redesign fully scaffolded and web login works

deploy/k8s/dev/configs/gateway-config.yaml

@@ -0,0 +1,66 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gateway-config
+data:
+  config.yaml: |
+    # Gateway Configuration
+
+    # Server configuration
+    server:
+      port: 3000
+      host: 0.0.0.0
+      log_level: debug
+      cors_origin: "*"
+      base_url: http://dexorder.local
+      trusted_origins:
+        - http://dexorder.local
+        - http://localhost:5173
+        - ws://dexorder.local
+
+    # Database
+    database:
+      url: postgresql://postgres:password@postgres:5432/iceberg
+
+    # Default model (if user has no preference)
+    defaults:
+      model_provider: anthropic
+      model: claude-3-5-sonnet-20241022
+
+    # Kubernetes configuration
+    kubernetes:
+      namespace: dexorder-agents
+      in_cluster: true
+      agent_image: ghcr.io/dexorder/agent:latest
+      sidecar_image: lifecycle-sidecar:latest
+      storage_class: standard
+
+    # DragonflyDB (Redis-compatible, for hot storage and session management)
+    redis:
+      url: redis://dragonfly:6379
+
+    # Qdrant (for RAG vector search)
+    qdrant:
+      url: http://qdrant:6333
+      collection: gateway_memory
+
+    # Iceberg (for durable storage via REST catalog)
+    iceberg:
+      catalog_uri: http://iceberg-catalog:8181
+      namespace: gateway
+      s3_endpoint: http://minio:9000
+
+    # Event router (ZeroMQ)
+    events:
+      router_bind: tcp://*:5571
+
+    # Embeddings (for RAG vector search)
+    # Ollama runs in the same container as the gateway (see gateway/Dockerfile)
+    embedding:
+      provider: ollama
+      model: all-minilm
+      ollama_url: http://localhost:11434
+
+    # Email service configuration
+    email:
+      from_address: noreply@dexorder.com

deploy/k8s/dev/gateway-dev-patch.yaml

@@ -0,0 +1,15 @@
+# Gateway dev overrides - use local image
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gateway
+spec:
+  template:
+    spec:
+      containers:
+        - name: gateway
+          image: dexorder/gateway:latest
+          imagePullPolicy: Never
+          env:
+            - name: NODE_OPTIONS
+              value: "--trace-deprecation"

deploy/k8s/dev/gateway-health-ingress.yaml

@@ -0,0 +1,19 @@
+---
+# Separate ingress for health endpoint without rewrite
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gateway-health-ingress
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: dexorder.local
+    http:
+      paths:
+      - path: /health
+        pathType: Exact
+        backend:
+          service:
+            name: gateway
+            port:
+              number: 3000

deploy/k8s/dev/gateway-ingress-patch.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gateway-ingress
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
+    # Enable WebSocket support
+    nginx.ingress.kubernetes.io/websocket-services: gateway
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  # Remove TLS for dev
+  tls: []
+  rules:
+  - host: dexorder.local
+    http:
+      paths:
+      # Gateway API routes - strip /api prefix
+      - path: /api/(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: gateway
+            port:
+              number: 3000

deploy/k8s/dev/infrastructure.yaml

@@ -1,4 +1,112 @@
 ---
+# DragonflyDB (Redis-compatible in-memory datastore)
+apiVersion: v1
+kind: Service
+metadata:
+  name: dragonfly
+spec:
+  selector:
+    app: dragonfly
+  ports:
+    - protocol: TCP
+      port: 6379
+      targetPort: 6379
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dragonfly
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dragonfly
+  template:
+    metadata:
+      labels:
+        app: dragonfly
+    spec:
+      containers:
+      - name: dragonfly
+        image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
+        ports:
+        - containerPort: 6379
+          name: dragonfly
+        args:
+        - --logtostderr
+        - --alsologtostderr=false
+        - --cache_mode=true
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "100m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+---
+# Qdrant (Vector database for RAG)
+apiVersion: v1
+kind: Service
+metadata:
+  name: qdrant
+spec:
+  selector:
+    app: qdrant
+  ports:
+    - name: http
+      protocol: TCP
+      port: 6333
+      targetPort: 6333
+    - name: grpc
+      protocol: TCP
+      port: 6334
+      targetPort: 6334
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: qdrant
+spec:
+  serviceName: qdrant
+  replicas: 1
+  selector:
+    matchLabels:
+      app: qdrant
+  template:
+    metadata:
+      labels:
+        app: qdrant
+    spec:
+      containers:
+      - name: qdrant
+        image: qdrant/qdrant:latest
+        ports:
+        - containerPort: 6333
+          name: http
+        - containerPort: 6334
+          name: grpc
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "200m"
+          limits:
+            memory: "1Gi"
+            cpu: "1000m"
+        volumeMounts:
+        - name: qdrant-data
+          mountPath: /qdrant/storage
+  volumeClaimTemplates:
+  - metadata:
+      name: qdrant-data
+    spec:
+      accessModes: ["ReadWriteOnce"]
+      storageClassName: dev-ephemeral
+      resources:
+        requests:
+          storage: 10Gi
+---
 # Kafka (KRaft mode - no Zookeeper needed)
 # Using apache/kafka:3.9.0 instead of confluentinc/cp-kafka because:
 # - cp-kafka's entrypoint script has issues with KRaft configuration
@@ -74,6 +182,7 @@ spec:
       name: kafka-data
     spec:
       accessModes: ["ReadWriteOnce"]
+      storageClassName: dev-ephemeral
       resources:
         requests:
           storage: 5Gi
@@ -130,6 +239,7 @@ spec:
       name: postgres-data
     spec:
       accessModes: ["ReadWriteOnce"]
+      storageClassName: dev-ephemeral
       resources:
         requests:
           storage: 2Gi
@@ -200,6 +310,7 @@ spec:
       name: minio-data
     spec:
       accessModes: ["ReadWriteOnce"]
+      storageClassName: dev-ephemeral
       resources:
         requests:
           storage: 10Gi

deploy/k8s/dev/ingress-dev.yaml

@@ -8,4 +8,12 @@ spec:
   rules:
   - host: dexorder.local
     http:
-      paths: []
+      paths:
+      # Web application at root
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ai-web
+            port:
+              number: 5173

deploy/k8s/dev/kustomization.yaml

@@ -1,13 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-# Note: namespaces are defined in base; workloads go to dexorder-system
-namespace: dexorder-system
-
 # Base resources (includes security policies)
 resources:
   - ../base
   - infrastructure.yaml
+  - storage-class.yaml
+  - configs/gateway-config.yaml
+  - gateway-health-ingress.yaml
 
 # Dev-specific patches
 patches:
@@ -15,6 +15,14 @@ patches:
   - path: agent-quotas-patch.yaml
   # Allow local registry images
   - path: admission-policy-patch.yaml
+  # Web environment variables for dev
+  - path: web-dev-patch.yaml
+  # Web ingress for dev (no TLS, dexorder.local)
+  - path: web-ingress-patch.yaml
+  # Gateway dev overrides (use local image)
+  - path: gateway-dev-patch.yaml
+  # Gateway ingress for dev (no TLS, dexorder.local)
+  - path: gateway-ingress-patch.yaml
 
 # ConfigMaps for service configs
 configMapGenerator:
@@ -34,3 +42,24 @@ secretGenerator: []
 
 generatorOptions:
   disableNameSuffixHash: true
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

deploy/k8s/dev/storage-class.yaml

@@ -0,0 +1,13 @@
+---
+# Development-specific StorageClass with auto-deletion
+# This ensures PVCs and PVs are automatically cleaned up when released
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: dev-ephemeral
+  labels:
+    environment: development
+provisioner: k8s.io/minikube-hostpath
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+allowVolumeExpansion: false

deploy/k8s/dev/web-dev-patch.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ai-web
+spec:
+  template:
+    spec:
+      containers:
+      - name: ai-web
+        image: dexorder/ai-web:latest
+        imagePullPolicy: Never
+        env:
+        - name: VITE_GATEWAY_URL
+          value: "/api"
+        - name: VITE_WS_URL
+          value: "ws://dexorder.local/api/ws/chat"

deploy/k8s/dev/web-ingress-patch.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ai-ingress
+spec:
+  ingressClassName: nginx
+  # Remove TLS for dev
+  tls: []
+  rules:
+  - host: dexorder.local
+    http:
+      paths:
+      # Web application at root
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ai-web
+            port:
+              number: 5173