ai-guard has been in ImagePullBackOff for 14+ days: no Dockerfile exists
in its source repo so no image was ever successfully built by CI, it
has no Kubernetes Service (unreachable even if the pod were healthy),
and its own dependencies (llm-guard, presidio) were never deployed.
Nothing currently routes through it anyway — both AI consumers call
LiteLLM directly. Scaling to 0 stops the wasted pull-retry churn until
it's properly rebuilt (Phase 3 of the target architecture).
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/
- Commit the Flux GitRepository/Kustomization (previously only applied manually)
with a decryption stanza referencing the sops-age key (created out-of-band,
not committed)
- Rotate JWT_SECRET (previously exposed in plaintext) and set a real
AI_SERVICE_KEY (was an empty placeholder), shared between
nxtgauge-backend-rust and nxtgauge-ai-assistant
- Wire JWT_SECRET into the ai-assistant deployment (was missing entirely,
causing every authenticated request to fail)
- Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT
docs; move the litellm prod overlay off a plaintext secretGenerator onto an
encrypted patch
16 of 20 rust services had no PORT env var set; their main.rs calls
std::env::var('PORT').expect('PORT must be a valid u16') which panicked
on startup. This commit adds env.PORT matching the existing containerPort
for each service. Service ports: gateway=9100 users=9101 companies=9102
jobs=9103 job_seekers=9104 customers=9105 employees=9106 photographers=9107
tutors=9108 makeup_artists=9109 developers=9110 video_editors=9111
graphic_designers=9112 social_media_managers=9113 fitness_trainers=9114
catering_services=9115 payments=9116 ugc_content_creators=9117 leads=9118
