fix: release v0.2.1 lesson deletes and large uploads

- Raise Traefik read timeout to 1h (compose dev/prod + k3s HelmChartConfig)
  so admin video uploads up to 200MB no longer 502 mid-upload.
- Migration 0029: cascade watch/quiz history on lesson delete and unlink
  dependent lessons, so removing a lesson or chapter stops 500ing.
- Add the Apollo cluster Helm overlay (values-apollo.yaml) for the deployed
  environment.
- k3s Traefik chart config also enables access logs, cross-namespace
  IngressRoutes, and fixes the Prometheus scrape port.

Bump appVersion/product.go/values tags to 0.2.1; chart version 0.2.3.

deploy/compose/compose.dev.yaml

@@ -63,6 +63,9 @@ services:
       - --entrypoints.web.http.redirections.entrypoint.permanent=true
       - --entrypoints.web.http.aliasHeadersStrategy=delete
       - --entrypoints.websecure.http.aliasHeadersStrategy=delete
+      # Allow slow, large uploads (admin video ≤ 200MB); default is 60s.
+      - --entrypoints.web.transport.respondingTimeouts.readTimeout=3600
+      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=3600
       # Dev: Traefik default certificate (browser warning expected on localhost).
       - --api.dashboard=true
       - --api.insecure=true

deploy/compose/compose.prod.yaml

@@ -71,6 +71,9 @@ services:
       - --entrypoints.web.http.redirections.entrypoint.permanent=true
       - --entrypoints.web.http.aliasHeadersStrategy=delete
       - --entrypoints.websecure.http.aliasHeadersStrategy=delete
+      # Allow slow, large uploads (admin video ≤ 200MB); default is 60s.
+      - --entrypoints.web.transport.respondingTimeouts.readTimeout=3600
+      - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=3600
       - --certificatesresolvers.le.acme.email=${ACME_EMAIL:?ACME_EMAIL must be set}
       - --certificatesresolvers.le.acme.storage=/data/acme.json
       - --certificatesresolvers.le.acme.httpchallenge=true

deploy/helm/pargar/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: pargar
 description: Pargar gated LMS - Go API, Next.js frontend, Postgres, Redis, S3-compatible storage
 type: application
-version: 0.2.2
-appVersion: "0.2.0"
+version: 0.2.3
+appVersion: "0.2.1"
 keywords:
   - lms
   - pargar

deploy/helm/pargar/values-apollo.yaml

@@ -0,0 +1,81 @@
+backend:
+  autoscaling:
+    enabled: false
+  env:
+    devMode: "false"
+    donationEnabled: "true"
+    otelEndpoint: http://tempo.infra.svc.cluster.local:4318
+    physicalCertEnabled: "false"
+    seedCurriculum: "false"
+  existingSecret: pargar-app
+  image:
+    pullPolicy: IfNotPresent
+    repository: pargar-backend
+    tag: 0.2.1
+  metrics:
+    serviceMonitor:
+      enabled: true
+      interval: 30s
+  podDisruptionBudget:
+    enabled: true
+    minAvailable: 1
+  replicaCount: 3
+  resources:
+    limits:
+      cpu: "1"
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+backup:
+  enabled: true
+  persistence:
+    size: 2Gi
+  retentionDays: 7
+  schedule: 0 3 * * *
+certManager:
+  enabled: false
+frontend:
+  autoscaling:
+    enabled: false
+  image:
+    pullPolicy: IfNotPresent
+    repository: pargar-frontend
+    tag: 0.2.1
+  podDisruptionBudget:
+    enabled: false
+  replicaCount: 2
+  resources:
+    limits:
+      cpu: "1"
+      memory: 512Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+global:
+  domain: pargar.panahifar.ir
+  frontendOrigins: https://pargar.panahifar.ir
+  imageRegistry: ""
+  publicUrl: https://pargar.panahifar.ir
+imagePullSecrets: []
+ingress:
+  enabled: true
+  tls:
+    enabled: true
+    existingSecret: pargar-wildcard-tls
+  useIngressRoute: true
+networkPolicy:
+  enabled: false
+postgres:
+  enabled: true
+  persistence:
+    size: 10Gi
+redis:
+  enabled: true
+  persistence:
+    size: 2Gi
+rustfs:
+  consoleEnable: false
+  enabled: true
+  persistence:
+    size: 20Gi

deploy/helm/pargar/values-prod.yaml

@@ -22,7 +22,7 @@ backend:
   replicaCount: 2
   image:
     repository: backend
-    tag: "0.2.0"
+    tag: "0.2.1"
     pullPolicy: IfNotPresent
   existingSecret: pargar-app
   env:
@@ -49,7 +49,7 @@ frontend:
   replicaCount: 2
   image:
     repository: frontend
-    tag: "0.2.0"
+    tag: "0.2.1"
     pullPolicy: IfNotPresent
   resources:
     requests:

deploy/k3s/traefik-helmchartconfig.yaml

@@ -0,0 +1,43 @@
+# k3s Traefik customisation (HelmChartConfig for the built-in `traefik` chart).
+#
+# Apply with:  kubectl apply -f deploy/k3s/traefik-helmchartconfig.yaml
+#
+# Why: Traefik's entrypoint `readTimeout` defaults to 60s and covers reading the
+# *entire request including the body*. Admin video uploads (up to 200MB) that take
+# longer than 60s were cut off with a 502 before reaching the backend. Raise it to
+# 1 hour (use 0 to disable entirely).
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  failurePolicy: reinstall
+  valuesContent: |-
+    # ACCESSLOG tile -> ON; access logs go to container stdout (kubectl logs).
+    # Key is logs.access.enabled on the chart k3s ships (40.1.5);
+    # the top-level accessLog.enabled only exists on newer chart versions.
+    logs:
+      access:
+        enabled: true
+    # Allow IngressRoutes to reference Services living in other namespaces,
+    # e.g. argocd-server in `argocd`.
+    providers:
+      kubernetesCRD:
+        allowCrossNamespace: true
+    deployment:
+      podAnnotations:
+        # fix: metrics entrypoint listens on :9100, annotation said 8082
+        prometheus.io/port: "9100"
+        prometheus.io/scrape: "true"
+    # Allow slow, large uploads (admin video upload ≤ 200MB) to finish.
+    # Default is 60s; 3600s = 1h. Set to 0 to disable the cap.
+    ports:
+      web:
+        transport:
+          respondingTimeouts:
+            readTimeout: 3600
+      websecure:
+        transport:
+          respondingTimeouts:
+            readTimeout: 3600