paperclip-operator/config/samples/paperclip_v1alpha1_instance_public.yaml at main · paperclipinc/paperclip-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
apiVersion: paperclip.inc/v1alpha1
kind: Instance
metadata:
  name: paperclip-public
  namespace: paperclip
spec:
  image:
    repository: ghcr.io/paperclipai/paperclip
    # Pick a specific upstream release tag. The operator rejects Instances
    # without a tag (or digest), since :latest can silently pull a broken build.
    # See the tags list at https://github.com/paperclipai/paperclip/pkgs/container/paperclip
    tag: "2026.0403"

  deployment:
    mode: authenticated
    exposure: public
    publicURL: https://paperclip.example.com
    allowedHostnames:
      - paperclip.example.com

  database:
    mode: external
    externalURLSecretRef:
      name: paperclip-database
      key: DATABASE_URL

  auth:
    secretRef:
      name: paperclip-auth
      key: BETTER_AUTH_SECRET

  secrets:
    masterKeySecretRef:
      name: paperclip-secrets
      key: MASTER_KEY
    strictMode: true

  storage:
    persistence:
      enabled: true
      size: 20Gi
      storageClass: gp3

  objectStorage:
    provider: s3
    bucket: my-paperclip-storage
    region: us-east-1
    credentialsSecretRef:
      name: paperclip-s3

  heartbeat:
    enabled: true
    intervalMS: 30000

  adapters:
    apiKeysSecretRef:
      name: paperclip-api-keys

  connections:
    credentialsSecretRef:
      name: paperclip-oauth-credentials

  security:
    networkPolicy:
      enabled: true
    rbac:
      create: true
      serviceAccountAnnotations:
        eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/paperclip

  networking:
    service:
      type: ClusterIP
      port: 3100
    ingress:
      enabled: true
      ingressClassName: nginx
      hosts:
        - paperclip.example.com
      tls:
        - hosts:
            - paperclip.example.com
          secretName: paperclip-tls
      annotations:
        nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
        nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
        nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
        nginx.ingress.kubernetes.io/proxy-set-headers: "Upgrade"
    # Alternative: use Gateway API HTTPRoute instead of Ingress
    # httpRoute:
    #   enabled: true
    #   parentRefs:
    #     - name: my-gateway
    #       sectionName: https
    #   hostnames:
    #     - paperclip.example.com

  observability:
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
        interval: 30s
    logging:
      level: info

  availability:
    podDisruptionBudget:
      enabled: true
      minAvailable: 1
    nodeSelector:
      kubernetes.io/arch: amd64

  resources:
    requests:
      cpu: "1"
      memory: 1Gi
    limits:
      cpu: "4"
      memory: 4Gi

  probes:
    startup:
      failureThreshold: 60
      periodSeconds: 5
---
# OAuth credentials for third-party connections (GitHub, Slack, etc.)
# Register OAuth apps with each provider and set the callback URL to:
#   https://paperclip.example.com/api/connections/callback
apiVersion: v1
kind: Secret
metadata:
  name: paperclip-oauth-credentials
  namespace: paperclip
type: Opaque
stringData:
  PAPERCLIP_OAUTH_CREDENTIALS: |
    {
      "github": {
        "clientId": "Iv1.xxxxxxxxxxxxxxxx",
        "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      },
      "slack": {
        "clientId": "1234567890.1234567890",
        "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }