Enable auth-service/api-gateway on production, build their images in CI

2026-08-18 14:11:00 +07:00
parent e5afedfa2f
commit b68005be1c
70 changed files with 6781 additions and 263 deletions
@@ -0,0 +1,48 @@
+# ArgoCD Applications (tracked copies)
+
+Personal ArgoCD instance at `argocd.realvuxbaro.me`, on the same k3s cluster
+that serves `realvuxbaro.me` — not the team's shared ArgoCD
+(`argocd.vinmec.tech`), which this project does not use or have access to.
+An earlier version of this directory described a plan to use the team's
+instance (`docs-legacy/adr/0002-argocd-gitops.md`); that was never started,
+and the owner deployed this personal instance instead because the team's
+on-prem infra was heavier than needed for a single-operator project.
+
+## Why these files exist
+
+Until 2026-08-18, `medical-chatbot-app` and `medical-chatbot-data` existed
+only as live objects inside ArgoCD — created once via the API during the
+2026-08-17 cutover, never captured as a manifest. Losing the ArgoCD instance
+would have meant losing the Application *definitions* too, even though the
+Helm values they render (`values-production.yaml`,
+`values-production-data.yaml`) were already tracked. These two files close
+that gap: they are the disaster-recovery source for the Application objects
+themselves.
+
+## What's tracked vs. what isn't
+
+`project`, `source` (repo/path/revision/valueFiles), `destination`, and
+`syncPolicy` are tracked — verified byte-for-byte against the live objects on
+2026-08-18. `medical-chatbot-app.yaml` deliberately omits the live
+Application's inline `spec.source.helm.values`: it currently carries the
+CI-rewritten image tags and, as a known gap, a plaintext Grafana admin
+password that belongs in a Kubernetes Secret instead (needs cluster write
+access this repo's automation doesn't have — not yet done). See the comment
+at the top of that file before ever applying it.
+
+## Files
+
+- `applications/medical-chatbot-app.yaml` — ai-service, web, observability.
+  Serves both `realvuxbaro.me` and `readytochat.realvuxbaro.me`.
+- `applications/medical-chatbot-data.yaml` — PostgreSQL + Qdrant, split into
+  its own Application so an app-side sync or prune can never touch the
+  PersistentVolumeClaims.
+
+## Known gaps
+
+- `project: default` on both — no RBAC/project scoping.
+- Image tags move through `.github/scripts/sync_practice_argocd.py` and
+  `rollback-k3s.yml` mutating the live Application directly via the ArgoCD
+  API, not through a Git commit — a real GitOps setup would use an image
+  updater that writes the tag back to Git. Not yet built.
+- The Grafana admin password gap above.
@@ -0,0 +1,51 @@
+# Tracked copy of the live `medical-chatbot-app` Application (k3s, personal
+# ArgoCD instance at argocd.realvuxbaro.me). Verified against the live object
+# 2026-08-18 — every field below matches `status.sync.status: Synced`,
+# `status.health.status: Healthy`.
+#
+# This Application serves BOTH realvuxbaro.me and readytochat.realvuxbaro.me
+# (same release, same Pods) since the 2026-08-17 cutover.
+#
+# Deliberately NOT reproduced here: `spec.source.helm.values`. The live
+# Application carries two things inline that must never live in Git:
+#
+#   - aiService.image.tag / web.image.tag — rewritten on every push by
+#     .github/scripts/sync_practice_argocd.py (or by rollback-k3s.yml for a
+#     rollback). A tag committed here would go stale the moment CI runs again,
+#     and applying this file naively would silently roll the running image
+#     back to whatever tag happened to be in Git.
+#   - secret.grafanaAdminPassword — a real credential. It must never enter
+#     Git history. It belongs in a proper Kubernetes Secret referenced via
+#     `secret.existingSecret` (see infra/helm/medical-chatbot/values.yaml),
+#     not inline on the Application — that migration hasn't been done yet
+#     (it needs cluster write access this repo's automation doesn't have).
+#
+# Applying this file (`argocd app create -f` or the ArgoCD UI) recreates the
+# Application's STRUCTURE — source, destination, sync policy — for disaster
+# recovery. It does NOT restore the current image tag or the Grafana
+# password: set the tag afterward via `rollback-k3s.yml` (target_sha = the
+# last known-good commit) and re-enter the Grafana password by hand.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: medical-chatbot-app
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/BaoVu2k4/vsf-duocthu.git
+    targetRevision: master
+    path: infra/helm/medical-chatbot
+    helm:
+      valueFiles:
+        - values.yaml
+        - values-production.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: medical-chatbot-app
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,39 @@
+# Tracked copy of the live `medical-chatbot-data` Application (k3s, personal
+# ArgoCD instance at argocd.realvuxbaro.me). Verified against the live object
+# 2026-08-18 — every field below matches `status.sync.status: Synced`,
+# `status.health.status: Healthy`.
+#
+# Owns PostgreSQL and Qdrant only (the 15,100-point corpus and query
+# history). Deliberately a separate Application from medical-chatbot-app so
+# that an app-side sync failure, prune, or rollback can never delete the
+# PersistentVolumeClaims — see values-production-data.yaml.
+#
+# Unlike medical-chatbot-app, the live Application carries no inline
+# `spec.source.helm.values` at all: this release has no image tag CI rewrites
+# and no secret, so it is already fully represented by this file plus
+# values.yaml + values-production-data.yaml. Applying this file for disaster
+# recovery needs no follow-up step.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: medical-chatbot-data
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/BaoVu2k4/vsf-duocthu.git
+    targetRevision: master
+    path: infra/helm/medical-chatbot
+    helm:
+      valueFiles:
+        - values.yaml
+        - values-production-data.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: medical-chatbot-data
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true