Deploy com Docker e Kubernetes

docker pull ghcr.io/diillson/chatcli:1.212.1
docker pull ghcr.io/diillson/chatcli-operator:1.212.1

cosign verify ghcr.io/diillson/chatcli:1.212.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'https://github.com/diillson/chatcli/'

# Imagem do servidor (a partir da raiz do repositório)
docker build -t chatcli:dev --build-arg VERSION=dev .

# Imagem do operator: também da raiz (o operator/go.mod substitui o módulo raiz por ../)
docker build -f operator/Dockerfile -t chatcli-operator:dev .

export CHATCLI_SERVER_TOKEN="$(openssl rand -hex 32)"
export ANTHROPIC_API_KEY=sk-ant-xxx

docker run -d --name chatcli \
  -p 50051:50051 -p 9090:9090 \
  -e CHATCLI_BIND_ADDRESS=0.0.0.0 \
  -e CHATCLI_SERVER_TOKEN \
  -e LLM_PROVIDER=CLAUDEAI \
  -e ANTHROPIC_API_KEY \
  -v chatcli-home:/home/nonroot \
  ghcr.io/diillson/chatcli:1.212.1

docker logs chatcli | grep listening          # 🚀 ChatCLI server listening on 0.0.0.0:50051
docker inspect --format '{{.State.Health.Status}}' chatcli   # healthy
curl -s localhost:9090/healthz                 # ok

CHATCLI_ALLOW_INSECURE=true chatcli connect localhost:50051 --token "$CHATCLI_SERVER_TOKEN"

# tls/ contém server.crt, server.key e ca.crt, legíveis pelo UID 65532
docker run -d --name chatcli -p 50051:50051 \
  -e CHATCLI_BIND_ADDRESS=0.0.0.0 -e CHATCLI_SERVER_TOKEN \
  -e LLM_PROVIDER=CLAUDEAI -e ANTHROPIC_API_KEY \
  -e CHATCLI_SERVER_TLS_CERT=/etc/chatcli/tls/server.crt \
  -e CHATCLI_SERVER_TLS_KEY=/etc/chatcli/tls/server.key \
  -v "$PWD/tls:/etc/chatcli/tls:ro" \
  -v chatcli-home:/home/nonroot \
  --no-healthcheck \
  ghcr.io/diillson/chatcli:1.212.1

chatcli connect localhost:50051 --tls --ca-cert tls/ca.crt --token "$CHATCLI_SERVER_TOKEN"

git clone https://github.com/diillson/chatcli.git && cd chatcli
export CHATCLI_SERVER_TOKEN="$(openssl rand -hex 32)"
export LLM_PROVIDER=CLAUDEAI ANTHROPIC_API_KEY=sk-ant-xxx
docker compose up -d --build

CHATCLI_ALLOW_INSECURE=true chatcli connect localhost:50051 --token "$CHATCLI_SERVER_TOKEN"

# docker-compose.override.yml
services:
  chatcli-server:
    # Forma exec, sem shell:
    healthcheck:
      test: ["CMD", "/usr/local/bin/grpc-health-probe", "-addr=:50051", "-tls",
             "-tls-ca-cert", "/etc/chatcli/tls/ca.crt", "-tls-server-name", "localhost"]

kubectl -n chatcli create secret generic chatcli-jwt --from-literal=secret="$(openssl rand -hex 32)"
helm upgrade chatcli oci://ghcr.io/diillson/charts/chatcli --version 1.212.1 -n chatcli \
  --reset-then-reuse-values --set security.jwtSecretRef.name=chatcli-jwt --set security.jwtSecretRef.key=secret

# values-tls.yaml
tls:
  enabled: true
  existingSecret: chatcli-tls              # Secret kubernetes.io/tls, montado em /etc/chatcli/tls

kubectl -n chatcli create secret generic chatcli-llm-keys \
  --from-literal=CHATCLI_SERVER_TOKEN="$(openssl rand -hex 32)" \
  --from-literal=ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY"
helm install chatcli oci://ghcr.io/diillson/charts/chatcli --version 1.212.1 -n chatcli \
  --set llm.provider=CLAUDEAI --set secrets.existingSecret=chatcli-llm-keys

llm:
  provider: CLAUDEAI
  model: claude-sonnet-5
fallback:
  enabled: true
  providers:                    # cadeia efetiva: CLAUDEAI -> OPENAI -> GOOGLEAI
    - name: OPENAI
      model: gpt-6-sol
    - name: GOOGLEAI
      model: gemini-3.8-flash

watcher:
  enabled: true
  interval: "15s"
  targets:
    - deployment: api-gateway
      namespace: production
      metricsPort: 9090
      metricsFilter: ["http_requests_*", "http_request_duration_*"]
    - deployment: postgres
      kind: StatefulSet
      namespace: production
    - deployment: nightly-report
      kind: CronJob
      namespace: batch

kubectl -n chatcli patch deploy/chatcli --type=json \
  -p '[{"op":"remove","path":"/spec/strategy/rollingUpdate"},{"op":"replace","path":"/spec/strategy/type","value":"Recreate"}]'

strategy:
  type: Recreate

# JWT de um Secret, mTLS com CA de cliente separada, log de auditoria num volume
tls:
  enabled: true
  existingSecret: chatcli-tls                 # caminhos assumem /etc/chatcli/tls/tls.crt e tls.key
security:
  jwtSecretRef: {name: chatcli-jwt, key: secret}
  tlsClientCA: /etc/chatcli/client-ca/ca.crt
  mtlsRole: viewer
  auditLogPath: /var/log/chatcli/audit.jsonl
extraVolumes:
  - name: client-ca
    secret: {secretName: chatcli-client-ca}
  - name: audit
    emptyDir: {}
extraVolumeMounts:
  - {name: client-ca, mountPath: /etc/chatcli/client-ca, readOnly: true}
  - {name: audit, mountPath: /var/log/chatcli}

# values-ingress.yaml: TLS termina no ingress-nginx, gRPC até o pod
ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: chatcli.example.com
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls:
    - secretName: chatcli-ingress-tls
      hosts: [chatcli.example.com]

kubectl -n chatcli logs deploy/chatcli -f            # o banner e, depois, o log em linhas JSON
kubectl -n chatcli port-forward deploy/chatcli 9090:9090 &
curl -s localhost:9090/healthz                       # ok
curl -s localhost:9090/metrics | grep '^chatcli_server_info'

logging:
  maxSizeMB: 10
  maxBackups: 5
extraEnv:
  - name: LOG_LEVEL              # debug | info | warn | error
    value: info
``` A porta de métricas não tem autenticação; restrinja com `networkPolicy.ingressFrom` onde isso importar.

### Upgrade, rollback, desinstalação

```bash
helm upgrade chatcli oci://ghcr.io/diillson/charts/chatcli --version 1.212.1 \
  -n chatcli --reset-then-reuse-values
helm history chatcli -n chatcli
helm rollback chatcli <revisão> -n chatcli
helm uninstall chatcli -n chatcli