gao/ljwx-deploy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2,884 Commits 264 Branches 0 Tags
main
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
BrunoGao 1ae6eb6416 feat(health): stage Contabo production migration (#360) 
Adds a manual-only Contabo canary path, Traefik overlays, fail-closed migration gates, and contract tests.

Refs lingjingwanxiang/ljwx-health#390
Refs lingjingwanxiang/ljwx-health#395
 2026-08-02 17:20:07 +08:00
BrunoGao 6833e1253a feat(ops): prefer cross-zone health replicas (#359) 
Add zone-first and hostname-fallback soft scheduling preferences plus a deploy-gate contract test.

Refs https://github.com/lingjingwanxiang/ljwx-health/issues/390
Refs https://github.com/lingjingwanxiang/ljwx-health/issues/395
 2026-08-02 09:17:13 +08:00
BrunoGao 94806b6876 Remove temporary LJWX Health legacy cleanup resources (#358) 
Remove the successful one-shot cleanup hook and its ordinary least-privilege RBAC so Argo prunes the last temporary resources while preserving the audit evidence.
 2026-08-01 05:15:05 +08:00
BrunoGao 96db8706b5 Delete retired LJWX Health hook orphans through GitOps (#357) 
Run an exact-name, least-privilege PostSync deletion for the hook objects that Argo does not ordinary-prune. Keep temporary cleanup RBAC tracked for a final GitOps prune after observed deletion.
 2026-08-01 05:05:03 +08:00
BrunoGao 188cd35e41 Adopt retired LJWX Health hooks for GitOps pruning (#356) 
Temporarily adopt the exact retired hook object names as empty, permissionless ordinary resources so Argo CD can track and prune them through a follow-up GitOps revision.
 2026-08-01 04:59:15 +08:00
BrunoGao 2b2cd69428 Retire legacy LJWX Health PostgreSQL schema paths (#355) 
Retire the duplicate PostgreSQL SQL ConfigMap/init/repair path after verified production adoption, qualified restore, and the repaired N/N-1/N compatibility window. Preserve ClickHouse SQL, immutable audit history, backups, and signed digest-only schema delivery.
 2026-08-01 04:49:03 +08:00
BrunoGao 0f7f812907 ops(health): deactivate completed restore drill (#354) 2026-08-01 03:40:53 +08:00
BrunoGao 7345fa7342 ops(health): restore latest qualified backup (#353) 2026-08-01 03:10:11 +08:00
BrunoGao 45256de506 fix(restore): authorize signed pre-adoption plan (#352) 2026-08-01 02:53:14 +08:00
BrunoGao 9f4c1fda01 fix(restore): allow exact k3s API endpoint (#351) 2026-08-01 02:35:42 +08:00
BrunoGao 8a7e6469d0 fix(restore): prepare volume modes before ownership (#350) 2026-08-01 02:23:29 +08:00
BrunoGao 6b220a414e ops(health): run pre-adoption schema restore drill (#349) 2026-08-01 02:15:21 +08:00
BrunoGao 16d1c987cd ops(postgres): schedule post-adoption differential backup (#347) 2026-08-01 02:08:51 +08:00
BrunoGao 5772d2f3d0 feat(restore): add application-level schema restore drill (#348) 
* ops(health): smoke immutable app after schema restore

* ci: silence trap-only shellcheck paths
 2026-08-01 02:07:42 +08:00
BrunoGao b236ed97ce chore(ljwx-health): activate restore drill read boundary (#346) 2026-07-31 20:02:18 +08:00
BrunoGao 7de60242c5 feat(ljwx-health): project adopted schema release facts (#345) 2026-07-31 19:48:23 +08:00
BrunoGao 8dd9827602 fix(ljwx-health): resume completed schema upgrade retries (#344) 
Verify the complete signed schema before retrying adoption-plan upgrades and report exact fingerprint mismatches.
 2026-07-31 18:43:21 +08:00
BrunoGao fc9dbaa9d1 fix(cluster): preserve registry-specific pull credentials (#343) 
Sync Harbor and GHCR Docker credentials from distinct source Secrets, avoid client-side secret annotations, and preserve Harbor-only default ServiceAccount binding.
 2026-07-31 18:33:34 +08:00
BrunoGao f35f8a4c00 fix(ljwx-health): stage signed schema release before adoption (#342) 
Create the immutable signed schema Release ConfigMap at PreSync wave -3 and preserve the ordering in future promotions.
 2026-07-31 11:29:41 +08:00
BrunoGao d02154f0d0 fix(ljwx-health): order schema bootstrap before PreSync job (#341) 
Create bootstrap ServiceAccount and RBAC as wave -3 PreSync hooks before the wave -2 schema adoption Job.
 2026-07-31 11:23:31 +08:00
BrunoGao 9d331f95c2 feat(ljwx-health): add isolated schema restore drill foundation (#340) 
* feat(ljwx-health): add isolated schema restore drill foundation

* fix(ljwx-health): verify Cosign v3 custom bindings

* test(ljwx-health): cover production binding envelope

* fix(ljwx-health): isolate restore drill API token

* fix(ljwx-health): split restore drill cross-namespace RBAC

* fix(ljwx-health): annotate trap-only cleanup
 2026-07-31 10:21:56 +08:00
BrunoGao b0a034b238 fix(schema): bootstrap migrator with signed runner image (#339) 
Refs #335 and lingjingwanxiang/ljwx-health#713.

Use only the signed schema-runner image and resource-scoped Kubernetes API access for the one-time migrator credential bootstrap.
 2026-07-31 09:04:38 +08:00
BrunoGao 1aa41d4c34 fix(postgres): make backup verification shell-free (#338) 
Refs #335 and lingjingwanxiang/ljwx-health#713.

Replace the failed report pod with shell-free verification and preserve the successful pgBackRest recovery chain.
 2026-07-31 08:52:07 +08:00
BrunoGao 3ad88f6093 ops(postgres): add Phase 5 pre-adoption backup gate (#337) 
Refs #335 and lingjingwanxiang/ljwx-health#713.

Run and report the required GitOps-owned pgBackRest backup before schema adoption. The later cleanup PR removes this one-time Job after evidence is archived.
 2026-07-31 08:45:03 +08:00
BrunoGao 7f8f3bc42a feat(ljwx-health): consume signed schema bundles via GitOps (#336) 
Closes #335 foundation slice
Refs lingjingwanxiang/ljwx-health#713

The schema package remains dormant until a validated v2 Release receipt activates it.
 2026-07-31 08:20:20 +08:00
BrunoGao c8b3d519ed docs(db): classify LJWX Health schema bundle drift (#334) 
Documents canonical-source drift classification for LJWX Health phase #709.

Refs lingjingwanxiang/ljwx-health#709.
 2026-07-30 21:58:43 +08:00
BrunoGao 4f9185ff41 feat: enforce ljwx-health digest-only promotion (#332) 
Refs #332
 2026-07-30 20:21:36 +08:00
BrunoGao 512ada635a feat(ljwx-health): deploy blueprint operations schema (#331) 
* feat(ljwx-health): deploy blueprint operations schema

* chore: retrigger deploy gate
 2026-07-29 05:50:42 +08:00
BrunoGao 6a715dd846 feat(ljwx-health): deploy IA17 tenant blueprint schema (#330) 
* feat(ljwx-health): deploy tenant blueprint schema

* docs(ljwx-health): trace IA17 schema source
 2026-07-29 04:22:13 +08:00
BrunoGao 920ee609ac Merge pull request #329 from lingjingwanxiang/codex/issue-383-ia15-schema 
feat(ljwx-health): deploy heartbeat current uniqueness
 2026-07-28 23:42:47 +08:00
BrunoGao b0adb9d144 Merge pull request #328 from lingjingwanxiang/codex/issue-383-ia14-columnstore 
fix(ljwx-health): tolerate columnstore envelope constraint
 2026-07-28 22:47:35 +08:00
BrunoGao 0efba2432d Merge pull request #327 from lingjingwanxiang/codex/issue-383-ia14-schema 
feat(ljwx-health): deploy resource provenance envelope schema
 2026-07-28 22:40:02 +08:00
BrunoGao fcdeb19fab feat(ljwx-health): deploy temporal device binding schema (#326) 
Refs https://github.com/lingjingwanxiang/ljwx-health/issues/383
 2026-07-28 21:23:46 +08:00
BrunoGao 879aafe92c feat(ljwx-health): deploy user position lifecycle schema (#325) 2026-07-28 20:14:48 +08:00
BrunoGao 549e2da497 fix(ljwx-health): roll out org manager assignment schema (#324) 2026-07-28 17:06:11 +08:00
BrunoGao 9230fe7078 fix(ljwx-health): roll out primary membership schema (#323) 2026-07-28 15:00:56 +08:00
BrunoGao ec53059aa5 fix(ljwx-health): roll out health task scope (#322) 2026-07-28 13:53:33 +08:00
BrunoGao 35f37c1889 fix(ljwx-health): roll out device self-service scope (#321) 
Refs https://github.com/lingjingwanxiang/ljwx-health/issues/383
 2026-07-27 15:42:03 +08:00
BrunoGao c7dc7bb9e7 fix(ljwx-health): roll out user feedback schema (#320) 
* fix(ljwx-health): roll out user feedback schema

* test(ljwx-health): gate feedback schema rollout
 2026-07-27 14:34:40 +08:00
BrunoGao 378e359a39 fix(ljwx-health): apply external alert purpose schema (#319) 2026-07-27 01:56:11 +08:00
BrunoGao c7926295e9 fix(ljwx-health): roll out NO_TRAFFIC reconciliation status (#318) 
Apply the five-value reconciliation status vocabulary through the K3s GitOps schema bundle and fail closed on stale or unvalidated constraints.

Refs: https://github.com/lingjingwanxiang/ljwx-health/issues/349
 2026-07-26 10:29:01 +08:00
BrunoGao 12470dc7c5 fix(health): make IA-05 role migration PostgreSQL 18 compatible (#317) 
Refs lingjingwanxiang/ljwx-health#383
 2026-07-22 10:11:26 +08:00
BrunoGao 40ade10f6f feat(health): converge tenant navigation schema (#316) 2026-07-22 10:01:32 +08:00
BrunoGao 8a750cb4e7 feat(ljwx-health): deploy authorization mutation grants (#315) 
* feat(ljwx-health): deploy authorization mutation grants

* ci: refresh operations issue contract
 2026-07-22 08:32:59 +08:00
BrunoGao c34655931f feat(ljwx-health): deploy authorization version facts (#314) 2026-07-22 07:15:10 +08:00
BrunoGao e4936e777a fix(health): deploy authorization relation RLS schema (#313) 
* fix(health): deploy authorization relation RLS schema

* fix(health): derive relation tenant keys from owners
 2026-07-22 06:25:59 +08:00
BrunoGao 4f68d5e9eb fix(health): deploy mobile subject scope schema (#312) 2026-07-20 04:16:59 +08:00
BrunoGao 86fdcda98b fix(health): preserve underscore in RLS verification (#311) 2026-07-19 21:07:14 +08:00
BrunoGao e69c2bedbf fix(gitops): trigger health schema hooks on bundle changes (#310) 2026-07-19 21:03:20 +08:00
BrunoGao 4bf87e5ba3 fix(health): deploy platform-default RLS policy (#309) 2026-07-19 21:00:43 +08:00
BrunoGao 44667c9ac9 fix(incident): start relay through ConfigMap symlink (#308) 2026-07-19 20:51:56 +08:00
BrunoGao 43fe777b11 feat(incident): enforce alert acknowledgement SLA (#307) 2026-07-19 20:48:46 +08:00
BrunoGao a6533accc0 Merge pull request #306 from lingjingwanxiang/agent/storage-capacity-alerts-375 
feat(health): deploy storage capacity alerts
 2026-07-19 19:00:50 +08:00
BrunoGao cb4acc8686 Merge pull request #305 from lingjingwanxiang/agent/health-collection-policy-schema-373 
feat(health): deploy collection policy schema
 2026-07-19 17:49:30 +08:00
BrunoGao 5b845d9c16 Merge pull request #304 from lingjingwanxiang/agent/health-shadow-init-fix-349 
fix(health): make shadow datastore hooks idempotent
 2026-07-19 17:32:59 +08:00
BrunoGao a7113a98a4 Merge pull request #303 from lingjingwanxiang/agent/health-shadow-canary-349 
feat(health): deploy governed shadow and score canaries (#349, #355)
 2026-07-19 16:44:39 +08:00
BrunoGao a66007da4e fix(ljwx-health): align MinIO runtime credentials (#302) 2026-07-19 14:17:57 +08:00
BrunoGao 0d18d908d2 fix(ljwx-health): pin pre-sync DB identity (#301) 2026-07-19 14:00:42 +08:00
BrunoGao c43fabbcf5 fix(ljwx-health): enforce restricted runtime DB role (#300) 2026-07-19 13:57:33 +08:00
BrunoGao e0448b0683 feat(health): add bigscreen trial observability (#299) 2026-07-19 12:23:24 +08:00
BrunoGao dd8599e1ca Merge pull request #298 from lingjingwanxiang/agent/bigscreen-restore-allowlist-172 
feat(health): restore bigscreen tenant-1 canary
 2026-07-19 11:08:49 +08:00
BrunoGao 3371005e59 Merge pull request #297 from lingjingwanxiang/agent/bigscreen-rollback-rehearsal-172 
test(health): rehearse bigscreen legacy rollback
 2026-07-19 11:06:20 +08:00
BrunoGao cf64406ca4 Merge pull request #296 from lingjingwanxiang/agent/bigscreen-allowlist-172 
feat(health): allowlist tenant 1 for bigscreen cutover
 2026-07-19 11:02:56 +08:00
BrunoGao 53135d713f Merge pull request #295 from lingjingwanxiang/agent/restore-bigscreen-resource-172 
fix(health): restore 5225 compatibility workload
 2026-07-19 10:52:22 +08:00
BrunoGao 622ab4dfd1 Merge pull request #294 from lingjingwanxiang/agent/bigscreen-cutover-172-gitops 
feat(health): configure safe bigscreen cutover defaults
 2026-07-19 10:31:01 +08:00
BrunoGao a35a5f347e fix(cert-manager): rotate Cloudflare DNS credentials (#293) 
* fix(cert-manager): rotate Cloudflare DNS credentials

* docs(cert-manager): clarify account token verification
 2026-07-12 20:54:25 +08:00
BrunoGao 67b9673ee1 fix(health): rewrite public API gateway prefix (#292) 
* fix(health): rewrite public API gateway prefix

* fix(ci): use cross-repo token for issue validation
 2026-07-12 18:46:39 +08:00
BrunoGao f8a7d98557 ci(health): enforce operations issue contracts (#290) 
* ci(health): enforce operations issue contracts

* fix(ci): authenticate pinned ops gate fetch

* fix(ci): vendor tested operations gate
 2026-07-12 18:31:38 +08:00
BrunoGao ffc13f4287 fix(health): suppress Sa-Token configuration logger (#291) 2026-07-12 18:30:33 +08:00
BrunoGao e13ef26120 fix(health): inject and rotate Sa-Token signing secret (#289) 2026-07-12 17:57:23 +08:00
BrunoGao e0a861b20a fix(ljwx-health): order schema config before hook (#288) 2026-07-11 08:48:39 +08:00
BrunoGao 1cfa358feb fix(ljwx-health): execute Epic 360 schema rollout (#287) 2026-07-11 08:46:36 +08:00
BrunoGao d325c6da66 feat(ljwx-health): add message chain alert rules (#286) 2026-07-11 08:26:57 +08:00
BrunoGao 477eea302f feat(ops): close LJWX Health alert edge and PITR loops (#285) 
Add the Feishu alert relay, dedicated in-cluster Cloudflare Tunnel, pgBackRest WAL/PITR operations, supporting Argo applications, and reproducible production drills.
 2026-07-10 22:59:40 +08:00
BrunoGao f77e477588 fix(ljwx-health): redact health dependency details (#284) 2026-07-10 21:17:20 +08:00
BrunoGao 90b5134afa rollback(ljwx-health): restore Boot and fix OTLP transport (#283) 
* fix(ljwx-health): use OTLP HTTP transport

* rollback(ljwx-health): restore healthy boot digest
 2026-07-10 20:53:26 +08:00
BrunoGao c98c6532d3 fix(ljwx-health): align TLS with Cloudflare edge (#282) 2026-07-10 20:36:40 +08:00
BrunoGao 2713658ad4 feat(ljwx-health): production operations baseline (#281) 2026-07-10 20:31:20 +08:00
BrunoGao 0b1838a17d Merge pull request #275 from lingjingwanxiang/bot/queue-ljwx-platform-24564532535 
queue(ljwx-platform): 20260417T122602Z-ljwx-platform-sha-dc7ec41
 2026-04-17 20:26:05 +08:00
BrunoGao 632490bc09 fix(chat,openclaw): migrate ingress to nginx + omniverseai.net domain 2026-04-09 10:12:24 +08:00
BrunoGao 7adcf10040 fix(omni-website): point ArgoCD source to GitHub instead of Gitea 2026-04-09 10:08:28 +08:00
BrunoGao 1780f0a5b4 fix(omni-website): migrate ingress from traefik to nginx class 2026-04-09 10:04:51 +08:00
BrunoGao f759285784 fix(n8n): use nginx ingress class for omniverseai.net domain 2026-04-09 09:32:33 +08:00
BrunoGao 6a8a829840 fix(n8n): change domain to n8n.omniverseai.net 2026-04-09 09:25:59 +08:00
BrunoGao 747bffcbdc fix(n8n): use short sha tag (sha-60f94c9) to avoid pull issues 2026-04-09 09:20:31 +08:00
BrunoGao 74136a4363 fix(n8n): use image.tag instead of digest (chart doesn't support digest) 2026-04-09 09:13:33 +08:00
BrunoGao 4465d1cb8e chore(n8n): deploy ljwx-n8n@60f94c9 -> sha256:e32ed434a91e9 2026-04-09 09:10:55 +08:00
BrunoGao 888153836d feat: register omni-website-dev namespace and application in cluster kustomization 2026-04-08 14:34:19 +08:00
BrunoGao 797ddc3566 feat: add omni-website-dev ArgoCD application 2026-04-08 14:33:56 +08:00
BrunoGao 8f319aacd8 feat: add omni-website-dev namespace with quotas and limits 2026-04-08 14:33:47 +08:00
BrunoGao c035fd62d0 feat: add omni-website dev overlay ingress with TLS 2026-04-08 14:33:38 +08:00
BrunoGao 2015e48026 feat: add omni-website dev overlay kustomization 2026-04-08 14:33:25 +08:00
BrunoGao be976b90e6 feat: add omni-website base kustomization 2026-04-08 14:33:18 +08:00
BrunoGao 311774230f feat: add omni-website base ingress manifest 2026-04-08 14:33:11 +08:00
BrunoGao ec50198cde feat: add omni-website base service manifest 2026-04-08 14:33:03 +08:00
BrunoGao dd5fc2ec48 feat: add omni-website base deployment manifest 2026-04-08 14:32:56 +08:00
BrunoGao 4ff90701e2 chore(deploy): update 4 services to latest GHCR digests + add omni-stock/zhihu-engine to service maps 
Phase 1: Update overlay digests for ljwx-health (3 images) and ljwx-shiti (1 image)
Phase 2: Add omni-stock and zhihu-engine to both service mapping files
 2026-04-07 15:41:14 +08:00
BrunoGao 677127d7f7 ci: remove monthly-rollback-drill scheduled workflow 
No longer using nightly/scheduled workflows per org policy.
 2026-04-07 13:22:21 +08:00
BrunoGao beae975ba8 ci: remove nightly-evidence scheduled workflow 
No longer using nightly/scheduled workflows per org policy.
 2026-04-07 13:22:20 +08:00
BrunoGao 7c18a770b0 ci: remove nightly-auto-repair scheduled workflow 
No longer using nightly/scheduled workflows per org policy.
 2026-04-07 13:22:18 +08:00