# AliangBoard 单文件安装 —— kubectl apply -f 即可
# 卸载:kubectl delete ns aliangboard(PVC 与数据随之删除)
apiVersion: v1
kind: Namespace
metadata:
  name: aliangboard
  labels:
    app.kubernetes.io/name: aliangboard
---
# 面板数据库与工作台仓库(API key / 集群凭据 / 审计,均在 /app/data)
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: aliangboard-data
  namespace: aliangboard
  labels:
    app: aliangboard
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 1Gi
  # 不指定 storageClassName → 用集群默认 StorageClass 动态供给;
  # 无动态供给的集群请自行创建 PV 后绑定,或改用自备存储
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: aliangboard
  namespace: aliangboard
  labels:
    app: aliangboard
    app.kubernetes.io/name: aliangboard
spec:
  replicas: 1        # SQLite + RWO 卷,固定单副本,勿扩
  strategy:
    type: Recreate   # 滚动更新会双活抢 RWO 卷,必须重建式更新
  selector:
    matchLabels:
      app: aliangboard
  template:
    metadata:
      labels:
        app: aliangboard
        app.kubernetes.io/name: aliangboard
    spec:
      securityContext:
        runAsNonRoot: true
        fsGroup: 1000          # 镜像 node 用户(uid/gid 1000),PVC 落盘归属
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: aliangboard
          image: ghcr.io/aliang-one/aliangboard:latest
          imagePullPolicy: Always   # latest 语义;要锁版本可换 sha-<7位hash> 不可变标签
          ports:
            - name: http
              containerPort: 8787
          env:
            - name: PORT
              value: "8787"
            # 首装管理员种子:仅首次启动播种(库里有 admin 后改 env 不生效)。
            # 出厂不再带默认口令(2026-08-28 安全审计:admin/admin+登录无限速曾构成完整暴力破解链)。两种安全开法:
            # ① 只设 ADMIN_USERNAME(不设 ADMIN_PASSWORD)→ 平台自动生成强口令,
            #    首启日志 / 数据盘 first-admin-credentials.txt(0600)可查,登录后改密并删文件;
            # ② secret 注入(推荐,口令确定性):
            #    kubectl -n aliangboard create secret generic aliangboard-admin \
            #      --from-literal=ADMIN_USERNAME=admin --from-literal=ADMIN_PASSWORD='<≥8位强口令>'
            #    再把上面 envFrom 替换为:
            #    envFrom: [{ secretRef: { name: aliangboard-admin } }]
            # 注意:显式 ADMIN_PASSWORD 若弱(<8 字符或字面 "admin")会拒绝播种并在日志说明原因。
            # - name: ADMIN_USERNAME
            #   value: "admin"
            # 可选:LLM 接入(也可登录后在管理后台「LLM 配置」里设)
            # - name: LLM_BASE_URL
            #   value: "https://api.deepseek.com/v1"
            # - name: LLM_MODEL
            #   value: "deepseek-chat"
            # 可选:工作台 AI 最大执行步数的「缺省值」(管理后台「AI 行为」面板可覆盖并存库;
            # 0 = 不限制;未设时默认 16)。仅作缺省通道(面板存库值优先;存库值改动即时生效,
            # 而本 env 仅在进程启动时读取,改动须重启网关)。
            # - name: WB_MAX_STEPS
            #   value: "16"
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
            failureThreshold: 6   # 起慢不误杀(1 分钟容忍)
          securityContext:
            allowPrivilegeEscalation: false
            runAsUser: 1000
            capabilities:
              drop: [ALL]
          volumeMounts:
            - name: data
              mountPath: /app/data
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: aliangboard-data
---
apiVersion: v1
kind: Service
metadata:
  name: aliangboard
  namespace: aliangboard
  labels:
    app: aliangboard
spec:
  type: NodePort
  selector:
    app: aliangboard
  ports:
    - name: http
      port: 8787
      targetPort: http
      # NodePort 由集群自动分配(避免撞口);查看:
      # kubectl -n aliangboard get svc aliangboard   →  PORT(S) 列 8787:31xxx/TCP