Deployment: notion-mcp-remote

arch-deployment-notion-mcp-remote Architecture

architecture active

Project

Component	Purpose	Notes
Tailscale Funnel	Public ingress at <code>notion-mcp-remote.tail5b443a.ts.net</code>	Provisioned by pal-e-services terraform when <code>funnel=true</code>
Namespace + Service + Pod	Standard k8s trio; app listens on :8000	Dockerfile.k8s EXPOSE 8000
PVC	Persists <code>data/tokens.json</code> across pod restarts	<code>k8s/pvc.yaml</code>; single-writer
Harbor	Private image registry; project <code>notion-mcp-remote</code>	Created by <code>tofu apply</code>; robot creds via Woodpecker secrets
Woodpecker CI	Builds on push to main, pushes SHA + latest tags	<code>.woodpecker.yaml</code>; must use internal Harbor URL per SOP
ArgoCD + Image Updater	Watches Harbor tags, writes newTag to overlay kustomization.yaml, syncs	Application managed by pal-e-services terraform
pal-e-services var.services	Declarative service registration: image, port, funnel, overlay path	<code>k3s.tfvars</code>; PR-gated
pal-e-deployments overlay	Kustomize overlay at <code>overlays/notion-mcp-remote/prod/</code>	kustomization.yaml + deployment-patch.yaml; no secrets in git

Tailscale Funnel for public exposure — same pattern as other remote MCP services. No separate domain or cert management.
Kustomize overlay, not inline in pal-e-services — per convention-kustomize-overlay. Image Updater writes newTag into the overlay so ArgoCD sees declarative tag pins.
Secrets created via kubectl before first sync — overlay must not contain real secret data or ArgoCD will clobber on sync (service-onboarding-sop warning).
No Keycloak client — auth is Notion OAuth end-to-end; no pal-e identity layer needed for this service.
No NetworkPolicy changes — service egresses only to api.notion.com; no MinIO/Postgres/Keycloak dependencies.