Add complete Paperclip deployment manifests to apps/paperclip

Add all necessary Kubernetes manifests for Paperclip deployment:
- deployment.yaml: Main Paperclip application deployment
- service.yaml: ClusterIP service for Paperclip (port 3100)
- ingress.yaml: Traefik ingress for paperclip.home.imicros.de
- pvc.yaml: 50Gi persistent volume for Paperclip data
- postgres-statefulset.yaml: PostgreSQL 16 StatefulSet
- postgres-service.yaml: PostgreSQL service

This completes the GitOps configuration for Paperclip in the
apps/paperclip directory. The ArgoCD application at apps/app-paperclip.yaml
is already configured to deploy from this path.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/paperclip/deployment.yaml

@@ -0,0 +1,114 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paperclip
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: paperclip
+    spec:
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: Always
+      initContainers:
+      - name: fix-permissions
+        image: busybox:1.36
+        command:
+          - sh
+          - -c
+          - |
+            mkdir -p /paperclip/scripts
+            chmod -R 777 /paperclip
+        volumeMounts:
+        - name: data
+          mountPath: /paperclip
+      containers:
+      - name: paperclip
+        image: ghcr.io/paperclipai/paperclip:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 3100
+          name: http
+          protocol: TCP
+        env:
+        - name: HOST
+          value: "0.0.0.0"
+        - name: PORT
+          value: "3100"
+        - name: PAPERCLIP_HOME
+          value: "/paperclip"
+        - name: PAPERCLIP_PUBLIC_URL
+          value: "https://paperclip.home.imicros.de"
+        - name: PAPERCLIP_DEPLOYMENT_MODE
+          value: "authenticated"
+        - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
+          value: "private"
+        - name: PAPERCLIP_MIGRATION_PROMPT
+          value: "never"
+        - name: PAPERCLIP_MIGRATION_AUTO_APPLY
+          value: "true"
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: paperclip-secrets
+              key: DATABASE_URL
+        - name: BETTER_AUTH_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: paperclip-secrets
+              key: BETTER_AUTH_SECRET
+        - name: AGENT_JWT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: paperclip-secrets
+              key: AGENT_JWT_SECRET
+        - name: OPENAI_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: paperclip-secrets
+              key: OPENAI_API_KEY
+        - name: ANTHROPIC_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: paperclip-secrets
+              key: ANTHROPIC_API_KEY
+        volumeMounts:
+        - name: data
+          mountPath: /paperclip
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 3100
+          initialDelaySeconds: 20
+          periodSeconds: 10
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 3100
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+        resources:
+          limits:
+            cpu: 2000m
+            memory: 4Gi
+          requests:
+            cpu: 500m
+            memory: 1Gi
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: paperclip-data

apps/paperclip/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: paperclip
+  namespace: paperclip
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: paperclip.home.imicros.de
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: paperclip
+            port:
+              number: 3100
+  tls:
+  - hosts:
+    - paperclip.home.imicros.de
+    secretName: paperclip-tls

apps/paperclip/postgres-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperclip-postgres
+  namespace: paperclip
+spec:
+  type: ClusterIP
+  selector:
+    app: paperclip-postgres
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+    protocol: TCP

apps/paperclip/postgres-statefulset.yaml

@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: paperclip-postgres
+  namespace: paperclip
+spec:
+  serviceName: paperclip-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paperclip-postgres
+  template:
+    metadata:
+      labels:
+        app: paperclip-postgres
+    spec:
+      containers:
+      - name: postgres
+        image: postgres:16-alpine
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: postgres
+          containerPort: 5432
+          protocol: TCP
+        env:
+        - name: POSTGRES_DB
+          value: paperclip
+        - name: POSTGRES_USER
+          value: paperclip
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: paperclip-secrets
+              key: POSTGRES_PASSWORD
+        resources:
+          requests:
+            cpu: 250m
+            memory: 512Mi
+          limits:
+            cpu: 1000m
+            memory: 2Gi
+        volumeMounts:
+        - name: postgres-data
+          mountPath: /var/lib/postgresql/data
+          subPath: pgdata
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - pg_isready -U paperclip
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - pg_isready -U paperclip
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 3
+          successThreshold: 1
+          failureThreshold: 3
+  volumeClaimTemplates:
+  - metadata:
+      name: postgres-data
+      annotations:
+        # Prevent Argo CD from deleting this PVC to avoid data loss
+        argocd.argoproj.io/sync-options: Delete=false
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      storageClassName: local-path
+      resources:
+        requests:
+          storage: 20Gi

apps/paperclip/pvc.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperclip-data
+  namespace: paperclip
+  annotations:
+    # Prevent Argo CD from deleting this PVC to avoid data loss
+    argocd.argoproj.io/sync-options: Delete=false
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 50Gi
+  storageClassName: local-path
+  volumeMode: Filesystem

apps/paperclip/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 3100
+    protocol: TCP
+    targetPort: 3100
+  selector:
+    app: paperclip