sirius0xdev
54f2f42710
fix(osint-dashboard): fix critical manifest issues found during audit
...
- Fix PostgreSQL topologySpreadConstraints label selector (cnpg.io/cluster)
- Fix Ingress HTTPRoutes: route API and WS traffic to correct backends
- Fix API NetworkPolicy port mismatch (4000 -> 8000)
- Fix MinIO bucket index syntax (_0 -> 0) in ConfigMap
- Add postgresql.port and postgresql.database to values.yaml
- Add container-level securityContext to API deployment
- Restrict monitoring NetworkPolicy ingress to monitoring namespace
- Enable readOnlyRootFilesystem for MinIO container
- Add activeDeadlineSeconds (3600s) to all 4 CronJobs
2026-05-23 04:38:51 +00:00
sirius0xdev
cc2074a4cb
change hermes image
2026-05-22 03:09:59 +00:00
sirius0xdev
f3c2e4991b
change hermes image
2026-05-22 03:06:36 +00:00
sirius0xdev
c76675335d
switch hermes image to main
2026-05-22 02:33:54 +00:00
sirius0xdev
75cea5abb7
fix secret issue
2026-05-22 02:11:22 +00:00
Hermes Agent
a433be1195
fix: resolve merge conflict in osint-dashboard values.yaml (keep real API config)
2026-05-21 14:17:52 +00:00
93754dcdf6
feat: OSINT Dashboard app + Helm templates
...
Add FastAPI backend for real-time geospatial OSINT dashboard:
- Full-text search via PostgreSQL tsvector (parameterized queries)
- Entity tracking, alert management, sentiment analytics
- Data ingestion: RSS feeds, GDELT, USGS earthquakes, social signals
- NATS JetStream consumer for event ingestion
- MinIO document storage integration
- Redis caching layer
- Alembic migrations with PostGIS + TimescaleDB extensions
- Single-page dashboard UI with live polling
- OpenTelemetry distributed tracing
Helm chart with infrastructure:
- CNPG PostgreSQL cluster (PostGIS + TimescaleDB)
- NATS JetStream with persistent streams
- MinIO distributed object storage (3 buckets)
- Redis Sentinel (1 primary + 2 replicas)
- NGINX Ingress with TLS and WebSocket support
- Prometheus + Grafana + Alertmanager monitoring stack
- Network policies with default deny
- ConfigMap, CronJob, Deployment, Service templates
Fixes applied during review:
- SQL injection in search endpoint (parameterized :q binding)
- Dockerfile PYTHONPATH mismatch (/app/app -> /app)
- Hardcoded DB credentials in alembic.ini
- RSS timestamp parsing (feedparser published_parsed -> parsedate_to_datetime)
- Removed dead PGVECTOR import
2026-05-21 13:39:52 +00:00
sirius0xdev
4a01c457ab
Update kustomization.yaml
2026-05-21 09:36:11 -04:00
8255467313
feat: add OSINT Dashboard Kubernetes infrastructure
...
- Helm chart scaffold (Chart.yaml, values.yaml, _helpers.tpl)
- Namespace + RBAC manifests
- PostgreSQL (CNPG, 3 replicas, PostGIS + TimescaleDB)
- NATS JetStream (3 replicas, persistent, custom subjects)
- Redis Sentinel (1 primary + 2 replicas, HA)
- MinIO distributed (4 replicas, bucket init job)
- Gateway API HTTPRoute + cert-manager TLS certificates
- Monitoring stack (Prometheus, Grafana, Alertmanager, exporters)
- NetworkPolicies (default deny + per-component policies)
- GitHub Actions CI/CD pipeline (lint, template, security scan)
- Flux CD staging overlay
2026-05-21 13:25:15 +00:00
b0748538c0
feat: add trading-platform K8s manifests for customer1
...
- Scaffold trading-platform under apps/base/customer1/trading-platform/
- Add 4 microservice deployments: data-service, execute-service, news-service, dashboard
- Add ConfigMaps with DB/Kafka/Redis connection configs
- Add HTTPRoutes via Gateway API (external-http-gateway)
- Add NetworkPolicies for inter-service and DB/Kafka/Redis egress
- Add SOPS-encrypted secrets (age key)
- Add Kafka (KRaft) and Redis infrastructure to hermes-db/
- Update root and staging kustomizations
All containers: non-root, readOnlyRootFilesystem, resource limits, health probes
Images: ghcr.io/sirius0xdev/trading-{service}:latest
2026-05-21 04:17:05 +00:00
5e477492e6
feat: add OSINT Dashboard Kubernetes infrastructure
...
- Helm chart scaffold (Chart.yaml, values.yaml, _helpers.tpl)
- Namespace + RBAC manifests
- PostgreSQL (CNPG, 3 replicas, PostGIS + TimescaleDB)
- NATS JetStream (3 replicas, persistent, custom subjects)
- Redis Sentinel (1 primary + 2 replicas, HA)
- MinIO distributed (4 replicas, bucket init job)
- Gateway API HTTPRoute + cert-manager TLS certificates
- Monitoring stack (Prometheus, Grafana, Alertmanager, exporters)
- NetworkPolicies (default deny + per-component policies)
- GitHub Actions CI/CD pipeline (lint, template, security scan)
- Flux CD staging overlay
2026-05-21 04:15:55 +00:00
sirius0xdev
a06a105f31
Update kustomization.yaml
2026-05-20 22:18:37 -04:00
sirius0xdev
da0ad4b7b9
Merge pull request #116 from sirius0xdev/feat/siriusdevops-site-deploy
...
feat: deploy siriusdevops.com main site to GKE
2026-05-15 11:02:01 -04:00
65e174a86d
feat: deploy siriusdevops.com main site to GKE
...
Add siriusdevops-site manifests:
- Deployment + ClusterIP Service (nginx:alpine, port 80)
- HTTPRoute for siriusdevops.com via external-http-gateway
- Kustomization overlay wiring
2026-05-15 14:56:10 +00:00
334be37781
fix: add real Telegram bot_token and chat_id
2026-05-15 02:10:47 +00:00
31fcd59a5f
fix: SOPS-encrypt waitlist secrets with age key
...
- DB password: random 48-char hex string
- admin_api_key: random 32-char hex string
- Telegram bot_token/chat_id still CHANGEME — fill before deploying
2026-05-15 01:36:06 +00:00
ac994f144a
fix: container hardening + NetworkPolicy for waitlist-api
...
- deployment.yaml: securityContext (runAsNonRoot, readOnlyRootFilesystem, drop ALL caps)
- network-policy.yaml: egress only to CNPG PG (5432) + api.telegram.org (443)
- kustomization.yaml: register new NetworkPolicy resource
- waitlist-telegram-secret: add admin_api_key field
2026-05-15 00:00:58 +00:00
sirius0xdev
36b1d637f1
feat: add siriusdevops CNPG cluster + waitlist API K8s manifests ( #112 )
...
- New CNPG PostgreSQL cluster (siriusdevops-pgdb) in customer1 namespace
- Single-instance, 20Gi storage, GCS backups to siriusdevops-backups/
- Waitlist database definition (waitlist-db.yaml)
- Scheduled backup manifest
- Waitlist API deployment, service, HTTPRoute, and Telegram secret placeholder
- Kustomization wiring for both siriusdevops-db and waitlist-api
2026-05-14 19:24:33 -04:00
sirius0xdev
e3b56d397d
Update deployment.yaml
2026-05-12 22:42:41 -04:00
sirius0xdev
9beb9c4887
Update deployment.yaml
2026-05-12 22:40:46 -04:00
sirius0xdev
228f4d5f0e
add version to webui
2026-05-11 13:23:43 +00:00
sirius0xdev
f173f4b84e
edit config map
2026-05-11 02:02:47 +00:00
sirius0xdev
24d8a7ce65
fix secret name
2026-05-11 01:34:03 +00:00
sirius0xdev
649e69b585
fix deployment
2026-05-11 01:29:31 +00:00
sirius0xdev
fb32fdad1c
fix new config map
2026-05-11 01:17:27 +00:00
sirius0xdev
9657d5bc18
add to kustomization
2026-05-11 01:12:22 +00:00
sirius0xdev
3eee3b3ecf
fix cm name
2026-05-11 01:09:02 +00:00
sirius0xdev
e1178b3691
create seperate config maps
2026-05-11 01:03:01 +00:00
sirius0xdev
0f8bcf62e9
add webhook env
2026-05-10 17:48:35 +00:00
sirius0xdev
29a36f9776
webhook nightmare
2026-05-10 03:40:24 +00:00
sirius0xdev
1491f0c1b4
fix webhooks and try vllm config
2026-05-10 03:15:57 +00:00
sirius0xdev
bce6e18f2b
fix vllm and tini
2026-05-10 01:48:34 +00:00
sirius0xdev
3d3f0a5a1f
change vllm settings
2026-05-10 01:33:47 +00:00
Hermes Agent
584c38ff38
fix: telegram webhook - HTTPRoute structure, kustomization, env var
...
- Fix HTTPRoute: merge backendRefs and matches into a single rule
(was split across two rules, causing Telegram POSTs to be dropped)
- Add hermes-webhook.yaml to kustomization.yaml resources
(was not applied during kustomize build at all)
- Clean up TELEGRAM_WEBHOOK_SECRET env var name (leading space)
2026-05-10 01:18:34 +00:00
sirius0xdev
7d98323a83
fix env
2026-05-09 23:50:00 +00:00
sirius0xdev
6e982f2930
fix webhook envs
2026-05-09 23:41:37 +00:00
sirius0xdev
e6a10d8c84
fix webhook envs and service
2026-05-09 23:22:02 +00:00
sirius0xdev
42dc470783
fix env typo
2026-05-09 23:01:20 +00:00
sirius0xdev
c282c551fd
Update new-deployment.yaml
2026-05-09 15:03:58 -04:00
sirius0xdev
4206d2a4b2
Update new-deployment.yaml
2026-05-09 15:02:19 -04:00
sirius0xdev
ce23a28792
Update new-deployment.yaml
2026-05-09 14:52:04 -04:00
sirius0xdev
3fc1759c3f
Update new-deployment.yaml
2026-05-09 14:17:33 -04:00
sirius0xdev
3fc8877cd5
Update kustomization.yaml
2026-05-09 14:07:18 -04:00
sirius0xdev
e5b1cda4d5
Update new-deployment.yaml
2026-05-09 14:06:51 -04:00
sirius0xdev
9ccc23434c
Update new-deployment.yaml
2026-05-09 13:37:36 -04:00
sirius0xdev
3bf54c690b
Update new-deployment.yaml
2026-05-09 13:31:08 -04:00
sirius0xdev
6122bcc460
Update new-deployment.yaml
2026-05-09 13:25:26 -04:00
sirius0xdev
ccd094fcca
Update new-deployment.yaml
2026-05-09 13:23:29 -04:00
sirius0xdev
c289dd6bc2
Update new-deployment.yaml
2026-05-09 13:17:12 -04:00
sirius0xdev
588332c55d
Update new-deployment.yaml
2026-05-09 12:46:53 -04:00
