119 lines
4.1 KiB
YAML
119 lines
4.1 KiB
YAML
# Production values for the `langfuse` ArgoCD Application (upstream
|
|
# `langfuse/langfuse-k8s` chart, not this repo's own medical-chatbot chart).
|
|
#
|
|
# Runs in the `medical-chatbot-data` namespace deliberately, not its own —
|
|
# that is the only namespace holding the K8s Secret with the shared Postgres
|
|
# password, and Secrets don't cross namespaces. Langfuse never reads that
|
|
# password directly: everything below points at the secret BY NAME/KEY
|
|
# (`medical-chatbot-data-medical-chatbot-runtime` / `postgres-password`), the
|
|
# same way infra/helm/medical-chatbot's own templates do it.
|
|
#
|
|
# Deliberately bundled rather than external: Redis and ClickHouse (personal-
|
|
# scale traffic, no case for a managed service here). Deliberately external:
|
|
# Postgres (reuse what already exists rather than a second instance) and S3
|
|
# (a real bucket, `duocthu-langfuse-blobs`, reached via the k3s node's IAM
|
|
# instance role — no static access keys anywhere in this file or the cluster,
|
|
# same pattern as ai-service's Bedrock access).
|
|
#
|
|
# SALT / ENCRYPTION_KEY / NEXTAUTH_SECRET are deliberately absent: the chart
|
|
# auto-generates and persists them in a release-managed Secret on first
|
|
# install when left unset. No manual secret entry needed for this file.
|
|
|
|
langfuse:
|
|
resources:
|
|
requests: { cpu: 100m, memory: 256Mi }
|
|
limits: { cpu: "1", memory: 512Mi }
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
hosts:
|
|
- host: langfuse.realvuxbaro.me
|
|
paths:
|
|
- path: /
|
|
pathType: ImplementationSpecific
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
tls:
|
|
enabled: true
|
|
secretName: langfuse-tls
|
|
|
|
nextauth:
|
|
url: https://langfuse.realvuxbaro.me
|
|
|
|
postgresql:
|
|
deploy: false
|
|
host: medical-chatbot-data-medical-chatbot-postgres.medical-chatbot-data.svc.cluster.local
|
|
port: 5432
|
|
auth:
|
|
username: duoc_thu
|
|
existingSecret: medical-chatbot-data-medical-chatbot-runtime
|
|
secretKeys:
|
|
userPasswordKey: postgres-password
|
|
database: langfuse
|
|
|
|
redis:
|
|
deploy: true
|
|
resources:
|
|
requests: { cpu: 50m, memory: 64Mi }
|
|
limits: { cpu: 250m, memory: 256Mi }
|
|
|
|
clickhouse:
|
|
deploy: true
|
|
cluster:
|
|
enabled: false
|
|
storage:
|
|
size: 20Gi
|
|
|
|
s3:
|
|
deploy: false
|
|
storageProvider: s3
|
|
bucket: duocthu-langfuse-blobs
|
|
region: us-east-1
|
|
endpoint: https://s3.us-east-1.amazonaws.com
|
|
forcePathStyle: false
|
|
# Both left empty on purpose: falls back to the AWS SDK default credential
|
|
# chain, which picks up the node's IAM instance role automatically.
|
|
accessKeyId:
|
|
value: ""
|
|
secretAccessKey:
|
|
value: ""
|
|
|
|
# One-off Job that creates the `langfuse` database on the existing Postgres
|
|
# instance before Langfuse's own migration runs. Idempotent (checks first).
|
|
# Never touches infra/helm/medical-chatbot's own templates or its release.
|
|
extraManifests:
|
|
- apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: langfuse-db-init
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-weight": "-5"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: create-db
|
|
image: postgres:16-alpine
|
|
env:
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: medical-chatbot-data-medical-chatbot-runtime
|
|
key: postgres-password
|
|
command: ["sh", "-c"]
|
|
args:
|
|
- |
|
|
set -e
|
|
HOST=medical-chatbot-data-medical-chatbot-postgres.medical-chatbot-data.svc.cluster.local
|
|
EXISTS=$(psql "postgresql://duoc_thu@$HOST:5432/duoc_thu" -tAc \
|
|
"SELECT 1 FROM pg_database WHERE datname = 'langfuse'")
|
|
if [ "$EXISTS" != "1" ]; then
|
|
psql "postgresql://duoc_thu@$HOST:5432/duoc_thu" -c "CREATE DATABASE langfuse OWNER duoc_thu"
|
|
fi
|