chore(search): wire Meilisearch — local compose + prod k8s manifests

Add a meilisearch service to the dev docker-compose (port 7700, persistent volume) and MEILI_URL/MEILI_KEY (+ IIOS_CRED_KEY, IIOS_MEDIA_GC_INTERVAL_MS) to .env.example. Add deploy/meilisearch.yaml — a ready-to-apply k8s Deployment/Service/PVC/Secret for the ArgoCD prod stack (copy into k8s-pods/services/iios/), with wiring notes for the iios-service env (MEILI_URL=http://meilisearch:7700, MEILI_KEY from the secret). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-23 14:35:07 +05:30
parent 8af25def83
commit f5c89159f4
3 changed files with 132 additions and 0 deletions
@@ -0,0 +1,98 @@
+# Meilisearch for IIOS message search (prod).
+#
+# IIOS deploys to Kubernetes via ArgoCD from the platform-engineering/k8s-pods repo
+# (services/iios/). This file is the template for the prod Meilisearch instance — copy it into
+# k8s-pods/services/iios/meilisearch.yaml and let ArgoCD sync it. Then wire the service:
+#
+#   1. Create the master key once (32+ random chars) and set it in the Secret below (or via a
+#      sealed-secret / your secret manager — do NOT commit a real key in plaintext):
+#        kubectl -n <iios-namespace> create secret generic iios-meili \
+#          --from-literal=MEILI_MASTER_KEY="$(openssl rand -base64 32)"
+#   2. Add these env vars to the iios-service Deployment (services/iios/deployment.yaml):
+#        - name: MEILI_URL
+#          value: http://meilisearch:7700
+#        - name: MEILI_KEY
+#          valueFrom: { secretKeyRef: { name: iios-meili, key: MEILI_MASTER_KEY } }
+#   3. After the first deploy, backfill existing messages once: POST /v1/search/reindex per tenant
+#      (authenticated as a scope member) — new messages index automatically on message.sent.
+#
+# Set the namespace on each object (or via kustomize) to match the iios-service namespace so the
+# `meilisearch` Service DNS resolves as http://meilisearch:7700 from the pod.
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: iios-meili
+type: Opaque
+stringData:
+  # Replace with a real key (or manage out-of-band per note #1 and delete this stringData block).
+  MEILI_MASTER_KEY: "CHANGE_ME_meili_master_key"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: iios-meili-data
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: meilisearch
+  labels: { app: meilisearch }
+spec:
+  replicas: 1
+  strategy: { type: Recreate } # single RWO volume — never run two writers
+  selector:
+    matchLabels: { app: meilisearch }
+  template:
+    metadata:
+      labels: { app: meilisearch }
+    spec:
+      containers:
+        - name: meilisearch
+          image: getmeili/meilisearch:v1.11
+          ports:
+            - containerPort: 7700
+          env:
+            - name: MEILI_ENV
+              value: "production"
+            - name: MEILI_NO_ANALYTICS
+              value: "true"
+            - name: MEILI_MASTER_KEY
+              valueFrom:
+                secretKeyRef: { name: iios-meili, key: MEILI_MASTER_KEY }
+          volumeMounts:
+            - name: data
+              mountPath: /meili_data
+          resources:
+            requests: { cpu: "100m", memory: "256Mi" }
+            limits: { cpu: "1", memory: "1Gi" }
+          readinessProbe:
+            httpGet: { path: /health, port: 7700 }
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: { path: /health, port: 7700 }
+            initialDelaySeconds: 15
+            periodSeconds: 20
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: iios-meili-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: meilisearch
+  labels: { app: meilisearch }
+spec:
+  selector: { app: meilisearch }
+  ports:
+    - port: 7700
+      targetPort: 7700
+  # ClusterIP (internal only) — reached by iios-service as http://meilisearch:7700.
+  type: ClusterIP