release(agent-platform): sha-d8237ae

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/agent-platform/base/deployment.yaml

@@ -0,0 +1,72 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: agent-platform
+  labels:
+    app: agent-platform
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: agent-platform
+  template:
+    metadata:
+      labels:
+        app: agent-platform
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: agent-platform
+          image: harbor.eu.lingjingwanxiang.cn/ljwx/agent-platform-api:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8000
+              name: http
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: agent-platform-db
+                  key: DATABASE_URL
+            - name: REDIS_URL
+              valueFrom:
+                secretKeyRef:
+                  name: agent-platform-app
+                  key: REDIS_URL
+            - name: ANTHROPIC_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: agent-platform-app
+                  key: ANTHROPIC_AUTH_TOKEN
+            - name: JWT_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: agent-platform-app
+                  key: JWT_SECRET_KEY
+            - name: MILVUS_HOST
+              value: ""
+            - name: MILVUS_PORT
+              value: "19530"
+            - name: APP_ENV
+              value: "prod"
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 5
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: "200m"
+              memory: "512Mi"
+            limits:
+              cpu: "1"
+              memory: "1Gi"

apps/agent-platform/base/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: agent-platform
+  annotations:
+    cert-manager.io/cluster-issuer: dnspod-letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - agent.lingjingwanxiang.cn
+      secretName: agent-platform-tls
+  rules:
+    - host: agent.lingjingwanxiang.cn
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: agent-platform
+                port:
+                  number: 8000

apps/agent-platform/base/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - secret.yaml
+  - regcred.yaml

apps/agent-platform/base/regcred.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: regcred
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: eyJhdXRocyI6eyJoYXJib3IuZXUubGluZ2ppbmd3YW54aWFuZy5jbiI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJIYXJib3IxMjM0NSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19

apps/agent-platform/base/secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: agent-platform-db
+type: Opaque
+stringData:
+  DATABASE_URL: postgresql+asyncpg://agent:ChangeMeInProduction@postgres-lb.infra.svc.cluster.local:5432/agent_platform
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: agent-platform-app
+type: Opaque
+stringData:
+  REDIS_URL: redis://redis-lb.infra.svc.cluster.local:6379/0
+  ANTHROPIC_AUTH_TOKEN: CHANGE_ME
+  JWT_SECRET_KEY: CHANGE_ME

apps/agent-platform/base/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: agent-platform
+  labels:
+    app: agent-platform
+spec:
+  selector:
+    app: agent-platform
+  ports:
+    - name: http
+      port: 8000
+      targetPort: http
+  type: ClusterIP

apps/agent-platform/overlays/prod/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: agent-platform
+resources:
+- ../../base
+images:
+- name: harbor.eu.lingjingwanxiang.cn/ljwx/agent-platform-api
+  newTag: sha-d8237ae

apps/backend/base/deployment.yaml

@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  labels:
+    app: backend
+    app.kubernetes.io/name: backend
+    app.kubernetes.io/part-of: youngth-guard
+    component: api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend
+      app.kubernetes.io/name: backend
+      app.kubernetes.io/part-of: youngth-guard
+  template:
+    metadata:
+      labels:
+        app: backend
+        app.kubernetes.io/name: backend
+        app.kubernetes.io/part-of: youngth-guard
+        component: api
+    spec:
+      imagePullSecrets:
+        - name: harbor-registry
+      containers:
+        - name: backend
+          image: harbor.omniverseai.net/ljwx/ljwx-shiti:sha-775861d
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8000
+              name: http
+              protocol: TCP
+          env:
+            - name: ENVIRONMENT
+              value: "dev"
+            - name: LOG_LEVEL
+              value: "info"
+            - name: DATABASE_URL
+              value: "postgresql+asyncpg://appuser:123456@postgres-infra-postgresql.infra.svc.cluster.local:5432/appdb"
+            - name: REDIS_URL
+              value: "redis://:123456@redis-infra-master.infra.svc.cluster.local:6379/0"
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi

apps/backend/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml

apps/backend/base/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  labels:
+    app: backend
+    app.kubernetes.io/name: backend
+    app.kubernetes.io/part-of: youngth-guard
+    component: api
+spec:
+  type: ClusterIP
+  selector:
+    app: backend
+    app.kubernetes.io/name: backend
+    app.kubernetes.io/part-of: youngth-guard
+  ports:
+    - name: http
+      port: 8000
+      targetPort: http
+      protocol: TCP

apps/backend/overlays/dev/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: dev
+
+resources:
+  - ../../base

apps/backend/overlays/github-dev/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: dev
+namePrefix: gh-
+
+resources:
+  - ../../base

apps/ljwx-health/base/all.yaml

@@ -0,0 +1,530 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ljwx-health-device-approval-config
+  namespace: ljwx-health
+  labels:
+    app: ljwx-boot
+    component: device-approval
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+data:
+  DEVICE_APPROVAL_AUTO_CLEANUP_DAYS: '30'
+  DEVICE_APPROVAL_BATCH_SIZE_LIMIT: '100'
+  DEVICE_APPROVAL_TIMEOUT_HOURS: '72'
+  DEVICE_APPROVAL_EVENT_THREAD_POOL_SIZE: '10'
+  DEVICE_APPROVAL_EVENT_QUEUE_CAPACITY: '100'
+  DEVICE_APPROVAL_METRICS_ENABLED: 'true'
+  DEVICE_APPROVAL_LOG_LEVEL: INFO
+  DEVICE_APPROVAL_EVENT_LISTENER_LOG_LEVEL: INFO
+  DEVICE_APPROVAL_METRICS_SERVICE_LOG_LEVEL: DEBUG
+  DEVICE_APPROVAL_QUERY_CACHE_TTL: '300'
+  DEVICE_APPROVAL_HISTORY_QUERY_OPTIMIZATION: 'true'
+  application-device-approval.yml: "# Device V2.1 - \u8BBE\u5907\u7ED1\u5B9A\u5BA1\
+    \u6279\u6A21\u5757\u4E13\u7528\u914D\u7F6E\n# \u81EA\u52A8\u52A0\u8F7D\u5F53 spring.profiles.include=device-approval\
+    \ \u65F6\u751F\u6548\n\ndevice:\n  approval:\n    # \u5BA1\u6279\u6D41\u7A0B\u914D\
+    \u7F6E\n    auto-cleanup-days: ${DEVICE_APPROVAL_AUTO_CLEANUP_DAYS:30}\n    batch-size-limit:\
+    \ ${DEVICE_APPROVAL_BATCH_SIZE_LIMIT:100}\n    timeout-hours: ${DEVICE_APPROVAL_TIMEOUT_HOURS:72}\n\
+    \n    # \u4E8B\u4EF6\u53D1\u5E03\u914D\u7F6E\n    events:\n      async-thread-pool-size:\
+    \ ${DEVICE_APPROVAL_EVENT_THREAD_POOL_SIZE:10}\n      async-queue-capacity: ${DEVICE_APPROVAL_EVENT_QUEUE_CAPACITY:100}\n\
+    \n    # \u53EF\u89C2\u6D4B\u6027\u914D\u7F6E\n    observability:\n      metrics-enabled:\
+    \ ${DEVICE_APPROVAL_METRICS_ENABLED:true}\n      log-level: ${DEVICE_APPROVAL_LOG_LEVEL:INFO}\n\
+    \      event-listener-log-level: ${DEVICE_APPROVAL_EVENT_LISTENER_LOG_LEVEL:INFO}\n\
+    \      metrics-service-log-level: ${DEVICE_APPROVAL_METRICS_SERVICE_LOG_LEVEL:DEBUG}\n\
+    \n    # \u6027\u80FD\u4F18\u5316\u914D\u7F6E\n    performance:\n      query-cache-ttl:\
+    \ ${DEVICE_APPROVAL_QUERY_CACHE_TTL:300}\n      history-query-optimization: ${DEVICE_APPROVAL_HISTORY_QUERY_OPTIMIZATION:true}\n\
+    \n# Logback \u65E5\u5FD7\u914D\u7F6E (\u8986\u76D6\u9ED8\u8BA4\u914D\u7F6E)\n\
+    logging:\n  level:\n    com.ljwx.modules.health.service.DeviceBindApprovalServiceImpl:\
+    \ ${DEVICE_APPROVAL_LOG_LEVEL:INFO}\n    com.ljwx.modules.health.listener.DeviceBindApprovalEventListener:\
+    \ ${DEVICE_APPROVAL_EVENT_LISTENER_LOG_LEVEL:INFO}\n    com.ljwx.modules.health.service.DeviceBindApprovalMetricsService:\
+    \ ${DEVICE_APPROVAL_METRICS_SERVICE_LOG_LEVEL:DEBUG}\n"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ljwx-health-admin
+  namespace: ljwx-health
+  labels:
+    app: ljwx-admin
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+  selector:
+    app: ljwx-admin
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ljwx-health-bigscreen
+  namespace: ljwx-health
+  labels:
+    app: ljwx-bigscreen
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+  - port: 5225
+    targetPort: 5225
+    protocol: TCP
+    name: http
+  selector:
+    app: ljwx-bigscreen
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ljwx-health-boot
+  namespace: ljwx-health
+  labels:
+    app: ljwx-boot
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+  - port: 9998
+    targetPort: 9998
+    protocol: TCP
+    name: http
+  selector:
+    app: ljwx-boot
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ljwx-health-admin
+  namespace: ljwx-health
+  labels:
+    app: ljwx-admin
+    component: frontend
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ljwx-admin
+  template:
+    metadata:
+      labels:
+        app: ljwx-admin
+        component: frontend
+    spec:
+      imagePullSecrets:
+      - name: harbor-secret
+      containers:
+      - name: ljwx-admin
+        image: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-admin:dev-latest
+        imagePullPolicy: Always
+        ports:
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 80
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 80
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 3
+          failureThreshold: 3
+        resources:
+          limits:
+            cpu: 500m
+            memory: 512Mi
+          requests:
+            cpu: 100m
+            memory: 256Mi
+      restartPolicy: Always
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ljwx-health-bigscreen
+  namespace: ljwx-health
+  labels:
+    app: ljwx-bigscreen
+    component: dashboard
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ljwx-bigscreen
+  template:
+    metadata:
+      labels:
+        app: ljwx-bigscreen
+        component: dashboard
+    spec:
+      imagePullSecrets:
+      - name: harbor-secret
+      containers:
+      - name: ljwx-bigscreen
+        image: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-bigscreen:dev-latest
+        imagePullPolicy: Always
+        ports:
+        - name: http
+          containerPort: 5225
+          protocol: TCP
+        env:
+        - name: ENV
+          value: production
+        - name: DB_HOST
+          value: mysql-lb.infra.svc.cluster.local
+        - name: DB_PORT
+          value: '3306'
+        - name: DB_NAME
+          value: ljwx_health
+        - name: REDIS_HOST
+          value: redis-lb.infra.svc.cluster.local
+        - name: REDIS_PORT
+          value: '6379'
+        - name: LOG_LEVEL
+          value: INFO
+        envFrom:
+        - secretRef:
+            name: ljwx-boot-secrets
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 5225
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 5225
+          initialDelaySeconds: 10
+          periodSeconds: 5
+        resources:
+          limits:
+            cpu: 1000m
+            memory: 1Gi
+          requests:
+            cpu: 250m
+            memory: 512Mi
+      restartPolicy: Always
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ljwx-health-boot
+  namespace: ljwx-health
+  labels:
+    app: ljwx-boot
+    component: backend
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ljwx-boot
+  template:
+    metadata:
+      annotations:
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: '9998'
+        prometheus.io/path: /actuator/prometheus
+      labels:
+        app: ljwx-boot
+        component: backend
+    spec:
+      imagePullSecrets:
+      - name: harbor-secret
+      containers:
+      - name: ljwx-boot
+        image: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-boot:dev-latest
+        imagePullPolicy: Always
+        ports:
+        - name: http
+          containerPort: 9998
+          protocol: TCP
+        env:
+        - name: SPRING_PROFILES_ACTIVE
+          value: prod
+        - name: SPRING_DATASOURCE_URL
+          value: jdbc:mysql://mysql.infra.svc.cluster.local:3306/ljwx_health?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true
+        - name: SPRING_DATASOURCE_DRIVER_CLASS_NAME
+          value: com.mysql.cj.jdbc.Driver
+        - name: SPRING_REDIS_HOST
+          value: redis-lb.infra.svc.cluster.local
+        - name: SPRING_REDIS_PORT
+          value: '6379'
+        - name: SPRING_REDIS_DATABASE
+          value: '1'
+        - name: SPRING_REDIS_PASSWORD
+          value: '123456'
+        - name: REDIS_HOST
+          value: redis-lb.infra.svc.cluster.local
+        - name: REDIS_PORT
+          value: '6379'
+        - name: REDIS_DB
+          value: '1'
+        - name: REDIS_PASSWORD
+          value: '123456'
+        - name: LOG_LEVEL
+          value: INFO
+        - name: SPRING_FLYWAY_ENABLED
+          value: 'false'
+        - name: SPRING_FLYWAY_BASELINE_ON_MIGRATE
+          value: 'true'
+        - name: SPRING_FLYWAY_LOCATIONS
+          value: classpath:db/baseline
+        - name: OTEL_SERVICE_NAME
+          value: ljwx-boot
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: http://tempo.infra.svc.cluster.local:4317
+        - name: OTEL_TRACES_SAMPLER
+          value: parentbased_traceidratio
+        - name: OTEL_TRACES_SAMPLER_ARG
+          value: '0.1'
+        - name: SPRING_PROFILES_INCLUDE
+          value: device-approval
+        envFrom:
+        - secretRef:
+            name: ljwx-boot-secrets
+        - configMapRef:
+            name: ljwx-health-device-approval-config
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /actuator/health/liveness
+            port: 9998
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 5
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /actuator/health/readiness
+            port: 9998
+          initialDelaySeconds: 30
+          periodSeconds: 5
+          timeoutSeconds: 3
+        resources:
+          limits:
+            cpu: 2000m
+            memory: 2Gi
+          requests:
+            cpu: 500m
+            memory: 1Gi
+        volumeMounts:
+        - name: logs
+          mountPath: /app/logs
+        - name: device-approval-config
+          mountPath: /app/config/application-device-approval.yml
+          subPath: application-device-approval.yml
+          readOnly: true
+      volumes:
+      - name: logs
+        emptyDir: {}
+      - name: device-approval-config
+        configMap:
+          name: ljwx-health-device-approval-config
+          items:
+          - key: application-device-approval.yml
+            path: application-device-approval.yml
+      restartPolicy: Always
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ljwx-health-api-ingress
+  namespace: ljwx-health
+  labels:
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: 'true'
+    traefik.ingress.kubernetes.io/router.middlewares: ljwx-health-ljwx-health-strip-api-prefix@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - health-admin.lingjingwanxiang.cn
+    secretName: ljwx-health-admin-tls
+  rules:
+  - host: health-admin.lingjingwanxiang.cn
+    http:
+      paths:
+      - path: /api
+        pathType: Prefix
+        backend:
+          service:
+            name: ljwx-health-boot
+            port:
+              number: 9998
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ljwx-health-ingress
+  namespace: ljwx-health
+  labels:
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: 'true'
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - health-admin.lingjingwanxiang.cn
+    secretName: ljwx-health-admin-tls
+  - hosts:
+    - health-dashboard.lingjingwanxiang.cn
+    secretName: ljwx-health-bigscreen-tls
+  rules:
+  - host: health-admin.lingjingwanxiang.cn
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ljwx-health-admin
+            port:
+              number: 80
+  - host: health-dashboard.lingjingwanxiang.cn
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ljwx-health-bigscreen
+            port:
+              number: 5225
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: ljwx-health-strip-api-prefix
+  namespace: ljwx-health
+  labels:
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  stripPrefix:
+    prefixes:
+    - /api
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: ljwx-health-boot
+  namespace: ljwx-health
+  labels:
+    app: ljwx-boot
+    release: monitoring
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchLabels:
+      app: ljwx-boot
+  endpoints:
+  - port: http
+    path: /actuator/prometheus
+    interval: 30s
+    scrapeTimeout: 10s
+    relabelings:
+    - sourceLabels:
+      - __meta_kubernetes_service_name
+      targetLabel: service
+    - sourceLabels:
+      - __meta_kubernetes_namespace
+      targetLabel: namespace
+    - sourceLabels:
+      - __meta_kubernetes_pod_name
+      targetLabel: pod
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: ljwx-health-bigscreen
+  namespace: ljwx-health
+  labels:
+    app: ljwx-bigscreen
+    release: monitoring
+    helm.sh/chart: ljwx-health-0.1.0
+    app.kubernetes.io/name: ljwx-health
+    app.kubernetes.io/instance: ljwx-health
+    app.kubernetes.io/version: 1.0.6
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchLabels:
+      app: ljwx-bigscreen
+  endpoints:
+  - port: http
+    path: /metrics
+    interval: 30s
+    scrapeTimeout: 10s
+    relabelings:
+    - sourceLabels:
+      - __meta_kubernetes_service_name
+      targetLabel: service
+    - sourceLabels:
+      - __meta_kubernetes_namespace
+      targetLabel: namespace
+    - sourceLabels:
+      - __meta_kubernetes_pod_name
+      targetLabel: pod

apps/ljwx-health/base/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - all.yaml

apps/ljwx-health/overlays/k3s-eu/kustomization.yaml

@@ -0,0 +1,13 @@
+resources:
+  - ../../base
+namespace: ljwx-health
+images:
+  - name: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-boot
+    newName: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-boot
+    newTag: "latest"
+  - name: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-admin
+    newName: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-admin
+    newTag: "latest"
+  - name: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-bigscreen
+    newName: harbor.eu.lingjingwanxiang.cn/ljwx-health/ljwx-bigscreen
+    newTag: "latest"

apps/ljwx-platform/base/configmap-nginx.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ljwx-platform-admin-ui-nginx
+data:
+  default.conf: |
+    server {
+      listen 80;
+      server_name _;
+      root /usr/share/nginx/html;
+      index index.html;
+
+      location / {
+        try_files $uri $uri/ /index.html;
+      }
+    }
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ljwx-platform-screen-nginx
+data:
+  default.conf: |
+    server {
+      listen 80;
+      server_name _;
+      root /usr/share/nginx/html;
+      index index.html;
+
+      location / {
+        try_files $uri $uri/ /index.html;
+      }
+    }

apps/ljwx-platform/base/deployment-admin-ui.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ljwx-platform-admin-ui
+  labels:
+    app: ljwx-platform-admin-ui
+    project: ljwx-platform
+    component: frontend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ljwx-platform-admin-ui
+  template:
+    metadata:
+      labels:
+        app: ljwx-platform-admin-ui
+        project: ljwx-platform
+        component: frontend
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: ljwx-platform-admin-ui
+          image: harbor.eu.lingjingwanxiang.cn/ljwx/ljwx-platform-admin-ui:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 80
+              name: http
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "64Mi"
+            limits:
+              cpu: "200m"
+              memory: "128Mi"
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d/default.conf
+              subPath: default.conf
+              readOnly: true
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: ljwx-platform-admin-ui-nginx

apps/ljwx-platform/base/deployment-screen.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ljwx-platform-screen
+  labels:
+    app: ljwx-platform-screen
+    project: ljwx-platform
+    component: screen
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ljwx-platform-screen
+  template:
+    metadata:
+      labels:
+        app: ljwx-platform-screen
+        project: ljwx-platform
+        component: screen
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: ljwx-platform-screen
+          image: harbor.eu.lingjingwanxiang.cn/ljwx/ljwx-platform-screen:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 80
+              name: http
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "64Mi"
+            limits:
+              cpu: "200m"
+              memory: "128Mi"
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d/default.conf
+              subPath: default.conf
+              readOnly: true
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: ljwx-platform-screen-nginx

apps/ljwx-platform/base/deployment.yaml

@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ljwx-platform
+  labels:
+    app: ljwx-platform
+    project: ljwx-platform
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ljwx-platform
+  template:
+    metadata:
+      labels:
+        app: ljwx-platform
+        project: ljwx-platform
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: ljwx-platform
+          image: harbor.eu.lingjingwanxiang.cn/ljwx-platform/ljwx-platform:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+          volumeMounts:
+            - name: app-logs
+              mountPath: /workspace/logs
+          env:
+            - name: APP_PORT
+              value: "8080"
+            - name: SPRING_PROFILES_ACTIVE
+              value: "prod"
+            - name: SPRING_FLYWAY_VALIDATE_ON_MIGRATE
+              value: "false"
+            - name: DB_URL
+              valueFrom:
+                secretKeyRef:
+                  name: ljwx-platform-db
+                  key: DB_URL
+            - name: DB_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: ljwx-platform-db
+                  key: DB_USERNAME
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: ljwx-platform-db
+                  key: DB_PASSWORD
+            - name: SPRING_DATASOURCE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: ljwx-platform-db
+                  key: DB_URL
+            - name: SPRING_DATASOURCE_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: ljwx-platform-db
+                  key: DB_USERNAME
+            - name: SPRING_DATASOURCE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: ljwx-platform-db
+                  key: DB_PASSWORD
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: ljwx-platform-app
+                  key: JWT_SECRET
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 90
+            periodSeconds: 30
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 45
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: "300m"
+              memory: "512Mi"
+            limits:
+              cpu: "1"
+              memory: "1Gi"
+      volumes:
+        - name: app-logs
+          emptyDir: {}

apps/ljwx-platform/base/ingress.yaml

@@ -0,0 +1,51 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ljwx-platform
+  annotations:
+    cert-manager.io/cluster-issuer: dnspod-letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - platform.lingjingwanxiang.cn
+      secretName: ljwx-platform-tls
+    - hosts:
+        - platform-admin.lingjingwanxiang.cn
+      secretName: ljwx-platform-admin-tls
+    - hosts:
+        - platform-screen.lingjingwanxiang.cn
+      secretName: ljwx-platform-screen-tls
+  rules:
+    - host: platform.lingjingwanxiang.cn
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ljwx-platform
+                port:
+                  number: 8080
+    - host: platform-admin.lingjingwanxiang.cn
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ljwx-platform-admin-ui
+                port:
+                  number: 80
+    - host: platform-screen.lingjingwanxiang.cn
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ljwx-platform-screen
+                port:
+                  number: 80

apps/ljwx-platform/base/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - deployment-admin-ui.yaml
+  - deployment-screen.yaml
+  - service.yaml
+  - service-admin-ui.yaml
+  - service-screen.yaml
+  - ingress.yaml
+  - configmap-nginx.yaml
+  - secret.yaml
+  - regcred.yaml
+  - networkpolicy.yaml

apps/ljwx-platform/base/networkpolicy.yaml

@@ -0,0 +1,160 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ljwx-platform-default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+---
+# ── Backend ────────────────────────────────────────────────────────────────────
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ljwx-platform-allow-ingress-from-traefik
+spec:
+  podSelector:
+    matchLabels:
+      app: ljwx-platform
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ljwx-platform-allow-egress-dns-and-db
+spec:
+  podSelector:
+    matchLabels:
+      app: ljwx-platform
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: infra
+          podSelector:
+            matchLabels:
+              app: postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+# ── Admin UI ───────────────────────────────────────────────────────────────────
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ljwx-platform-admin-ui-allow-ingress-from-traefik
+spec:
+  podSelector:
+    matchLabels:
+      app: ljwx-platform-admin-ui
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ljwx-platform-admin-ui-allow-egress-dns
+spec:
+  podSelector:
+    matchLabels:
+      app: ljwx-platform-admin-ui
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+# ── Screen ─────────────────────────────────────────────────────────────────────
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ljwx-platform-screen-allow-ingress-from-traefik
+spec:
+  podSelector:
+    matchLabels:
+      app: ljwx-platform-screen
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ljwx-platform-screen-allow-egress-dns
+spec:
+  podSelector:
+    matchLabels:
+      app: ljwx-platform-screen
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53

apps/ljwx-platform/base/regcred.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: regcred
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: eyJhdXRocyI6eyJoYXJib3IuZXUubGluZ2ppbmd3YW54aWFuZy5jbiI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJIYXJib3IxMjM0NSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifSwiaGFyYm9yLmV1LmxpbmdqaW5nd2FueGlhbmcuY246ODA4MCI6eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJIYXJib3IxMjM0NSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19
+

apps/ljwx-platform/base/secret.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ljwx-platform-db
+type: Opaque
+stringData:
+  DB_URL: jdbc:postgresql://postgres-lb.infra.svc.cluster.local:5432/postgres
+  DB_USERNAME: postgres
+  DB_PASSWORD: ChangeMeInProduction123!
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ljwx-platform-app
+type: Opaque
+stringData:
+  JWT_SECRET: ChangeThisToAtLeast32BytesBeforeProductionUse
+

apps/ljwx-platform/base/service-admin-ui.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ljwx-platform-admin-ui
+  labels:
+    app: ljwx-platform-admin-ui
+    project: ljwx-platform
+spec:
+  selector:
+    app: ljwx-platform-admin-ui
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+      name: http
+  type: ClusterIP

apps/ljwx-platform/base/service-screen.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ljwx-platform-screen
+  labels:
+    app: ljwx-platform-screen
+    project: ljwx-platform
+spec:
+  selector:
+    app: ljwx-platform-screen
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+      name: http
+  type: ClusterIP

apps/ljwx-platform/base/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ljwx-platform
+spec:
+  selector:
+    app: ljwx-platform
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+      name: http
+  type: ClusterIP
+

apps/ljwx-platform/overlays/prod/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ljwx-platform
+resources:
+- ../../base
+images:
+- name: harbor.eu.lingjingwanxiang.cn/ljwx-platform/ljwx-platform
+  newName: harbor.eu.lingjingwanxiang.cn/ljwx/ljwx-platform
+  newTag: sha-9f1266d1
+- name: harbor.eu.lingjingwanxiang.cn/ljwx/ljwx-platform-admin-ui
+  newName: harbor.eu.lingjingwanxiang.cn/ljwx/ljwx-platform-admin-ui
+  newTag: sha-b7766e9
+- name: harbor.eu.lingjingwanxiang.cn/ljwx/ljwx-platform-screen
+  newName: harbor.eu.lingjingwanxiang.cn/ljwx/ljwx-platform-screen
+  newTag: sha-b7766e9

apps/ljwx-website/overlays/eu-dev/values.yaml

@@ -0,0 +1,70 @@
+# ljwx-website EU Development Environment Configuration
+# This file is automatically updated by CI/CD pipeline
+
+website:
+  enabled: true
+  replicaCount: 1
+  
+  image:
+    repository: harbor.eu.lingjingwanxiang.cn:8080/ljwx/ljwx-website
+    tag: "main-latest"  # Updated by CI
+    pullPolicy: IfNotPresent
+  
+  service:
+    type: ClusterIP
+    port: 80
+    targetPort: 80
+  
+  resources:
+    requests:
+      memory: "32Mi"
+      cpu: "25m"
+    limits:
+      memory: "64Mi"
+      cpu: "50m"
+  
+  autoscaling:
+    enabled: false
+  
+  probes:
+    liveness:
+      path: /
+      initialDelaySeconds: 10
+      periodSeconds: 10
+    readiness:
+      path: /
+      initialDelaySeconds: 5
+      periodSeconds: 5
+
+# Ingress configuration
+ingress:
+  enabled: true
+  className: traefik  # k3s default ingress controller
+  
+  # Fixed subdomain
+  host: "website.lingjingwanxiang.cn"
+  baseDomain: "lingjingwanxiang.cn"
+  
+  path: /
+  pathType: Prefix
+  
+  annotations:
+    # Traefik annotations
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    # cert-manager.io/cluster-issuer: letsencrypt-prod
+  
+  tls:
+    enabled: true
+    secretName: "website-tls"
+    # clusterIssuer: "letsencrypt-prod"
+
+# ServiceMonitor (Prometheus Operator)
+serviceMonitor:
+  enabled: false
+  interval: 30s
+
+# Namespace labels
+namespaceLabels:
+  project: ljwx-website
+  managed-by: argocd
+  environment: dev-eu

argocd-apps/21-infra-data.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: infra-data
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/BrunoGaoSZ/ljwx-deploy.git
+    targetRevision: main
+    path: infra/data
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: infra
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd-apps/41-ljwx-platform.yaml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ljwx-platform
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  labels:
+    environment: prod
+    project: ljwx-platform
+spec:
+  project: ljwx
+  source:
+    repoURL: https://github.com/BrunoGaoSZ/ljwx-deploy.git
+    targetRevision: main
+    path: apps/ljwx-platform/overlays/prod
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ljwx-platform
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+    syncOptions:
+      - CreateNamespace=true
+      - PrunePropagationPolicy=foreground
+      - PruneLast=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m

argocd-apps/42-agent-platform.yaml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: agent-platform
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  labels:
+    environment: prod
+    project: agent-platform
+spec:
+  project: ljwx
+  source:
+    repoURL: https://github.com/BrunoGaoSZ/ljwx-deploy.git
+    targetRevision: main
+    path: apps/agent-platform/overlays/prod
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: agent-platform
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+    syncOptions:
+      - CreateNamespace=true
+      - PrunePropagationPolicy=foreground
+      - PruneLast=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m

argocd-apps/50-ljwx-health-k3s-eu.yaml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ljwx-health-k3s-eu
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  labels:
+    environment: k3s-eu
+    project: ljwx-health
+spec:
+  project: ljwx
+  source:
+    repoURL: "https://github.com/BrunoGaoSZ/ljwx-deploy.git"
+    targetRevision: main
+    path: apps/ljwx-health/overlays/k3s-eu
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: ljwx-health
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+    syncOptions:
+      - CreateNamespace=true
+      - PrunePropagationPolicy=foreground
+      - PruneLast=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m

argocd-apps/ljwx-website-eu-dev.yaml

@@ -0,0 +1,62 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ljwx-website-eu-dev
+  namespace: argocd
+  labels:
+    project: ljwx-website
+    environment: dev-eu
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default  # Or use 'ljwx-project' if you have a specific AppProject
+  
+  source:
+    # Source: ljwx-website business repository (contains Helm chart)
+    repoURL: https://github.com/BrunoGaoSZ/ljwx-website.git
+    targetRevision: main
+    path: deploy/helm/app
+    helm:
+      # Use both base values and environment-specific overlay
+      valueFiles:
+        - values.yaml                      # Base configuration
+        - ../../environments/dev-eu.yaml   # Environment overlay
+      
+      # Additional runtime overrides (managed by CI/CD)
+      # These values override everything above
+      values: |
+        website:
+          image:
+            tag: "main-latest"  # Will be updated by CI/CD
+        
+        ingress:
+          enabled: true
+          className: traefik
+          host: "website.lingjingwanxiang.cn"
+  
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ljwx-website-dev
+  
+  syncPolicy:
+    automated:
+      prune: true       # Auto-delete resources when removed from git
+      selfHeal: true    # Auto-sync when cluster state drifts from git
+      allowEmpty: false
+    syncOptions:
+      - CreateNamespace=true  # Auto-create namespace if it doesn't exist
+      - PrunePropagationPolicy=foreground
+      - PruneLast=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+  
+  # Health assessment
+  ignoreDifferences:
+    - group: apps
+      kind: Deployment
+      jsonPointers:
+        - /spec/replicas  # Ignore if HPA manages replicas

argocd-apps/projects/ljwx-project.yaml

@@ -29,6 +29,8 @@ spec:
       server: 'https://kubernetes.default.svc'
     - namespace: 'bookstore'  # bookstore 命名空间
       server: 'https://kubernetes.default.svc'
+    - namespace: 'agent-platform'
+      server: 'https://kubernetes.default.svc'
 
   # 允许创建的集群级资源（谨慎开放）
   clusterResourceWhitelist:

infra/arc/arc-github-token.secret.example.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: arc-github-token
+  namespace: arc-system
+type: Opaque
+stringData:
+  # Option A: Personal Access Token
+  github_token: "ghp_xxx_replace_me"
+  # Option B: GitHub App (use these keys instead of github_token)
+  # github_app_id: "123456"
+  # github_app_installation_id: "789012"
+  # github_app_private_key: |
+  #   -----BEGIN RSA PRIVATE KEY-----
+  #   ...
+  #   -----END RSA PRIVATE KEY-----

infra/arc/controller.yaml

@@ -13,6 +13,12 @@ spec:
     targetRevision: 0.23.3
     helm:
       values: |
+        # Secret naming strategy:
+        # - ARC controller always reads credentials from secret `arc-github-token`.
+        # - `arc-github-token` must contain one of:
+        #   - github_token (PAT), or
+        #   - github_app_id + github_app_installation_id + github_app_private_key.
+        # - Do not rename this secret without updating this Application.
         authSecret:
           enabled: true
           create: false
@@ -27,3 +33,34 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
+  ignoreDifferences:
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      name: horizontalrunnerautoscalers.actions.summerwind.dev
+      jsonPointers:
+        - /spec
+        - /metadata/annotations
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      name: runnerdeployments.actions.summerwind.dev
+      jsonPointers:
+        - /spec
+        - /metadata/annotations
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      name: runnerreplicasets.actions.summerwind.dev
+      jsonPointers:
+        - /spec
+        - /metadata/annotations
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      name: runners.actions.summerwind.dev
+      jsonPointers:
+        - /spec
+        - /metadata/annotations
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+      name: runnersets.actions.summerwind.dev
+      jsonPointers:
+        - /spec
+        - /metadata/annotations

infra/data/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../postgres
+  - ../redis

infra/postgres/statefulset.yaml

@@ -20,6 +20,8 @@ spec:
         app: postgres
         component: database
     spec:
+      nodeSelector:
+        node-role.kubernetes.io/worker: "true"
       containers:
         - name: postgres
           image: postgres:16-alpine

infra/redis/configmap.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: redis-config
+  namespace: infra
+data:
+  redis.conf: |
+    bind 0.0.0.0
+    protected-mode yes
+    port 6379
+    tcp-backlog 511
+    timeout 0
+    tcp-keepalive 300
+
+    maxmemory 2gb
+    maxmemory-policy allkeys-lru
+
+    save 900 1
+    save 300 10
+    save 60 10000
+    stop-writes-on-bgsave-error yes
+    rdbcompression yes
+    rdbchecksum yes
+    dbfilename dump.rdb
+    dir /data
+
+    appendonly yes
+    appendfilename "appendonly.aof"
+    appendfsync everysec
+    no-appendfsync-on-rewrite no
+    auto-aof-rewrite-percentage 100
+    auto-aof-rewrite-min-size 64mb
+
+    loglevel notice
+    logfile ""
+

infra/redis/deployment.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: infra
+  labels:
+    app: redis
+    component: cache
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+        component: cache
+    spec:
+      nodeSelector:
+        node-role.kubernetes.io/worker: "true"
+      containers:
+        - name: redis
+          image: redis:7.2-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - redis-server
+            - /etc/redis/redis.conf
+            - --requirepass
+            - $(REDIS_PASSWORD)
+          ports:
+            - containerPort: 6379
+              name: redis
+              protocol: TCP
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: redis-secret
+                  key: REDIS_PASSWORD
+          livenessProbe:
+            exec:
+              command: ["redis-cli", "-a", "$(REDIS_PASSWORD)", "ping"]
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            exec:
+              command: ["redis-cli", "-a", "$(REDIS_PASSWORD)", "ping"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "256Mi"
+            limits:
+              cpu: "1"
+              memory: "2Gi"
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+            - name: redis-config
+              mountPath: /etc/redis
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: redis-data
+        - name: redis-config
+          configMap:
+            name: redis-config

infra/redis/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: infra
+
+resources:
+  - configmap.yaml
+  - secret.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml

infra/redis/pvc.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-data
+  namespace: infra
+  labels:
+    app: redis
+    component: cache
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: local-path
+

infra/redis/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: redis-secret
+  namespace: infra
+type: Opaque
+stringData:
+  REDIS_PASSWORD: "123456"
+

infra/redis/service.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: infra
+  labels:
+    app: redis
+    component: cache
+spec:
+  type: ClusterIP
+  clusterIP: None
+  selector:
+    app: redis
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: 6379
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-lb
+  namespace: infra
+  labels:
+    app: redis
+    component: cache
+spec:
+  type: ClusterIP
+  selector:
+    app: redis
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: 6379
+      protocol: TCP
+