpEndpoints:
|
|
- cidr: 10.42.0.1/32
|
|
ports:
|
|
- 24318
|
|
codex:
|
|
package: "@openai/codex"
|
|
version: 0.144.1
|
|
executable: codex
|
|
home: /home/codex
|
|
codexHome: /home/codex/.codex
|
|
sessionsPath: /home/codex/.codex/sessions
|
|
supervisorStatePath: /home/codex/.codex/state/selfmedia-supervisor.json
|
|
resumeArgs:
|
|
- resume
|
|
- --last
|
|
sourcePath: /app
|
|
skillsPath: /home/codex/.codex/skills
|
|
webProbe:
|
|
enabled: true
|
|
productId: selfmedia
|
|
runner:
|
|
node: NC01
|
|
lane: v03
|
|
origin:
|
|
name: public
|
|
mode: public
|
|
baseUrl: https://media-dev.hwpod.com
|
|
browserProxyMode: auto
|
|
authentication:
|
|
mode: json-post-session-cookie
|
|
path: /api/v1/auth/session
|
|
credentials:
|
|
configRef: config/secrets-distribution.yaml
|
|
targetId: selfmedia-nc01
|
|
secretName: selfmedia-access
|
|
usernameTargetKey: admin-username
|
|
passwordTargetKey: admin-password
|
|
requestFields:
|
|
username: username
|
|
password: password
|
|
cookieNames:
|
|
- selfmedia_operator
|
|
defaultSmokeProfile: voice-algorithm
|
|
smokeProfiles:
|
|
voice-algorithm:
|
|
kind: select-and-save
|
|
routeTemplate: /editions/{editionId}/resources/audio
|
|
readySelector: .production-settings
|
|
identitySelector: select[aria-label="选择资讯版本"]
|
|
selectSelector: select[aria-label="语音算法"]
|
|
saveButtonName: 保存设置
|
|
statusSelector: .production-settings__status
|
|
successTexts:
|
|
- 本期设置已保存
|
|
- 设置没有变化
|
|
saveRequest:
|
|
method: PUT
|
|
pathTemplate: /api/v1/editions/{editionId}/resources/metadata
|
|
screenshotName: selfmedia-voice-algorithm.png
|
|
viewport:
|
|
width: 1920
|
|
height: 1080
|
|
navigationTimeoutMs: 30000
|
|
settleMs: 500
|
|
commandTimeoutSeconds: 120
|
|
outputLimits:
|
|
options: 20
|
|
network: 12
|
|
failures: 12
|
|
NC01_PRODUCTION:
|
|
extends: NC01
|
|
node: NC01
|
|
lane: selfmedia-production
|
|
ci:
|
|
namespace: selfmedia-ci
|
|
pipeline: selfmedia-production-nc01-pac
|
|
pipelineRunPrefix: selfmedia-production-nc01
|
|
serviceAccountName: selfmedia-production-nc01-tekton-runner
|
|
roleBindingName: selfmedia-production-nc01-tekton-runner
|
|
parameterBinding: literal
|
|
source:
|
|
branch: release
|
|
snapshotPrefix: refs/unidesk/snapshots/gitea-actions/selfmedia-release-nc01
|
|
build:
|
|
imageRepository: 127.0.0.1:5000/selfmedia/newsroom-production
|
|
envReuse:
|
|
statePath: /var/lib/unidesk/selfmedia-production-ci/buildkit-state
|
|
gitops:
|
|
branch: nc01-selfmedia-production-gitops
|
|
manifestPath: deploy/gitops/nc01-production/resources.yaml
|
|
releaseStatePath: deploy/gitops-state/nc01-production/release.json
|
|
credentialSecretName: pac-gitea-selfmedia-nc01
|
|
author:
|
|
name: SelfMedia NC01 Production CI
|
|
email: selfmedia-production-nc01-ci@unidesk.local
|
|
webProbe:
|
|
enabled: false
|
|
deployment:
|
|
metadata:
|
|
name: selfmedia-production-nc01
|
|
target:
|
|
id: NC01_PRODUCTION
|
|
namespace: selfmedia-production
|
|
runtime:
|
|
serviceAccountName: selfmedia-production
|
|
environment:
|
|
SELFMEDIA_TTS_BASE_URL: ""
|
|
service:
|
|
name: selfmedia-production
|
|
publicExposure:
|
|
address: http://152.53.229.148:4319
|
|
hostPort: 4319
|
|
edge:
|
|
name: selfmedia-production-public-edge
|
|
hostname: media.hwpod.com
|
|
expectedA: 152.53.229.148
|
|
upstream: 127.0.0.1:4319
|
|
healthPath: /healthz
|
|
storage:
|
|
media:
|
|
claimName: selfmedia-production-data
|
|
codexSessions:
|
|
claimName: selfmedia-production-codex-sessions
|
|
secrets:
|
|
access:
|
|
target:
|
|
secretName: selfmedia-production-access
|
|
runtime:
|
|
target:
|
|
secretName: selfmedia-production-runtime
|
|
codex:
|
|
target:
|
|
secretName: selfmedia-production-codex
|
|
codex:
|
|
supervisorStatePath: /home/codex/.codex/state/selfmedia-production-supervisor.json
|
|
networkPolicy:
|
|
allowedTcpEndpoints: []
|
|
cutover:
|
|
targets:
|
|
NC01:
|
|
mode: host-process-to-kubernetes
|
|
source:
|
|
workspace: /root/selfmedia
|
|
publicAddress: http://152.53.229.148:4317
|
|
healthUrl: http://127.0.0.1:4317/healthz
|
|
stopCommand:
|
|
- bun
|
|
- scripts/selfmedia-cli.ts
|
|
- server
|
|
- stop
|
|
startCommand:
|
|
- bun
|
|
- scripts/selfmedia-cli.ts
|
|
- server
|
|
- start
|
|
dataPaths:
|
|
- data
|
|
- .state
|
|
- logs
|
|
excludes:
|
|
- .state/server.json
|
|
destination:
|
|
route: NC01:k3s
|
|
namespace: selfmedia
|
|
application: selfmedia-nc01
|
|
publicAddress: http://152.53.229.148:4317
|
|
healthUrl: http://152.53.229.148:4317/healthz
|
|
dataClaim: selfmedia-data
|
|
codexClaim: selfmedia-codex-sessions
|
|
prepare:
|
|
requiresFinalConfirmation: true
|
|
phases:
|
|
- 校验源服务健康、Secret presence/fingerprint 与目标 PVC
|
|
- 在线种子复制并记录文件数和字节数
|
|
- 停止旧服务、执行最终增量并确认宿主 4317 已释放
|
|
- 允许 Argo 首次同步并验证公网健康
|
|
rollback:
|
|
phases:
|
|
- 暂停 selfmedia-nc01 Argo 自动同步
|
|
- 缩容 selfmedia 与 selfmedia-public-edge
|
|
- 确认宿主 4317 已释放
|
|
- 启动旧服务并验证原公网地址
|
|
dataPolicy: 回滚默认不反向覆盖旧数据，需单独的数据恢复决策。
|