.github/workflows/trigger-app-builds-from-gitops.yml

@@ -0,0 +1,83 @@
+name: Trigger App Builds From GitOps
+
+on:
+  push:
+    branches:
+      - main
+      - testingcodex
+    paths:
+      - apps/nxtgauge-backend/**
+      - apps/nxtgauge-admin-frontend/**
+      - apps/nxtgauge-frontendwebsite/**
+
+permissions:
+  contents: read
+
+jobs:
+  detect-changes:
+    if: ${{ github.actor != 'github-actions[bot]' && !startsWith(github.event.head_commit.message, 'chore(gitops): update ') }}
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.filter.outputs.backend }}
+      admin: ${{ steps.filter.outputs.admin }}
+      public: ${{ steps.filter.outputs.public }}
+    steps:
+      - name: Checkout GitOps repo
+        uses: actions/checkout@v4
+
+      - name: Detect changed app paths
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            backend:
+              - 'apps/nxtgauge-backend/**'
+            admin:
+              - 'apps/nxtgauge-admin-frontend/**'
+            public:
+              - 'apps/nxtgauge-frontendwebsite/**'
+
+  trigger-backend:
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.backend == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger backend workflow
+        env:
+          TOKEN: ${{ secrets.GITOPS_PAT }}
+        run: |
+          curl -sS -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            https://api.github.com/repos/Traceworks2023/nxtgauge-nov-2025-backend/actions/workflows/build-and-push-ghcr.yml/dispatches \
+            -d '{"ref":"testingcodex"}'
+
+  trigger-admin-frontend:
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.admin == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger admin frontend workflow
+        env:
+          TOKEN: ${{ secrets.GITOPS_PAT }}
+        run: |
+          curl -sS -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            https://api.github.com/repos/Traceworks2023/nxtgauge-nov-2025-frontend/actions/workflows/build-push-and-update-gitops.yml/dispatches \
+            -d '{"ref":"testingcodex"}'
+
+  trigger-public-frontend:
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.public == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger public frontend workflow
+        env:
+          TOKEN: ${{ secrets.GITOPS_PAT }}
+        run: |
+          curl -sS -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            https://api.github.com/repos/Traceworks2023/nxtgauge-frontendwebsite/actions/workflows/build-push-and-update-gitops.yml/dispatches \
+            -d '{"ref":"testingcodex"}'

.test_push

@@ -0,0 +1 @@
+# test

README.md

@@ -1,2 +0,0 @@
-# nxtgauge-gitops
-

apps/nxtgauge-admin-solid/base/configmap.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nxtgauge-admin-solid-config
+  namespace: nxtgauge
+data:
+  NODE_ENV: "production"
+  PORT: "3000"
+  GATEWAY_URL: "http://nxtgauge-rust-gateway:9100"
+  PUBLIC_API_URL: "http://nxtgauge-rust-gateway:9100/api"
+  NEXT_PUBLIC_API_URL: "http://nxtgauge-rust-gateway:9100/api"

apps/nxtgauge-admin-solid/base/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-admin-solid
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-admin-solid
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-admin-solid
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-admin-solid
+    spec:
+      containers:
+        - name: admin-solid
+          image: registry.nxtgauge.com/nxtgauge-admin-solid
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3000
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-admin-solid-config
+            - secretRef:
+                name: nxtgauge-admin-solid-secrets
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi

apps/nxtgauge-admin-solid/base/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nxtgauge-admin-solid
+  namespace: nxtgauge
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - admin.nxtgauge.com
+      secretName: admin-tls
+  rules:
+    - host: admin.nxtgauge.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nxtgauge-admin-solid
+                port:
+                  number: 80

apps/nxtgauge-admin-solid/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - configmap.yaml
+  - secret.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

apps/nxtgauge-admin-solid/base/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nxtgauge

apps/nxtgauge-admin-solid/base/secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nxtgauge-admin-solid-secrets
+  namespace: nxtgauge
+type: Opaque
+stringData:
+  SMTP_HOST: "smtp.zeptomail.in"
+  SMTP_PORT: "587"
+  SMTP_USER: "emailapikey"
+  SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA=="
+  SMTP_FROM: "support@nxtgauge.com"

apps/nxtgauge-admin-solid/base/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-admin-solid
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-admin-solid
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-admin-solid
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3000
+      protocol: TCP

apps/nxtgauge-admin-solid/overlays/prod/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+patchesStrategicMerge:
+  - replicas-patch.yaml
+images:
+  - name: registry.nxtgauge.com/nxtgauge-admin-solid
+    newTag: high-performance-latest

apps/nxtgauge-admin-solid/overlays/prod/replicas-patch.yaml

@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-admin-solid
+  namespace: nxtgauge
+spec:
+  replicas: 1

apps/nxtgauge-ai-assistant/base/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-ai-assistant
+  labels:
+    app: nxtgauge-ai-assistant
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-ai-assistant
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-ai-assistant
+    spec:
+      containers:
+        - name: ai-assistant
+          image: registry.nxtgauge.com/nxtgauge-ai-assistant
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: APP_HOST
+              value: "0.0.0.0"
+            - name: APP_PORT
+              value: "8080"
+            - name: OLLAMA_BASE_URL
+              value: "http://ollama.nxtgauge-ai.svc.cluster.local:11434"
+            - name: OLLAMA_CHAT_MODEL
+              value: "gemma3:270m"
+            - name: OLLAMA_EMBED_MODEL
+              value: "nomic-embed-text"
+            - name: NXTGAUGE_USERS_URL
+              value: "http://nxtgauge-rust-users:9101"
+            - name: AI_SERVICE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: nxtgauge-ai-assistant-secrets
+                  key: ai-service-key
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 1000m
+              memory: 512Mi

apps/nxtgauge-ai-assistant/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret.yaml
+  - deployment.yaml
+  - service.yaml

apps/nxtgauge-ai-assistant/base/secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nxtgauge-ai-assistant-secrets
+  namespace: nxtgauge
+type: Opaque
+stringData:
+  # TODO: set to the shared key expected by callers of the AI assistant.
+  ai-service-key: ""
+

apps/nxtgauge-ai-assistant/base/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-ai-assistant
+  labels:
+    app: nxtgauge-ai-assistant
+spec:
+  ports:
+    - port: 8080
+      targetPort: 8080
+      name: http
+  selector:
+    app: nxtgauge-ai-assistant

apps/nxtgauge-ai-assistant/overlays/prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+images:
+  - name: registry.nxtgauge.com/nxtgauge-ai-assistant
+    newTag: high-performance-latest

apps/nxtgauge-backend-rust/base/catering-services-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-catering-services
+  labels:
+    app: nxtgauge-rust-catering-services
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-catering-services
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-catering-services
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: catering-services
+          image: registry.nxtgauge.com/nxtgauge-rust-catering-services:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9115
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9115
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9115
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/catering-services-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-catering-services
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-catering-services
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-catering-services
+  ports:
+    - name: http
+      port: 9115
+      targetPort: 9115
+      protocol: TCP

apps/nxtgauge-backend-rust/base/companies-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-companies
+  labels:
+    app: nxtgauge-rust-companies
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-companies
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-companies
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: companies
+          image: registry.nxtgauge.com/nxtgauge-rust-companies:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9102
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9102
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9102
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/companies-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-companies
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-companies
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-companies
+  ports:
+    - name: http
+      port: 9102
+      targetPort: 9102
+      protocol: TCP

apps/nxtgauge-backend-rust/base/configmap.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nxtgauge-backend-rust-config
+  namespace: nxtgauge
+data:
+  RUST_LOG: "info"
+  FRONTEND_URL: "https://nxtgauge.com"
+  ADMIN_URL: "https://admin.nxtgauge.com"
+  USERS_SERVICE_URL: "http://nxtgauge-rust-users:9101"
+  COMPANIES_SERVICE_URL: "http://nxtgauge-rust-companies:9102"
+  JOBS_SERVICE_URL: "http://nxtgauge-rust-jobs:9103"
+  LEADS_SERVICE_URL: "http://nxtgauge-rust-leads:9118"
+  JOB_SEEKERS_SERVICE_URL: "http://nxtgauge-rust-job-seekers:9104"
+  CUSTOMERS_SERVICE_URL: "http://nxtgauge-rust-customers:9105"
+  EMPLOYEES_SERVICE_URL: "http://nxtgauge-rust-employees:9106"
+  PHOTOGRAPHERS_SERVICE_URL: "http://nxtgauge-rust-photographers:9107"
+  TUTORS_SERVICE_URL: "http://nxtgauge-rust-tutors:9108"
+  MAKEUP_ARTISTS_SERVICE_URL: "http://nxtgauge-rust-makeup-artists:9109"
+  DEVELOPERS_SERVICE_URL: "http://nxtgauge-rust-developers:9110"
+  VIDEO_EDITORS_SERVICE_URL: "http://nxtgauge-rust-video-editors:9111"
+  GRAPHIC_DESIGNERS_SERVICE_URL: "http://nxtgauge-rust-graphic-designers:9112"
+  SOCIAL_MEDIA_MANAGERS_SERVICE_URL: "http://nxtgauge-rust-social-media-managers:9113"
+  FITNESS_TRAINERS_SERVICE_URL: "http://nxtgauge-rust-fitness-trainers:9114"
+  CATERING_SERVICES_SERVICE_URL: "http://nxtgauge-rust-catering-services:9115"
+  PAYMENTS_SERVICE_URL: "http://nxtgauge-rust-payments:9116"
+  UGC_CONTENT_CREATORS_SERVICE_URL: "http://nxtgauge-rust-ugc-content-creators:9117"
+  OLLAMA_BASE_URL: "http://ollama.nxtgauge-ai.svc.cluster.local:11434"
+  OLLAMA_CHAT_MODEL: "gemma3:270m"

apps/nxtgauge-backend-rust/base/cron-deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-cron
+  labels:
+    app: nxtgauge-rust-cron
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-cron
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-cron
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: cron
+          image: registry.nxtgauge.com/nxtgauge-rust-cron:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi

apps/nxtgauge-backend-rust/base/customers-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-customers
+  labels:
+    app: nxtgauge-rust-customers
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-customers
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-customers
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: customers
+          image: registry.nxtgauge.com/nxtgauge-rust-customers:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9105
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9105
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9105
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/customers-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-customers
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-customers
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-customers
+  ports:
+    - name: http
+      port: 9105
+      targetPort: 9105
+      protocol: TCP

apps/nxtgauge-backend-rust/base/developers-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-developers
+  labels:
+    app: nxtgauge-rust-developers
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-developers
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-developers
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: developers
+          image: registry.nxtgauge.com/nxtgauge-rust-developers:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9110
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9110
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9110
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/developers-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-developers
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-developers
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-developers
+  ports:
+    - name: http
+      port: 9110
+      targetPort: 9110
+      protocol: TCP

apps/nxtgauge-backend-rust/base/employees-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-employees
+  labels:
+    app: nxtgauge-rust-employees
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-employees
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-employees
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: employees
+          image: registry.nxtgauge.com/nxtgauge-rust-employees:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9106
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9106
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9106
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/employees-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-employees
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-employees
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-employees
+  ports:
+    - name: http
+      port: 9106
+      targetPort: 9106
+      protocol: TCP

apps/nxtgauge-backend-rust/base/fitness-trainers-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-fitness-trainers
+  labels:
+    app: nxtgauge-rust-fitness-trainers
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-fitness-trainers
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-fitness-trainers
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: fitness-trainers
+          image: registry.nxtgauge.com/nxtgauge-rust-fitness-trainers:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9114
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9114
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9114
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/fitness-trainers-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-fitness-trainers
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-fitness-trainers
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-fitness-trainers
+  ports:
+    - name: http
+      port: 9114
+      targetPort: 9114
+      protocol: TCP

apps/nxtgauge-backend-rust/base/gateway-deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-gateway
+  labels:
+    app: nxtgauge-rust-gateway
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-gateway
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-gateway
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: gateway
+          image: registry.nxtgauge.com/nxtgauge-rust-gateway:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9100
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          env:
+            - name: PORT
+              value: "9100"
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9100
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9100
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/gateway-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-gateway
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-gateway
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-gateway
+  ports:
+    - name: http
+      port: 9100
+      targetPort: 9100
+      protocol: TCP

apps/nxtgauge-backend-rust/base/graphic-designers-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-graphic-designers
+  labels:
+    app: nxtgauge-rust-graphic-designers
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-graphic-designers
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-graphic-designers
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: graphic-designers
+          image: registry.nxtgauge.com/nxtgauge-rust-graphic-designers:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9112
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9112
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9112
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/graphic-designers-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-graphic-designers
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-graphic-designers
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-graphic-designers
+  ports:
+    - name: http
+      port: 9112
+      targetPort: 9112
+      protocol: TCP

apps/nxtgauge-backend-rust/base/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nxtgauge-backend-rust
+  namespace: nxtgauge
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - api.nxtgauge.com
+      secretName: api-tls
+  rules:
+    - host: api.nxtgauge.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nxtgauge-rust-gateway
+                port:
+                  number: 9100

apps/nxtgauge-backend-rust/base/job-seekers-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-job-seekers
+  labels:
+    app: nxtgauge-rust-job-seekers
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-job-seekers
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-job-seekers
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: job-seekers
+          image: registry.nxtgauge.com/nxtgauge-rust-job-seekers:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9104
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9104
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9104
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/job-seekers-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-job-seekers
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-job-seekers
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-job-seekers
+  ports:
+    - name: http
+      port: 9104
+      targetPort: 9104
+      protocol: TCP

apps/nxtgauge-backend-rust/base/jobs-deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-jobs
+  labels:
+    app: nxtgauge-rust-jobs
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-jobs
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-jobs
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: jobs
+          image: registry.nxtgauge.com/nxtgauge-rust-jobs:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9103
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          env:
+            - name: PORT
+              value: "9103"
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9103
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9103
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/jobs-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-jobs
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-jobs
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-jobs
+  ports:
+    - name: http
+      port: 9103
+      targetPort: 9103
+      protocol: TCP

apps/nxtgauge-backend-rust/base/kustomization.yaml

@@ -0,0 +1,51 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - serviceaccount-default.yaml
+  - configmap.yaml
+  - secret.yaml
+  - ingress.yaml
+  - gateway-deployment.yaml
+  - gateway-service.yaml
+  - users-deployment.yaml
+  - users-service.yaml
+  - companies-deployment.yaml
+  - companies-service.yaml
+  - jobs-deployment.yaml
+  - jobs-service.yaml
+  - leads-deployment.yaml
+  - leads-service.yaml
+  - job-seekers-deployment.yaml
+  - job-seekers-service.yaml
+  - customers-deployment.yaml
+  - customers-service.yaml
+  - payments-deployment.yaml
+  - payments-service.yaml
+  - employees-deployment.yaml
+  - employees-service.yaml
+  - photographers-deployment.yaml
+  - photographers-service.yaml
+  - makeup-artists-deployment.yaml
+  - makeup-artists-service.yaml
+  - tutors-deployment.yaml
+  - tutors-service.yaml
+  - developers-deployment.yaml
+  - developers-service.yaml
+  - video-editors-deployment.yaml
+  - video-editors-service.yaml
+  - graphic-designers-deployment.yaml
+  - graphic-designers-service.yaml
+  - social-media-managers-deployment.yaml
+  - social-media-managers-service.yaml
+  - fitness-trainers-deployment.yaml
+  - fitness-trainers-service.yaml
+  - catering-services-deployment.yaml
+  - catering-services-service.yaml
+  - ugc-content-creators-deployment.yaml
+  - ugc-content-creators-service.yaml
+  - cron-deployment.yaml
+  - openobserve-endpoint-monitor-secret.yaml
+  - openobserve-endpoint-monitor-cronjob.yaml
+  - openobserve-k8s-monitor-rbac.yaml
+  - openobserve-k8s-monitor-cronjob.yaml

apps/nxtgauge-backend-rust/base/leads-deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-leads
+  labels:
+    app: nxtgauge-rust-leads
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-leads
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-leads
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: leads
+          image: registry.nxtgauge.com/nxtgauge-rust-leads:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9118
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          env:
+            - name: PORT
+              value: "9118"
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9118
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9118
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/leads-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-leads
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-leads
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-leads
+  ports:
+    - name: http
+      port: 9118
+      targetPort: 9118
+      protocol: TCP

apps/nxtgauge-backend-rust/base/makeup-artists-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-makeup-artists
+  labels:
+    app: nxtgauge-rust-makeup-artists
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-makeup-artists
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-makeup-artists
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: makeup-artists
+          image: registry.nxtgauge.com/nxtgauge-rust-makeup-artists:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9109
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9109
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9109
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/makeup-artists-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-makeup-artists
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-makeup-artists
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-makeup-artists
+  ports:
+    - name: http
+      port: 9109
+      targetPort: 9109
+      protocol: TCP

apps/nxtgauge-backend-rust/base/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nxtgauge

apps/nxtgauge-backend-rust/base/openobserve-endpoint-monitor-cronjob.yaml

@@ -0,0 +1,51 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: nxtgauge-openobserve-endpoint-monitor
+  namespace: nxtgauge
+spec:
+  schedule: "*/1 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: endpoint-monitor
+              image: curlimages/curl:8.10.1
+              imagePullPolicy: IfNotPresent
+              envFrom:
+                - secretRef:
+                    name: nxtgauge-openobserve-endpoint-monitor-secret
+              command: ["/bin/sh", "-ec"]
+              args:
+                - |
+                  post_result() {
+                    name="$1"
+                    url="$2"
+                    checked_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+                    out="$(curl -sS -o /dev/null -w '%{http_code} %{time_total}' --max-time 15 "$url" || true)"
+                    code="$(printf '%s' "$out" | awk '{print $1}')"
+                    total="$(printf '%s' "$out" | awk '{print $2}')"
+                    [ -n "$code" ] || code="0"
+                    [ -n "$total" ] || total="0"
+                    latency_ms="$(awk "BEGIN { printf \"%.0f\", $total * 1000 }")"
+                    if [ "$code" -ge 200 ] && [ "$code" -lt 400 ]; then
+                      ok="true"
+                    else
+                      ok="false"
+                    fi
+                    payload="$(printf '[{"endpoint":"%s","url":"%s","status_code":%s,"ok":%s,"latency_ms":%s,"checked_at":"%s"}]' "$name" "$url" "$code" "$ok" "$latency_ms" "$checked_at")"
+                    curl -sS -X POST \
+                      "${OO_ENDPOINT}/api/${OO_ORG}/${OO_STREAM}/_json" \
+                      -H "Authorization: ${OO_AUTH_HEADER}" \
+                      -H "Content-Type: application/json" \
+                      -d "$payload" >/dev/null
+                  }
+
+                  post_result "frontend" "https://test111.nxtgauge.com/"
+                  post_result "admin" "https://admin.nxtgauge.com/"
+                  post_result "api-health" "https://api.nxtgauge.com/health"

apps/nxtgauge-backend-rust/base/openobserve-endpoint-monitor-secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nxtgauge-openobserve-endpoint-monitor-secret
+  namespace: nxtgauge
+type: Opaque
+stringData:
+  OO_ENDPOINT: "http://o2-openobserve-standalone.openobserve.svc.cluster.local:5080"
+  OO_ORG: "default"
+  OO_STREAM: "nxtgauge_endpoints"
+  OO_AUTH_HEADER: "Basic cm9vdEBleGFtcGxlLmNvbTpDb21wbGV4cGFzcyMxMjM="

apps/nxtgauge-backend-rust/base/openobserve-k8s-monitor-cronjob.yaml

@@ -0,0 +1,176 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: nxtgauge-openobserve-k8s-monitor
+  namespace: nxtgauge
+spec:
+  schedule: "*/1 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: nxtgauge-openobserve-k8s-monitor
+          restartPolicy: OnFailure
+          containers:
+            - name: k8s-monitor
+              image: python:3.12-alpine
+              imagePullPolicy: IfNotPresent
+              envFrom:
+                - secretRef:
+                    name: nxtgauge-openobserve-endpoint-monitor-secret
+              command: ["python", "-c"]
+              args:
+                - |
+                  import datetime
+                  import json
+                  import os
+                  import ssl
+                  import time
+                  import urllib.error
+                  import urllib.request
+
+                  token_path = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+                  ca_path = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+                  with open(token_path, "r", encoding="utf-8") as f:
+                      token = f.read().strip()
+
+                  kube_ctx = ssl.create_default_context(cafile=ca_path)
+                  kube_api = "https://kubernetes.default.svc"
+
+                  def kube_get(path: str):
+                      req = urllib.request.Request(
+                          kube_api + path,
+                          headers={"Authorization": f"Bearer {token}"},
+                      )
+                      with urllib.request.urlopen(req, context=kube_ctx, timeout=20) as resp:
+                          return json.loads(resp.read().decode("utf-8"))
+
+                  def check_url(name: str, url: str):
+                      start = time.time()
+                      status = 0
+                      ok = False
+                      err = ""
+                      try:
+                          req = urllib.request.Request(url)
+                          with urllib.request.urlopen(req, timeout=15) as resp:
+                              status = int(getattr(resp, "status", 0) or 0)
+                              ok = 200 <= status < 400
+                      except urllib.error.HTTPError as e:
+                          status = int(getattr(e, "code", 0) or 0)
+                          ok = 200 <= status < 400
+                          err = str(e)
+                      except Exception as e:
+                          err = str(e)
+                      if name == "registry-svc" and status in (200, 401):
+                          ok = True
+                      latency_ms = int((time.time() - start) * 1000)
+                      return {
+                          "kind": "endpoint",
+                          "endpoint": name,
+                          "url": url,
+                          "status_code": status,
+                          "ok": ok,
+                          "latency_ms": latency_ms,
+                          "error": err,
+                      }
+
+                  now = datetime.datetime.utcnow().replace(microsecond=0).isoformat() + "Z"
+                  records = []
+
+                  nodes = kube_get("/api/v1/nodes").get("items", [])
+                  ready_count = 0
+                  for n in nodes:
+                      conds = {c.get("type"): c.get("status") for c in n.get("status", {}).get("conditions", [])}
+                      ready = conds.get("Ready") == "True"
+                      if ready:
+                          ready_count += 1
+                      records.append(
+                          {
+                              "kind": "node",
+                              "node": n.get("metadata", {}).get("name", "unknown"),
+                              "ready": ready,
+                              "memory_pressure": conds.get("MemoryPressure"),
+                              "disk_pressure": conds.get("DiskPressure"),
+                              "pid_pressure": conds.get("PIDPressure"),
+                              "network_unavailable": conds.get("NetworkUnavailable"),
+                              "checked_at": now,
+                          }
+                      )
+
+                  pod_issues = 0
+                  pods = kube_get("/api/v1/pods").get("items", [])
+                  for p in pods:
+                      ns = p.get("metadata", {}).get("namespace", "")
+                      name = p.get("metadata", {}).get("name", "")
+                      phase = p.get("status", {}).get("phase", "")
+                      reason = p.get("status", {}).get("reason", "") or ""
+                      message = p.get("status", {}).get("message", "") or ""
+                      crash = False
+
+                      for cs in p.get("status", {}).get("containerStatuses", []) or []:
+                          waiting = (cs.get("state") or {}).get("waiting") or {}
+                          if waiting.get("reason") in ("CrashLoopBackOff", "ImagePullBackOff", "ErrImagePull"):
+                              crash = True
+                              reason = waiting.get("reason", reason)
+                              message = waiting.get("message", message)
+
+                      if phase in ("Pending", "Failed", "Unknown") or crash:
+                          pod_issues += 1
+                          records.append(
+                              {
+                                  "kind": "pod",
+                                  "namespace": ns,
+                                  "pod": name,
+                                  "phase": phase,
+                                  "reason": reason,
+                                  "message": message[:300],
+                                  "checked_at": now,
+                              }
+                          )
+
+                  endpoints = [
+                      ("frontend-svc", "http://nxtgauge-frontend-solid.nxtgauge.svc.cluster.local/"),
+                      ("admin-svc", "http://nxtgauge-admin-solid.nxtgauge.svc.cluster.local/"),
+                      ("api-gateway-svc", "http://nxtgauge-rust-gateway.nxtgauge.svc.cluster.local:9100/health"),
+                      ("registry-svc", "http://docker-registry.registry.svc.cluster.local:5000/v2/"),
+                      ("woodpecker-svc", "http://woodpecker-server.woodpecker.svc.cluster.local/"),
+                      ("argocd-metrics", "http://argocd-server-metrics.argocd.svc.cluster.local:8083/metrics"),
+                      ("openobserve-svc", "http://o2-openobserve-standalone.openobserve.svc.cluster.local:5080/healthz"),
+                  ]
+                  for name, url in endpoints:
+                      rec = check_url(name, url)
+                      rec["checked_at"] = now
+                      records.append(rec)
+
+                  records.append(
+                      {
+                          "kind": "cluster_summary",
+                          "cluster": "nxtgauge",
+                          "node_total": len(nodes),
+                          "node_ready": ready_count,
+                          "node_not_ready": len(nodes) - ready_count,
+                          "pod_issues": pod_issues,
+                          "checked_at": now,
+                      }
+                  )
+
+                  oo_endpoint = os.environ["OO_ENDPOINT"].rstrip("/")
+                  oo_org = os.environ.get("OO_ORG", "default")
+                  stream = "nxtgauge_k8s_health"
+                  auth_header = os.environ["OO_AUTH_HEADER"]
+                  payload = json.dumps(records).encode("utf-8")
+
+                  req = urllib.request.Request(
+                      f"{oo_endpoint}/api/{oo_org}/{stream}/_json",
+                      data=payload,
+                      headers={
+                          "Content-Type": "application/json",
+                          "Authorization": auth_header,
+                      },
+                      method="POST",
+                  )
+                  with urllib.request.urlopen(req, timeout=30) as resp:
+                      _ = resp.read()

apps/nxtgauge-backend-rust/base/openobserve-k8s-monitor-rbac.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nxtgauge-openobserve-k8s-monitor
+  namespace: nxtgauge
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: nxtgauge-openobserve-k8s-monitor
+rules:
+  - apiGroups: [""]
+    resources: ["nodes", "pods", "namespaces"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: nxtgauge-openobserve-k8s-monitor
+subjects:
+  - kind: ServiceAccount
+    name: nxtgauge-openobserve-k8s-monitor
+    namespace: nxtgauge
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nxtgauge-openobserve-k8s-monitor

apps/nxtgauge-backend-rust/base/payments-deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-payments
+  labels:
+    app: nxtgauge-rust-payments
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-payments
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-payments
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: payments
+          image: registry.nxtgauge.com/nxtgauge-rust-payments:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9116
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            tcpSocket:
+              port: 9116
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            tcpSocket:
+              port: 9116
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/payments-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-payments
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-payments
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-payments
+  ports:
+    - name: http
+      port: 9116
+      targetPort: 9116
+      protocol: TCP

apps/nxtgauge-backend-rust/base/photographers-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-photographers
+  labels:
+    app: nxtgauge-rust-photographers
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-photographers
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-photographers
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: photographers
+          image: registry.nxtgauge.com/nxtgauge-rust-photographers:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9107
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9107
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9107
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/photographers-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-photographers
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-photographers
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-photographers
+  ports:
+    - name: http
+      port: 9107
+      targetPort: 9107
+      protocol: TCP

apps/nxtgauge-backend-rust/base/secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nxtgauge-backend-rust-secrets
+  namespace: nxtgauge
+type: Opaque
+stringData:
+  DATABASE_URL: "postgresql://postgres:chandan2026%401@pg-postgresql.data.svc.cluster.local:5432/nxtgauge"
+  JWT_SECRET: "bPU0RQ/N7JW8CDCioe6AFBw/lBLTm++pGtta20pcsTX36p3OyheplgUyiD66OCuV"
+  # Password contains '@', so it must be URL-encoded as %40.
+  REDIS_URL: "redis://:chandan2026%401@redis-master.data.svc.cluster.local:6379"
+  SMTP_HOST: "smtp.zeptomail.in"
+  SMTP_PORT: "587"
+  SMTP_USER: "emailapikey"
+  SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA=="
+  SMTP_FROM_NAME: "NXTGAUGE"
+  SMTP_FROM_EMAIL: "support@nxtgauge.com"
+  SMTP_SECURE: "false"
+  B2_BUCKET_NAME: "nxtgauge"
+  B2_REGION: "eu-central-003"
+  B2_ENDPOINT: "s3.eu-central-003.backblazeb2.com"
+  B2_ACCESS_KEY_ID: ""
+  B2_SECRET_ACCESS_KEY: ""

apps/nxtgauge-backend-rust/base/serviceaccount-default.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: default
+  namespace: nxtgauge
+imagePullSecrets:
+  - name: regcred

apps/nxtgauge-backend-rust/base/social-media-managers-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-social-media-managers
+  labels:
+    app: nxtgauge-rust-social-media-managers
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-social-media-managers
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-social-media-managers
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: social-media-managers
+          image: registry.nxtgauge.com/nxtgauge-rust-social-media-managers:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9113
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9113
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9113
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/social-media-managers-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-social-media-managers
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-social-media-managers
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-social-media-managers
+  ports:
+    - name: http
+      port: 9113
+      targetPort: 9113
+      protocol: TCP

apps/nxtgauge-backend-rust/base/tutors-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-tutors
+  labels:
+    app: nxtgauge-rust-tutors
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-tutors
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-tutors
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: tutors
+          image: registry.nxtgauge.com/nxtgauge-rust-tutors:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9108
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9108
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9108
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/tutors-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-tutors
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-tutors
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-tutors
+  ports:
+    - name: http
+      port: 9108
+      targetPort: 9108
+      protocol: TCP

apps/nxtgauge-backend-rust/base/ugc-content-creators-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-ugc-content-creators
+  labels:
+    app: nxtgauge-rust-ugc-content-creators
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-ugc-content-creators
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-ugc-content-creators
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: ugc-content-creators
+          image: registry.nxtgauge.com/nxtgauge-rust-ugc-content-creators:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9117
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9117
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9117
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/ugc-content-creators-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-ugc-content-creators
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-ugc-content-creators
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-ugc-content-creators
+  ports:
+    - name: http
+      port: 9117
+      targetPort: 9117
+      protocol: TCP

apps/nxtgauge-backend-rust/base/users-deployment.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-users
+  labels:
+    app: nxtgauge-rust-users
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-users
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-users
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: users
+          image: registry.nxtgauge.com/nxtgauge-rust-users
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9101
+              name: http
+          env:
+            # The image currently defaults to a different port (it exposes 8000/tcp).
+            # Force the service to bind to the port our Service/ConfigMap expects.
+            - name: PORT
+              value: "9101"
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          startupProbe:
+            tcpSocket:
+              port: 9101
+            periodSeconds: 5
+            timeoutSeconds: 1
+            failureThreshold: 120
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9101
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9101
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/users-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-users
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-users
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-users
+  ports:
+    - name: http
+      port: 9101
+      targetPort: 9101
+      protocol: TCP

apps/nxtgauge-backend-rust/base/video-editors-deployment.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-video-editors
+  labels:
+    app: nxtgauge-rust-video-editors
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-rust-video-editors
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-rust-video-editors
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: video-editors
+          image: registry.nxtgauge.com/nxtgauge-rust-video-editors:e6d85ffc8367885050b9434494f291724cc523c0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9111
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-backend-rust-config
+            - secretRef:
+                name: nxtgauge-backend-rust-secrets
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9111
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 9111
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi

apps/nxtgauge-backend-rust/base/video-editors-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-rust-video-editors
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-rust-video-editors
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-rust-video-editors
+  ports:
+    - name: http
+      port: 9111
+      targetPort: 9111
+      protocol: TCP

apps/nxtgauge-backend-rust/overlays/prod/kustomization.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+patches:
+  - path: replicas-patch.yaml
+    target:
+      kind: Deployment
+      name: nxtgauge-rust-gateway
+images:
+  - name: registry.nxtgauge.com/nxtgauge-rust-gateway
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-users
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-companies
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-job-seekers
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-jobs
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-leads
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-customers
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-payments
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-employees
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-photographers
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-makeup-artists
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-tutors
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-developers
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-video-editors
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-graphic-designers
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-social-media-managers
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-fitness-trainers
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-catering-services
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-ugc-content-creators
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0
+  - name: registry.nxtgauge.com/nxtgauge-rust-cron
+    newTag: e6d85ffc8367885050b9434494f291724cc523c0

apps/nxtgauge-backend-rust/overlays/prod/replicas-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-gateway
+spec:
+  replicas: 2

apps/nxtgauge-frontend-solid/base/configmap.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nxtgauge-frontend-solid-config
+  namespace: nxtgauge
+data:
+  NODE_ENV: "production"
+  PORT: "3000"
+  GATEWAY_URL: "http://nxtgauge-rust-gateway:9100"
+  PUBLIC_API_URL: "http://nxtgauge-rust-gateway:9100/api"
+  NEXT_PUBLIC_API_URL: "http://nxtgauge-rust-gateway:9100/api"

apps/nxtgauge-frontend-solid/base/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-frontend-solid
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-frontend-solid
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nxtgauge-frontend-solid
+  template:
+    metadata:
+      labels:
+        app: nxtgauge-frontend-solid
+    spec:
+      containers:
+        - name: frontend-solid
+          image: registry.nxtgauge.com/nxtgauge-frontend-solid
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3000
+              name: http
+          envFrom:
+            - configMapRef:
+                name: nxtgauge-frontend-solid-config
+            - secretRef:
+                name: nxtgauge-frontend-solid-secrets
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi

apps/nxtgauge-frontend-solid/base/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nxtgauge-frontend-solid
+  namespace: nxtgauge
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - test111.nxtgauge.com
+      secretName: test111-tls
+  rules:
+    - host: test111.nxtgauge.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nxtgauge-frontend-solid
+                port:
+                  number: 80

apps/nxtgauge-frontend-solid/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - configmap.yaml
+  - secret.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

apps/nxtgauge-frontend-solid/base/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nxtgauge

apps/nxtgauge-frontend-solid/base/secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nxtgauge-frontend-solid-secrets
+  namespace: nxtgauge
+type: Opaque
+stringData:
+  SMTP_HOST: "smtp.zeptomail.in"
+  SMTP_PORT: "587"
+  SMTP_USER: "emailapikey"
+  SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA=="
+  SMTP_FROM: "support@nxtgauge.com"

apps/nxtgauge-frontend-solid/base/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nxtgauge-frontend-solid
+  namespace: nxtgauge
+  labels:
+    app: nxtgauge-frontend-solid
+spec:
+  type: ClusterIP
+  selector:
+    app: nxtgauge-frontend-solid
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3000
+      protocol: TCP

apps/nxtgauge-frontend-solid/overlays/prod/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+patchesStrategicMerge:
+  - replicas-patch.yaml
+images:
+  - name: registry.nxtgauge.com/nxtgauge-frontend-solid
+    newTag: d888466

apps/nxtgauge-frontend-solid/overlays/prod/replicas-patch.yaml

@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-frontend-solid
+  namespace: nxtgauge
+spec:
+  replicas: 1

apps/ollama/base/deployment.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ollama
+  namespace: nxtgauge-ai
+  labels:
+    app: ollama
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ollama
+  template:
+    metadata:
+      labels:
+        app: ollama
+    spec:
+      containers:
+        - name: ollama
+          image: ollama/ollama:latest
+          ports:
+            - containerPort: 11434
+              name: http
+          env:
+            - name: OLLAMA_HOST
+              value: "0.0.0.0:11434"
+          volumeMounts:
+            - name: ollama-models
+              mountPath: /root/.ollama
+          resources:
+            requests:
+              cpu: 500m
+              memory: 700Mi
+            limits:
+              cpu: 1000m
+              memory: 1500Mi
+      volumes:
+        - name: ollama-models
+          persistentVolumeClaim:
+            claimName: ollama-models

apps/ollama/base/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml

apps/ollama/base/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nxtgauge-ai

apps/ollama/base/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ollama-models
+  namespace: nxtgauge-ai
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

apps/ollama/base/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ollama
+  namespace: nxtgauge-ai
+  labels:
+    app: ollama
+spec:
+  type: ClusterIP
+  ports:
+    - port: 11434
+      targetPort: 11434
+      name: http
+  selector:
+    app: ollama

argocd/coredns-nodehosts-application.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: coredns-nodehosts
+  namespace: argocd
+spec:
+  destination:
+    namespace: kube-system
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: ops/coredns-nodehosts
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+

argocd/nxtgauge-admin-solid-application.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nxtgauge-admin-solid
+  namespace: argocd
+  annotations:
+    argocd-image-updater.argoproj.io/image-list: admin=registry.nxtgauge.com/nxtgauge-admin-solid:high-performance-latest
+    argocd-image-updater.argoproj.io/admin.update-strategy: digest
+    argocd-image-updater.argoproj.io/admin.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+    path: apps/nxtgauge-admin-solid/overlays/prod
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: nxtgauge
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd/nxtgauge-ai-assistant-application.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nxtgauge-ai-assistant
+  namespace: argocd
+  annotations:
+    argocd-image-updater.argoproj.io/image-list: ai=registry.nxtgauge.com/nxtgauge-ai-assistant:high-performance-latest
+    argocd-image-updater.argoproj.io/ai.update-strategy: digest
+    argocd-image-updater.argoproj.io/ai.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+    path: apps/nxtgauge-ai-assistant/overlays/prod
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: nxtgauge
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd/nxtgauge-backend-rust-application.yaml

@@ -0,0 +1,81 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nxtgauge-backend-rust
+  namespace: argocd
+  annotations:
+    argocd-image-updater.argoproj.io/image-list: >-
+      gateway=registry.nxtgauge.com/nxtgauge-rust-gateway:d084491,
+      users=registry.nxtgauge.com/nxtgauge-rust-users:d084491,
+      companies=registry.nxtgauge.com/nxtgauge-rust-companies:high-performance-latest,
+      job-seekers=registry.nxtgauge.com/nxtgauge-rust-job-seekers:high-performance-latest,
+      customers=registry.nxtgauge.com/nxtgauge-rust-customers:high-performance-latest,
+      payments=registry.nxtgauge.com/nxtgauge-rust-payments:high-performance-latest,
+      employees=registry.nxtgauge.com/nxtgauge-rust-employees:high-performance-latest,
+      photographers=registry.nxtgauge.com/nxtgauge-rust-photographers:high-performance-latest,
+      makeup-artists=registry.nxtgauge.com/nxtgauge-rust-makeup-artists:high-performance-latest,
+      tutors=registry.nxtgauge.com/nxtgauge-rust-tutors:high-performance-latest,
+      developers=registry.nxtgauge.com/nxtgauge-rust-developers:high-performance-latest,
+      video-editors=registry.nxtgauge.com/nxtgauge-rust-video-editors:high-performance-latest,
+      graphic-designers=registry.nxtgauge.com/nxtgauge-rust-graphic-designers:high-performance-latest,
+      social-media-managers=registry.nxtgauge.com/nxtgauge-rust-social-media-managers:high-performance-latest,
+      fitness-trainers=registry.nxtgauge.com/nxtgauge-rust-fitness-trainers:high-performance-latest,
+      catering-services=registry.nxtgauge.com/nxtgauge-rust-catering-services:high-performance-latest,
+      ugc-content-creators=registry.nxtgauge.com/nxtgauge-rust-ugc-content-creators:high-performance-latest,
+      cron=registry.nxtgauge.com/nxtgauge-rust-cron:high-performance-latest
+    argocd-image-updater.argoproj.io/gateway.update-strategy: digest
+    argocd-image-updater.argoproj.io/gateway.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/users.update-strategy: digest
+    argocd-image-updater.argoproj.io/users.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/companies.update-strategy: digest
+    argocd-image-updater.argoproj.io/companies.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/jobs.update-strategy: digest
+    argocd-image-updater.argoproj.io/jobs.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/leads.update-strategy: digest
+    argocd-image-updater.argoproj.io/leads.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/job-seekers.update-strategy: digest
+    argocd-image-updater.argoproj.io/job-seekers.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/customers.update-strategy: digest
+    argocd-image-updater.argoproj.io/customers.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/payments.update-strategy: digest
+    argocd-image-updater.argoproj.io/payments.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/employees.update-strategy: digest
+    argocd-image-updater.argoproj.io/employees.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/photographers.update-strategy: digest
+    argocd-image-updater.argoproj.io/photographers.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/makeup-artists.update-strategy: digest
+    argocd-image-updater.argoproj.io/makeup-artists.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/tutors.update-strategy: digest
+    argocd-image-updater.argoproj.io/tutors.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/developers.update-strategy: digest
+    argocd-image-updater.argoproj.io/developers.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/video-editors.update-strategy: digest
+    argocd-image-updater.argoproj.io/video-editors.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/graphic-designers.update-strategy: digest
+    argocd-image-updater.argoproj.io/graphic-designers.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/social-media-managers.update-strategy: digest
+    argocd-image-updater.argoproj.io/social-media-managers.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/fitness-trainers.update-strategy: digest
+    argocd-image-updater.argoproj.io/fitness-trainers.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/catering-services.update-strategy: digest
+    argocd-image-updater.argoproj.io/catering-services.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/ugc-content-creators.update-strategy: digest
+    argocd-image-updater.argoproj.io/ugc-content-creators.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/cron.update-strategy: digest
+    argocd-image-updater.argoproj.io/cron.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
+spec:
+  destination:
+    namespace: nxtgauge
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: apps/nxtgauge-backend-rust/overlays/prod
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd/nxtgauge-frontend-solid-application.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nxtgauge-frontend-solid
+  namespace: argocd
+  annotations:
+    argocd-image-updater.argoproj.io/image-list: frontend=registry.nxtgauge.com/nxtgauge-frontend-solid:bb6db6c
+    argocd-image-updater.argoproj.io/frontend.update-strategy: digest
+    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^high-performance-latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+    path: apps/nxtgauge-frontend-solid/overlays/prod
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: nxtgauge
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd/ollama-application.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ollama
+  namespace: argocd
+spec:
+  destination:
+    namespace: nxtgauge-ai
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: apps/ollama/base
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd/openobserve-alerts-application.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: openobserve-alerts
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+    path: ops/openobserve-alerts
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: openobserve
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+

argocd/openobserve-otelcol-application.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: openobserve-otelcol
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+    path: ops/openobserve-otelcol
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: openobserve
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+

argocd/registry-ingress-application.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: registry-ingress
+  namespace: argocd
+spec:
+  destination:
+    namespace: registry
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: ops/registry-ingress
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+

argocd/woodpecker-registry-pull-application.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: woodpecker-registry-pull
+  namespace: argocd
+spec:
+  destination:
+    namespace: woodpecker
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: ops/woodpecker-registry-pull
+    repoURL: https://github.com/Traceworks2023/nxtgauge-gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+

ops/coredns-nodehosts/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - patch-coredns-nodehosts.yaml
+

ops/coredns-nodehosts/patch-coredns-nodehosts.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system
+data:
+  NodeHosts: |
+    10.0.0.2 nxtgauge-1
+    10.0.0.3 nxtgauge-2
+    10.0.0.5 nxtgauge-3
+    10.43.37.98 registry.nxtgauge.com

ops/k3s/README.md

@@ -0,0 +1,64 @@
+# k3s Registry Node Configuration
+
+This repo uses `registry.nxtgauge.com` for backend images.
+
+## Why
+Image pulls happen on k3s nodes via containerd, not inside cluster DNS context.
+Using `*.svc.cluster.local` for image pulls can fail with DNS lookup errors from node runtime.
+
+## Required node config
+Each node must have `/etc/rancher/k3s/registries.yaml` configured with auth for the registry.
+
+Template file:
+- `ops/k3s/registries.yaml`
+
+## Recommended node DNS/hosts override (prevents Cloudflare/proxy path)
+Even if `registry.nxtgauge.com` is set to "DNS only" in Cloudflare, k3s nodes can still end up resolving to public/IPv6 records depending on upstream DNS/caches.
+
+For reliable large image pulls/pushes (avoids `413 Payload Too Large` from proxies), point nodes directly at the in-cluster ingress VIP:
+
+- Traefik VIPs: `10.0.0.2`, `10.0.0.3`, `10.0.0.5`
+- Recommended: pick one stable VIP (example `10.0.0.2`) and map `registry.nxtgauge.com` to it on every node.
+
+## Apply to all nodes
+
+1. Export required env vars:
+
+```bash
+export K3S_NODES="node1 node2 node3"
+export REGISTRY_USERNAME="<registry-user>"
+export REGISTRY_PASSWORD="<registry-pass>"
+export REGISTRY_VIP_IP="10.0.0.2"   # optional but recommended
+```
+
+2. Apply config and restart k3s on each node:
+
+```bash
+./ops/k3s/apply-registries.sh
+```
+
+## Manual steps (if needed)
+On each node:
+
+1. Copy `registries.yaml` to `/etc/rancher/k3s/registries.yaml`
+2. Restart runtime:
+
+```bash
+sudo systemctl restart k3s
+# or for agents
+sudo systemctl restart k3s-agent
+```
+
+3. Verify pod pulls:
+
+```bash
+kubectl -n nxtgauge get pods
+kubectl -n nxtgauge describe pod <failing-pod>
+```
+
+## Notes
+- Ensure DNS for `registry.nxtgauge.com` resolves from every k3s node.
+- If DNS is not available, use a stable node-reachable IP and update:
+  - backend GitOps manifests
+  - backend Woodpecker registry push target
+  - `ops/k3s/registries.yaml`

ops/k3s/apply-registries.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage:
+#   export K3S_NODES="node1 node2 node3"
+#   export REGISTRY_USERNAME="..."
+#   export REGISTRY_PASSWORD="..."
+#   export REGISTRY_VIP_IP="10.0.0.2"   # optional (recommended)
+#   ./ops/k3s/apply-registries.sh
+
+if [[ -z "${K3S_NODES:-}" ]]; then
+  echo "K3S_NODES is required (space-separated ssh targets)"
+  exit 1
+fi
+
+if [[ -z "${REGISTRY_USERNAME:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
+  echo "REGISTRY_USERNAME and REGISTRY_PASSWORD are required"
+  exit 1
+fi
+
+TMP_FILE="$(mktemp)"
+
+sed \
+  -e "s#\${REGISTRY_USERNAME}#${REGISTRY_USERNAME}#g" \
+  -e "s#\${REGISTRY_PASSWORD}#${REGISTRY_PASSWORD}#g" \
+  "$(dirname "$0")/registries.yaml" > "$TMP_FILE"
+
+for node in ${K3S_NODES}; do
+  echo "Applying registry config on ${node}"
+  scp "$TMP_FILE" "${node}:/tmp/registries.yaml"
+  ssh "$node" "sudo mkdir -p /etc/rancher/k3s && sudo mv /tmp/registries.yaml /etc/rancher/k3s/registries.yaml"
+
+  if [[ -n "${REGISTRY_VIP_IP:-}" ]]; then
+    echo "Ensuring /etc/hosts contains registry.nxtgauge.com -> ${REGISTRY_VIP_IP} on ${node}"
+    ssh "$node" "sudo sh -lc 'grep -q \"\\sregistry\\.nxtgauge\\.com\\b\" /etc/hosts && sed -i \"s/^.*\\sregistry\\.nxtgauge\\.com\\b.*/${REGISTRY_VIP_IP} registry.nxtgauge.com/\" /etc/hosts || echo \"${REGISTRY_VIP_IP} registry.nxtgauge.com\" >> /etc/hosts'"
+  fi
+
+  ssh "$node" "sudo systemctl restart k3s || sudo systemctl restart k3s-agent"
+  echo "Waiting for ${node} to recover..."
+  sleep 8
+done
+
+rm -f "$TMP_FILE"
+
+echo "Done: registries.yaml applied and k3s restarted on all nodes."

ops/k3s/registries.yaml

@@ -0,0 +1,10 @@
+mirrors:
+  "registry.nxtgauge.com":
+    endpoint:
+      - "https://registry.nxtgauge.com"
+
+configs:
+  "registry.nxtgauge.com":
+    auth:
+      username: "${REGISTRY_USERNAME}"
+      password: "${REGISTRY_PASSWORD}"

ops/openobserve-alerts/README.md

@@ -0,0 +1,22 @@
+# OpenObserve alerts + Telegram
+
+This deploys a CronJob (`openobserve-alerts-bootstrap`) that upserts alert templates + common alerts in OpenObserve.
+
+## Prereqs
+
+Create a Kubernetes Secret with your Telegram chat id:
+
+```bash
+kubectl -n openobserve create secret generic openobserve-telegram \
+  --from-literal=TELEGRAM_CHAT_ID='<your_chat_id>'
+```
+
+The OpenObserve credentials are read from the existing Secret created by the OpenObserve install:
+
+- `o2-openobserve-standalone` (`ZO_ROOT_USER_EMAIL`, `ZO_ROOT_USER_PASSWORD`)
+
+## Notes
+
+- Alerts are created to send to destination `nxtgauge_telegram` (must exist in OpenObserve).
+- Edit `ops/openobserve-alerts/configmap.yaml` to add/remove alerts.
+

ops/openobserve-alerts/configmap.yaml

@@ -0,0 +1,166 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: openobserve-alerts-bootstrap
+  namespace: openobserve
+data:
+  bootstrap.sh: |
+    #!/usr/bin/env sh
+    set -eu
+
+    ORG_ID="${ORG_ID:-default}"
+    BASE_URL="${BASE_URL:-http://o2-openobserve-standalone.openobserve.svc.cluster.local:5080}"
+    STREAM_NAME="${STREAM_NAME:-default}"
+    TELEGRAM_CHAT_ID="${TELEGRAM_CHAT_ID:-}"
+
+    if [ -z "${ZO_ROOT_USER_EMAIL:-}" ] || [ -z "${ZO_ROOT_USER_PASSWORD:-}" ]; then
+      echo "missing ZO_ROOT_USER_EMAIL / ZO_ROOT_USER_PASSWORD"
+      exit 1
+    fi
+    if [ -z "$TELEGRAM_CHAT_ID" ]; then
+      echo "missing TELEGRAM_CHAT_ID"
+      exit 1
+    fi
+
+    AUTH="$(printf '%s:%s' "$ZO_ROOT_USER_EMAIL" "$ZO_ROOT_USER_PASSWORD" | base64 | tr -d '\n')"
+    auth_hdr="Authorization: Basic $AUTH"
+
+    api() {
+      # shellcheck disable=SC2068
+      curl -sfS -H "$auth_hdr" -H "Content-Type: application/json" "$@"
+    }
+
+    ensure_template() {
+      template_name="$1"
+      template_type="$2" # http or email
+      title="$3"
+      body="$4"
+      is_default="$5" # true/false
+
+      payload="$(jq -n \
+        --arg name "$template_name" \
+        --arg type "$template_type" \
+        --arg title "$title" \
+        --arg body "$body" \
+        --argjson isDefault "$is_default" \
+        '{name: $name, type: $type, title: $title, body: $body, isDefault: $isDefault}')"
+
+      # Upsert: PUT works for existing, and also works as create in newer versions.
+      if api -X PUT "$BASE_URL/api/$ORG_ID/alerts/templates/$template_name" -d "$payload" >/dev/null 2>&1; then
+        echo "upserted template=$template_name"
+        return 0
+      fi
+
+      api -X POST "$BASE_URL/api/$ORG_ID/alerts/templates" -d "$payload" >/dev/null
+      echo "created template=$template_name"
+    }
+
+    ensure_alert() {
+      alert_name="$1"
+      sql="$2"
+      period_minutes="$3"
+      frequency_minutes="$4"
+      silence_minutes="$5"
+      row_template="$6"
+
+      existing_id="$(
+        api "$BASE_URL/api/v2/$ORG_ID/alerts" \
+          | jq -r --arg n "$alert_name" '.list[] | select(.name == $n) | .alert_id' \
+          | head -n 1
+      )"
+
+      payload="$(jq -n \
+        --arg name "$alert_name" \
+        --arg stream "$STREAM_NAME" \
+        --arg sql "$sql" \
+        --argjson period "$period_minutes" \
+        --argjson frequency "$frequency_minutes" \
+        --argjson silence "$silence_minutes" \
+        --arg row_template "$row_template" \
+        '{
+          name: $name,
+          stream_type: "logs",
+          stream_name: $stream,
+          is_real_time: false,
+          enabled: true,
+          tz_offset: 330,
+          destinations: ["nxtgauge_telegram"],
+          row_template: $row_template,
+          row_template_type: "String",
+          query_condition: { type: "sql", sql: $sql },
+          trigger_condition: {
+            period: $period,
+            operator: ">=",
+            threshold: 1,
+            frequency: $frequency,
+            frequency_type: "minutes",
+            silence: $silence
+          }
+        }')"
+
+      if [ -n "$existing_id" ] && [ "$existing_id" != "null" ]; then
+        resp="$(api -X PUT "$BASE_URL/api/v2/$ORG_ID/alerts/$existing_id" -d "$payload")" || {
+          echo "failed updating alert=$alert_name id=$existing_id"
+          exit 1
+        }
+        code="$(echo "$resp" | jq -r '.code // empty')"
+        if [ "$code" != "200" ]; then
+          echo "failed updating alert=$alert_name id=$existing_id resp=$resp"
+          exit 1
+        fi
+        echo "updated alert=$alert_name id=$existing_id"
+      else
+        resp="$(api -X POST "$BASE_URL/api/v2/$ORG_ID/alerts" -d "$payload")" || {
+          echo "failed creating alert=$alert_name"
+          exit 1
+        }
+        code="$(echo "$resp" | jq -r '.code // empty')"
+        if [ "$code" != "200" ]; then
+          echo "failed creating alert=$alert_name resp=$resp"
+          exit 1
+        fi
+        echo "created alert=$alert_name"
+      fi
+    }
+
+    # Telegram template includes useful debugging context + top rows.
+    # Uses OpenObserve built-in variables: {alert_url}, {alert_count}, {rows:5}, etc.
+    telegram_body="$(printf '{\"chat_id\":\"%s\",\"text\":\"ALERT {alert_name}\\\\norg={org_name} stream={stream_type}/{stream_name}\\\\ncount={alert_count} window={alert_start_time}..{alert_end_time}\\\\n\\\\n{rows:5}\\\\n\\\\nOpen: {alert_url}\"}' "$TELEGRAM_CHAT_ID")"
+
+    ensure_template "telegram_nxtgauge" "http" "" "$telegram_body" true
+
+    ensure_alert \
+      "k8s-image-pull-failures" \
+      "SELECT k8s_namespace_name, k8s_pod_name, body_object_reason, body_object_message FROM \"default\" WHERE body_object_message ILIKE '%ErrImagePull%' OR body_object_message ILIKE '%ImagePullBackOff%' OR body_object_message ILIKE '%Failed to pull image%' ORDER BY _timestamp DESC LIMIT 50" \
+      5 1 30 \
+      "{k8s_namespace_name}/{k8s_pod_name} {body_object_reason}: {body_object_message}"
+
+    ensure_alert \
+      "k8s-crashloopbackoff" \
+      "SELECT k8s_namespace_name, k8s_pod_name, body_object_reason, body_object_message FROM \"default\" WHERE body_object_message ILIKE '%CrashLoopBackOff%' OR body_object_message ILIKE '%Back-off restarting failed container%' ORDER BY _timestamp DESC LIMIT 50" \
+      5 1 30 \
+      "{k8s_namespace_name}/{k8s_pod_name} {body_object_reason}: {body_object_message}"
+
+    ensure_alert \
+      "k8s-volume-mount-failures" \
+      "SELECT k8s_namespace_name, k8s_pod_name, body_object_reason, body_object_message FROM \"default\" WHERE body_object_message ILIKE '%FailedMount%' OR body_object_message ILIKE '%FailedAttachVolume%' OR body_object_message ILIKE '%MountVolume%' ORDER BY _timestamp DESC LIMIT 50" \
+      10 2 60 \
+      "{k8s_namespace_name}/{k8s_pod_name} {body_object_reason}: {body_object_message}"
+
+    ensure_alert \
+      "argocd-errors" \
+      "SELECT k8s_pod_name, k8s_container_name, substring(body, 1, 220) AS msg FROM \"default\" WHERE k8s_namespace_name = 'argocd' AND (body ILIKE '%level=error%' OR body ILIKE '%ERROR%' OR body ILIKE '%ComparisonError%' OR body ILIKE '%SyncFailed%') ORDER BY _timestamp DESC LIMIT 50" \
+      10 2 30 \
+      "argocd/{k8s_pod_name} {k8s_container_name}: {msg}"
+
+    ensure_alert \
+      "woodpecker-errors" \
+      "SELECT k8s_pod_name, k8s_container_name, substring(body, 1, 220) AS msg FROM \"default\" WHERE k8s_namespace_name = 'woodpecker' AND (body ILIKE '%error%' OR body ILIKE '%ERROR%' OR body ILIKE '%failed%') ORDER BY _timestamp DESC LIMIT 50" \
+      10 2 30 \
+      "woodpecker/{k8s_pod_name} {k8s_container_name}: {msg}"
+
+    ensure_alert \
+      "registry-errors" \
+      "SELECT k8s_pod_name, k8s_container_name, substring(body, 1, 220) AS msg FROM \"default\" WHERE k8s_namespace_name = 'registry' AND (body ILIKE '%error%' OR body ILIKE '%ERROR%' OR body ILIKE '%413%' OR body ILIKE '%payload too large%') ORDER BY _timestamp DESC LIMIT 50" \
+      10 2 60 \
+      "registry/{k8s_pod_name} {k8s_container_name}: {msg}"

ops/openobserve-alerts/cronjob.yaml

@@ -0,0 +1,49 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: openobserve-alerts-bootstrap
+  namespace: openobserve
+spec:
+  schedule: "*/15 * * * *"
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: bootstrap
+              image: registry.nxtgauge.com/docker:28-cli
+              command: ["sh", "-lc"]
+              args:
+                - apk add --no-cache curl jq >/dev/null && /scripts/bootstrap.sh
+              env:
+                - name: ORG_ID
+                  value: default
+                - name: BASE_URL
+                  value: http://o2-openobserve-standalone.openobserve.svc.cluster.local:5080
+                - name: TELEGRAM_CHAT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: openobserve-telegram
+                      key: TELEGRAM_CHAT_ID
+                - name: ZO_ROOT_USER_EMAIL
+                  valueFrom:
+                    secretKeyRef:
+                      name: o2-openobserve-standalone
+                      key: ZO_ROOT_USER_EMAIL
+                - name: ZO_ROOT_USER_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: o2-openobserve-standalone
+                      key: ZO_ROOT_USER_PASSWORD
+              volumeMounts:
+                - name: scripts
+                  mountPath: /scripts
+                  readOnly: true
+          volumes:
+            - name: scripts
+              configMap:
+                name: openobserve-alerts-bootstrap
+                defaultMode: 0555