# Infrastructure — Exoscale Swiss Hosting

All infrastructure is on Exoscale, zone ch-gva-2 (Geneva, Switzerland).
Swiss data sovereignty under FADP. Outside US legal jurisdiction.

## Account

- Provider: Exoscale
- Organization: "The Recognition Protocol"
- Account type: Individual
- CLI: `exo` (installed via homebrew)
- Zone: ch-gva-2

## Services

### PostgreSQL (DBaaS)

- Name: `temple-council-db`
- Plan: hobbyist-2
- Zone: ch-gva-2
- IP filter: `0.0.0.0/0` (opened for Gitea connection — tighten in production)
- Databases: `defaultdb` (system), `gitea` (Gitea data)
- Password retrieved from: `exo dbaas show temple-council-db --zone ch-gva-2`

### Kubernetes (SKS)

- Cluster name: `temple-council`
- Zone: ch-gva-2
- Node pool: 1x standard.small
- Kubeconfig: `~/.kube/exoscale-temple-council.yaml`
- Namespace: `temple-council`
- Security group: `default` (attached manually — was missing initially)

### Object Storage

- Bucket: `temple-council-identities`
- Zone: ch-gva-2

### Gitea (Self-hosted Git)

- URL: `http://185.19.29.94`
- Exposed via: LoadBalancer service on K8s
- Admin user: `heaviness510`
- Database: `gitea` on `temple-council-db` PostgreSQL
- Storage: emptyDir (NOT persistent — data lost on pod restart)
- Repositories:
  - `heaviness510/shorashim` — Torah as AI specification

### AnythingLLM

- URL: `http://185.19.28.73`
- Exposed via: LoadBalancer service on K8s
- Storage: emptyDir (NOT persistent)
- Workspaces: Not yet configured on Exoscale instance

## Domain

- **Domain:** `shorashim.ch`
- **Registrar:** Infomaniak (Swiss)
- **Add-ons:** DNS Fast Anycast, Domain Privacy
- **Registrant:** Karp Scott (Individual)
- **Email:** kSuite free tier — 1 address @shorashim.ch

## Known Issues

- No persistent storage on K8s (need Exoscale Block Storage CSI driver)
- No HTTPS (need cert-manager + Let's Encrypt + domain — domain now registered)
- AWS instances still running (not shut down)
- AnythingLLM workspaces not configured
- DNS not yet pointed to infrastructure (185.19.29.94)

## Security Group Rules

Ports opened on default security group:
- 80 (HTTP)
- 22 (SSH)
- 30575, 31345 (K8s NodePorts for services)