initial commit

deploy/k8s/external-secret.yaml

@@ -0,0 +1,44 @@
+# Optional: ExternalSecret for the captcha-solver API key.
+#
+# The default Deployment points at the keyless in-cluster LLM gateway
+# (agentgateway-proxy → api.minimax.io via the `minimax` AgentgatewayBackend,
+# which holds the upstream auth in `agentgateway-minimax-auth`). No client
+# API key is needed in that case, and this file is **not** required.
+#
+# Only apply this if you change `CAPTCHA_LLM_BASE_URL` to a public endpoint
+# that needs an API key (e.g. https://llmgw.h.raczylo.com/v1 from outside the
+# cluster, or https://api.openai.com/v1). 1Password layout (matches the
+# convention in home-cluster/.../base/mcp-servers/eso.yaml):
+#
+#   vault: <whatever stores ns_agentgateway>
+#   item:  ns_agentgateway/mcp_captcha_solver_llm_api_key
+#   field: key   (1Password item key)
+#
+# Append to home-cluster/kubernetes/namespaces/agentgateway-system/base/mcp-servers/eso.yaml.
+# The Secret is consumed by the Deployment as `mcp-captcha-solver` / `CAPTCHA_LLM_API_KEY`,
+# and the Deployment's `env:` block must be amended to re-add the
+# `valueFrom: secretKeyRef` lookup.
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: 1p-mcp-captcha-solver
+  namespace: agentgateway-system
+spec:
+  refreshInterval: 24h
+  secretStoreRef:
+    name: 1password-homecluster
+    kind: ClusterSecretStore
+  target:
+    name: mcp-captcha-solver
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    template:
+      engineVersion: v2
+      type: Opaque
+      data:
+        CAPTCHA_LLM_API_KEY: "{{ .key }}"
+  data:
+    - secretKey: key
+      remoteRef:
+        key: ns_agentgateway/mcp_captcha_solver_llm_api_key