- /metrics is bearer-protected via METRICS_TOKEN; the endpoint carries
authorization.credentials (pargar-app/metrics-token) so Prometheus
scrapes it the same way the live probe does.
- disabled by default: plain 'helm template' renders byte-identical;
values-apollo enables it (enabled: true, interval 30s already present).
- kube-prometheus (ns infra) selects ServiceMonitors in all namespaces;
its operator holds cluster-wide secret read to resolve the credential.
randAlphaNum fallbacks silently minted new db/redis/rustfs passwords on
every cluster-less render (always the case under Argo CD's helm
template), overwriting live credentials. Fresh installs now get a clear
error demanding explicit values; helm upgrades are unaffected (lookup
preserves existing secrets).
Bare string items rendered an invalid Deployment spec (LocalObjectReference
is a struct) which made Argo CD's strategic-merge patch fail with
'cannot restore struct from: string' on both Deployments.
- ci: run build jobs on the runner's default linux-amd64 label
- deploy: pin apollo images to 0.3.6 (built+pushed by CI on this tag)
Same app code as v0.3.5; first release deployed via Gitea Actions
(build) + Argo CD (rollout) instead of manual build/import/helm.
- Raise Traefik read timeout to 1h (compose dev/prod + k3s HelmChartConfig)
so admin video uploads up to 200MB no longer 502 mid-upload.
- Migration 0029: cascade watch/quiz history on lesson delete and unlink
dependent lessons, so removing a lesson or chapter stops 500ing.
- Add the Apollo cluster Helm overlay (values-apollo.yaml) for the deployed
environment.
- k3s Traefik chart config also enables access logs, cross-namespace
IngressRoutes, and fixes the Prometheus scrape port.
Bump appVersion/product.go/values tags to 0.2.1; chart version 0.2.3.
Shared NAT egress makes client IP unusable for uniqueness checks. Gate the
behavior behind REGISTRATION_ENFORCE_IP (default false) for public/invite signup.
ahp