# AWOOOI 正式環境 ConfigMap
# 負責人: CIO
# 版本: v1.4
# 日期: 2026-05-03 (台北時區)
# 變更: ADR-110 Ollama GCP 三層容災架構（GCP-A → GCP-B → Local HDD）

apiVersion: v1
kind: ConfigMap
metadata:
  name: awoooi-config
  namespace: awoooi-prod
data:
  # 環境標識
  ENVIRONMENT: "prod"
  SYSTEM_NAME: "awoooi"

  # 服務端點 (非機密)
  # 2026-04-16 ogt + Claude Sonnet 4.6: 改指向 111（GPU 機，RTX）
  #   188 = CPU-only Ollama，推理極慢（>60s）；111 有 GPU，avg 10s
  # 2026-05-25 Codex: keep ADR-110 production policy visible and ordered.
  # High-volume callers use short endpoint cooldowns when GCP-A/B are down,
  # but health/status must still show GCP-A -> GCP-B -> 111 before Gemini.
  OLLAMA_URL: "http://192.168.0.110:11435"
  OLLAMA_SECONDARY_URL: "http://192.168.0.110:11436"
  OLLAMA_FALLBACK_URL: "http://192.168.0.110:11437"
  OPENCLAW_URL: "http://192.168.0.188:8088"
  KALI_SCANNER_URL: "http://192.168.0.112:8080"
  SIGNOZ_URL: "http://192.168.0.188:3301"
  LANGFUSE_URL: "http://192.168.0.110:3100"
  # 2026-04-01 Claude Code: 開啟 Langfuse LLMOps 追蹤 (Phase 15.1 key 已注入 K8s Secret)
  LANGFUSE_ENABLED: "true"

  # OTEL 可觀測性 (P0 核心神經)
  # 2026-03-31 ogt: 修正為 gRPC endpoint (Python SDK 使用 grpc exporter)
  # HTTP: 24318, gRPC: 24317
  OTEL_ENABLED: "true"
  OTEL_EXPORTER_OTLP_ENDPOINT: "http://192.168.0.188:24317"
  OTEL_SERVICE_NAME: "awoooi-api"

  # 應用配置
  LOG_LEVEL: "INFO"
  # JSON array 格式 (pydantic-settings 要求)
  # 正式域名優先，本機開發備用
  CORS_ORIGINS: '["https://awoooi.wooo.work","http://localhost:3000","http://localhost:3001"]'
  # 2026-07-01 Codex: production DB role `awoooi` currently has CONNECTION
  # LIMIT 2. Keep API/worker pools single-connection until the role budget is
  # raised and verified, otherwise rollout startup can exhaust PostgreSQL.
  DATABASE_POOL_SIZE: "1"
  DATABASE_MAX_OVERFLOW: "0"
  DATABASE_POOL_TIMEOUT_SECONDS: "5"

  # AI 配置 (JSON array 格式 for pydantic-settings)
  # 2026-04-16 ogt + Claude Sonnet 4.6: 修正 fallback 順序 — 本地 GPU Ollama(111) 第一
  #   ollama(111 GPU) → nvidia(NIM) → gemini → claude
  #   111 有 RTX GPU，avg 10s；nvidia NIM 外部 API；gemini/claude 雲端備援
  AI_FALLBACK_ORDER: '["ollama","nvidia","gemini","claude"]'
  AI_CACHE_TTL: "3600"

  # ============================================================================
  # Phase 24: AI Provider Registry (ADR-052)
  # 2026-04-02 ogt: 絞殺者開關 — false=舊路徑(安全), true=新 AIRouter
  # 2026-04-02 ogt: B2 觀察期啟動，改為 true (48h, 截止 2026-04-04 18:40 台北)
  # 回滾: kubectl set env deployment/awoooi-api -n awoooi-prod USE_AI_ROUTER=false
  # ============================================================================
  USE_AI_ROUTER: "true"
  ALERT_AI_ALLOW_CLOUD_FALLBACK: "true"
  ALERT_AI_ENFORCE_OLLAMA_FIRST: "true"
  ALERT_OLLAMA_MODEL: "qwen3:14b"
  OLLAMA_HEALTH_CHECK_MODEL: "gemma3:4b"
  OLLAMA_EMBEDDING_MODEL: "bge-m3:latest"
  OPENCLAW_DEFAULT_MODEL: "qwen2.5:7b-instruct"
  OPENCLAW_TIMEOUT: "120"
  OLLAMA_DIAGNOSE_TIMEOUT_SECONDS: "300"
  INCIDENT_LLM_TIMEOUT_SECONDS: "360"
  AGENT_DEBATE_GLOBAL_TIMEOUT_SEC: "420"
  AGENT_DIAGNOSTICIAN_TIMEOUT_SEC: "100"
  AGENT_SOLVER_TIMEOUT_SEC: "80"
  # ADR-105 P1: OpenClaw Agent Loop shadow canary.
  # 只給 read-only MCP tools，使用本地 Ollama，結果只附加 metadata 不改決策。
  # 回滾: kubectl set env deployment/awoooi-api -n awoooi-prod ENABLE_OPENCLAW_AGENT_LOOP_SHADOW=false
  ENABLE_OPENCLAW_AGENT_LOOP_SHADOW: "true"
  OPENCLAW_AGENT_LOOP_MAX_ITERATIONS: "2"

  # ============================================================================
  # Phase 22: OpenClaw + Nemotron 協作 (ADR-044)
  # 2026-03-31 ogt: 統帥需求 - @tsenyangbot 對話 + Incident 雙軌
  # 2026-04-12 ogt: 停用 Nemotron 協作 — Ollama 111 tool_call 60s×2 timeout
  #   > asyncio.wait_for 30s 先觸發 → expert_system fallback → confidence=0.0
  #   ADR-044 暫停，待 Ollama 穩定後重啟
  # ============================================================================
  ENABLE_NEMOTRON_COLLABORATION: "false"
  NEMOTRON_TIMEOUT_SECONDS: "55"
  NEMOTRON_ASYNC_UPDATE: "true"

  # ============================================================================
  # Phase 22 P1: Shadow Mode 解除 - 開放低風險自動執行 (2026-04-01 ogt)
  # 條件: risk_level=low AND confidence≥90% AND trust_score≥5 AND playbook_success≥95%
  # ============================================================================
  SHADOW_MODE_ENABLED: "false"
  SHADOW_MODE_LOG_ONLY: "false"
  # The former API-owned polling rule is superseded_by=global_product_governance_v2.
  # 188/OpenClaw owns getUpdates. A second poller receives Telegram 409 and
  # can consume commands before the Agent99 bridge records a receipt.
  TELEGRAM_ENABLE_POLLING: "false"

  # ============================================================================
  # 2026-04-03 ogt: SRE 戰情室群組三頭政治 (Triumvirate ADR-053)
  # OPENCLAW_BOT_TOKEN / NEMOTRON_BOT_TOKEN 在 Secrets 中配置
  # ============================================================================
  SRE_GROUP_CHAT_ID: "-1003711974679"
  # 2026-07-10 Codex: Agent99 direct SRE relay. Alertmanager still lands in
  # AWOOI API first; the sanitized bridge then POSTs to 99 so Agent99 can queue
  # allowlisted recovery and write evidence/KM. Optional relay token stays in
  # Secret/env only; no token value is stored here.
  AGENT99_SRE_ALERT_RELAY_URL: "http://192.168.0.99:8787/agent99/sre-alert/"
  AGENT99_SRE_ALERT_RELAY_TIMEOUT_SECONDS: "3"

  # 快取 TTL (秒)
  CACHE_TTL_DASHBOARD: "300"
  CACHE_TTL_HOST_STATUS: "30"
  CACHE_TTL_AI_RESPONSE: "3600"

  # ============================================================================
  # Phase 10: Sentry Self-Hosted (192.168.0.110:9000)
  # 2026-03-27: 首席架構師審查 - 補齊遺漏配置
  # ============================================================================
  SENTRY_URL: "http://192.168.0.110:9000"
  SENTRY_ORG: "awoooi"
  SENTRY_PROJECT_API: "awoooi-api"
  SENTRY_PROJECT_WEB: "awoooi-web"
  # Note: SENTRY_DSN 在 Secrets 中配置 (含認證 token)

  # 2026-04-06 Claude Code: Sprint 3 — ansible:// 白名單 (Security Fix A2)
  ANSIBLE_PLAYBOOK_WHITELIST: "restart_docker_service.yml,vacuum_postgres.yml,clear_redis_cache.yml"
  ANSIBLE_CONTROL_NODE_HOST: "192.168.0.188"
  ANSIBLE_CONTROL_NODE_USER: "ollama"
  ANSIBLE_PLAYBOOKS_PATH: "~/openclaw-v5/ansible/playbooks"

  # 2026-04-09 Claude Sonnet 4.6: K3s ClusterIP 10.43.0.1 在 Pod 內 Connection Refused
  # in-cluster config 讀到 10.43.0.1，但 iptables/kube-proxy 沒把流量導到實際 API server
  # 用此 URL 覆蓋 host，讓 executor 直接打 K3s API server node IP
  K8S_API_SERVER_URL: "https://192.168.0.120:6443"

  # MCP Phase 2a (2026-04-11 Claude Sonnet 4.6): SSH MCP 啟用
  # SSH_MCP_ENABLED=true 需確認 ssh-mcp-key Secret 已建立且 188 已加 authorized_keys
  SSH_MCP_ENABLED: "true"
  SSH_MCP_KNOWN_HOSTS_FILE: "/etc/ssh-mcp/known_hosts"
  # 2026-04-27 Claude Sonnet 4.6: 授權主機告警 SSH 自動執行白名單
  # 根因：SSH_MCP_ALLOWED_HOSTS 未設定 → _ssh_execute() 攔截 → 主機告警全部降級人工審核
  # 四台主機：110(DevOps金庫/wooo), 120(K3s-1/wooo), 121(K3s-2/wooo), 188(AI中心/ollama)
  SSH_MCP_ALLOWED_HOSTS: "192.168.0.110,192.168.0.120,192.168.0.121,192.168.0.188"
  SSH_MCP_HOST_USERS: "192.168.0.188=ollama"
  # 2026-04-28 Claude Sonnet 4.6: Wave 2 B3 — LLM 動態 Telegram 按鈕正式啟用
  # B2 dispatch_llm_action + B3 keyboard + B4 la:{short_id} handler 全部就緒
  USE_LLM_DYNAMIC_BUTTONS: "true"
  # MCP Phase 3 (2026-04-11 Claude Sonnet 4.6): ArgoCD + Sentry MCP 啟用
  # ARGOCD_API_TOKEN 在 Secrets 中配置
  ARGOCD_MCP_ENABLED: "true"
  # 2026-04-14 Claude Sonnet 4.6: 改指向 121 — node 120 kube-proxy 對 30443 有路由 bug
  # 測試結果: 120:30443 → 000(FAIL), 121:30443 → 405(ArgoCD 正常), VIP:30443 → 000(經由120故障)
  ARGOCD_URL: "https://192.168.0.121:30443"
  SENTRY_MCP_ENABLED: "true"
  # Prometheus server 在 110:9090 (非 188)
  PROMETHEUS_URL: "http://192.168.0.110:9090"
  PROMETHEUS_MULTIPROC_DIR: "/tmp/awoooi-prometheus-multiproc"

  # ============================================================================
  # AIOps Phase 1-6 Feature Flags (2026-04-15 ogt: 全開，資料先全寫入 DB)
  # ============================================================================
  AIOPS_P1_ENABLED: "true"
  AIOPS_P1_PRE_DECISION_INVESTIGATOR: "true"
  AIOPS_P1_POST_EXECUTION_VERIFIER: "true"
  AIOPS_P2_ENABLED: "true"
  AIOPS_P2_CRITIC_ENABLED: "true"
  AIOPS_P2_AGENT_TIMEOUT_SEC: "15"
  AIOPS_P3_ENABLED: "true"
  AIOPS_P3_EVOLVER_ENABLED: "true"
  AIOPS_P3_FINETUNE_EXPORT: "true"
  AIOPS_P3_KNOWLEDGE_DECAY: "true"
  AIOPS_P4_ENABLED: "true"
  AIOPS_P4_DYNAMIC_BASELINE: "true"
  AIOPS_P4_LOG_ANOMALY: "true"
  AIOPS_P4_TREND_PREDICTOR: "true"
  AIOPS_P4_PROACTIVE_INSPECTOR: "true"
  # 2026-04-16 Claude Sonnet 4.6: 解除 shadow mode — 真實主動監控啟用
  # 原因: baseline_anomalies/trend_breaches 皆 0，且 proactive_inspector 只寫 _last_report
  # 行為改變: ProactiveAlert.shadow_mode=false → PreDecisionInvestigator 讀取後可觸發 Incident
  AIOPS_P4_SHADOW_MODE: "false"
  AIOPS_P5_ENABLED: "true"
  AIOPS_P5_BLAST_RADIUS_CHECK: "true"
  AIOPS_P5_GITOPS_PR: "false"
  AIOPS_P5_DRY_RUN_ENFORCED: "true"
  AIOPS_P6_ENABLED: "true"
  AIOPS_P6_GOVERNANCE_ENABLED: "true"
  AIOPS_P6_SELF_DEMOTION: "true"
  AIOPS_P6_OFFLINE_REPLAY: "true"
  AIOPS_P6_KB_ROT_CLEANER: "true"
  AIOPS_P6_TRUST_DRIFT_DETECTOR: "true"
  # 2026-04-25 ogt + Claude Sonnet 4.6: Hermes × 12-Agent 整合（ADR-093/094/095）
  # 2026-04-25 ogt: HERMES_NL_ENABLED 開啟 — polling 路徑已接入 @tsenyangbot @mention → Hermes NL
  # 2026-04-25 ogt: 全切群組 — 所有告警轉 SRE 戰情室 (TG_GROUP_CUTOVER 正式啟用)
  TG_GROUP_CUTOVER: "true"
  HERMES_NL_ENABLED: "true"
  ENABLE_12AGENT_CONSENSUS: "false"