DataKnifeAI · surrealwolf · Aug 16, 2026 · cursor · Aug 16, 2026
diff --git a/README.md b/README.md
@@ -25,6 +25,16 @@ Coder provides secure, on-demand development environments (workspaces) that run
 - **PostgreSQL**: Deployed via [CloudNativePG](https://cloudnative-pg.io/) operator (same pattern as `high-command-postgres` in the cluster)
 - **Storage**: TrueNAS CSI NFS — see [docs/](docs/README.md)
 
+### [Slashbay](https://github.com/DataKnifeAI/slashbay) — Issue-webhook herald
+
+Slashbay receives GitHub/GitLab issue webhooks, triages with a cheap LLM, and berths a Coder `dkai-agent` workspace.
+
+- **Path**: `slashbay/`
+- **Namespace**: `slashbay`
+- **Image**: `harbor.dataknife.net/library/slashbay` (GitLab CI → Harbor `library`)
+- **Ingress**: `slashbay.dataknife.net` (webhooks)
+- **Secrets**: [slashbay/secrets/README.md](slashbay/secrets/README.md)
+
 ## Prerequisites
 
 - [CloudNativePG operator](https://cloudnative-pg.io/documentation/current/installation/) installed on the cluster
@@ -44,6 +54,11 @@ gitops-dev/
 │       └── prd-apps/            # prd-apps cluster overlay
 │           ├── fleet.yaml
 │           └── kustomization.yaml
+├── slashbay/
+│   ├── base/                    # Generic Slashbay manifests
+│   ├── overlays/
+│   │   └── prd-apps/            # Self-contained Fleet overlay
+│   └── secrets/                 # Secret examples (not live values)
 ├── docs/                        # Deployment and operations documentation
 │   └── truenas-csi/             # TrueNAS CSI driver patches and migration
 └── README.md
@@ -65,6 +80,7 @@ postgres://{user}:{password}@{cluster}-rw.{namespace}:5432/{database}?sslmode=di
 ```bash
 kubectl config use-context prd-apps
 kubectl apply -k coder/overlays/prd-apps/
+kubectl apply -k slashbay/overlays/prd-apps/
 ```
 
 ### Fleet (GitOps)

diff --git a/fleet-gitrepo.yaml b/fleet-gitrepo.yaml
@@ -0,0 +1,32 @@
+# Fleet GitRepo — register this repo to deploy Coder + Slashbay to prd-apps
+# Apply to the cluster where Fleet runs (e.g. Rancher management cluster):
+#   kubectl apply -f fleet-gitrepo.yaml
+#
+# If a GitRepo named gitops-dev-prd-apps already exists, add the slashbay
+# path to spec.paths instead of creating a second GitRepo.
+#
+# Requires: Fleet installed, prd-apps cluster registered with label
+# management.cattle.io/cluster-display-name=prd-apps
+# Before Slashbay starts: create secrets — see slashbay/secrets/README.md
+apiVersion: fleet.cattle.io/v1alpha1
+kind: GitRepo
+metadata:
+  name: gitops-dev-prd-apps
+  namespace: fleet-default
+  labels:
+    app: gitops-dev
+    cluster: prd-apps
+    managed-by: gitops
+spec:
+  repo: https://github.com/DataKnifeAI/gitops-dev.git
+  branch: main
+  paths:
+    - coder/overlays/prd-apps
+    - slashbay/overlays/prd-apps
+  targets:
+    - clusterSelector:
+        matchLabels:
+          management.cattle.io/cluster-display-name: prd-apps
+  correctDrift:
+    enabled: true
+  keepResources: true
diff --git a/slashbay/README.md b/slashbay/README.md
@@ -0,0 +1,36 @@
+# Slashbay
+
+[Slashbay](https://github.com/DataKnifeAI/slashbay) — DataKnifeAI issue-webhook herald. Issues dock here, cheap-LLM triage decides if they are work, and a Coder workspace is berthed for a coding agent.
+
+Image is built in GitLab CI (GitHub mirror) and pushed to Harbor. This repo only deploys it.
+
+## Target
+
+| Item | Value |
+|------|--------|
+| Cluster | `prd-apps` |
+| Namespace | `slashbay` |
+| Image | `harbor.dataknife.net/library/slashbay` |
+| Fleet path | `slashbay/overlays/prd-apps` |
+| Ingress | `slashbay.dataknife.net` (nginx; GitHub/GitLab webhooks) |
+| Coder | `https://coder.dataknife.net` (`CODER_ACCESS_URL`) |
+
+## Prerequisites
+
+1. Harbor image exists (`library/slashbay`) and `harbor-registry-secret` in namespace `slashbay`
+2. Application secret `slashbay-secrets` — see [secrets/README.md](secrets/README.md)
+3. DNS for `slashbay.dataknife.net` if webhooks must reach the cluster from GitHub/GitLab.com
+
+## Deployment
+
+```bash
+kubectl config use-context prd-apps
+# secrets first — see secrets/README.md
+kubectl apply -k overlays/prd-apps/
+```
+
+`overlays/prd-apps` is self-contained (no `../../base`) so Fleet can use that directory as the GitRepo path, same as Coder.
+
+Leave `SLASHBAY_DRY_RUN=true` on the ConfigMap until secrets and Coder are ready. Pin the image tag after the first Harbor release (siblings pin `high-command-*:v0.N`).
+
+App-repo copy of these manifests: [DataKnifeAI/slashbay](https://github.com/DataKnifeAI/slashbay) `deploy/`.
diff --git a/slashbay/base/configmap.yaml b/slashbay/base/configmap.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: slashbay-config
+  namespace: slashbay
+  labels:
+    app: slashbay
+    app.kubernetes.io/name: slashbay
+data:
+  SLASHBAY_DRY_RUN: "true"
+  SLASHBAY_STATE_DSN: "sqlite:////data/slashbay.db"
+  SLASHBAY_REPO_ALLOWLIST: "DataKnifeAI/*"
+  SLASHBAY_TRIGGER_EVENTS: "opened,reopened"
+  SLASHBAY_MAX_CONCURRENT: "3"
+  SLASHBAY_TRIAGE_MODEL: "gpt-5-nano"
+  SLASHBAY_TRIAGE_ESCALATE_MODEL: "gpt-5.6-luna"
+  SLASHBAY_TRIAGE_ESCALATE_BELOW: "0.7"
+  CODER_ACCESS_URL: "https://coder.dataknife.net"
+  CODER_TEMPLATE: "dkai-agent"
+  CODER_WORKSPACE_OWNER: "me"
+  GITHUB_API_URL: "https://api.github.com"
+  GITLAB_API_URL: "https://gitlab.com/api/v4"
diff --git a/slashbay/base/deployment.yaml b/slashbay/base/deployment.yaml
@@ -0,0 +1,87 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: slashbay
+  namespace: slashbay
+  labels:
+    app: slashbay
+    app.kubernetes.io/name: slashbay
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: slashbay
+  template:
+    metadata:
+      labels:
+        app: slashbay
+        app.kubernetes.io/name: slashbay
+    spec:
+      serviceAccountName: slashbay
+      imagePullSecrets:
+        - name: harbor-registry-secret
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: slashbay
+          image: harbor.dataknife.net/library/slashbay:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: slashbay-config
+            - secretRef:
+                name: slashbay-secrets
+                optional: true
+          env:
+            - name: SLASHBAY_HOST
+              value: "0.0.0.0"
+            - name: SLASHBAY_PORT
+              value: "8080"
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 2
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: slashbay-data
+        - name: tmp
+          emptyDir: {}
diff --git a/slashbay/base/kustomization.yaml b/slashbay/base/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - configmap.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
diff --git a/slashbay/base/namespace.yaml b/slashbay/base/namespace.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: slashbay
+  labels:
+    app.kubernetes.io/name: slashbay
+    managed-by: gitops
diff --git a/slashbay/base/pvc.yaml b/slashbay/base/pvc.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: slashbay-data
+  namespace: slashbay
+  labels:
+    app: slashbay
+    app.kubernetes.io/name: slashbay
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/slashbay/base/service.yaml b/slashbay/base/service.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: slashbay
+  namespace: slashbay
+  labels:
+    app: slashbay
+    app.kubernetes.io/name: slashbay
+spec:
+  type: ClusterIP
+  selector:
+    app: slashbay
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
diff --git a/slashbay/base/serviceaccount.yaml b/slashbay/base/serviceaccount.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: slashbay
+  namespace: slashbay
+  labels:
+    app: slashbay
+    app.kubernetes.io/name: slashbay
diff --git a/slashbay/overlays/prd-apps/configmap.yaml b/slashbay/overlays/prd-apps/configmap.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: slashbay-config
+  namespace: slashbay
+  labels:
+    app: slashbay
+    app.kubernetes.io/name: slashbay
+data:
+  SLASHBAY_DRY_RUN: "true"
+  SLASHBAY_STATE_DSN: "sqlite:////data/slashbay.db"
+  SLASHBAY_REPO_ALLOWLIST: "DataKnifeAI/*"
+  SLASHBAY_TRIGGER_EVENTS: "opened,reopened"
+  SLASHBAY_MAX_CONCURRENT: "3"
+  SLASHBAY_TRIAGE_MODEL: "gpt-5-nano"
+  SLASHBAY_TRIAGE_ESCALATE_MODEL: "gpt-5.6-luna"
+  SLASHBAY_TRIAGE_ESCALATE_BELOW: "0.7"
+  CODER_ACCESS_URL: "https://coder.dataknife.net"
+  CODER_TEMPLATE: "dkai-agent"
+  CODER_WORKSPACE_OWNER: "me"
+  GITHUB_API_URL: "https://api.github.com"
+  GITLAB_API_URL: "https://gitlab.com/api/v4"
diff --git a/slashbay/overlays/prd-apps/deployment.yaml b/slashbay/overlays/prd-apps/deployment.yaml
@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: slashbay
+  namespace: slashbay
+  labels:
+    app: slashbay
+    app.kubernetes.io/name: slashbay
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: slashbay
+  template:
+    metadata:
+      labels:
+        app: slashbay
+        app.kubernetes.io/name: slashbay
+    spec:
+      serviceAccountName: slashbay
+      imagePullSecrets:
+        - name: harbor-registry-secret
+      # Omit fsGroup — TrueNAS CSI NFS can fail kubelet applyFSGroup (same as Coder postgres).
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+      containers:
+        - name: slashbay
+          image: harbor.dataknife.net/library/slashbay:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: slashbay-config
+            - secretRef:
+                name: slashbay-secrets
+                optional: true
+          env:
+            - name: SLASHBAY_HOST
+              value: "0.0.0.0"
+            - name: SLASHBAY_PORT
+              value: "8080"
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            successThreshold: 1
+            failureThreshold: 2
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: slashbay-data
+        - name: tmp
+          emptyDir: {}