Sync the self-hosting stack

kubernetes/02-config.yaml

@@ -0,0 +1,82 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: jarvis-api-config
+  namespace: jarvis
+data:
+  NODE_ENV: "production"
+  API_PORT: "4000"
+
+  # One logical keyspace, shared by every pod. Sentinel or a managed single-primary rather than
+  # Cluster: the Socket.IO adapter and the inter-pod bus both publish across what would otherwise
+  # be different slots.
+  #
+  # A SINGLE REDIS IS A SINGLE POINT OF FAILURE FOR EVERY POD AT ONCE. This line is correct for a
+  # managed Redis that fails over behind one address, and correct-but-fragile for one Deployment of
+  # one Redis. For Sentinel, comment this out and set the two below instead — see
+  # `08-redis-sentinel.yaml`, which deploys exactly that.
+  REDIS_URL: "redis://redis.jarvis.svc.cluster.local:6379"
+
+  # Set BOTH or neither. Sentinel needs the sentinels and the name of the primary they watch; a
+  # name is refused rather than defaulted, because ioredis's own default (`mymaster`) against a
+  # primary called anything else is not an error — it is a pod that never becomes ready, silently.
+  # When these are set, REDIS_URL above is ignored.
+  #
+  #REDIS_SENTINELS: "redis-sentinel-0.redis-sentinel.jarvis.svc.cluster.local:26379,redis-sentinel-1.redis-sentinel.jarvis.svc.cluster.local:26379,redis-sentinel-2.redis-sentinel.jarvis.svc.cluster.local:26379"
+  #REDIS_SENTINEL_NAME: "jarvis"
+
+  # ONE, not the two the compose files use, and getting this wrong is a security fault rather than
+  # a cosmetic one.
+  #
+  # It counts the proxies that REWRITE X-Forwarded-For. On compose a request passes the operator's
+  # TLS terminator and then the web container's nginx: two. Here the Ingress routes /api/ straight
+  # at the API Service, so there is one. Set HIGHER than the truth, the API believes a hop that does
+  # not exist — and since X-Forwarded-For is a request header, anyone can then prepend an address of
+  # their choosing and have it written into session records, audit rows, and the key the anonymous
+  # WebAuthn budget counts on.
+  #
+  # It is a STORED setting: this seeds the first boot, and the install screen — which shows the
+  # chain the API actually received — is where it is confirmed.
+  TRUST_PROXY_HOPS: "1"
+
+  # The seed for the address enrolled agents dial back to. Whatever the install screen stores wins
+  # from then on, so this is a starting value rather than the answer.
+  WEB_ORIGIN: "https://jarvis.example.com"
+
+  # Where the agent binaries are, filled per pod by an initContainer. Leaving it unset is
+  # supported: everything works except the agent installer, which answers 503 saying no build is
+  # published.
+  AGENT_RELEASE_DIR: "/srv/agent-releases"
+
+  AGENT_HEARTBEAT_INTERVAL_SEC: "30"
+  # Must stay comfortably below the pod's terminationGracePeriodSeconds (90). Whichever expires
+  # first decides whether a restart leaves a closed transcript or a half-written one.
+  RUN_SHUTDOWN_GRACE_SEC: "25"
+
+  # No demo organization and no seeded administrator: the install screen is the way in. The seed
+  # refuses an instance that already has accounts anyway, but a Deployment has no business
+  # furnishing anything.
+  SEED_ON_START: "false"
+
+  OPENAI_BASE_URL: "https://api.openai.com/v1"
+  OPENAI_MODEL: "gpt-4o"
+  OPENAI_THINKING_LEVEL: "medium"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: jarvis-web-config
+  namespace: jarvis
+data:
+  # Where the web container's nginx sends /api/, the socket.io handshake and the agent websocket.
+  #
+  # FULLY QUALIFIED, and that is not decoration: nginx's `resolver` does not apply the search list
+  # from /etc/resolv.conf, so a bare `jarvis-api` would not resolve however correct it looks.
+  JARVIS_API_UPSTREAM: "jarvis-api.jarvis.svc.cluster.local:4000"
+
+  # Who resolves it. The compose default is Docker's embedded DNS at 127.0.0.11, which nothing
+  # listens on inside a pod — every /api/ request answered 502 until this became substitutable.
+  #
+  # Replace with your cluster's DNS ClusterIP:
+  #   kubectl -n kube-system get svc kube-dns -o jsonpath='{.spec.clusterIP}'
+  JARVIS_DNS_RESOLVER: "REPLACE_WITH_YOUR_CLUSTER_DNS"