conjurer: napraw drogę powrotną librarian/musician -> bot

Wyniki wyszukań (librarian) i eventy 'now playing' (musician) POST-owane do
bota ginęły, bo droga powrotna do bota była krucha:

* Service 'bot' był NodePort BEZ przypiętego nodePort -> k8s losował port z
  30000-32767 przy każdym (od)tworzeniu Service, a musician/betoniarka z
  Dockera adresują bota na sztywno http://192.168.1.73:32442. Rozjazd = każdy
  POST leci w zamknięty port. Przypinam nodePort: 32442.
* Librarian jest w tym samym klastrze co bot, a mimo to szedł przez nodePort
  węzła. Przełączam na DNS Service'u http://bot:5000 - odporne na
  przetasowania nodePortu (nodePort zostaje tylko dla zewnętrznych z Dockera).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

astrololo/kustomization.yaml

@@ -10,10 +10,10 @@ resources:
   - ingress.yaml # wejście po https + przekierowanie z http
 images:
   - name: gitea.czernobog.pl/gitea/astrololo-data
-    newTag: 623603b1
+    newTag: 8ebce816
   - name: gitea.czernobog.pl/gitea/astrololo-logic
-    newTag: 623603b1
+    newTag: 8ebce816
   - name: gitea.czernobog.pl/gitea/astrololo-render
     newTag: latest
   - name: gitea.czernobog.pl/gitea/astrololo-presentation
-    newTag: 623603b1
+    newTag: 8ebce816

conjurer/bot.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bot
+  namespace: conjurer
+spec:
+  replicas: 1                     # NIGDY więcej — jedna sesja gateway na token
+  strategy: { type: Recreate }    # NIE RollingUpdate — dwa pody = wojna o sesję Discord
+  selector: { matchLabels: { app: bot } }
+  template:
+    metadata: { labels: { app: bot } }
+    spec:
+      imagePullSecrets: [{ name: gitea-registry }]
+      containers:
+        - name: bot
+          image: gitea.czernobog.pl/gitea/conjurer-bot:c8aae106
+          ports: [{ containerPort: 5000 }]
+          env:
+            - { name: CONJURER_DATA_DIR,      value: "/data" }
+            - { name: CONJURER_DISCORD_HOST,  value: "0.0.0.0" }
+            - { name: CONJURER_DISCORD_PORT,  value: "5000" }
+            - { name: CONJURER_API_KEY,  value: "d97008b3-7a5a-11f1-acd1-000b0e0f00ed" }
+            - { name: CONJURER_NETRC_FILE, value: "/secrets/.netrc" }
+            # ↓ NAZWY PODSTAW WG WYNIKU grepa z 0.2 ↓
+            - { name: CONJURER_LIBRARIAN_SERVICE, value: "http://librarian:5001" }
+            - { name: CONJURER_MUSICIAN_SERVICE,  value: "http://192.168.1.89:5000" }
+            - { name: CONJURER_RADIO_SERVICE,     value: "http://192.168.1.79:5005" }
+            - { name: CONJURER_FILE_SERVICE,     value: "http://192.168.1.89:5000" }
+
+            - { name: CONJURER_RADIO_HARBOR,      value: "http://192.168.1.79:54321" }
+          volumeMounts:
+            - { name: data,  mountPath: /data }
+            - { name: netrc, mountPath: /secrets, readOnly: true }
+          resources:
+            requests: { cpu: "200m", memory: "256Mi" }
+            limits:   { cpu: "2",    memory: "1Gi" }
+      volumes:
+        - name: data
+          persistentVolumeClaim: { claimName: bot-data }
+        - name: netrc
+          secret: { secretName: conjurer-netrc }
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata: { name: bot-data, namespace: conjurer }
+spec:
+  accessModes: [ReadWriteOnce]
+  resources: { requests: { storage: 2Gi } }
+---
+apiVersion: v1
+kind: Service
+metadata: { name: bot, namespace: conjurer }
+spec:
+  type: NodePort                  # radio/musician z Dockera muszą go dosięgnąć
+  selector: { app: bot }
+  # nodePort PRZYPIĘTY na sztywno. Bez tego k8s losuje port z 30000-32767 przy
+  # (od)tworzeniu Service, a musician/betoniarka z Dockera adresują bota po
+  # http://192.168.1.73:32442 na sztywno - rozjazd = wyniki/eventy giną w locie.
+  ports: [{ port: 5000, targetPort: 5000, nodePort: 32442 }]

conjurer/conjurer-imageupdater.yaml

@@ -0,0 +1,19 @@
+apiVersion: argocd-image-updater.argoproj.io/v1alpha1
+kind: ImageUpdater
+metadata:
+  name: conjurer
+  namespace: argocd
+spec:
+  commonUpdateSettings:
+    updateStrategy: "newest-build"
+  writeBackConfig:
+    method: "git:secret:argocd/git-creds"
+    gitConfig:
+      repository: "https://gitea.czernobog.pl/gitea/deploy.git"
+      branch: "master"                       # ← gałąź repo deploy
+      writeBackTarget: "kustomization:/conjurer"
+  applicationRefs:
+    - namePattern: "conjurer"
+      images:
+        - { alias: "librarian", imageName: "gitea.czernobog.pl/gitea/conjurer-librarian" }
+        - { alias: "bot",       imageName: "gitea.czernobog.pl/gitea/conjurer-bot" }

conjurer/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - librarian.yaml
+  - bot.yaml
+images:
+  - name: gitea.czernobog.pl/gitea/conjurer-librarian
+    newTag: 5d321f2f
+  - name: gitea.czernobog.pl/gitea/conjurer-bot
+    newTag: 5d321f2f

conjurer/librarian.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: librarian
+  namespace: conjurer
+spec:
+  replicas: 1
+  selector: { matchLabels: { app: librarian } }
+  template:
+    metadata: { labels: { app: librarian } }
+    spec:
+      imagePullSecrets: [{ name: gitea-registry }]
+      containers:
+        - name: librarian
+          image: gitea.czernobog.pl/gitea/conjurer-librarian:e243777e
+          ports: [{ containerPort: 5001 }]
+          env:
+            - { name: CONJURER_LIBRARIAN_HOST,      value: "0.0.0.0" }
+            - { name: CONJURER_LIBRARIAN_PORT,      value: "5001" }
+            - { name: CONJURER_LIBRARIAN_DB_PATH,   value: "/doi/" }
+            - { name: CONJURER_API_KEY,  value: "d97008b3-7a5a-11f1-acd1-000b0e0f00ed" }
+            - { name: CONJURER_LIBRARIAN_MAXTHREADS,  value: "40" }
+            - { name: CONJURER_CROSSREF_MAILTO,  value: "mtuszowski@gmail.com" }
+            - { name: CONJURER_LIBRARIAN_CHUNK,  value: "_chunk.txt" }
+            # Librarian jest W TYM SAMYM klastrze/namespace co bot - gada z nim
+            # po DNS Service'u, nie przez nodePort węzła (ten zostaje tylko dla
+            # zewnętrznych musician/betoniarka z Dockera). Odporne na przetasowania.
+            - { name: CONJURER_MAIN_BOT,  value: "http://bot:5000" }
+
+            - { name: CONJURER_LIBRARIAN_STATE_DIR, value: "/lib_temp_files" }
+
+          volumeMounts:
+            - { name: doi,   mountPath: /doi, readOnly: true }
+            - { name: state, mountPath: /lib_temp_files }
+          resources:
+            requests: { cpu: "100m", memory: "256Mi" }
+            limits:   { cpu: "1",    memory: "1Gi" }
+      volumes:
+        - name: doi
+          nfs:
+            server: 192.168.1.34
+            path: /mnt/Tank1/conjurer_swap/librarian_data/base_it1
+        - name: state
+          persistentVolumeClaim: { claimName: librarian-state }
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata: { name: librarian-state, namespace: conjurer }
+spec:
+  accessModes: [ReadWriteOnce]
+  resources: { requests: { storage: 1Gi } }
+---
+apiVersion: v1
+kind: Service
+metadata: { name: librarian, namespace: conjurer }
+spec:
+  selector: { app: librarian }
+  ports: [{ port: 5001, targetPort: 5001 }]

conjurer/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: conjurer