/setup-environment

Stand up a new MeshWeaver/Memex environment on AKS end-to-end — namespace, RWX storage for the shared /data caches (the hard rule), database + migration, secrets/identity, helm apply, ingress/TLS, and the first-boot compile-storm expectations with verification checklist.

• Instructions: You are standing up a **new MeshWeaver/Memex environment** — a new portal instance (its own namespace, database, storage, DNS) on the AKS cluster, or a fresh cluster altogether. The **authoritative, maintained procedure lives in the MeshWeaver repo** — this skill is the map and the non-obvious rules; always read the referenced files before running anything: - `deploy/aks/DEPLOY-RUNBOOK.md` — the end-to-end runbook (images → Bicep infra → OAuth → workload → ingress/TLS/DNS → observability/VPN). - `deploy/aks/README.md`, `deploy/aks/values.aks.yaml`, `deploy/helm/` — the chart and the shared AKS values. - `deploy/aks/envs/<env>/` — one folder per environment (memex-cloud is the template): `deploy.sh`, `portal-pvcs.yaml`, `portal-patch.json`, `portal-ingress.yaml`, `tls.sh`, `migrate-db.sh`. # 0. Decide the shape An *environment* = one namespace on `memexaks-cluster` (rg `memex-aks-rg`; PRIVATE cluster — every kubectl goes through `az aks command invoke -g memex-aks-rg -n memexaks-cluster --command … --file .`). Existing map: ns `memex` = memex.systemorph.com, ns `memex-cloud` = memex.meshweaver.cloud (also the plugin registry). Copy `deploy/aks/envs/memex-cloud/` to `deploy/aks/envs/<newenv>/` and adjust names (namespace, hostnames, PVC sizes, SecretProviderClass, UAMI client ids). Everything below is applied FROM THE REPO — never hand-edit live objects on the cluster; fix the env folder and re-apply. # 1. Storage FIRST — the caches must be durable and SHARED (the hard rule) The portal runs `Deployment__Backend=Filesystem` with `Deployment__DataRoot=/data` (values.aks.yaml). Everything under `/data` — DataProtection keys, the **NodeType assembly cache** (`/data/assembly-cache`), the NuGet cache — and the `/mnt/*` drives MUST live on **ReadWriteMany** PVCs shared by all replicas. A pod-local or ephemeral `/data` means: every restart wipes the compiled-assembly cache, every deploy becomes a mesh-wide recompile-on-activation storm racing the 60s enrichment settl…
• Auto mount: yes
• Launches sub thread: no