# OPC Gateway — Deploy Notes (SIENTIAPDE-1972)

This repo has no Dockerfile and no `values/` directory — that's by design (see
below). This doc captures what the Helm, container-images, and platform repos
need to know to deploy the gateway. Cross-reference:
`docs/superpowers/specs/2026-07-13-opc-gateway-design.md` (§9/§10/§12).

## Entrypoint & image

- Runs as `ingestor.app` (`PYTHON_APP` entrypoint), cloned from Gitea at pod
  start onto the shared **`sientia-module`** base image (Python 3.11+).
- No repo-local Dockerfile: images are centralized in
  `sientia-container-images`.
- New pip deps that must be present in the image / library distribution
  (see `requirements.txt`):
  - `nats-py>=2.6`
  - `grpcio>=1.60`
  - `grpcio-tools>=1.60`
  - the `sientia_do` release that includes SIENTIAPDE-1590 (generic
    Mongo/MinIO/Postgres methods used by the gateway).

## Env (new since the ingestor)

From `.env.example`, `# OPC Gateway` block:

- `NATS_URL`
- `NATS_WRITE_SUBJECT`
- `NATS_QUEUE`
- `GRPC_ENABLED`
- `GRPC_PORT`
- `CERT_BUCKET`
- `CERT_CACHE_DIR`
- `WRITE_TIMESTAMP`
- `WRITE_QUALITY`
- `WRITE_MIN_PAUSE_S`
- `IDLE_CONN_MAX_S`

Plus MinIO (client cert storage) and Postgres (`write_status` updates):

- `MINIO_ENDPOINT`, `MINIO_ACCESS_KEY`, `MINIO_SECRET_KEY`, `MINIO_SECURE`
- `POSTGRES_HOST`, `POSTGRES_PORT`, `POSTGRES_USER`, `POSTGRES_PASSWORD`,
  `POSTGRES_DBNAME`, `POSTGRES_MIN_CONNECTIONS`, `POSTGRES_MAX_CONNECTIONS`

## Health probe

Exec probe (platform DataOps standard):

```
curl -sf http://localhost:9090/metrics | grep -q '^app_up{.*} 1'
```

Verified: `ingestor/app.py` sets `metrics.APP_UP.labels(pod_id=...).set(1)`
right after `start_http_server(HTTP_METRICS_PORT, default 9090)` in
`start_prometheus_server()`, and `.set(0)` on shutdown in the main loop's
`finally`/exit path. A runtime check (prometheus_client HTTP server, gauge
set to 1, scraped over HTTP) produced the exposition line
`app_up{pod_id="x"} 1.0`, which matches the probe regex.

## waitForDependencies

Init-container wait list: **Gitea, MongoDB, Redis, Postgres, MinIO, NATS**.

NATS is also tolerated at runtime: the app starts even if NATS is
unreachable and the `nats-py` client retries/reconnects internally
(`ingestor/adapters/nats_consumer.py` — no custom reconnect logic, relies on
nats-py's built-in reconnection); only the first connection failure should
raise a notification, not every retry.

## NetworkPolicy

- Egress: Mongo, Redis, Postgres, MinIO, NATS, OPC servers (port 4840).
- Ingress: Prometheus scrape on 9090.
- gRPC port (default 50051): **internal-only**, no auth — there is no
  consumer yet. Only add an ingress rule when a real caller appears, per the
  feature owner (Vitor Pimentel).

## Cert cache

- `CERT_CACHE_DIR` (default `/tmp/opc-certs`) must be writable —
  `emptyDir`/tmpfs, since the pod root filesystem is read-only.
- Certs are sourced from MinIO bucket `sientia-dataops` + Mongo collection
  `platform_certificates`.

## ServiceMonitor

- Label `release: kube-prometheus-stack`.

## Cross-repo integration gates

- Subscription v2 + gRPC persist land at **SIENTIAPDE-1974** (Orchestrator).
- `write_status` column via Flyway (`sientia-dataops-database-migrations`) +
  the Laborious DataFrame change land at **SIENTIAPDE-1975**.
- NATS broker provisioning on the air-gapped platform is
  **SIENTIAPDE-1985**.