92 lines
3.6 KiB
YAML
92 lines
3.6 KiB
YAML
# Production — the `medical-chatbot-app` release serving realvuxbaro.me.
|
|
#
|
|
# This file is the Git source of truth for every stable, non-secret setting of
|
|
# this cluster. It exists because the same values used to
|
|
# live only inside the ArgoCD Application's inline `spec.source.helm.values`,
|
|
# where they were invisible to review, diff and rollback: the cluster could
|
|
# drift from the repository without a single commit recording it. That is how
|
|
# practice ended up on DeepSeek with reranking off while production ran Qwen
|
|
# with reranking on.
|
|
#
|
|
# Two things deliberately stay OUT of this file and remain inline on the
|
|
# Application:
|
|
#
|
|
# - `aiService.image` / `web.image` — rewritten on every push by
|
|
# `.github/scripts/sync_practice_argocd.py`, which regex-replaces the tag
|
|
# in the inline values. A tag committed here would be stale by design.
|
|
# - anything secret. Nothing in the practice release currently needs one;
|
|
# Bedrock authenticates through the node's instance role.
|
|
#
|
|
# ArgoCD applies `valueFiles` in order and then the inline values last, so the
|
|
# image block inline still wins over anything the chart defaults set here.
|
|
#
|
|
# The behavioural settings below mirror the production runtime contract audited
|
|
# on 2026-08-17 (see coordination/ARGOCD_PRODUCTION_MIGRATION_STATE_2026-08-17.md).
|
|
# Practice is only useful as a migration rehearsal while they stay in sync.
|
|
|
|
global:
|
|
environment: production
|
|
# The GHCR packages are private; without this the Pods fail ImagePullBackOff.
|
|
imagePullSecrets:
|
|
- name: ghcr-pull-secret
|
|
|
|
# PostgreSQL and Qdrant are owned by the separate `medical-chatbot-data`
|
|
# release so that redeploying the app never touches persistent state. This
|
|
# release therefore runs neither, and points at the data release's Services.
|
|
postgres:
|
|
enabled: false
|
|
|
|
qdrant:
|
|
enabled: false
|
|
url: http://medical-chatbot-data-medical-chatbot-qdrant.medical-chatbot-data.svc.cluster.local:6333
|
|
|
|
secret:
|
|
postgresHost: medical-chatbot-data-medical-chatbot-postgres.medical-chatbot-data.svc.cluster.local
|
|
|
|
aiService:
|
|
config:
|
|
embeddingProvider: cohere-v4
|
|
embeddingDimensions: 1024
|
|
evidenceMinimumScore: 0.12
|
|
awsRegion: us-east-1
|
|
answerProvider: bedrock-converse
|
|
answerModelId: qwen.qwen3-next-80b-a3b
|
|
rerankEnabled: true
|
|
|
|
observability:
|
|
grafana:
|
|
# Dashboards stay open so a demo needs no credentials, but read-only: this
|
|
# Grafana answers on the public production hostname, and it previously ran
|
|
# anonymous *Admin* with the login form disabled — which handed the
|
|
# datasource and dashboard APIs to anyone who found the URL, and left no
|
|
# way to sign in as a real admin either.
|
|
anonymous:
|
|
enabled: true
|
|
role: Viewer
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
# Primary, not merely first in a list: `ingress.host` is what Grafana's
|
|
# GF_SERVER_ROOT_URL is built from, so it must be the name users arrive on.
|
|
# `realvuxbaro.me` moved here from the Compose host on 2026-08-17 — routed
|
|
# first and certificated only once its A record pointed at this cluster,
|
|
# because cert-manager solves HTTP-01 and the challenge could not reach here
|
|
# before that.
|
|
host: realvuxbaro.me
|
|
# The rehearsal name is kept so existing links and bookmarks still resolve.
|
|
extraHosts:
|
|
- readytochat.realvuxbaro.me
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
# Separate secrets per hostname: a renewal failure on one name must not take
|
|
# the other offline.
|
|
tls:
|
|
- hosts:
|
|
- readytochat.realvuxbaro.me
|
|
secretName: readytochat-tls
|
|
- hosts:
|
|
- realvuxbaro.me
|
|
secretName: realvuxbaro-tls
|