NXTGAUGE_USERS_URL used the short service name "nxtgauge-rust-users",
which only resolves within the same namespace. The prod overlay places
ai-assistant in nxtgauge-ai while the users service is in nxtgauge, so
every help-center search and ticket-creation call failed with a DNS
resolution error (surfaced as a 502 to the client). Use the full
in-cluster FQDN instead.
Was defaulting to plain Ollama with gemma3:270m for every request -
no LLM_PROVIDER or LITELLM_* env vars were set. LiteLLM is already
deployed with purpose-built model aliases per task
(apps/litellm/base/configmap.yaml); this wires ai-assistant to use it.
JWT_SECRET can't reference nxtgauge-backend-rust-secrets (namespace
nxtgauge) from the ai-assistant pod, which the prod overlay places in
nxtgauge-ai — Kubernetes secretKeyRef must be same-namespace. Duplicate
the value into nxtgauge-ai-assistant-secrets instead.
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/
- Commit the Flux GitRepository/Kustomization (previously only applied manually)
with a decryption stanza referencing the sops-age key (created out-of-band,
not committed)
- Rotate JWT_SECRET (previously exposed in plaintext) and set a real
AI_SERVICE_KEY (was an empty placeholder), shared between
nxtgauge-backend-rust and nxtgauge-ai-assistant
- Wire JWT_SECRET into the ai-assistant deployment (was missing entirely,
causing every authenticated request to fail)
- Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT
docs; move the litellm prod overlay off a plaintext secretGenerator onto an
encrypted patch
- Add nxtgauge-ai-assistant deployment, service, and kustomization overlays
- Update users service to commit 430711a with AI endpoints
- Set NXTGAUGE_USERS_URL and AI_SERVICE_KEY env vars
