- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/
- Commit the Flux GitRepository/Kustomization (previously only applied manually)
with a decryption stanza referencing the sops-age key (created out-of-band,
not committed)
- Rotate JWT_SECRET (previously exposed in plaintext) and set a real
AI_SERVICE_KEY (was an empty placeholder), shared between
nxtgauge-backend-rust and nxtgauge-ai-assistant
- Wire JWT_SECRET into the ai-assistant deployment (was missing entirely,
causing every authenticated request to fail)
- Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT
docs; move the litellm prod overlay off a plaintext secretGenerator onto an
encrypted patch
- frontend: use registry.nxtgauge.com/node:20-alpine
- admin: use registry.nxtgauge.com/node:20-alpine
- ai: use registry.nxtgauge.com/rust:1.87-alpine and alpine:3.20
- All images now use internal registry to avoid Docker Hub rate limits
- Update kustomization.yaml tags and admin base deployment image
- Remove ghcr.io references from admin gitops
Images needed in registry.nxtgauge.com:
- node:20-alpine
- rust:1.87-alpine
- alpine:3.20
Adds Kustomize base+prod overlays for nxtgauge-frontend-solid,
nxtgauge-admin-solid, and nxtgauge-backend-rust (18 services).
ArgoCD Image Updater configured for auto-deploy on high-performance-latest tag.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
