viktor/infra
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/master'
All checks were successful
ci/woodpecker/push/default Pipeline was successful
Details

Browse source
This commit is contained in:
Viktor Barzin 2026-07-02 05:39:15 +00:00
commit dab307f9f8
2 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

26
stacks/broker-sync/main.tf
View file

@ -87,7 +87,7 @@ resource "kubernetes_persistent_volume_claim" "data_encrypted" {
}
locals {
broker_sync_image = "viktorbarzin/broker-sync:${var.image_tag}"
broker_sync_image = "ghcr.io/viktorbarzin/wealthfolio-sync:${var.image_tag}"
# Shared env block for every CronJob: auth into Wealthfolio + data path.
common_env = [
@ -123,6 +123,9 @@ resource "kubernetes_cron_job_v1" "version_probe" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
container {
name = "broker-sync"
image = local.broker_sync_image
@ -167,6 +170,9 @@ resource "kubernetes_cron_job_v1" "trading212" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -283,6 +289,9 @@ resource "kubernetes_cron_job_v1" "ibkr" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -423,6 +432,9 @@ resource "kubernetes_cron_job_v1" "imap" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -581,6 +593,9 @@ resource "kubernetes_cron_job_v1" "csv_drop" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -679,6 +694,9 @@ resource "kubernetes_cron_job_v1" "fx_reconcile" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -777,6 +795,9 @@ resource "kubernetes_cron_job_v1" "backup" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
@ -886,6 +907,9 @@ resource "kubernetes_cron_job_v1" "fidelity" {
}
spec {
restart_policy = "OnFailure"
image_pull_secrets {
name = "ghcr-credentials"
}
# Pin every job that mounts the shared RWO data volume to one node:
# cross-node scheduling forced a nightly detach/attach cycle whose
# QMP hotplug intermittently ghost-attaches on disk-heavy VMs and

5
stacks/kyverno/modules/kyverno/ghcr-credentials.tf
View file

@ -22,6 +22,11 @@ locals {
"instagram-poster",
"payslip-ingest",
"wealthfolio",
# broker-sync pulls the same PRIVATE ghcr.io/viktorbarzin/wealthfolio-sync
# image; the ADR-0002 migration only allowlisted the wealthfolio namespace,
# so broker-sync silently kept running the frozen pre-migration DockerHub
# image (its CronJobs lacked pull auth for ghcr).
"broker-sync",
"fire-planner",
"recruiter-responder",
# openclaw's install-recruiter-plugin init container pulls the PRIVATE