Initial cursor-devbox: image, deploy manifests, and Flux SHA automation.

Owns Dockerfile/CI and node1 workload YAML; ImagePolicy elects run_number-sha tags and ImageUpdateAutomation commits them into deploy/.

deploy/010-namespace-secrets.yaml

@@ -0,0 +1,61 @@
+# Namespace, DCR pull secret, SSH allowlist, Service.
+# Reconciled by Flux Kustomization cursor-devbox (path ./deploy) on node1-k3s.
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cursor-devbox
+  labels:
+    name: cursor-devbox
+  annotations:
+    linkerd.io/inject: disabled
+
+---
+# Replicate federated DCR RO credentials for kubelet imagePullSecrets.
+apiVersion: secret-adapter.trinitysan.by/v1
+kind: SecretAdapter
+metadata:
+  name: dcr-registry-auth-ro
+  namespace: cursor-devbox
+spec:
+  name: dcr-registry-auth-ro
+  namespace: cursor-devbox
+  type: kubernetes.io/dockerconfigjson
+  waitForSources: true
+  syncInterval: 60
+  stringData:
+    .dockerconfigjson: ${federated-secrets.dcr-registry-auth-ro.".dockerconfigjson"}
+
+---
+# Hardcoded allowlist: laptop SSH public keys (not secrets).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cursor-devbox-authorized-keys
+  namespace: cursor-devbox
+data:
+  authorized_keys: |
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDbyPCd5RhlTZYCIgmrSGR6ugnwI513vzHf0qvUP3pGf8mYVd68G6CLu9OXJxFv+LKo2eT8H3ToxLpuG0iiIWz+4rJrNXTJInU2lqrcMsHhLoo1XCs7OAARYiIp7Pl4XKcLdbiXwdL2XUsHImv7cjmaD6jGJ3yR+q9t6jORQEB/h6nUc0MMkNKLIrUyJSlZtWRp22ymGnEqiwKl9doukii6QBhY1k+i9oW09ln6gbFTol9KoONkJ74b2iKw5abZwyjjXuXaE1b98/nmI30MYs8VMJC/w9pEZbmVEflb1k4+C1IE5llwmievjNWpWlZt38uzvGTLbiC9mMIewwFm4UsT5ASLpYKBdFrCaK4JIOTCdJt+SMInkzz0rArCNPMBwZIjBgCFSM33nJsX4gbf/l/rnVtLjXr86rF5s9SOSVyQmjPJoBigqyGw45H2CrB7iTqqWGCpPTnXbzzspiIQGYXLW5+5/4wARCPO0KXYcPgg4Vzh5z+dMcFKJvc8XhocZCc= aaa@LAPTOP-08PG1IL5
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDK+dk9MtPgRZr7638SASpbJK7z+XkmBesXRlozTFqvT0X6gKk+75kyqNR2W+ZXDwiiWuXS2t9Dbdk9Xpuj2uWaUE0D+n3NOFEQV27Zd1ZTMeLlf3ukSLhb7un0pFHXQXvPn2Iwhh5zCyTDvIWU1rHUgBmakmxoRZ6zwJdsZX/yZHurts//7Dvb2xKKYAq4MFMAB+s6Ch80q6kCnHcByJVFyVLfOUVcNzHGUQbbj4pft2QYiTVxqTBZdvdWQvdBRkKjV2oK/mRUfGsdwmk+ldT65hdcFjbG3oG4hD3g2+AJC+/vN/xqlCeht/TU/Ei4GMF3UB3ank7z1rsGbU1T5lDoFWBWMg+tgw7ZdbYD+HIi/kuQU3FKM2xekB2fgpzuu5GQynjflygBmuQQp5/HAJDoxrkt+Yn79QX6aan8xXcHnt600Bm7SWfnsCl6BpcaD/8f2Lr8CcFCN5pcG020gvLSVdok71dB27NQ/2HOax1i0WQTZVjDrL6kMwRb37njr/k= svv@LAPTOP-08PG1IL5
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cursor-devbox
+  namespace: cursor-devbox
+  annotations:
+    service.kubernetes.io/topology-mode: Auto
+spec:
+  selector:
+    app: cursor-devbox
+  ports:
+    - name: ssh
+      port: 22
+      targetPort: ssh
+      protocol: TCP
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP

deploy/020-statefulset.yaml

@@ -0,0 +1,113 @@
+# StatefulSet: OpenSSH workspace + DinD sidecar.
+# Image tag is updated by Flux ImageUpdateAutomation (SHA-bearing run_number-sha tags).
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: cursor-devbox
+  namespace: cursor-devbox
+spec:
+  serviceName: cursor-devbox
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cursor-devbox
+  template:
+    metadata:
+      labels:
+        app: cursor-devbox
+      annotations:
+        linkerd.io/inject: disabled
+    spec:
+      terminationGracePeriodSeconds: 30
+      imagePullSecrets:
+        - name: dcr-registry-auth-ro
+      containers:
+        - name: ssh
+          image: dcr.trinitysan.by/infra/cursor-devbox:latest # {"$imagepolicy": "flux-system:cursor-devbox"}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: ssh
+              containerPort: 22
+            - name: http
+              containerPort: 8080
+          env:
+            - name: DOCKER_HOST
+              value: tcp://127.0.0.1:2375
+            - name: HOME
+              value: /home/developer
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - SYS_PTRACE
+          resources:
+            requests:
+              cpu: "750m"
+              memory: 3Gi
+            limits:
+              cpu: "4"
+              memory: 8Gi
+          readinessProbe:
+            tcpSocket:
+              port: ssh
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: ssh
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          volumeMounts:
+            - name: home
+              mountPath: /home/developer
+              subPath: home
+            - name: authorized-keys
+              mountPath: /etc/ssh-authorized-keys
+              readOnly: true
+        - name: dind
+          image: docker:27-dind
+          imagePullPolicy: IfNotPresent
+          args:
+            - --host=tcp://0.0.0.0:2375
+            - --tls=false
+          env:
+            - name: DOCKER_TLS_CERTDIR
+              value: ""
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              cpu: "250m"
+              memory: 1Gi
+            limits:
+              cpu: "2"
+              memory: 4Gi
+          readinessProbe:
+            tcpSocket:
+              port: 2375
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          volumeMounts:
+            - name: home
+              mountPath: /var/lib/docker
+              subPath: docker
+            - name: dind-run
+              mountPath: /var/run
+      volumes:
+        - name: authorized-keys
+          configMap:
+            name: cursor-devbox-authorized-keys
+        - name: dind-run
+          emptyDir: {}
+  volumeClaimTemplates:
+    - metadata:
+        name: home
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: local-storage
+        resources:
+          requests:
+            storage: 30Gi

deploy/030-ingress.yaml

@@ -0,0 +1,33 @@
+# Traefik TCP SSH + TrinityIngress HTTP health.
+
+---
+# Traefik TCP :2222 → OpenSSH in the pod (plain SSH; HostSNI catch-all).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: cursor-devbox-ssh
+  namespace: cursor-devbox
+spec:
+  entryPoints:
+    - ssh
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: cursor-devbox
+          port: 22
+
+---
+# DNS A record + HTTPS front for the tiny HTTP health page; SSH uses Traefik TCP :2222.
+apiVersion: ingress.trinitysan.by/v1
+kind: TrinityIngress
+metadata:
+  name: cursor-devbox
+  namespace: cursor-devbox
+spec:
+  hostname: devbox.trinitysan.by
+  targetTraefikIP: "91.210.106.53"
+  serviceRef:
+    namespace: cursor-devbox
+    name: cursor-devbox
+    port: 8080
+  certificateReclaimPolicy: Retain