# AWOOOI 正式環境 ConfigMap
# 負責人: CIO
# 版本: v1.3
# 日期: 2026-03-31 (台北時區)
# 變更: Phase 22 OpenClaw + Nemotron 協作啟用

apiVersion: v1
kind: ConfigMap
metadata:
  name: awoooi-config
  namespace: awoooi-prod
data:
  # 環境標識
  ENVIRONMENT: "prod"
  SYSTEM_NAME: "awoooi"

  # 服務端點 (非機密)
  # 2026-04-16 ogt + Claude Sonnet 4.6: 改指向 111（GPU 機，RTX）
  #   188 = CPU-only Ollama，推理極慢（>60s）；111 有 GPU，avg 10s
  OLLAMA_URL: "http://192.168.0.111:11434"
  OPENCLAW_URL: "http://192.168.0.188:8088"
  KALI_SCANNER_URL: "http://192.168.0.112:8080"
  SIGNOZ_URL: "http://192.168.0.188:3301"
  LANGFUSE_URL: "http://192.168.0.110:3100"
  # 2026-04-01 Claude Code: 開啟 Langfuse LLMOps 追蹤 (Phase 15.1 key 已注入 K8s Secret)
  LANGFUSE_ENABLED: "true"

  # OTEL 可觀測性 (P0 核心神經)
  # 2026-03-31 ogt: 修正為 gRPC endpoint (Python SDK 使用 grpc exporter)
  # HTTP: 24318, gRPC: 24317
  OTEL_ENABLED: "true"
  OTEL_EXPORTER_OTLP_ENDPOINT: "http://192.168.0.188:24317"
  OTEL_SERVICE_NAME: "awoooi-api"

  # 應用配置
  LOG_LEVEL: "INFO"
  # JSON array 格式 (pydantic-settings 要求)
  # 正式域名優先，本機開發備用
  CORS_ORIGINS: '["https://awoooi.wooo.work","http://localhost:3000","http://localhost:3001"]'

  # AI 配置 (JSON array 格式 for pydantic-settings)
  # 2026-04-16 ogt + Claude Sonnet 4.6: 修正 fallback 順序 — 本地 GPU Ollama(111) 第一
  #   ollama(111 GPU) → nvidia(NIM) → gemini → claude
  #   111 有 RTX GPU，avg 10s；nvidia NIM 外部 API；gemini/claude 雲端備援
  AI_FALLBACK_ORDER: '["ollama","nvidia","gemini","claude"]'
  AI_CACHE_TTL: "3600"

  # ============================================================================
  # Phase 24: AI Provider Registry (ADR-052)
  # 2026-04-02 ogt: 絞殺者開關 — false=舊路徑(安全), true=新 AIRouter
  # 2026-04-02 ogt: B2 觀察期啟動，改為 true (48h, 截止 2026-04-04 18:40 台北)
  # 回滾: kubectl set env deployment/awoooi-api -n awoooi-prod USE_AI_ROUTER=false
  # ============================================================================
  USE_AI_ROUTER: "true"

  # ============================================================================
  # Phase 22: OpenClaw + Nemotron 協作 (ADR-044)
  # 2026-03-31 ogt: 統帥需求 - @tsenyangbot 對話 + Incident 雙軌
  # 2026-04-12 ogt: 停用 Nemotron 協作 — Ollama 111 tool_call 60s×2 timeout
  #   > asyncio.wait_for 30s 先觸發 → expert_system fallback → confidence=0.0
  #   ADR-044 暫停，待 Ollama 穩定後重啟
  # ============================================================================
  ENABLE_NEMOTRON_COLLABORATION: "false"
  NEMOTRON_TIMEOUT_SECONDS: "55"
  NEMOTRON_ASYNC_UPDATE: "true"

  # ============================================================================
  # Phase 22 P1: Shadow Mode 解除 - 開放低風險自動執行 (2026-04-01 ogt)
  # 條件: risk_level=low AND confidence≥90% AND trust_score≥5 AND playbook_success≥95%
  # ============================================================================
  SHADOW_MODE_ENABLED: "false"
  SHADOW_MODE_LOG_ONLY: "false"
  # 2026-04-03 ogt: 改為 true — clawbot-v5 已設 STANDBY_MODE，AWOOOI API 接管 Polling
  # Phase 22.6: 統帥需要直接在同一 Bot 與 OpenClaw/NemoClaw 雙 AI 對話
  TELEGRAM_ENABLE_POLLING: "true"

  # ============================================================================
  # 2026-04-03 ogt: SRE 戰情室群組三頭政治 (Triumvirate ADR-053)
  # OPENCLAW_BOT_TOKEN / NEMOTRON_BOT_TOKEN 在 Secrets 中配置
  # ============================================================================
  SRE_GROUP_CHAT_ID: "-1003711974679"

  # 快取 TTL (秒)
  CACHE_TTL_DASHBOARD: "300"
  CACHE_TTL_HOST_STATUS: "30"
  CACHE_TTL_AI_RESPONSE: "3600"

  # ============================================================================
  # Phase 10: Sentry Self-Hosted (192.168.0.110:9000)
  # 2026-03-27: 首席架構師審查 - 補齊遺漏配置
  # ============================================================================
  SENTRY_URL: "http://192.168.0.110:9000"
  SENTRY_ORG: "awoooi"
  SENTRY_PROJECT_API: "awoooi-api"
  SENTRY_PROJECT_WEB: "awoooi-web"
  # Note: SENTRY_DSN 在 Secrets 中配置 (含認證 token)

  # 2026-04-06 Claude Code: Sprint 3 — ansible:// 白名單 (Security Fix A2)
  ANSIBLE_PLAYBOOK_WHITELIST: "restart_docker_service.yml,vacuum_postgres.yml,clear_redis_cache.yml"
  ANSIBLE_CONTROL_NODE_HOST: "192.168.0.188"
  ANSIBLE_CONTROL_NODE_USER: "ollama"
  ANSIBLE_PLAYBOOKS_PATH: "~/openclaw-v5/ansible/playbooks"

  # 2026-04-09 Claude Sonnet 4.6: K3s ClusterIP 10.43.0.1 在 Pod 內 Connection Refused
  # in-cluster config 讀到 10.43.0.1，但 iptables/kube-proxy 沒把流量導到實際 API server
  # 用此 URL 覆蓋 host，讓 executor 直接打 K3s API server node IP
  K8S_API_SERVER_URL: "https://192.168.0.120:6443"

  # MCP Phase 2a (2026-04-11 Claude Sonnet 4.6): SSH MCP 啟用
  # SSH_MCP_ENABLED=true 需確認 ssh-mcp-key Secret 已建立且 188 已加 authorized_keys
  SSH_MCP_ENABLED: "true"
  SSH_MCP_KNOWN_HOSTS_FILE: "/etc/ssh-mcp/known_hosts"
  # MCP Phase 3 (2026-04-11 Claude Sonnet 4.6): ArgoCD + Sentry MCP 啟用
  # ARGOCD_API_TOKEN 在 Secrets 中配置
  ARGOCD_MCP_ENABLED: "true"
  # 2026-04-14 Claude Sonnet 4.6: 改指向 121 — node 120 kube-proxy 對 30443 有路由 bug
  # 測試結果: 120:30443 → 000(FAIL), 121:30443 → 405(ArgoCD 正常), VIP:30443 → 000(經由120故障)
  ARGOCD_URL: "https://192.168.0.121:30443"
  SENTRY_MCP_ENABLED: "true"
  # Prometheus server 在 110:9090 (非 188)
  PROMETHEUS_URL: "http://192.168.0.110:9090"

  # ============================================================================
  # AIOps Phase 1-6 Feature Flags (2026-04-15 ogt: 全開，資料先全寫入 DB)
  # ============================================================================
  AIOPS_P1_ENABLED: "true"
  AIOPS_P1_PRE_DECISION_INVESTIGATOR: "true"
  AIOPS_P1_POST_EXECUTION_VERIFIER: "true"
  AIOPS_P2_ENABLED: "true"
  AIOPS_P2_CRITIC_ENABLED: "true"
  AIOPS_P2_AGENT_TIMEOUT_SEC: "15"
  AIOPS_P3_ENABLED: "true"
  AIOPS_P3_EVOLVER_ENABLED: "true"
  AIOPS_P3_FINETUNE_EXPORT: "true"
  AIOPS_P3_KNOWLEDGE_DECAY: "true"
  AIOPS_P4_ENABLED: "true"
  AIOPS_P4_DYNAMIC_BASELINE: "true"
  AIOPS_P4_LOG_ANOMALY: "true"
  AIOPS_P4_TREND_PREDICTOR: "true"
  AIOPS_P4_PROACTIVE_INSPECTOR: "true"
  # 2026-04-16 Claude Sonnet 4.6: 解除 shadow mode — 真實主動監控啟用
  # 原因: baseline_anomalies/trend_breaches 皆 0，且 proactive_inspector 只寫 _last_report
  # 行為改變: ProactiveAlert.shadow_mode=false → PreDecisionInvestigator 讀取後可觸發 Incident
  AIOPS_P4_SHADOW_MODE: "false"
  AIOPS_P5_ENABLED: "true"
  AIOPS_P5_BLAST_RADIUS_CHECK: "true"
  AIOPS_P5_GITOPS_PR: "false"
  AIOPS_P5_DRY_RUN_ENFORCED: "true"
  AIOPS_P6_ENABLED: "true"
  AIOPS_P6_GOVERNANCE_ENABLED: "true"
  AIOPS_P6_SELF_DEMOTION: "true"
  AIOPS_P6_OFFLINE_REPLAY: "true"
  AIOPS_P6_KB_ROT_CLEANER: "true"
  AIOPS_P6_TRUST_DRIFT_DETECTOR: "true"
