k8s/digest-cronjob.yaml

# Twice-daily digest scheduler for the TS-03 bot.
#
# The pod only PINGS the bot's webhook on the Mac. The bot then runs the digest itself, because the
# digest needs `claude` and the Sheets credentials, which live on the Mac and not in the cluster.
# So this is a scheduler, not a replacement for the bot: if the Mac is off or asleep, nothing is posted.
#
# It reaches the Mac the same way WAHA does (host.k3d.internal:5055). If the bot receives WhatsApp
# messages, this ping can reach it too, and if that name stops resolving, both break together.
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ts03-digest
  namespace: waha
spec:
  schedule: "0 8,22 * * *"            # 08:00 and 22:00
  timeZone: "Asia/Singapore"          # needs Kubernetes 1.27+; check: kubectl explain cronjob.spec.timeZone
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 7200       # a start missed by more than 2 h (cluster down) is skipped, not fired late
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 5
  jobTemplate:
    spec:
      backoffLimit: 4                 # retries only when the ping itself fails (Mac asleep, name not resolving)
      activeDeadlineSeconds: 600
      ttlSecondsAfterFinished: 86400
      template:
        spec:
          restartPolicy: Never
          hostAliases:                      # pin the Mac: CoreDNS lost host.k3d.internal
            - ip: "192.168.5.2"
              hostnames: ["host.k3d.internal"]
          containers:
            - name: ping
              image: curlimages/curl:latest
              imagePullPolicy: IfNotPresent
              env:
                - name: HOOK_SECRET
                  valueFrom:
                    secretKeyRef:
                      name: waha-secrets
                      key: HOOK_SECRET
              command: ["sh", "-c"]
              args:
                - >-
                  curl -sS --fail --max-time 20 -X POST
                  -H 'Content-Type: application/json'
                  -d '{"event":"ts03.digest"}'
                  "http://host.k3d.internal:5055/hook/${HOOK_SECRET}"