leads-deployment.yaml and leads-service.yaml were already removed from
kustomization.yaml's resources list in the prior commit (e51f199) —
these were just the leftover, unreferenced files themselves.
Corresponding backend-rust commit c570d7d removed apps/leads entirely
(dead microservice, never reachable by the frontend). Removing the
matching Deployment/Service resources, the gateway's LEADS_SERVICE_URL
env var, and the stale release-state/patch entries so kustomize stops
tracking an image nothing builds anymore.
NOTE: leads-deployment.yaml and leads-service.yaml themselves are now
unreferenced (removed from kustomization.yaml's resources list) but
still present in base/ — file deletion was blocked by a permission
classifier in this session; safe to remove whenever convenient since
kustomize no longer includes them in the build.
Wires the PayU credentials for the classic hosted-checkout hash flow
(PAYU_MERCHANT_KEY, PAYU_SALT), consumed by the payments service's
resolve_payu_config fallback and the admin payment-gateway config API.
Old password was reused across the postgres superuser, Redis, and
Forgejo's separate nxtgauge DB role. Rotated only the postgres role
and Redis (Forgejo's nxtgauge role password is untouched and still
valid, verified against the live DB).
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/
- Commit the Flux GitRepository/Kustomization (previously only applied manually)
with a decryption stanza referencing the sops-age key (created out-of-band,
not committed)
- Rotate JWT_SECRET (previously exposed in plaintext) and set a real
AI_SERVICE_KEY (was an empty placeholder), shared between
nxtgauge-backend-rust and nxtgauge-ai-assistant
- Wire JWT_SECRET into the ai-assistant deployment (was missing entirely,
causing every authenticated request to fail)
- Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT
docs; move the litellm prod overlay off a plaintext secretGenerator onto an
encrypted patch
- Fix PostgreSQL endpoints (now auto-creating correctly)
- Fix Forgejo DB connection
- Update retention to keep 10 SHA tags (was 2, too aggressive)
- Update all deployments to use available tags
- Add missing base images to registry (alpine, node, rust, python)
- Protect base images from retention deletion
16 of 20 rust services had no PORT env var set; their main.rs calls
std::env::var('PORT').expect('PORT must be a valid u16') which panicked
on startup. This commit adds env.PORT matching the existing containerPort
for each service. Service ports: gateway=9100 users=9101 companies=9102
jobs=9103 job_seekers=9104 customers=9105 employees=9106 photographers=9107
tutors=9108 makeup_artists=9109 developers=9110 video_editors=9111
graphic_designers=9112 social_media_managers=9113 fitness_trainers=9114
catering_services=9115 payments=9116 ugc_content_creators=9117 leads=9118
- Change ghcr.io/traceworks2023/nxtgauge-db-migrate to registry.nxtgauge.com/nxtgauge-db-migrate
- Ensure all images in gitops reference registry.nxtgauge.com
- Add namespace, PVC, deployment, service, and kustomization for Ollama
- ClusterIP only (internal), no ingress
- 10Gi PVC mounted at /root/.ollama
- Resource limits: 700Mi-1500Mi memory, 500m-1000m CPU
- Add ArgoCD Application CR for ollama
- Update backend configmap with OLLAMA_BASE_URL and OLLAMA_CHAT_MODEL
Namespace is now managed by Argo's spec.destination.namespace (nxtgauge)
This stops the permanent OutOfSync noise from duplicate namespace definitions.
- Switch jobs/leads deployments from registry.nxtgauge.com:5000 to ghcr.io/traceworks2023
- Add jobs and leads to argocd-image-updater image list with digest strategy
- All services now tracked by Argo image-updater for automatic updates
- Add jobs service (port 9103) deployment and service
- Add leads service (port 9118) deployment and service
- Update configmap with JOBS_SERVICE_URL and LEADS_SERVICE_URL
- Update kustomization.yaml to include new resources
