feat: add tts-gateway service, pinned to nik-gpu for GPU inference

Deploys the Go gRPC gateway and Python/libtorch inference sidecar as one
pod on nik-gpu (nodeSelector/toleration/runtimeClassName: nvidia, sidecar
requesting nvidia.com/gpu: 1), matching the existing GPU device plugin.
Model checkpoint/config are bind-mounted from /data/tts-gateway, added to
gpu-node's Ansible data_dirs for consistency with the other hosts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ansible/host_vars/gpu-node.yaml

@@ -21,7 +21,8 @@ ufw_allowed_ports:
   - { port: "11434", proto: tcp, comment: "Ollama API" }
   - { port: "61208", proto: tcp, comment: "Glances web UI" }
 
-data_dirs: []
+data_dirs:
+  - /data/tts-gateway
 
 # ── nvidia ─────────────────────────────────────────────────────────────────────
 nvidia_driver_version: "570"

manifests/home-services/certs.yaml

@@ -52,3 +52,22 @@ spec:
     - client auth
     - digital signature
     - key encipherment
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: tts-gateway-tls
+  namespace: home-services
+spec:
+  secretName: tts-gateway-tls
+  issuerRef:
+    name: internal-ca-issuer
+    kind: ClusterIssuer
+  commonName: tts-gateway
+  dnsNames:
+    - tts-gateway.home-services.svc.cluster.local
+    - tts-gateway
+  usages:
+    - server auth
+    - digital signature
+    - key encipherment

manifests/home-services/tts-gateway.yaml

@@ -0,0 +1,136 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tts-gateway
+  namespace: home-services
+  labels:
+    app: tts-gateway
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tts-gateway
+  template:
+    metadata:
+      labels:
+        app: tts-gateway
+    spec:
+      runtimeClassName: nvidia
+      nodeSelector:
+        nik4nao.com/gpu: "true"
+      tolerations:
+        - key: spot
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
+      imagePullSecrets:
+        - name: gitea-registry-secret
+      containers:
+        - name: tts-gateway
+          image: gitea.nik4nao.com/nik/tts-gateway:latest
+          ports:
+            - containerPort: 50053
+              name: grpc
+          env:
+            - name: GRPC_PORT
+              value: "50053"
+            - name: INFERENCE_SIDECAR_ADDR
+              value: "localhost:50054"
+            - name: OTEL_ENDPOINT
+              value: "otel-collector-opentelemetry-collector.monitoring.svc.cluster.local:4317"
+            - name: LOG_LEVEL
+              value: "info"
+            - name: LOG_FORMAT
+              value: "json"
+            - name: TLS_DIR
+              value: /tls
+          readinessProbe:
+            tcpSocket:
+              port: 50053
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: 50053
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          volumeMounts:
+            - name: tls
+              mountPath: /tls
+              readOnly: true
+        # Needs an Nvidia GPU for net_g.infer() - only meaningfully runs on
+        # nik-gpu. Shares the pod network with tts-gateway so the Go side can
+        # reach it over localhost, mirroring the --network host setup used
+        # for local docker testing (see tts-gateway/README.md).
+        - name: tts-sidecar
+          image: gitea.nik4nao.com/nik/tts-sidecar:latest
+          ports:
+            - containerPort: 50054
+              name: http
+          env:
+            - name: PORT
+              value: "50054"
+            - name: CONFIG_PATH
+              value: /models/uma.json
+            - name: CHECKPOINT_PATH
+              value: /models/G_790000.pth
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 50054
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 50054
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 500m
+              memory: 3Gi
+              nvidia.com/gpu: 1
+            limits:
+              cpu: "2"
+              memory: 6Gi
+              nvidia.com/gpu: 1
+          volumeMounts:
+            - name: models
+              mountPath: /models
+              readOnly: true
+      volumes:
+        - name: tls
+          secret:
+            secretName: tts-gateway-tls
+        # Checkpoint/config aren't baked into the sidecar image (still an
+        # open decision per tts-gateway/README.md) - bind-mounted from
+        # /data/tts-gateway on nik-gpu instead. Populate with G_790000.pth
+        # and uma.json before this Deployment will go Ready.
+        - name: models
+          hostPath:
+            path: /data/tts-gateway
+            type: Directory
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tts-gateway
+  namespace: home-services
+  labels:
+    app: tts-gateway
+spec:
+  selector:
+    app: tts-gateway
+  ports:
+    - name: grpc
+      port: 50053
+      targetPort: 50053
+  type: ClusterIP