homelab/kubernetes/apps/wiki/deployment.yaml

# Index snapshots per embedding model and the document catalog. A lost volume
# costs one full sync from Gitea (~10 min).
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: wiki-data
  namespace: ai
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: ceph-block
  resources:
    requests:
      storage: 1Gi
---
# Wiki service (konairius/Wiki): mirrors the Notes repo from Gitea, embeds
# wiki/ via wiki-embed, serves /rank, /api/v1 and the MudBlazor UI. Adapters
# are selected in appsettings (Wiki__* env overrides); secrets arrive as env
# from ExternalSecrets, the pod has no OpenBao access.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wiki
  namespace: ai
  annotations:
    # Keys, tokens and the Anthropic key arrive via envFrom; a rotated Secret rolls the pod.
    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic
  labels:
    app.kubernetes.io/name: wiki
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: wiki
  template:
    metadata:
      labels:
        app.kubernetes.io/name: wiki
    spec:
      # Its embedding backend (wiki-embed) needs the Intel iGPU; without it
      # the wiki has nothing to serve, so it runs where the iGPU is declared.
      nodeSelector:
        hardware.renner.uno/intel-gpu: "true"
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        runAsGroup: 65534
        fsGroup: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: wiki
          image: gitea.renner.uno/konairius/wiki:build.1790322994 # {"$imagepolicy": "flux-system:wiki"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          env:
            - name: HOME
              value: /tmp
            - name: Wiki__Index__File__Directory
              value: /data
            - name: Wiki__NoteStore__Gitea__BaseUrl
              value: https://gitea.renner.uno
            - name: Wiki__NoteStore__Gitea__Repository
              value: konairius/notes
            - name: Wiki__NoteStore__Gitea__Branch
              value: main
            - name: Wiki__Embeddings__Models__bge-m3__Url
              value: http://wiki-embed.ai.svc.cluster.local:8080
            # Pod networks: the CNPs admit only the gate outpost and Gitea.
            - name: Auth__ReverseProxy__TrustedProxies__0
              value: fd10:244::/48
            - name: Auth__ReverseProxy__TrustedProxies__1
              value: 10.244.0.0/16
          envFrom:
            - secretRef:
                name: wiki-gitea
            - secretRef:
                name: wiki-api-keys
            - secretRef:
                name: wiki-typesafe
            - secretRef:
                name: wiki-anthropic
                optional: true
          ports:
            - name: http
              containerPort: 8080
          resources:
            requests:
              cpu: 200m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          # /health: the process serves (liveness). /ready: catalog synced once and the
          # active index loaded; a cold start syncs the whole vault first (~10 min).
          startupProbe:
            httpGet:
              path: /ready
              port: http
            periodSeconds: 10
            failureThreshold: 120
          readinessProbe:
            httpGet:
              path: /ready
              port: http
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: http
            periodSeconds: 60
            timeoutSeconds: 10
            failureThreshold: 3
          volumeMounts:
            - name: data
              mountPath: /data
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: wiki-data
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: wiki
  namespace: ai
  labels:
    app.kubernetes.io/name: wiki
spec:
  selector:
    app.kubernetes.io/name: wiki
  ports:
    - name: http
      port: 8080
      targetPort: http