mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 17:54:41 +02:00
110 lines
4.4 KiB
YAML
110 lines
4.4 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: stt-server
|
|
namespace: ai
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: stt-server
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: stt-server
|
|
spec:
|
|
# Image privée sur ghcr → secret de pull créé manuellement dans le ns ai
|
|
# (cf. README : kubectl create secret docker-registry ghcr-pull ...)
|
|
imagePullSecrets:
|
|
- name: ghcr-pull
|
|
# Conformité PodSecurity "restricted" (namespace ai)
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: stt-server
|
|
# Tag géré par la CI (build-stt-server.yml) : bumpé en sha-<commit> à chaque build main.
|
|
image: ghcr.io/alkatrazz24/funk-stt-server:sha-f47bc36
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
ports:
|
|
- containerPort: 8000
|
|
env:
|
|
# LiteLLM (s01) joint en IP directe — même pattern qu'open-webui
|
|
- name: STT_LITELLM_URL
|
|
value: "http://192.168.10.1:4000/v1/chat/completions"
|
|
- name: STT_LITELLM_KEY
|
|
value: "lm-studio"
|
|
- name: STT_MODEL
|
|
value: "hermes-default"
|
|
# Mémoire long-terme (Qdrant s01 + embeddings nomic gpu-01) — dégrade si injoignable
|
|
- name: STT_MEMORY_LONGTERM
|
|
value: "true"
|
|
- name: STT_QDRANT_URL
|
|
value: "http://192.168.10.1:6333"
|
|
# Instance dédiée embeddings nomic-embed-text sur gpu-01 (:1238, dim 768)
|
|
- name: STT_EMBED_URL
|
|
value: "http://192.168.10.20:1238/v1/embeddings"
|
|
- name: STT_EMBED_MODEL
|
|
value: "nomic-embed-text"
|
|
# Contextes présélectionnables (sources live) — services in-cluster.
|
|
# Défaut « asa » : boucle d'outils (function calling local) → Asa sonde l'état
|
|
# live du homelab et la doc d'elle-même. « funk » (RAG strict) reste sélectionnable.
|
|
- name: STT_DEFAULT_CONTEXT
|
|
value: "asa"
|
|
# Recherche web (outil web_search du contexte asa) → SearXNG in-cluster (ns ai).
|
|
- name: STT_SEARXNG_URL
|
|
value: "http://searxng:8080"
|
|
- name: STT_PROMETHEUS_URL
|
|
value: "http://kube-prometheus-stack-prometheus.monitoring:9090"
|
|
- name: STT_ALERTMANAGER_URL
|
|
value: "http://kube-prometheus-stack-alertmanager.monitoring:9093"
|
|
- name: STT_GHOSTFOLIO_URL
|
|
value: "http://ghostfolio:3333" # même namespace (ai)
|
|
# Jeton Ghostfolio (« Security token ») — secret optionnel créé à la main :
|
|
# kubectl -n ai create secret generic stt-server-secrets \
|
|
# --from-literal=ghostfolio-token=<TOKEN>
|
|
- name: STT_GHOSTFOLIO_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: stt-server-secrets
|
|
key: ghostfolio-token
|
|
optional: true
|
|
# Actions via Hermes (contexte « agent ») — OPT-IN. Mettre "true" + le jeton
|
|
# pour activer. hermes-exec écoute sur storage-01:9096 (IP directe).
|
|
- name: STT_ACTIONS_ENABLED
|
|
value: "true"
|
|
- name: STT_HERMES_EXEC_URL
|
|
value: "http://192.168.10.1:9096"
|
|
# Même jeton que vault_hermes_exec_token (Ansible) :
|
|
# kubectl -n ai create secret generic stt-server-secrets \
|
|
# --from-literal=hermes-exec-token=<TOKEN> (ou --dry-run -o yaml | kubectl apply)
|
|
- name: STT_HERMES_EXEC_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: stt-server-secrets
|
|
key: hermes-exec-token
|
|
optional: true
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 20
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|