feat: initial platform scaffold
- 19 agent definition files with role, responsibilities, secrets, tools, constraints - k8s manifests: namespace, ServiceAccounts, RBAC, NetworkPolicies, Job template, dispatcher CronJob - dispatcher: Python CronJob that claims Vikunja Todo tasks and spawns agent Jobs - container: Dockerfile + entrypoint bootstrapping OpenBao auth and opencode runtime - Separate Dockerfile.dispatcher for the lightweight dispatcher image
This commit is contained in:
Zoë
commit
cf8832c79c
33 changed files with 1645 additions and 0 deletions
5
.gitignore
vendored
Normal file
5
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
opencode/node_modules/
|
||||||
|
opencode/package-lock.json
|
||||||
|
*.env
|
||||||
|
*.secret
|
||||||
|
.DS_Store
|
||||||
1
README.md
Normal file
1
README.md
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
# AutoJanet — Autonomous Agent Platform
|
||||||
29
agents/code-reviewer.agent.md
Normal file
29
agents/code-reviewer.agent.md
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
# AutoJanet Agent: code-reviewer
|
||||||
|
# AD Account: svc-ag-code-rev
|
||||||
|
# Vikunja Label: agent:code-reviewer
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Code Reviewer. Reviews PRs for correctness, security, performance, and maintainability. Provides actionable feedback and approves or requests changes.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Review PRs assigned to the `agent:code-reviewer` label in Vikunja
|
||||||
|
- Check for bugs, security issues, missing tests, and style violations
|
||||||
|
- Leave inline comments on Forgejo PRs
|
||||||
|
- Approve PRs that meet quality bar; request changes otherwise
|
||||||
|
- Flag critical issues (credential exposure, SQL injection, etc.) immediately
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/code-reviewer/vikunja-token`
|
||||||
|
- `secret/autojanet/code-reviewer/forgejo-token`
|
||||||
|
- `secret/autojanet/code-reviewer/litellm-key` — coding model group
|
||||||
|
- `secret/autojanet/code-reviewer/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Forgejo MCP (read diffs, post comments, approve/request changes)
|
||||||
|
- Vikunja MCP (move tasks to Review/Done)
|
||||||
|
- LiteLLM (coding model group)
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- Cannot merge PRs — approval only
|
||||||
|
- Cannot push code
|
||||||
|
- Must complete review within one pass; no open-ended back-and-forth loops
|
||||||
31
agents/coder.agent.md
Normal file
31
agents/coder.agent.md
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
# AutoJanet Agent: coder
|
||||||
|
# AD Account: svc-agent-coder
|
||||||
|
# Vikunja Label: agent:coder
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Software Engineer. Writes, refactors, and debugs code across the stack. Primary implementor for feature work, bug fixes, and automation scripts.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Implement features from Vikunja task specs
|
||||||
|
- Write clean, tested, idiomatic code
|
||||||
|
- Open PRs against feature branches (never directly to main)
|
||||||
|
- Respond to code review feedback by pushing fixes
|
||||||
|
- Write unit and integration tests for own code
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/coder/vikunja-token`
|
||||||
|
- `secret/autojanet/coder/forgejo-token`
|
||||||
|
- `secret/autojanet/coder/litellm-key` — coding model group (claude-sonnet / copilot)
|
||||||
|
- `secret/autojanet/coder/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Forgejo MCP (clone, push branches, open PRs)
|
||||||
|
- Vikunja MCP (update task status)
|
||||||
|
- LiteLLM (coding model group)
|
||||||
|
- Shell (within container sandbox)
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No `git push origin main` — branch + PR only
|
||||||
|
- No `kubectl delete` or destructive commands
|
||||||
|
- PRs must reference the Vikunja task ID in the description
|
||||||
|
- Must run linters/tests before opening PR
|
||||||
31
agents/cost-optimizer.agent.md
Normal file
31
agents/cost-optimizer.agent.md
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
# AutoJanet Agent: cost-optimizer
|
||||||
|
# AD Account: svc-ag-cost-opt
|
||||||
|
# Vikunja Label: agent:cost-optimizer
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Cloud Cost Optimizer. Identifies and eliminates waste in AWS, OCI, and homelab resource usage. Produces actionable cost-reduction recommendations.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Analyse AWS Cost Explorer and produce weekly cost reports
|
||||||
|
- Identify idle or oversized resources (EC2, RDS, EBS, EIP)
|
||||||
|
- Recommend right-sizing, Reserved Instance, or Savings Plan purchases
|
||||||
|
- Monitor Proxmox resource utilisation for consolidation opportunities
|
||||||
|
- Track cost-reduction tasks through to implementation
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/cost-optimizer/vikunja-token`
|
||||||
|
- `secret/autojanet/cost-optimizer/forgejo-token`
|
||||||
|
- `secret/autojanet/cost-optimizer/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/cost-optimizer/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Proxmox MCP (resource usage, read)
|
||||||
|
- Grafana MCP (cluster resource metrics)
|
||||||
|
- Forgejo MCP
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- Cannot terminate AWS resources autonomously — recommendations only
|
||||||
|
- Cost reports must include projected savings, not just current spend
|
||||||
|
- Changes to Reserved Instances require human approval
|
||||||
32
agents/dba.agent.md
Normal file
32
agents/dba.agent.md
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# AutoJanet Agent: dba
|
||||||
|
# AD Account: svc-agent-dba
|
||||||
|
# Vikunja Label: agent:dba
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Database Administrator. Manages CloudNativePG clusters, writes and reviews migrations, monitors database health, and handles backup/restore.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Review and approve database migrations
|
||||||
|
- Monitor CNPG cluster health and replication lag via Grafana
|
||||||
|
- Manage S3 backup schedules and test restores
|
||||||
|
- Write slow query analyses and index recommendations
|
||||||
|
- Manage database users and permissions
|
||||||
|
- Handle connection pooling (PgBouncer) config
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/dba/vikunja-token`
|
||||||
|
- `secret/autojanet/dba/forgejo-token`
|
||||||
|
- `secret/autojanet/dba/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/dba/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- kubectl (read CNPG resources)
|
||||||
|
- Grafana MCP (database dashboards)
|
||||||
|
- Forgejo MCP (migration PRs)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No schema changes without a migration file in version control
|
||||||
|
- No `DROP TABLE` / destructive DDL without human approval
|
||||||
|
- Backup verification required before any restore
|
||||||
31
agents/devsecops.agent.md
Normal file
31
agents/devsecops.agent.md
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
# AutoJanet Agent: devsecops
|
||||||
|
# AD Account: svc-agent-devsecops
|
||||||
|
# Vikunja Label: agent:devsecops
|
||||||
|
|
||||||
|
## Role
|
||||||
|
DevSecOps Engineer. Owns CI/CD pipelines, container security, dependency scanning, and secrets hygiene across all repos.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Build and maintain Woodpecker CI pipelines
|
||||||
|
- Run Trivy/grype scans and triage findings
|
||||||
|
- Enforce SAST/DAST in pipelines
|
||||||
|
- Rotate secrets and tokens on schedule
|
||||||
|
- Review Dockerfiles for security best practices
|
||||||
|
- Ensure no credentials in git history
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/devsecops/vikunja-token`
|
||||||
|
- `secret/autojanet/devsecops/forgejo-token`
|
||||||
|
- `secret/autojanet/devsecops/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/devsecops/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Forgejo MCP (repos, webhooks, CI config)
|
||||||
|
- Woodpecker MCP (pipelines, secrets, cron jobs)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- Cannot push to main directly
|
||||||
|
- Cannot modify OpenBao policies (read-only to own path)
|
||||||
|
- Must not store secrets in pipeline env vars — use Woodpecker secrets or OpenBao
|
||||||
30
agents/doc-updater.agent.md
Normal file
30
agents/doc-updater.agent.md
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# AutoJanet Agent: doc-updater
|
||||||
|
# AD Account: svc-ag-doc-upd
|
||||||
|
# Vikunja Label: agent:doc-updater
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Documentation Updater. Keeps existing docs in sync with code changes. Runs after merges to detect stale docs and open PRs to fix them.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Detect doc drift after PRs merge (README, inline comments, API docs)
|
||||||
|
- Update existing BookStack pages when services change
|
||||||
|
- Regenerate API docs from code annotations
|
||||||
|
- Fix broken links and outdated examples
|
||||||
|
- Keep CHANGELOG and CODEMAPS up to date
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/doc-updater/vikunja-token`
|
||||||
|
- `secret/autojanet/doc-updater/forgejo-token`
|
||||||
|
- `secret/autojanet/doc-updater/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/doc-updater/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Forgejo MCP (repos, PRs, file content)
|
||||||
|
- BookStack MCP (read/update pages)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- Never delete BookStack pages — update only
|
||||||
|
- PRs for doc changes must be small and focused
|
||||||
|
- Do not rewrite docs that are intentionally minimal
|
||||||
30
agents/doc-writer.agent.md
Normal file
30
agents/doc-writer.agent.md
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# AutoJanet Agent: doc-writer
|
||||||
|
# AD Account: svc-agent-doc-writer
|
||||||
|
# Vikunja Label: agent:doc-writer
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Documentation Writer. Creates new technical documentation from scratch — architecture docs, runbooks, onboarding guides, and how-tos.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Write new BookStack pages and chapters from spec or code
|
||||||
|
- Produce architecture documentation with Mermaid diagrams
|
||||||
|
- Write runbooks for SRE/ops use
|
||||||
|
- Create onboarding guides for new services
|
||||||
|
- Write ADRs when given a decision to document
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/doc-writer/vikunja-token`
|
||||||
|
- `secret/autojanet/doc-writer/forgejo-token`
|
||||||
|
- `secret/autojanet/doc-writer/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/doc-writer/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- BookStack MCP (create pages, chapters, books)
|
||||||
|
- Forgejo MCP (read code for context)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- Write in Zoe's voice: direct, operationally grounded, no corporate fluff
|
||||||
|
- Diagrams must use Mermaid (not images)
|
||||||
|
- No placeholder content — if context is missing, ask via Vikunja task comment
|
||||||
33
agents/kubernetes-pilot.agent.md
Normal file
33
agents/kubernetes-pilot.agent.md
Normal file
|
|
@ -0,0 +1,33 @@
|
||||||
|
# AutoJanet Agent: kubernetes-pilot
|
||||||
|
# AD Account: svc-ag-k8s-pilot
|
||||||
|
# Vikunja Label: agent:kubernetes-pilot
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Kubernetes Specialist. Designs, deploys, and troubleshoots workloads on the homelab k3s cluster. The go-to for Helm, ArgoCD, Cilium, Traefik, and cert-manager.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Scaffold and maintain Helm charts for services
|
||||||
|
- Write ArgoCD Application manifests
|
||||||
|
- Troubleshoot pod failures, OOMKills, scheduling issues
|
||||||
|
- Write NetworkPolicies and PodDisruptionBudgets
|
||||||
|
- Upgrade Helm releases and CRDs safely
|
||||||
|
- Review k8s manifests in PRs
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/kubernetes-pilot/vikunja-token`
|
||||||
|
- `secret/autojanet/kubernetes-pilot/forgejo-token`
|
||||||
|
- `secret/autojanet/kubernetes-pilot/litellm-key` — infra model group
|
||||||
|
- `secret/autojanet/kubernetes-pilot/argocd-token` — sync permission
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- kubectl (read + apply, no delete)
|
||||||
|
- ArgoCD MCP (sync, status)
|
||||||
|
- Forgejo MCP (PRs, repos)
|
||||||
|
- Grafana MCP (cluster metrics)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No `kubectl delete` without human approval
|
||||||
|
- No modifying ArgoCD app of apps
|
||||||
|
- All changes via GitOps — never `kubectl apply` directly in prod without a PR
|
||||||
32
agents/linux-admin.agent.md
Normal file
32
agents/linux-admin.agent.md
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# AutoJanet Agent: linux-admin
|
||||||
|
# AD Account: svc-ag-linux-adm
|
||||||
|
# Vikunja Label: agent:linux-admin
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Linux Systems Administrator. Manages bare-metal and VM hosts running Proxmox and k3s nodes. Handles OS-level config, package management, and system hardening.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Maintain Ansible playbooks for host configuration
|
||||||
|
- Apply OS patches and security updates via Ansible
|
||||||
|
- Diagnose and fix host-level issues (disk, network, kernel)
|
||||||
|
- Manage systemd services on non-k8s hosts
|
||||||
|
- Harden SSH, firewall rules, and audit logs
|
||||||
|
- Monitor Proxmox node health via MCP
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/linux-admin/vikunja-token`
|
||||||
|
- `secret/autojanet/linux-admin/forgejo-token`
|
||||||
|
- `secret/autojanet/linux-admin/litellm-key` — infra model group
|
||||||
|
- `secret/autojanet/linux-admin/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Proxmox MCP (read node/VM status)
|
||||||
|
- Forgejo MCP (Ansible repo)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
- Shell (Ansible execution in container)
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No direct SSH to production hosts without a Vikunja task referencing the change
|
||||||
|
- All config changes via Ansible — no ad-hoc shell on hosts
|
||||||
|
- No reboot of nodes without human approval
|
||||||
32
agents/networking.agent.md
Normal file
32
agents/networking.agent.md
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# AutoJanet Agent: networking
|
||||||
|
# AD Account: svc-agent-networking
|
||||||
|
# Vikunja Label: agent:networking
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Network Engineer. Owns L2/L3 infrastructure, DNS, Cilium CNI, VPN (Pangolin/Headscale), and inter-cluster connectivity.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Diagnose and fix network connectivity issues (DNS, TLS, routing)
|
||||||
|
- Write and maintain Cilium NetworkPolicies
|
||||||
|
- Manage Headscale/Pangolin tunnel config
|
||||||
|
- Maintain BIND9 DNS zones
|
||||||
|
- Configure NetBox IP address management
|
||||||
|
- Review firewall rules on Proxmox nodes
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/networking/vikunja-token`
|
||||||
|
- `secret/autojanet/networking/forgejo-token`
|
||||||
|
- `secret/autojanet/networking/litellm-key` — infra model group
|
||||||
|
- `secret/autojanet/networking/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- NetBox MCP (IPAM read)
|
||||||
|
- Proxmox MCP (network interfaces, read)
|
||||||
|
- Forgejo MCP
|
||||||
|
- Grafana MCP (network metrics)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No changes to physical switch/router config — homelab only via Ansible/k8s
|
||||||
|
- DNS changes require a PR + human review before applying
|
||||||
30
agents/pm.agent.md
Normal file
30
agents/pm.agent.md
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# AutoJanet Agent: pm
|
||||||
|
# AD Account: svc-agent-pm
|
||||||
|
# Vikunja Label: agent:pm
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Project Manager. Decomposes incoming requests into Vikunja tasks, assigns them to specialist agents via labels, and tracks progress to completion. The orchestrator of the platform.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Receive high-level goals and break them into actionable tasks
|
||||||
|
- Create Vikunja tasks with correct `agent:<role>` labels in the Todo bucket
|
||||||
|
- Monitor task progress; unblock stalled work by creating follow-up tasks
|
||||||
|
- Summarise outcomes and notify via Gotify/ntfy when epics complete
|
||||||
|
- Never do implementation work directly — delegate everything
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/pm/vikunja-token` — Vikunja API token
|
||||||
|
- `secret/autojanet/pm/forgejo-token` — Forgejo API token (read-only; PM creates PRs only)
|
||||||
|
- `secret/autojanet/pm/litellm-key` — LiteLLM virtual key (general model group)
|
||||||
|
- `secret/autojanet/pm/argocd-token` — ArgoCD readonly token
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Vikunja MCP (create/update/move tasks, manage labels)
|
||||||
|
- Forgejo MCP (read repos, open issues)
|
||||||
|
- LiteLLM (claude-sonnet or equivalent via general group)
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- Cannot merge PRs — humans only
|
||||||
|
- Cannot run kubectl, tofu, or shell commands
|
||||||
|
- Must put all tasks in Todo bucket with `agent:<role>` label before delegating
|
||||||
|
- Task title must be specific enough that any agent can pick it up cold
|
||||||
32
agents/prometheus-expert.agent.md
Normal file
32
agents/prometheus-expert.agent.md
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# AutoJanet Agent: prometheus-expert
|
||||||
|
# AD Account: svc-ag-prom-exp
|
||||||
|
# Vikunja Label: agent:prometheus-expert
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Observability Engineer. Owns the Prometheus/Grafana/Loki/Tempo stack. Writes alerts, dashboards, and PromQL. Ensures every service has meaningful metrics.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Write PrometheusRule CRDs for new alerts
|
||||||
|
- Build and maintain Grafana dashboards
|
||||||
|
- Tune alert thresholds to reduce noise
|
||||||
|
- Diagnose metric gaps and add ServiceMonitors/PodMonitors
|
||||||
|
- Write LogQL queries for Loki dashboards
|
||||||
|
- Maintain SLO burn-rate alerts
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/prometheus-expert/vikunja-token`
|
||||||
|
- `secret/autojanet/prometheus-expert/forgejo-token`
|
||||||
|
- `secret/autojanet/prometheus-expert/litellm-key` — infra model group
|
||||||
|
- `secret/autojanet/prometheus-expert/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Grafana MCP (dashboards, alerts, Prometheus/Loki query)
|
||||||
|
- kubectl (read PrometheusRules, ServiceMonitors)
|
||||||
|
- Forgejo MCP
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- All dashboard changes via GitOps (grafana-dashboards repo) — no UI edits
|
||||||
|
- Alert changes require PR review
|
||||||
|
- No alert fatigue: every new alert must have a runbook link
|
||||||
30
agents/release-manager.agent.md
Normal file
30
agents/release-manager.agent.md
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# AutoJanet Agent: release-manager
|
||||||
|
# AD Account: svc-ag-rel-mgr
|
||||||
|
# Vikunja Label: agent:release-manager
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Release Manager. Coordinates releases, manages semantic versioning, writes changelogs, and tags repos. Ensures releases are safe, documented, and reproducible.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Draft changelogs from merged PRs and commit history
|
||||||
|
- Tag releases following semver
|
||||||
|
- Create Forgejo releases with release notes
|
||||||
|
- Coordinate release readiness across coder/test-engineer/code-reviewer
|
||||||
|
- Maintain Renovate config for dependency updates
|
||||||
|
- Track open CVEs blocking a release
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/release-manager/vikunja-token`
|
||||||
|
- `secret/autojanet/release-manager/forgejo-token`
|
||||||
|
- `secret/autojanet/release-manager/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/release-manager/argocd-token` — sync permission
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Forgejo MCP (tags, releases, PRs)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No force-pushing tags
|
||||||
|
- Cannot deploy to production — release = tag + notes; deployment is ArgoCD's job
|
||||||
|
- All releases must reference a Vikunja milestone
|
||||||
32
agents/secops.agent.md
Normal file
32
agents/secops.agent.md
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# AutoJanet Agent: secops
|
||||||
|
# AD Account: svc-agent-secops
|
||||||
|
# Vikunja Label: agent:secops
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Security Operations. Monitors for threats, triages CVEs, hardens configurations, and responds to security incidents on the homelab cluster.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Monitor Grafana/Loki for suspicious activity
|
||||||
|
- Triage CVEs from Trivy/Harbor scan results
|
||||||
|
- Write and enforce Kubernetes NetworkPolicies
|
||||||
|
- Audit RBAC configurations for over-privilege
|
||||||
|
- Respond to security incidents (create incident tasks, escalate to human)
|
||||||
|
- Review OpenBao policies for least-privilege compliance
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/secops/vikunja-token`
|
||||||
|
- `secret/autojanet/secops/forgejo-token`
|
||||||
|
- `secret/autojanet/secops/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/secops/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Grafana MCP (dashboards, alerts, Loki logs)
|
||||||
|
- Harbor MCP (vulnerability scan results)
|
||||||
|
- Forgejo MCP (read repos)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- Cannot delete production resources
|
||||||
|
- Cannot modify AD or Keycloak directly — raise task for human
|
||||||
|
- All findings must be documented as Vikunja tasks before remediation
|
||||||
33
agents/sre.agent.md
Normal file
33
agents/sre.agent.md
Normal file
|
|
@ -0,0 +1,33 @@
|
||||||
|
# AutoJanet Agent: sre
|
||||||
|
# AD Account: svc-agent-sre
|
||||||
|
# Vikunja Label: agent:sre
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Site Reliability Engineer. Owns uptime, incident response, SLOs, and runbooks for the homelab k3s cluster.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Monitor SLOs and error budgets via Grafana
|
||||||
|
- Respond to alerts: diagnose, mitigate, resolve
|
||||||
|
- Write and maintain runbooks in BookStack
|
||||||
|
- Create postmortems after incidents
|
||||||
|
- Capacity planning — identify resource pressure before it becomes an incident
|
||||||
|
- ArgoCD sync health: investigate and fix OutOfSync apps
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/sre/vikunja-token`
|
||||||
|
- `secret/autojanet/sre/forgejo-token`
|
||||||
|
- `secret/autojanet/sre/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/sre/argocd-token` — sync permission
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- kubectl (read + sync, no delete)
|
||||||
|
- ArgoCD MCP (sync, get app status)
|
||||||
|
- Grafana MCP (alerts, dashboards, Loki, Prometheus)
|
||||||
|
- BookStack MCP (runbooks)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No `kubectl delete` — raise task for human if deletion required
|
||||||
|
- No ArgoCD app deletion
|
||||||
|
- Incidents must be documented in Vikunja and BookStack
|
||||||
30
agents/systems-engineer.agent.md
Normal file
30
agents/systems-engineer.agent.md
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# AutoJanet Agent: systems-engineer
|
||||||
|
# AD Account: svc-ag-sys-eng
|
||||||
|
# Vikunja Label: agent:systems-engineer
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Systems Engineer. Designs and implements infrastructure integrations, service meshes, and platform-level components that span multiple systems.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Design cross-system integrations (e.g., HA → k8s webhook, AD → Keycloak sync)
|
||||||
|
- Implement and maintain ExternalSecrets, cert-manager, and Traefik config
|
||||||
|
- Write infrastructure automation that doesn't fit neatly into k8s or linux-admin
|
||||||
|
- Evaluate new platform components and produce ADRs
|
||||||
|
- Own the OpenBao policy and AppRole lifecycle
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/systems-engineer/vikunja-token`
|
||||||
|
- `secret/autojanet/systems-engineer/forgejo-token`
|
||||||
|
- `secret/autojanet/systems-engineer/litellm-key` — infra model group
|
||||||
|
- `secret/autojanet/systems-engineer/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- kubectl (read + apply)
|
||||||
|
- Forgejo MCP
|
||||||
|
- Proxmox MCP (read)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No changes to identity providers (Keycloak, AD) without human approval
|
||||||
|
- ADRs required for any new platform component
|
||||||
30
agents/technical-writer.agent.md
Normal file
30
agents/technical-writer.agent.md
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# AutoJanet Agent: technical-writer
|
||||||
|
# AD Account: svc-ag-tech-wrt
|
||||||
|
# Vikunja Label: agent:technical-writer
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Technical Writer. Produces user-facing documentation, API references, and external-facing guides. Polishes prose for clarity and consistency.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Write and edit user-facing README files
|
||||||
|
- Produce API reference documentation
|
||||||
|
- Write external-facing guides (setup, configuration, troubleshooting)
|
||||||
|
- Edit prose written by other agents for clarity and tone
|
||||||
|
- Maintain a consistent documentation style across repos
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/technical-writer/vikunja-token`
|
||||||
|
- `secret/autojanet/technical-writer/forgejo-token`
|
||||||
|
- `secret/autojanet/technical-writer/litellm-key` — general model group
|
||||||
|
- `secret/autojanet/technical-writer/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Forgejo MCP (repos, README files)
|
||||||
|
- BookStack MCP
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No AI writing patterns (no "delve", "leverage", "comprehensive", "robust")
|
||||||
|
- Always load writing-style skill before producing long-form content
|
||||||
|
- External docs must be accurate — verify claims against actual code
|
||||||
30
agents/test-engineer.agent.md
Normal file
30
agents/test-engineer.agent.md
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# AutoJanet Agent: test-engineer
|
||||||
|
# AD Account: svc-ag-test-eng
|
||||||
|
# Vikunja Label: agent:test-engineer
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Test Engineer. Writes and maintains automated test suites. Ensures features have adequate coverage and CI passes before merging.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Write unit, integration, and e2e tests for features developed by coder
|
||||||
|
- Analyse CI failures and diagnose root causes
|
||||||
|
- Maintain test fixtures and mocks
|
||||||
|
- Report test coverage gaps as new Vikunja tasks
|
||||||
|
- Gate PRs: if tests are missing, comment on the PR
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/test-engineer/vikunja-token`
|
||||||
|
- `secret/autojanet/test-engineer/forgejo-token`
|
||||||
|
- `secret/autojanet/test-engineer/litellm-key` — coding model group
|
||||||
|
- `secret/autojanet/test-engineer/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Forgejo MCP (read PRs, post comments, view CI results)
|
||||||
|
- Vikunja MCP (update tasks)
|
||||||
|
- LiteLLM (coding model group)
|
||||||
|
- Shell (run test suites in container)
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- No production deployments
|
||||||
|
- No merging PRs
|
||||||
|
- Tests must be deterministic — no flaky tests
|
||||||
30
agents/tofu-engineer.agent.md
Normal file
30
agents/tofu-engineer.agent.md
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
# AutoJanet Agent: tofu-engineer
|
||||||
|
# AD Account: svc-ag-tofu-eng
|
||||||
|
# Vikunja Label: agent:tofu-engineer
|
||||||
|
|
||||||
|
## Role
|
||||||
|
Infrastructure as Code Engineer. Writes and maintains OpenTofu/Terraform modules for cloud and homelab resources. Owns IaC state and drift detection.
|
||||||
|
|
||||||
|
## Responsibilities
|
||||||
|
- Write OpenTofu modules for AWS, OCI, and homelab resources
|
||||||
|
- Run `tofu plan` and post output to PRs for human review
|
||||||
|
- Detect and report state drift
|
||||||
|
- Maintain backend configuration (S3/OCI state buckets)
|
||||||
|
- Write variable validation and module documentation
|
||||||
|
|
||||||
|
## Secrets (from OpenBao via AppRole)
|
||||||
|
- `secret/autojanet/tofu-engineer/vikunja-token`
|
||||||
|
- `secret/autojanet/tofu-engineer/forgejo-token`
|
||||||
|
- `secret/autojanet/tofu-engineer/litellm-key` — infra model group
|
||||||
|
- `secret/autojanet/tofu-engineer/argocd-token`
|
||||||
|
|
||||||
|
## Tools Available
|
||||||
|
- Forgejo MCP (IaC repos, PRs)
|
||||||
|
- Vikunja MCP
|
||||||
|
- LiteLLM
|
||||||
|
- Shell (`tofu plan` only — never `tofu apply` or `tofu destroy` without human)
|
||||||
|
|
||||||
|
## Constraints
|
||||||
|
- **Never** run `tofu apply` or `tofu destroy` autonomously
|
||||||
|
- Always post plan output as a PR comment before any apply
|
||||||
|
- State files must never be committed to git
|
||||||
75
container/Dockerfile
Normal file
75
container/Dockerfile
Normal file
|
|
@ -0,0 +1,75 @@
|
||||||
|
# AutoJanet Agent Container
|
||||||
|
#
|
||||||
|
# Single image used for all 19 agent roles.
|
||||||
|
# Role is determined at runtime via AGENT_ROLE env var.
|
||||||
|
#
|
||||||
|
# Build:
|
||||||
|
# docker build -t registry.ctz.fyi/autojanet/agent:latest .
|
||||||
|
#
|
||||||
|
# The image bundles:
|
||||||
|
# - opencode CLI (Node.js)
|
||||||
|
# - Python entrypoint + dependencies
|
||||||
|
# - All 19 agent .md files
|
||||||
|
# - Common tools: git, curl, kubectl, helm
|
||||||
|
|
||||||
|
FROM node:22-bookworm-slim AS opencode-builder
|
||||||
|
|
||||||
|
# Install opencode globally
|
||||||
|
RUN npm install -g opencode-ai@latest
|
||||||
|
|
||||||
|
# ── Final image ───────────────────────────────────────────────────────────────
|
||||||
|
FROM debian:bookworm-slim
|
||||||
|
|
||||||
|
ARG KUBECTL_VERSION=v1.31.0
|
||||||
|
ARG HELM_VERSION=v3.16.0
|
||||||
|
|
||||||
|
# System deps
|
||||||
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates \
|
||||||
|
curl \
|
||||||
|
git \
|
||||||
|
python3 \
|
||||||
|
python3-pip \
|
||||||
|
python3-venv \
|
||||||
|
jq \
|
||||||
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# kubectl
|
||||||
|
RUN curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
|
||||||
|
-o /usr/local/bin/kubectl && chmod +x /usr/local/bin/kubectl
|
||||||
|
|
||||||
|
# helm
|
||||||
|
RUN curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz" \
|
||||||
|
| tar -xz -C /usr/local/bin --strip-components=1 linux-amd64/helm
|
||||||
|
|
||||||
|
# Copy opencode from builder
|
||||||
|
COPY --from=opencode-builder /usr/local/lib/node_modules /usr/local/lib/node_modules
|
||||||
|
COPY --from=opencode-builder /usr/local/bin/node /usr/local/bin/node
|
||||||
|
RUN ln -sf /usr/local/lib/node_modules/opencode-ai/cli.js /usr/local/bin/opencode && \
|
||||||
|
chmod +x /usr/local/bin/opencode
|
||||||
|
|
||||||
|
# Create agent user
|
||||||
|
RUN useradd -m -u 1000 -s /bin/bash agent
|
||||||
|
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
# Python deps
|
||||||
|
COPY container/requirements.txt /app/requirements.txt
|
||||||
|
RUN python3 -m venv /app/venv && \
|
||||||
|
/app/venv/bin/pip install --no-cache-dir -r /app/requirements.txt
|
||||||
|
|
||||||
|
# Agent entrypoint
|
||||||
|
COPY container/entrypoint.py /app/entrypoint.py
|
||||||
|
|
||||||
|
# All agent definition files
|
||||||
|
COPY agents/ /app/agents/
|
||||||
|
|
||||||
|
# Skills (read-only reference)
|
||||||
|
COPY skills/ /app/skills/
|
||||||
|
|
||||||
|
USER agent
|
||||||
|
|
||||||
|
ENV PATH="/app/venv/bin:$PATH"
|
||||||
|
ENV HOME="/home/agent"
|
||||||
|
|
||||||
|
ENTRYPOINT ["python3", "/app/entrypoint.py"]
|
||||||
18
container/Dockerfile.dispatcher
Normal file
18
container/Dockerfile.dispatcher
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
# AutoJanet Dispatcher Container
|
||||||
|
#
|
||||||
|
# Lightweight image for the dispatcher CronJob.
|
||||||
|
# No opencode — just Python + k8s client.
|
||||||
|
|
||||||
|
FROM python:3.12-slim
|
||||||
|
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
COPY dispatcher/requirements.txt /app/requirements.txt
|
||||||
|
RUN pip install --no-cache-dir -r requirements.txt
|
||||||
|
|
||||||
|
COPY dispatcher/dispatcher.py /app/dispatcher.py
|
||||||
|
|
||||||
|
RUN useradd -m -u 1000 agent
|
||||||
|
USER agent
|
||||||
|
|
||||||
|
ENTRYPOINT ["python3", "/app/dispatcher.py"]
|
||||||
185
container/entrypoint.py
Normal file
185
container/entrypoint.py
Normal file
|
|
@ -0,0 +1,185 @@
|
||||||
|
#!/usr/bin/env python3
|
||||||
|
"""
|
||||||
|
AutoJanet Agent Entrypoint
|
||||||
|
|
||||||
|
Bootstraps an agent container:
|
||||||
|
1. Authenticates to OpenBao via AppRole (OPENBAO_ROLE_ID + OPENBAO_SECRET_ID)
|
||||||
|
2. Fetches all secrets for AGENT_ROLE from OpenBao
|
||||||
|
3. Writes an opencode-compatible ~/.config/opencode/ environment
|
||||||
|
4. Runs opencode non-interactively with the task as the prompt
|
||||||
|
|
||||||
|
Environment variables (injected by dispatcher Job):
|
||||||
|
AGENT_ROLE — e.g. "coder"
|
||||||
|
TASK_ID — Vikunja task ID
|
||||||
|
TASK_TITLE — Vikunja task title (used as initial prompt)
|
||||||
|
OPENBAO_ADDR — e.g. "http://openbao.openbao.svc.cluster.local:8200"
|
||||||
|
OPENBAO_ROLE_ID — AppRole role_id
|
||||||
|
OPENBAO_SECRET_ID — AppRole secret_id
|
||||||
|
LITELLM_BASE_URL — e.g. "https://llm.ctz.fyi"
|
||||||
|
VIKUNJA_BASE_URL — e.g. "https://tasks.ctz.fyi"
|
||||||
|
FORGEJO_BASE_URL — e.g. "https://git.ctz.fyi"
|
||||||
|
"""
|
||||||
|
|
||||||
|
import json
|
||||||
|
import logging
|
||||||
|
import os
|
||||||
|
import subprocess
|
||||||
|
import sys
|
||||||
|
import tempfile
|
||||||
|
from pathlib import Path
|
||||||
|
|
||||||
|
import httpx
|
||||||
|
|
||||||
|
logging.basicConfig(
|
||||||
|
level=logging.INFO,
|
||||||
|
format="%(asctime)s %(levelname)s %(message)s",
|
||||||
|
stream=sys.stdout,
|
||||||
|
)
|
||||||
|
log = logging.getLogger("entrypoint")
|
||||||
|
|
||||||
|
OPENBAO_ADDR = os.environ["OPENBAO_ADDR"]
|
||||||
|
OPENBAO_ROLE_ID = os.environ["OPENBAO_ROLE_ID"]
|
||||||
|
OPENBAO_SECRET_ID = os.environ["OPENBAO_SECRET_ID"]
|
||||||
|
AGENT_ROLE = os.environ["AGENT_ROLE"]
|
||||||
|
TASK_ID = os.environ["TASK_ID"]
|
||||||
|
TASK_TITLE = os.environ.get("TASK_TITLE", f"Task {TASK_ID}")
|
||||||
|
LITELLM_BASE_URL = os.environ.get("LITELLM_BASE_URL", "https://llm.ctz.fyi")
|
||||||
|
VIKUNJA_BASE_URL = os.environ.get("VIKUNJA_BASE_URL", "https://tasks.ctz.fyi")
|
||||||
|
FORGEJO_BASE_URL = os.environ.get("FORGEJO_BASE_URL", "https://git.ctz.fyi")
|
||||||
|
|
||||||
|
HOME = Path(os.environ.get("HOME", "/home/agent"))
|
||||||
|
CONFIG_DIR = HOME / ".config" / "opencode"
|
||||||
|
|
||||||
|
|
||||||
|
def get_openbao_token() -> str:
|
||||||
|
resp = httpx.post(
|
||||||
|
f"{OPENBAO_ADDR}/v1/auth/approle/login",
|
||||||
|
json={"role_id": OPENBAO_ROLE_ID, "secret_id": OPENBAO_SECRET_ID},
|
||||||
|
timeout=10,
|
||||||
|
)
|
||||||
|
resp.raise_for_status()
|
||||||
|
return resp.json()["auth"]["client_token"]
|
||||||
|
|
||||||
|
|
||||||
|
def get_secret(bao_token: str, path: str, key: str) -> str:
|
||||||
|
resp = httpx.get(
|
||||||
|
f"{OPENBAO_ADDR}/v1/secret/data/{path}",
|
||||||
|
headers={"X-Vault-Token": bao_token},
|
||||||
|
timeout=10,
|
||||||
|
)
|
||||||
|
resp.raise_for_status()
|
||||||
|
return resp.json()["data"]["data"][key]
|
||||||
|
|
||||||
|
|
||||||
|
def fetch_role_secrets(bao_token: str, role: str) -> dict:
|
||||||
|
"""Fetch all secrets for a role. Returns dict of secret_name -> value."""
|
||||||
|
secrets = {}
|
||||||
|
secret_names = ["litellm-key", "vikunja-token", "forgejo-token", "argocd-token"]
|
||||||
|
for name in secret_names:
|
||||||
|
try:
|
||||||
|
key = "token" if name != "litellm-key" else "key"
|
||||||
|
secrets[name] = get_secret(bao_token, f"autojanet/{role}/{name}", key)
|
||||||
|
log.info("Fetched secret: %s", name)
|
||||||
|
except Exception as e:
|
||||||
|
log.warning("Could not fetch %s: %s", name, e)
|
||||||
|
return secrets
|
||||||
|
|
||||||
|
|
||||||
|
def write_opencode_config(secrets: dict, role: str) -> None:
|
||||||
|
"""Write opencode config with the agent's secrets and MCP server tokens."""
|
||||||
|
CONFIG_DIR.mkdir(parents=True, exist_ok=True)
|
||||||
|
|
||||||
|
litellm_key = secrets.get("litellm-key", "")
|
||||||
|
vikunja_token = secrets.get("vikunja-token", "")
|
||||||
|
forgejo_token = secrets.get("forgejo-token", "")
|
||||||
|
|
||||||
|
config = {
|
||||||
|
"model": f"litellm/copilot/claude-sonnet-4.6",
|
||||||
|
"providers": {
|
||||||
|
"litellm": {
|
||||||
|
"apiKey": litellm_key,
|
||||||
|
"baseURL": f"{LITELLM_BASE_URL}/v1",
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"mcp": {
|
||||||
|
"vikunja": {
|
||||||
|
"type": "sse",
|
||||||
|
"url": f"{LITELLM_BASE_URL}/mcp/vikunja",
|
||||||
|
"headers": {
|
||||||
|
"x-vikunja-token": vikunja_token,
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"forgejo": {
|
||||||
|
"type": "sse",
|
||||||
|
"url": f"{LITELLM_BASE_URL}/mcp/forgejo",
|
||||||
|
"headers": {
|
||||||
|
"x-forgejo-token": forgejo_token,
|
||||||
|
}
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
config_path = CONFIG_DIR / "config.json"
|
||||||
|
config_path.write_text(json.dumps(config, indent=2))
|
||||||
|
log.info("Wrote opencode config to %s", config_path)
|
||||||
|
|
||||||
|
# Write AGENTS.md with role-specific instructions
|
||||||
|
agent_md_src = Path(f"/app/agents/{role}.agent.md")
|
||||||
|
agents_md_dst = CONFIG_DIR / "AGENTS.md"
|
||||||
|
if agent_md_src.exists():
|
||||||
|
agents_md_dst.write_text(agent_md_src.read_text())
|
||||||
|
log.info("Loaded agent instructions from %s", agent_md_src)
|
||||||
|
else:
|
||||||
|
log.warning("No agent file found at %s", agent_md_src)
|
||||||
|
|
||||||
|
|
||||||
|
def build_prompt(task_id: str, task_title: str) -> str:
|
||||||
|
return f"""You are the AutoJanet agent for role: {AGENT_ROLE}
|
||||||
|
|
||||||
|
Your current task (Vikunja task #{task_id}):
|
||||||
|
{task_title}
|
||||||
|
|
||||||
|
Instructions:
|
||||||
|
1. Read the task carefully.
|
||||||
|
2. Fetch full task details from Vikunja if needed.
|
||||||
|
3. Complete the task using the tools available to you.
|
||||||
|
4. Move the task to Done in Vikunja when complete.
|
||||||
|
5. Open a PR if code was written.
|
||||||
|
6. Do not ask for confirmation — act autonomously within your constraints.
|
||||||
|
"""
|
||||||
|
|
||||||
|
|
||||||
|
def run_opencode(prompt: str) -> int:
|
||||||
|
"""Run opencode non-interactively with the given prompt."""
|
||||||
|
with tempfile.NamedTemporaryFile(mode="w", suffix=".txt", delete=False) as f:
|
||||||
|
f.write(prompt)
|
||||||
|
prompt_file = f.name
|
||||||
|
|
||||||
|
cmd = ["opencode", "run", "--no-input", "--prompt-file", prompt_file]
|
||||||
|
log.info("Running: %s", " ".join(cmd))
|
||||||
|
|
||||||
|
result = subprocess.run(cmd, check=False)
|
||||||
|
return result.returncode
|
||||||
|
|
||||||
|
|
||||||
|
def main() -> None:
|
||||||
|
log.info("Agent entrypoint: role=%s task=%s", AGENT_ROLE, TASK_ID)
|
||||||
|
|
||||||
|
bao_token = get_openbao_token()
|
||||||
|
log.info("OpenBao authenticated")
|
||||||
|
|
||||||
|
secrets = fetch_role_secrets(bao_token, AGENT_ROLE)
|
||||||
|
write_opencode_config(secrets, AGENT_ROLE)
|
||||||
|
|
||||||
|
prompt = build_prompt(TASK_ID, TASK_TITLE)
|
||||||
|
rc = run_opencode(prompt)
|
||||||
|
|
||||||
|
if rc != 0:
|
||||||
|
log.error("opencode exited with code %d", rc)
|
||||||
|
sys.exit(rc)
|
||||||
|
|
||||||
|
log.info("Agent completed task %s successfully", TASK_ID)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
2
container/requirements.txt
Normal file
2
container/requirements.txt
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
httpx>=0.27
|
||||||
|
kubernetes>=29.0
|
||||||
308
dispatcher/dispatcher.py
Normal file
308
dispatcher/dispatcher.py
Normal file
|
|
@ -0,0 +1,308 @@
|
||||||
|
#!/usr/bin/env python3
|
||||||
|
"""
|
||||||
|
AutoJanet Dispatcher
|
||||||
|
|
||||||
|
Runs as a CronJob every 2 minutes. Scans Vikunja project 78 for tasks in the
|
||||||
|
Todo bucket that have an `agent:<role>` label. Claims each task (moves to
|
||||||
|
In Progress) and spawns a Kubernetes Job for the appropriate agent.
|
||||||
|
|
||||||
|
Requirements:
|
||||||
|
- OPENBAO_ADDR, OPENBAO_ROLE_ID, OPENBAO_SECRET_ID — for fetching Vikunja token
|
||||||
|
- VIKUNJA_BASE_URL, VIKUNJA_PROJECT_ID, VIKUNJA_TODO_BUCKET_ID
|
||||||
|
- K8S_NAMESPACE, AGENT_IMAGE
|
||||||
|
"""
|
||||||
|
|
||||||
|
import json
|
||||||
|
import logging
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
from string import Template
|
||||||
|
|
||||||
|
import httpx
|
||||||
|
from kubernetes import client as k8s_client, config as k8s_config
|
||||||
|
|
||||||
|
logging.basicConfig(
|
||||||
|
level=logging.INFO,
|
||||||
|
format="%(asctime)s %(levelname)s %(message)s",
|
||||||
|
stream=sys.stdout,
|
||||||
|
)
|
||||||
|
log = logging.getLogger("dispatcher")
|
||||||
|
|
||||||
|
# ── Config ────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
OPENBAO_ADDR = os.environ["OPENBAO_ADDR"]
|
||||||
|
OPENBAO_ROLE_ID = os.environ["OPENBAO_ROLE_ID"]
|
||||||
|
OPENBAO_SECRET_ID = os.environ["OPENBAO_SECRET_ID"]
|
||||||
|
|
||||||
|
VIKUNJA_BASE_URL = os.environ.get("VIKUNJA_BASE_URL", "https://tasks.ctz.fyi")
|
||||||
|
VIKUNJA_PROJECT_ID = int(os.environ.get("VIKUNJA_PROJECT_ID", "78"))
|
||||||
|
VIKUNJA_TODO_BUCKET_ID = int(os.environ.get("VIKUNJA_TODO_BUCKET_ID", "116"))
|
||||||
|
VIKUNJA_IN_PROGRESS_BUCKET_ID = int(os.environ.get("VIKUNJA_IN_PROGRESS_BUCKET_ID", "117"))
|
||||||
|
|
||||||
|
K8S_NAMESPACE = os.environ.get("K8S_NAMESPACE", "autojanet")
|
||||||
|
AGENT_IMAGE = os.environ.get("AGENT_IMAGE", "registry.ctz.fyi/autojanet/agent:latest")
|
||||||
|
|
||||||
|
VALID_ROLES = {
|
||||||
|
"pm", "coder", "code-reviewer", "test-engineer", "devsecops", "secops",
|
||||||
|
"sre", "kubernetes-pilot", "linux-admin", "systems-engineer", "networking",
|
||||||
|
"dba", "prometheus-expert", "tofu-engineer", "release-manager",
|
||||||
|
"doc-updater", "doc-writer", "technical-writer", "cost-optimizer",
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── OpenBao ───────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def get_openbao_token() -> str:
|
||||||
|
"""Authenticate to OpenBao via AppRole and return a client token."""
|
||||||
|
resp = httpx.post(
|
||||||
|
f"{OPENBAO_ADDR}/v1/auth/approle/login",
|
||||||
|
json={"role_id": OPENBAO_ROLE_ID, "secret_id": OPENBAO_SECRET_ID},
|
||||||
|
timeout=10,
|
||||||
|
)
|
||||||
|
resp.raise_for_status()
|
||||||
|
return resp.json()["auth"]["client_token"]
|
||||||
|
|
||||||
|
|
||||||
|
def get_secret(bao_token: str, path: str, key: str) -> str:
|
||||||
|
"""Read a KV v2 secret from OpenBao."""
|
||||||
|
resp = httpx.get(
|
||||||
|
f"{OPENBAO_ADDR}/v1/secret/data/{path}",
|
||||||
|
headers={"X-Vault-Token": bao_token},
|
||||||
|
timeout=10,
|
||||||
|
)
|
||||||
|
resp.raise_for_status()
|
||||||
|
return resp.json()["data"]["data"][key]
|
||||||
|
|
||||||
|
|
||||||
|
# ── Vikunja ───────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def get_vikunja_token(bao_token: str) -> str:
|
||||||
|
"""Fetch the dispatcher's Vikunja token from OpenBao."""
|
||||||
|
return get_secret(bao_token, "autojanet/pm/vikunja-token", "token")
|
||||||
|
|
||||||
|
|
||||||
|
def list_todo_tasks(vikunja_token: str) -> list[dict]:
|
||||||
|
"""Return all tasks in the Todo bucket of the AutoJanet project."""
|
||||||
|
tasks = []
|
||||||
|
page = 1
|
||||||
|
while True:
|
||||||
|
resp = httpx.get(
|
||||||
|
f"{VIKUNJA_BASE_URL}/api/v1/projects/{VIKUNJA_PROJECT_ID}/tasks",
|
||||||
|
headers={"Authorization": f"Bearer {vikunja_token}"},
|
||||||
|
params={"page": page, "per_page": 50},
|
||||||
|
timeout=15,
|
||||||
|
)
|
||||||
|
resp.raise_for_status()
|
||||||
|
batch = resp.json()
|
||||||
|
if not batch:
|
||||||
|
break
|
||||||
|
tasks.extend(batch)
|
||||||
|
if len(batch) < 50:
|
||||||
|
break
|
||||||
|
page += 1
|
||||||
|
# Filter to Todo bucket only
|
||||||
|
return [t for t in tasks if t.get("bucket_id") == VIKUNJA_TODO_BUCKET_ID]
|
||||||
|
|
||||||
|
|
||||||
|
def extract_agent_role(task: dict) -> str | None:
|
||||||
|
"""
|
||||||
|
Return the role name if the task has exactly one `agent:<role>` label
|
||||||
|
that matches a known role. Returns None otherwise.
|
||||||
|
"""
|
||||||
|
labels = task.get("labels") or []
|
||||||
|
roles_found = []
|
||||||
|
for label in labels:
|
||||||
|
title = label.get("title", "")
|
||||||
|
m = re.match(r"^agent:(.+)$", title)
|
||||||
|
if m:
|
||||||
|
role = m.group(1)
|
||||||
|
if role in VALID_ROLES:
|
||||||
|
roles_found.append(role)
|
||||||
|
if len(roles_found) == 1:
|
||||||
|
return roles_found[0]
|
||||||
|
return None
|
||||||
|
|
||||||
|
|
||||||
|
def claim_task(vikunja_token: str, task_id: int) -> bool:
|
||||||
|
"""Move task to In Progress bucket. Returns True on success."""
|
||||||
|
resp = httpx.post(
|
||||||
|
f"{VIKUNJA_BASE_URL}/api/v1/tasks/{task_id}",
|
||||||
|
headers={
|
||||||
|
"Authorization": f"Bearer {vikunja_token}",
|
||||||
|
"Content-Type": "application/json",
|
||||||
|
},
|
||||||
|
json={"bucket_id": VIKUNJA_IN_PROGRESS_BUCKET_ID},
|
||||||
|
timeout=10,
|
||||||
|
)
|
||||||
|
if resp.status_code in (200, 201):
|
||||||
|
return True
|
||||||
|
log.warning("Failed to claim task %d: %d %s", task_id, resp.status_code, resp.text)
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
# ── Kubernetes ────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def load_k8s_config() -> None:
|
||||||
|
try:
|
||||||
|
k8s_config.load_incluster_config()
|
||||||
|
except k8s_config.ConfigException:
|
||||||
|
k8s_config.load_kube_config()
|
||||||
|
|
||||||
|
|
||||||
|
def job_name(role: str, task_id: int) -> str:
|
||||||
|
safe_role = role.replace("-", "")[:12]
|
||||||
|
return f"agent-{safe_role}-{task_id}"
|
||||||
|
|
||||||
|
|
||||||
|
def job_already_exists(batch_v1: k8s_client.BatchV1Api, name: str) -> bool:
|
||||||
|
try:
|
||||||
|
batch_v1.read_namespaced_job(name=name, namespace=K8S_NAMESPACE)
|
||||||
|
return True
|
||||||
|
except k8s_client.ApiException as e:
|
||||||
|
if e.status == 404:
|
||||||
|
return False
|
||||||
|
raise
|
||||||
|
|
||||||
|
|
||||||
|
def spawn_agent_job(
|
||||||
|
batch_v1: k8s_client.BatchV1Api,
|
||||||
|
role: str,
|
||||||
|
task_id: int,
|
||||||
|
task_title: str,
|
||||||
|
) -> None:
|
||||||
|
name = job_name(role, task_id)
|
||||||
|
if job_already_exists(batch_v1, name):
|
||||||
|
log.info("Job %s already exists, skipping", name)
|
||||||
|
return
|
||||||
|
|
||||||
|
job = k8s_client.V1Job(
|
||||||
|
api_version="batch/v1",
|
||||||
|
kind="Job",
|
||||||
|
metadata=k8s_client.V1ObjectMeta(
|
||||||
|
name=name,
|
||||||
|
namespace=K8S_NAMESPACE,
|
||||||
|
labels={
|
||||||
|
"autojanet/type": "agent",
|
||||||
|
"autojanet/role": role,
|
||||||
|
"autojanet/task-id": str(task_id),
|
||||||
|
},
|
||||||
|
),
|
||||||
|
spec=k8s_client.V1JobSpec(
|
||||||
|
ttl_seconds_after_finished=3600,
|
||||||
|
backoff_limit=1,
|
||||||
|
template=k8s_client.V1PodTemplateSpec(
|
||||||
|
metadata=k8s_client.V1ObjectMeta(
|
||||||
|
labels={
|
||||||
|
"autojanet/type": "agent",
|
||||||
|
"autojanet/role": role,
|
||||||
|
"autojanet/task-id": str(task_id),
|
||||||
|
}
|
||||||
|
),
|
||||||
|
spec=k8s_client.V1PodSpec(
|
||||||
|
service_account_name=f"agent-{role}",
|
||||||
|
restart_policy="Never",
|
||||||
|
node_selector={"kubernetes.io/arch": "amd64"},
|
||||||
|
containers=[
|
||||||
|
k8s_client.V1Container(
|
||||||
|
name="agent",
|
||||||
|
image=AGENT_IMAGE,
|
||||||
|
image_pull_policy="Always",
|
||||||
|
env=[
|
||||||
|
k8s_client.V1EnvVar(name="AGENT_ROLE", value=role),
|
||||||
|
k8s_client.V1EnvVar(name="TASK_ID", value=str(task_id)),
|
||||||
|
k8s_client.V1EnvVar(name="TASK_TITLE", value=task_title),
|
||||||
|
k8s_client.V1EnvVar(name="OPENBAO_ADDR", value=OPENBAO_ADDR),
|
||||||
|
k8s_client.V1EnvVar(name="LITELLM_BASE_URL", value="https://llm.ctz.fyi"),
|
||||||
|
k8s_client.V1EnvVar(name="VIKUNJA_BASE_URL", value=VIKUNJA_BASE_URL),
|
||||||
|
k8s_client.V1EnvVar(name="FORGEJO_BASE_URL", value="https://git.ctz.fyi"),
|
||||||
|
k8s_client.V1EnvVar(
|
||||||
|
name="OPENBAO_ROLE_ID",
|
||||||
|
value_from=k8s_client.V1EnvVarSource(
|
||||||
|
secret_key_ref=k8s_client.V1SecretKeySelector(
|
||||||
|
name=f"agent-{role}-approle",
|
||||||
|
key="role_id",
|
||||||
|
)
|
||||||
|
),
|
||||||
|
),
|
||||||
|
k8s_client.V1EnvVar(
|
||||||
|
name="OPENBAO_SECRET_ID",
|
||||||
|
value_from=k8s_client.V1EnvVarSource(
|
||||||
|
secret_key_ref=k8s_client.V1SecretKeySelector(
|
||||||
|
name=f"agent-{role}-approle",
|
||||||
|
key="secret_id",
|
||||||
|
)
|
||||||
|
),
|
||||||
|
),
|
||||||
|
],
|
||||||
|
resources=k8s_client.V1ResourceRequirements(
|
||||||
|
requests={"cpu": "250m", "memory": "512Mi"},
|
||||||
|
limits={"cpu": "2000m", "memory": "2Gi"},
|
||||||
|
),
|
||||||
|
security_context=k8s_client.V1SecurityContext(
|
||||||
|
allow_privilege_escalation=False,
|
||||||
|
run_as_non_root=True,
|
||||||
|
run_as_user=1000,
|
||||||
|
capabilities=k8s_client.V1Capabilities(drop=["ALL"]),
|
||||||
|
),
|
||||||
|
)
|
||||||
|
],
|
||||||
|
),
|
||||||
|
),
|
||||||
|
),
|
||||||
|
)
|
||||||
|
|
||||||
|
batch_v1.create_namespaced_job(namespace=K8S_NAMESPACE, body=job)
|
||||||
|
log.info("Spawned job %s for role=%s task=%d", name, role, task_id)
|
||||||
|
|
||||||
|
|
||||||
|
# ── Main ──────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def main() -> None:
|
||||||
|
log.info("Dispatcher starting")
|
||||||
|
|
||||||
|
# Auth
|
||||||
|
bao_token = get_openbao_token()
|
||||||
|
vikunja_token = get_vikunja_token(bao_token)
|
||||||
|
log.info("Authenticated to OpenBao and Vikunja")
|
||||||
|
|
||||||
|
# k8s
|
||||||
|
load_k8s_config()
|
||||||
|
batch_v1 = k8s_client.BatchV1Api()
|
||||||
|
|
||||||
|
# Scan tasks
|
||||||
|
tasks = list_todo_tasks(vikunja_token)
|
||||||
|
log.info("Found %d tasks in Todo bucket", len(tasks))
|
||||||
|
|
||||||
|
claimed = 0
|
||||||
|
for task in tasks:
|
||||||
|
task_id = task["id"]
|
||||||
|
title = task.get("title", "")
|
||||||
|
role = extract_agent_role(task)
|
||||||
|
|
||||||
|
if not role:
|
||||||
|
log.debug("Task %d has no valid agent label, skipping", task_id)
|
||||||
|
continue
|
||||||
|
|
||||||
|
log.info("Claiming task %d (%s) for role=%s", task_id, title[:60], role)
|
||||||
|
if not claim_task(vikunja_token, task_id):
|
||||||
|
continue
|
||||||
|
|
||||||
|
try:
|
||||||
|
spawn_agent_job(batch_v1, role, task_id, title)
|
||||||
|
claimed += 1
|
||||||
|
except Exception as e:
|
||||||
|
log.error("Failed to spawn job for task %d: %s", task_id, e)
|
||||||
|
# Un-claim: move back to Todo
|
||||||
|
httpx.post(
|
||||||
|
f"{VIKUNJA_BASE_URL}/api/v1/tasks/{task_id}",
|
||||||
|
headers={"Authorization": f"Bearer {vikunja_token}", "Content-Type": "application/json"},
|
||||||
|
json={"bucket_id": VIKUNJA_TODO_BUCKET_ID},
|
||||||
|
timeout=10,
|
||||||
|
)
|
||||||
|
|
||||||
|
log.info("Dispatcher done. Claimed %d tasks.", claimed)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
2
dispatcher/requirements.txt
Normal file
2
dispatcher/requirements.txt
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
httpx>=0.27
|
||||||
|
kubernetes>=29.0
|
||||||
26
k8s/manifests/clustersecretstore.yaml
Normal file
26
k8s/manifests/clustersecretstore.yaml
Normal file
|
|
@ -0,0 +1,26 @@
|
||||||
|
---
|
||||||
|
# ExternalSecret: pull agent AppRole credentials from OpenBao into k8s Secrets
|
||||||
|
# One ExternalSecret per role. Template shown for pm; others follow same pattern.
|
||||||
|
# Deploy via: kubectl apply -f externalsecrets/ (generated per-role)
|
||||||
|
#
|
||||||
|
# Prerequisites:
|
||||||
|
# - external-secrets operator installed
|
||||||
|
# - ClusterSecretStore "openbao" configured pointing to OpenBao in-cluster
|
||||||
|
#
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
metadata:
|
||||||
|
name: openbao
|
||||||
|
spec:
|
||||||
|
provider:
|
||||||
|
vault:
|
||||||
|
server: "http://openbao.openbao.svc.cluster.local:8200"
|
||||||
|
path: "secret"
|
||||||
|
version: "v2"
|
||||||
|
auth:
|
||||||
|
kubernetes:
|
||||||
|
mountPath: "kubernetes"
|
||||||
|
role: "external-secrets"
|
||||||
|
serviceAccountRef:
|
||||||
|
name: "external-secrets"
|
||||||
|
namespace: "external-secrets"
|
||||||
68
k8s/manifests/dispatcher-cronjob.yaml
Normal file
68
k8s/manifests/dispatcher-cronjob.yaml
Normal file
|
|
@ -0,0 +1,68 @@
|
||||||
|
---
|
||||||
|
# Dispatcher CronJob — runs every 2 minutes, claims unclaimed tasks from Vikunja
|
||||||
|
# and spawns agent Jobs for each
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: CronJob
|
||||||
|
metadata:
|
||||||
|
name: dispatcher
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: dispatcher
|
||||||
|
spec:
|
||||||
|
schedule: "*/2 * * * *"
|
||||||
|
concurrencyPolicy: Forbid # never run two dispatchers simultaneously
|
||||||
|
successfulJobsHistoryLimit: 5
|
||||||
|
failedJobsHistoryLimit: 5
|
||||||
|
jobTemplate:
|
||||||
|
spec:
|
||||||
|
ttlSecondsAfterFinished: 600
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
autojanet/role: dispatcher
|
||||||
|
spec:
|
||||||
|
serviceAccountName: dispatcher
|
||||||
|
restartPolicy: Never
|
||||||
|
containers:
|
||||||
|
- name: dispatcher
|
||||||
|
image: registry.ctz.fyi/autojanet/dispatcher:latest
|
||||||
|
imagePullPolicy: Always
|
||||||
|
env:
|
||||||
|
- name: OPENBAO_ADDR
|
||||||
|
value: "http://openbao.openbao.svc.cluster.local:8200"
|
||||||
|
- name: OPENBAO_ROLE_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: dispatcher-approle
|
||||||
|
key: role_id
|
||||||
|
- name: OPENBAO_SECRET_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: dispatcher-approle
|
||||||
|
key: secret_id
|
||||||
|
- name: VIKUNJA_BASE_URL
|
||||||
|
value: "https://tasks.ctz.fyi"
|
||||||
|
- name: VIKUNJA_PROJECT_ID
|
||||||
|
value: "78"
|
||||||
|
- name: VIKUNJA_TODO_BUCKET_ID
|
||||||
|
value: "116"
|
||||||
|
- name: VIKUNJA_IN_PROGRESS_BUCKET_ID
|
||||||
|
value: "117"
|
||||||
|
- name: K8S_NAMESPACE
|
||||||
|
value: "autojanet"
|
||||||
|
- name: AGENT_IMAGE
|
||||||
|
value: "registry.ctz.fyi/autojanet/agent:latest"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: "100m"
|
||||||
|
memory: "128Mi"
|
||||||
|
limits:
|
||||||
|
cpu: "500m"
|
||||||
|
memory: "256Mi"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
capabilities:
|
||||||
|
drop: ["ALL"]
|
||||||
75
k8s/manifests/job-template.yaml
Normal file
75
k8s/manifests/job-template.yaml
Normal file
|
|
@ -0,0 +1,75 @@
|
||||||
|
---
|
||||||
|
# Agent Job Template
|
||||||
|
# The dispatcher renders this template per-task, substituting:
|
||||||
|
# AGENT_ROLE, TASK_ID, TASK_TITLE
|
||||||
|
#
|
||||||
|
# This is a reference template — not applied directly.
|
||||||
|
# The dispatcher generates Job manifests from this pattern.
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: agent-${ROLE}-${TASK_ID}
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/type: agent
|
||||||
|
autojanet/role: ${ROLE}
|
||||||
|
autojanet/task-id: "${TASK_ID}"
|
||||||
|
spec:
|
||||||
|
ttlSecondsAfterFinished: 3600 # clean up after 1 hour
|
||||||
|
backoffLimit: 1 # retry once on failure
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
autojanet/type: agent
|
||||||
|
autojanet/role: ${ROLE}
|
||||||
|
autojanet/task-id: "${TASK_ID}"
|
||||||
|
spec:
|
||||||
|
serviceAccountName: agent-${ROLE}
|
||||||
|
restartPolicy: Never
|
||||||
|
# CPU nodes only — GPU reserved for LiteLLM
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/arch: amd64
|
||||||
|
tolerations: []
|
||||||
|
containers:
|
||||||
|
- name: agent
|
||||||
|
image: registry.ctz.fyi/autojanet/agent:latest
|
||||||
|
imagePullPolicy: Always
|
||||||
|
env:
|
||||||
|
- name: AGENT_ROLE
|
||||||
|
value: "${ROLE}"
|
||||||
|
- name: TASK_ID
|
||||||
|
value: "${TASK_ID}"
|
||||||
|
- name: TASK_TITLE
|
||||||
|
value: "${TASK_TITLE}"
|
||||||
|
- name: OPENBAO_ROLE_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: agent-${ROLE}-approle
|
||||||
|
key: role_id
|
||||||
|
- name: OPENBAO_SECRET_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: agent-${ROLE}-approle
|
||||||
|
key: secret_id
|
||||||
|
- name: OPENBAO_ADDR
|
||||||
|
value: "http://openbao.openbao.svc.cluster.local:8200"
|
||||||
|
- name: LITELLM_BASE_URL
|
||||||
|
value: "https://llm.ctz.fyi"
|
||||||
|
- name: VIKUNJA_BASE_URL
|
||||||
|
value: "https://tasks.ctz.fyi"
|
||||||
|
- name: FORGEJO_BASE_URL
|
||||||
|
value: "https://git.ctz.fyi"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: "250m"
|
||||||
|
memory: "512Mi"
|
||||||
|
limits:
|
||||||
|
cpu: "2000m"
|
||||||
|
memory: "2Gi"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
capabilities:
|
||||||
|
drop: ["ALL"]
|
||||||
7
k8s/manifests/namespace.yaml
Normal file
7
k8s/manifests/namespace.yaml
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: autojanet
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: autojanet
|
||||||
|
app.kubernetes.io/managed-by: argocd
|
||||||
80
k8s/policies/networkpolicy.yaml
Normal file
80
k8s/policies/networkpolicy.yaml
Normal file
|
|
@ -0,0 +1,80 @@
|
||||||
|
---
|
||||||
|
# Default-deny all ingress and egress in autojanet namespace
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: default-deny-all
|
||||||
|
namespace: autojanet
|
||||||
|
spec:
|
||||||
|
podSelector: {}
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
---
|
||||||
|
# Allow agents to reach the internet (APIs: Vikunja, Forgejo, LiteLLM, OpenBao, Grafana, etc.)
|
||||||
|
# All external services are HTTPS on 443; OpenBao internal is 8200
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: allow-egress-external
|
||||||
|
namespace: autojanet
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
autojanet/type: agent
|
||||||
|
policyTypes:
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
# HTTPS to external services
|
||||||
|
- ports:
|
||||||
|
- port: 443
|
||||||
|
protocol: TCP
|
||||||
|
# Internal cluster DNS
|
||||||
|
- ports:
|
||||||
|
- port: 53
|
||||||
|
protocol: UDP
|
||||||
|
- port: 53
|
||||||
|
protocol: TCP
|
||||||
|
# OpenBao in-cluster (openbao namespace)
|
||||||
|
- to:
|
||||||
|
- namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
kubernetes.io/metadata.name: openbao
|
||||||
|
ports:
|
||||||
|
- port: 8200
|
||||||
|
protocol: TCP
|
||||||
|
# k8s API server (for kubectl-capable agents)
|
||||||
|
- to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 0.0.0.0/0
|
||||||
|
ports:
|
||||||
|
- port: 6443
|
||||||
|
protocol: TCP
|
||||||
|
---
|
||||||
|
# Allow dispatcher egress to k8s API and OpenBao only
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: allow-dispatcher-egress
|
||||||
|
namespace: autojanet
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
autojanet/role: dispatcher
|
||||||
|
policyTypes:
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- ports:
|
||||||
|
- port: 443
|
||||||
|
protocol: TCP
|
||||||
|
- port: 53
|
||||||
|
protocol: UDP
|
||||||
|
- port: 53
|
||||||
|
protocol: TCP
|
||||||
|
- to:
|
||||||
|
- namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
kubernetes.io/metadata.name: openbao
|
||||||
|
ports:
|
||||||
|
- port: 8200
|
||||||
|
protocol: TCP
|
||||||
205
k8s/rbac/serviceaccounts.yaml
Normal file
205
k8s/rbac/serviceaccounts.yaml
Normal file
|
|
@ -0,0 +1,205 @@
|
||||||
|
---
|
||||||
|
# ServiceAccount per agent role
|
||||||
|
# One SA per role — bound to its own OpenBao AppRole secret
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-pm
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: pm
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-coder
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: coder
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-code-reviewer
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: code-reviewer
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-test-engineer
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: test-engineer
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-devsecops
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: devsecops
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-secops
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: secops
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-sre
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: sre
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-kubernetes-pilot
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: kubernetes-pilot
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-linux-admin
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: linux-admin
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-systems-engineer
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: systems-engineer
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-networking
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: networking
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-dba
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: dba
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-prometheus-expert
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: prometheus-expert
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-tofu-engineer
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: tofu-engineer
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-release-manager
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: release-manager
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-doc-updater
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: doc-updater
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-doc-writer
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: doc-writer
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-technical-writer
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: technical-writer
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: agent-cost-optimizer
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: cost-optimizer
|
||||||
|
---
|
||||||
|
# Dispatcher ServiceAccount — runs the CronJob that claims tasks
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: dispatcher
|
||||||
|
namespace: autojanet
|
||||||
|
labels:
|
||||||
|
autojanet/role: dispatcher
|
||||||
|
---
|
||||||
|
# Role: agents can create/manage Jobs in their own namespace
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: agent-job-runner
|
||||||
|
namespace: autojanet
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["batch"]
|
||||||
|
resources: ["jobs"]
|
||||||
|
verbs: ["create", "get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods", "pods/log"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
---
|
||||||
|
# Dispatcher gets broader job management
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: dispatcher
|
||||||
|
namespace: autojanet
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["batch"]
|
||||||
|
resources: ["jobs"]
|
||||||
|
verbs: ["create", "get", "list", "watch", "delete"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods", "pods/log", "configmaps"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: dispatcher
|
||||||
|
namespace: autojanet
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: dispatcher
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: dispatcher
|
||||||
|
namespace: autojanet
|
||||||
Loading…
Reference in a new issue