63 lines
1.6 KiB
YAML
63 lines
1.6 KiB
YAML
# GitOps demo release — full copy of production, source read from
|
|
# git.vinmec.tech/VuQuangBao/duocthu instead of GitHub. Separate EC2, separate
|
|
# cluster, own Postgres/Qdrant (single-release, not split like production —
|
|
# this box is short-lived and disposable, the split's prune-safety benefit
|
|
# does not matter here).
|
|
#
|
|
# Real secrets (grafana/jwt/postgres passwords) are generated fresh for this
|
|
# box and stay inline on the ArgoCD Application, same pattern as production —
|
|
# never in this tracked file.
|
|
|
|
global:
|
|
environment: gitea-demo
|
|
imagePullSecrets:
|
|
- name: ghcr-pull-secret
|
|
|
|
aiService:
|
|
config:
|
|
embeddingProvider: cohere-v4
|
|
embeddingDimensions: 1024
|
|
evidenceMinimumScore: 0.12
|
|
awsRegion: us-east-1
|
|
answerProvider: bedrock-converse
|
|
answerModelId: qwen.qwen3-next-80b-a3b
|
|
rerankEnabled: true
|
|
qdrantCollection: duocthu_v1
|
|
metricsEnabled: true
|
|
otelEnabled: true
|
|
otelSampleRatio: 1.0
|
|
|
|
authService:
|
|
enabled: true
|
|
|
|
apiGateway:
|
|
enabled: true
|
|
|
|
postgres:
|
|
enabled: true
|
|
|
|
qdrant:
|
|
enabled: true
|
|
|
|
observability:
|
|
enabled: true
|
|
grafana:
|
|
anonymous:
|
|
enabled: true
|
|
role: Viewer
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
host: finalduocthu.realvuxbaro.me
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
# DNS confirmed resolving to this box before this block was added -- same
|
|
# ordering that let the 2026-08-17 cutover issue its cert on the first
|
|
# attempt instead of burning failed-validation ACME orders.
|
|
tls:
|
|
- hosts:
|
|
- finalduocthu.realvuxbaro.me
|
|
secretName: finalduocthu-tls
|