From 1892e137c122b39844529e27d906dd35f282e8de Mon Sep 17 00:00:00 2001
From: chrisfu <chrisfu@prole.org>
Date: Thu, 7 May 2026 01:25:32 -0400
Subject: [PATCH] feat(infra): replace GitLab with Gitea on git.prole.org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove GitLab hostname/storage config from k3s.cfg; GitLab is gone.
- Update GITEA_HOSTNAME git-internal → git.prole.org
- Fix MONITORING_STORAGE_CLASS local-path → merlin-local-iscsi-prometheus
- Kong: route git.prole.org → gitea-http.gitea:3000
- Add svc-knoe-ingress.yaml as source-of-truth for the prole ingress (was
  missing; live object named svc-knoe-ingress, routes git.prole.org through
  Traefik → Kong → Gitea)
- DNS: add git.prole.org A record → 73.15.20.166 (public front-door)
- monitoring/kps-values-k3s.yaml: fix storage class for Prometheus/Alertmanager

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .idea/runConfigurations/pytest_all.xml        |  2 +-
 .idea/runConfigurations/pytest_gke.xml        |  7 +-
 .idea/runConfigurations/pytest_k3d.xml        |  7 +-
 .idea/runConfigurations/pytest_min.xml        |  7 +-
 .idea/runConfigurations/pytest_unit.xml       |  7 +-
 conf/k3d.cfg                                  | 47 ++++++++-----
 conf/k3s.cfg                                  | 10 +--
 conf/port-mapping.cfg                         |  4 +-
 .../k3s/manifests/knoe/kong-configmap.yaml    |  2 +-
 .../k3s/manifests/knoe/svc-knoe-ingress.yaml  | 69 +++++++++++++++++++
 env.sh                                        |  8 +--
 etc/init_grafana_oauth_prole.sh               |  0
 etc/init_oauth2_proxy_prole.sh                |  0
 .../inventory/group_vars/all/dns.yml          |  5 ++
 modes/k3d/knoe-db/.version                    |  2 +-
 supabase/helm/generated/manifest-summary.json | 14 ++--
 .../helm/generated/supabase-helm.app.yaml     | 58 +++++-----------
 .../generated/supabase-helm.frontdoor-db.yaml |  9 +++
 18 files changed, 174 insertions(+), 84 deletions(-)
 create mode 100644 deploy/opentofu/k3s/manifests/knoe/svc-knoe-ingress.yaml
 mode change 100755 => 100644 etc/init_grafana_oauth_prole.sh
 mode change 100755 => 100644 etc/init_oauth2_proxy_prole.sh

diff --git a/.idea/runConfigurations/pytest_all.xml b/.idea/runConfigurations/pytest_all.xml
index 6bf0f13..f2829fa 100644
--- a/.idea/runConfigurations/pytest_all.xml
+++ b/.idea/runConfigurations/pytest_all.xml
@@ -9,7 +9,7 @@
       <env name="PYTHONPATH" value="$PROJECT_DIR$" />
     </envs>
     <option name="SDK_HOME" value="" />
-    <option name="SDK_NAME" value="Python 3.14 (knoe-db)" />
+    <option name="SDK_NAME" value="Python 3.14 (prole)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
diff --git a/.idea/runConfigurations/pytest_gke.xml b/.idea/runConfigurations/pytest_gke.xml
index 858be99..491ca9c 100644
--- a/.idea/runConfigurations/pytest_gke.xml
+++ b/.idea/runConfigurations/pytest_gke.xml
@@ -1,17 +1,22 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="pytest — gke mode" type="PythonConfigurationType" factoryName="Python">
     <module name="knoe-db" />
+    <option name="ENV_FILES" value="" />
     <option name="INTERPRETER_OPTIONS" value="" />
     <option name="PARENT_ENVS" value="true" />
     <envs>
+      <env name="PYTHONUNBUFFERED" value="1" />
       <env name="PYTHONPATH" value="$PROJECT_DIR$" />
       <env name="KNOE_MODE" value="gke" />
     </envs>
     <option name="SDK_HOME" value="" />
+    <option name="SDK_NAME" value="Python 3.14 (prole)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="DEBUG_JUST_MY_CODE" value="true" />
+    <option name="RUN_TOOL" value="" />
     <option name="SCRIPT_NAME" value="-m pytest" />
     <option name="PARAMETERS" value="-m gke --cov=knoe --cov-report=term-missing -v tests/" />
     <option name="SHOW_COMMAND_LINE" value="false" />
@@ -21,4 +26,4 @@
     <option name="INPUT_FILE" value="" />
     <method v="2" />
   </configuration>
-</component>
+</component>
\ No newline at end of file
diff --git a/.idea/runConfigurations/pytest_k3d.xml b/.idea/runConfigurations/pytest_k3d.xml
index d94d551..4034f14 100644
--- a/.idea/runConfigurations/pytest_k3d.xml
+++ b/.idea/runConfigurations/pytest_k3d.xml
@@ -1,17 +1,22 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="pytest — k3d mode" type="PythonConfigurationType" factoryName="Python">
     <module name="knoe-db" />
+    <option name="ENV_FILES" value="" />
     <option name="INTERPRETER_OPTIONS" value="" />
     <option name="PARENT_ENVS" value="true" />
     <envs>
+      <env name="PYTHONUNBUFFERED" value="1" />
       <env name="PYTHONPATH" value="$PROJECT_DIR$" />
       <env name="KNOE_MODE" value="k3d" />
     </envs>
     <option name="SDK_HOME" value="" />
+    <option name="SDK_NAME" value="Python 3.14 (prole)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="DEBUG_JUST_MY_CODE" value="true" />
+    <option name="RUN_TOOL" value="" />
     <option name="SCRIPT_NAME" value="-m pytest" />
     <option name="PARAMETERS" value="-m k3d --cov=knoe --cov-report=term-missing -v tests/" />
     <option name="SHOW_COMMAND_LINE" value="false" />
@@ -21,4 +26,4 @@
     <option name="INPUT_FILE" value="" />
     <method v="2" />
   </configuration>
-</component>
+</component>
\ No newline at end of file
diff --git a/.idea/runConfigurations/pytest_min.xml b/.idea/runConfigurations/pytest_min.xml
index 12e00f6..8383115 100644
--- a/.idea/runConfigurations/pytest_min.xml
+++ b/.idea/runConfigurations/pytest_min.xml
@@ -1,17 +1,22 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="pytest — min mode" type="PythonConfigurationType" factoryName="Python">
     <module name="knoe-db" />
+    <option name="ENV_FILES" value="" />
     <option name="INTERPRETER_OPTIONS" value="" />
     <option name="PARENT_ENVS" value="true" />
     <envs>
+      <env name="PYTHONUNBUFFERED" value="1" />
       <env name="PYTHONPATH" value="$PROJECT_DIR$" />
       <env name="KNOE_MODE" value="min" />
     </envs>
     <option name="SDK_HOME" value="" />
+    <option name="SDK_NAME" value="Python 3.14 (prole)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="DEBUG_JUST_MY_CODE" value="true" />
+    <option name="RUN_TOOL" value="" />
     <option name="SCRIPT_NAME" value="-m pytest" />
     <option name="PARAMETERS" value="-m min --cov=knoe --cov-report=term-missing -v tests/" />
     <option name="SHOW_COMMAND_LINE" value="false" />
@@ -21,4 +26,4 @@
     <option name="INPUT_FILE" value="" />
     <method v="2" />
   </configuration>
-</component>
+</component>
\ No newline at end of file
diff --git a/.idea/runConfigurations/pytest_unit.xml b/.idea/runConfigurations/pytest_unit.xml
index c0f7d1f..56f12e8 100644
--- a/.idea/runConfigurations/pytest_unit.xml
+++ b/.idea/runConfigurations/pytest_unit.xml
@@ -1,16 +1,21 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="pytest — unit (fast, no deps)" type="PythonConfigurationType" factoryName="Python">
     <module name="knoe-db" />
+    <option name="ENV_FILES" value="" />
     <option name="INTERPRETER_OPTIONS" value="" />
     <option name="PARENT_ENVS" value="true" />
     <envs>
+      <env name="PYTHONUNBUFFERED" value="1" />
       <env name="PYTHONPATH" value="$PROJECT_DIR$" />
     </envs>
     <option name="SDK_HOME" value="" />
+    <option name="SDK_NAME" value="Python 3.14 (prole)" />
     <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$" />
     <option name="IS_MODULE_SDK" value="false" />
     <option name="ADD_CONTENT_ROOTS" value="true" />
     <option name="ADD_SOURCE_ROOTS" value="true" />
+    <option name="DEBUG_JUST_MY_CODE" value="true" />
+    <option name="RUN_TOOL" value="" />
     <option name="SCRIPT_NAME" value="-m pytest" />
     <option name="PARAMETERS" value="-m &quot;unit and not integration&quot; --cov=knoe --cov-report=term-missing -v tests/" />
     <option name="SHOW_COMMAND_LINE" value="false" />
@@ -20,4 +25,4 @@
     <option name="INPUT_FILE" value="" />
     <method v="2" />
   </configuration>
-</component>
+</component>
\ No newline at end of file
diff --git a/conf/k3d.cfg b/conf/k3d.cfg
index 7626709..c41c86a 100644
--- a/conf/k3d.cfg
+++ b/conf/k3d.cfg
@@ -1,5 +1,5 @@
 ; Knoe Master Configuration File
-; Generated by install.py on 2026-05-03 19:40:53
+; Generated by install.py on 2026-05-04 02:15:57
 ; This file is used as input for Ansible deployment and k8s cluster creation.
 
 [User]
@@ -53,7 +53,7 @@ env_setup.PROLE_DATA = /Users/chrisfu/dev/prole/data
 env_setup.PROLE_LOGS = /Users/chrisfu/dev/prole/logs
 gitops.git_provider = Gitea
 gitops.node_selector = 
-init_cluster.argocd_enabled = false
+init_cluster.argocd_enabled = true
 init_cluster.at_rest_encryption_enabled = true
 init_cluster.cluster_env = dev
 init_cluster.deployment_target = knoe-dev-cluster
@@ -70,26 +70,27 @@ init_db_build.run_build = true
 init_password.cluster_name = ${CLUSTER_NAME}
 init_password.db_host_port = 5432
 init_password.db_namespace = ${DATABASE_NAMESPACE}
-init_password.db_password = ${KNOE_SECRET:v1:dZtt1snkOcvvfKLT:InElcG1YzL86l6ZPP03cf9Zx07Tq5-qt}
-init_password.db_password_confirm = ${KNOE_SECRET:v1:dZtt1snkOcvvfKLT:InElcG1YzL86l6ZPP03cf9Zx07Tq5-qt}
-init_password.db_username = chrisfu
+init_password.db_password = ${KNOE_SECRET:v1:v00gnU0lZjZUF__L:3tlFaJnbjpK1_Ufggmfp8T91VSuq1uMO}
+init_password.db_password_confirm = ${KNOE_SECRET:v1:v00gnU0lZjZUF__L:3tlFaJnbjpK1_Ufggmfp8T91VSuq1uMO}
+init_password.db_username = root
 init_password.generate_ssh_key = true
 init_scripts.run_scripts = true
 kerberos_config.enabled = true
 kerberos_config.kdc = 10.0.0.3
-kerberos_config.password = ${KNOE_SECRET:v1:FIPsTmrzljDXRhwf:Hfp05VmT2yAOJIUFoSG1utMJHMvNP7reGAkoXyvmIp_lAftCI6NyHSj0AqrHPI0Q}
+kerberos_config.password = ${KNOE_SECRET:v1:b3l7OBzEaKrOf04_:HQL8wPSazmkCgAjevoW0eNjsoOUkPi11OxZSQyOqvcD347WCoUKcztiyqubQwMj5}
 kerberos_config.realm = PROLE.ORG
 kerberos_config.test_connection = true
 kerberos_config.user = administrator
 network_scan.run = true
 ollama_config.model = 
-ollama_config.server_host = fairyland.prole.org
+ollama_config.server_host = 
 ollama_config.server_port = 11434
 supabase_config.pv_base_dir = /synology/d005
 supabase_config.pv_node = 
 
 [Global]
 ; Variables used by name in more than one place or assumed global scope
+ARGOCD_NAMESPACE = argocd
 CLUSTER_ENV = dev
 CLUSTER_NAME = knoe-db
 CNPG_PLACEMENT_PLAN_FILE = /Users/chrisfu/dev/prole/conf/cnpg-placement/knoe-system-knoe-db.json
@@ -97,16 +98,21 @@ CNPG_PLACEMENT_PLAN_HASH = 965d2fde4035059f
 CNPG_PLACEMENT_PLAN_ID = cnpg-placement-965d2fde4035059f
 DATABASE_NAMESPACE = knoe-db
 DB_HOST_PORT = 5432
-DB_PASSWORD = ${KNOE_SECRET:v1:LJJ4Y6WIqRMV5Pp6:UD3iURPdk8_3xDqlakAg0eY_81kppn4g}
+DB_PASSWORD = ${KNOE_SECRET:v1:UHU7cGaV3F206SiN:iWT-KbxciZyijyU2W3d_toKCoTRyCKfp}
 DEPLOYMENT_MODE = k3d
 DEPLOYMENT_TARGET = knoe-dev-cluster
 DOCKER_PRELOAD = false
-KNOE_DB_USER = chrisfu
+K3S_SERVER = https://myrddin.prole.org:6443
+K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
+KNOE_DB_USER = root
 KNOE_HOME = /Users/chrisfu/dev/prole
+KUBECONTEXT = k3d-knoe-dev-cluster
+OPENTOFU_URL = http://127.0.0.1:8080
 OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
 PROLE_K3S_SERVER = https://myrddin.prole.org:6443
 PROLE_K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
 PROLE_OPENTOFU_URL = http://127.0.0.1:8080
+REGISTRY_NAMESPACE = knoe-system
 SERVICE_NAMESPACE = knoe-system
 SUPABASE_PV_BASE = /synology/d005
 SUPABASE_PV_BASE_DIR = /synology/d005
@@ -115,7 +121,7 @@ SUPABASE_PV_BASE_DIR = /synology/d005
 ; No configuration values captured yet for this section.
 
 [Dependencies]
-; No configuration values captured yet for this section.
+STATUS = All installed
 
 [Network]
 AD_DC_HOST = myrddin.prole.org
@@ -138,7 +144,7 @@ PROLE_DATA = $HOME/dev/prole/data
 PROLE_LOGS = $HOME/dev/prole/logs
 
 [Monitoring]
-GRAFANA_ADMIN_PASSWORD = ${KNOE_SECRET:v1:T80z8G4SXuY96xLZ:HFX0qAPJIOz7Fevc5m2Ml2YL8qmpbES3}
+GRAFANA_ADMIN_PASSWORD = ${KNOE_SECRET:v1:KjciJR7E96MaNboA:dLAYw8xx0bQt9qoh7CYqnbOUUCwFU4bY}
 
 [Kerberos Authentication]
 AD_PORT_FORWARD = 1
@@ -149,18 +155,17 @@ AD_TCP_PORTS = 88 389 445 464 636
 AD_UDP_PORTS = 88 464
 ENABLED = True
 KDC = 10.0.0.3
-PASSWORD = ${KNOE_SECRET:v1:SwR1_S3KrYbGj7k8:Qi4fnGhMAaMetBAhql2FhskJgVVIvj3mcN3Po5TCk7JyZaVzDZuYEjwpPjevODjC}
+PASSWORD = ${KNOE_SECRET:v1:LRsb2eBOIlB3CksO:73aNgprchcwifxIEiaGBLLj-kZCpry1v34DADJIfUaA4ltfVQc2V6kvoBmznYBmH}
 REALM = PROLE.ORG
 SERVER = 10.0.0.3
+STATUS = Attempted
 USER = administrator
 
 [Ollama]
-OLLAMA_HOST = http://fairyland.prole.org:11434
 OLLAMA_SERVERS = fairyland.prole.org:11434,k3d.localhost:11434,morgoth.prole.org:11434
-OLLAMA_SERVER_HOST = fairyland.prole.org
-OLLAMA_SERVER_PORT = 11434
 
 [Optional Features]
+ARGOCD_ENABLED = True
 AT_REST_ENCRYPTION_ENABLED = True
 GITOPS_ENABLED = False
 KERBEROS_ENABLED = True
@@ -170,7 +175,9 @@ SUPABASE_ENABLED = False
 ; No configuration values captured yet for this section.
 
 [Database Creation]
-; No configuration values captured yet for this section.
+APP_CLUSTER_NAME = knoe-dev-0
+DB_CLUSTER_NAME = knoe-dev-cnpg-0
+DB_USER = root
 
 [Initialize Cluster]
 ENVIRONMENT = dev
@@ -180,6 +187,7 @@ K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWk
 [Dev Cluster (k3d)]
 CLUSTER_ENV = dev
 DISPLAY_NAME = knoe-dev-cluster
+KUBECTL_CONTEXT = k3d-knoe-dev-cluster
 MODE = k3d
 
 [Service Cluster (k3s)]
@@ -191,7 +199,10 @@ MODE = k3s
 PIPELINE_URL = http://127.0.0.1:8080
 
 [GCP]
-; No configuration values captured yet for this section.
+BILLING_ACCOUNT = 01193C-25783B-3211AD
+BILLING_PROJECT = plenary-truck-485623-p7
+ORG_ID = 584001916389
+PROJECT_ID = plenary-truck-485623-p7
 
 [Prod Cluster (k8s)]
 ARTIFACTS_DIR = $HOME/dev/prole/data/staging
@@ -212,4 +223,4 @@ MODE = k3d
 TARGET = knoe-dev-cluster
 
 [Install]
-; No configuration values captured yet for this section.
+STATUS = Failed
diff --git a/conf/k3s.cfg b/conf/k3s.cfg
index ba0507f..0ac5438 100644
--- a/conf/k3s.cfg
+++ b/conf/k3s.cfg
@@ -143,18 +143,14 @@ DEPLOYMENT_MODE = k3s
 DEPLOYMENT_TARGET = knoe-service-cluster
 DOCKER_IMPORT_DIR = 
 DOCKER_PRELOAD = false
-GITEA_HOSTNAME = git-internal.prole.org
+GITEA_HOSTNAME = git.prole.org
 GITEA_PV_NODE = gandalf.prole.org
-GITLAB_GITALY_STORAGE_CLASS = synology-iscsi
-GITLAB_PUBLIC_HOSTS = git.prole.org
-GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 1
-GITLAB_STORAGE_NODE = merlin.prole.org
 K3S_SERVER = https://myrddin.prole.org:6443
 K3S_TOKEN = ${KNOE_SECRET:v1:-cslrAhG8WhxxJLY:vAx5MGOBcU1NBMjf4U-3y1djMDmwwOjiWkrutxPa4Li5P8RBjCBhEOCEdGP2CiPJJ6UQK-ietX-mu_5nO3yNNjpwDququT4U6lWHPEInSvUNH6ImU-HzPvm_diL2FwJtZm3sY5HgecIy2dwXB_vLnYaA_7VXt9zf0T70rw==}
 KNOE_DB_USER = root
 KNOE_HOME = $HOME/dev/knoe
 KNOE_IMAGE_REGISTRY = registry.prole.org
-MONITORING_STORAGE_CLASS = local-path
+MONITORING_STORAGE_CLASS = merlin-local-iscsi-prometheus
 OPENTOFU_URL = http://127.0.0.1:8080
 OPTIONAL_WORKLOADS_MIN_READY_SCHEDULABLE_NODES = 2
 PROLE_K3S_SERVER = https://myrddin.prole.org:6443
@@ -208,7 +204,7 @@ PROLE_DATA = $HOME/dev/knoe/data
 PROLE_LOGS = $HOME/dev/knoe/logs
 
 [Monitoring]
-MONITORING_STORAGE_CLASS = local-path
+MONITORING_STORAGE_CLASS = merlin-local-iscsi-prometheus
 
 [Kerberos Authentication]
 STATUS = Initialized
diff --git a/conf/port-mapping.cfg b/conf/port-mapping.cfg
index 561f824..f879a37 100644
--- a/conf/port-mapping.cfg
+++ b/conf/port-mapping.cfg
@@ -1,9 +1,11 @@
 # Port mappings for Knoe Tools (generated).
 # Format: key: local=... remote=... ns=... svc=... address=...
 
+gitea-ssh: local=22 remote=22 ns=gitea svc=gitea-ssh address=0.0.0.0
 garage: local=3900 remote=3900 ns=knoe-system svc=garage address=0.0.0.0
-openbao: local=8200 remote=8200 ns=knoe-system svc=openbao address=127.0.0.1
+openbao: local=8200 remote=8200 ns=knoe-system svc=openbao address=0.0.0.0
 opentofu: local=8080 remote=8080 ns=knoe-system svc=opentofu address=0.0.0.0
 postgres: local=5432 remote=5432 ns=knoe-db svc=knoe-db-rw address=0.0.0.0
 prometheus: local=9090 remote=9090 ns=monitoring svc=prometheus-kube-prometheus-stack-prometheus address=127.0.0.1
 grafana: local=3000 remote=80 ns=monitoring svc=prometheus-grafana address=0.0.0.0
+gitea-http: local=13000 remote=3000 ns=gitea svc=gitea-http address=0.0.0.0
diff --git a/deploy/opentofu/k3s/manifests/knoe/kong-configmap.yaml b/deploy/opentofu/k3s/manifests/knoe/kong-configmap.yaml
index db89b16..9d66df8 100644
--- a/deploy/opentofu/k3s/manifests/knoe/kong-configmap.yaml
+++ b/deploy/opentofu/k3s/manifests/knoe/kong-configmap.yaml
@@ -82,7 +82,7 @@ data:
         routes:
           - name: gitea-root
             hosts:
-              - git-internal.prole.org
+              - git.prole.org
             paths:
               - /
             strip_path: false
diff --git a/deploy/opentofu/k3s/manifests/knoe/svc-knoe-ingress.yaml b/deploy/opentofu/k3s/manifests/knoe/svc-knoe-ingress.yaml
new file mode 100644
index 0000000..71bfb86
--- /dev/null
+++ b/deploy/opentofu/k3s/manifests/knoe/svc-knoe-ingress.yaml
@@ -0,0 +1,69 @@
+# svc-knoe-ingress.yaml
+# Traefik ingress for *.prole.org — routes all public domains through
+# knoe-svc-kong (declarative Kong in knoe-system). cert-manager issues a
+# Let's Encrypt cert (svc-prole-org-tls) for all hosts via HTTP-01.
+#
+# Kong routing (kong-configmap.yaml):
+#   api.prole.org   → knoe-auth.knoe-system:8080
+#   db.prole.org    → oauth2-proxy.supabase:4180  (Supabase Studio + Google gate)
+#   svc.prole.org   → knoe-grafana-proxy.monitoring:80 (Grafana)
+#   git.prole.org   → gitea-http.gitea:3000 (Gitea)
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: svc-knoe-ingress
+  namespace: knoe-system
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.priority: "10"
+spec:
+  rules:
+    - host: svc.prole.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: knoe-svc-kong
+                port:
+                  number: 8000
+    - host: api.prole.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: knoe-svc-kong
+                port:
+                  number: 8000
+    - host: db.prole.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 80
+    - host: git.prole.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: knoe-svc-kong
+                port:
+                  number: 8000
+  tls:
+    - hosts:
+        - svc.prole.org
+        - api.prole.org
+        - db.prole.org
+        - git.prole.org
+      secretName: svc-prole-org-tls
diff --git a/env.sh b/env.sh
index cc498c1..c31ea6a 100755
--- a/env.sh
+++ b/env.sh
@@ -4,10 +4,10 @@
 #   "$KNOE_HOME/env.sh" <command> [args…]
 # shellcheck shell=bash
 export KNOE_HOME="$HOME/dev/prole"
-export KNOE_CONF="$HOME/dev/prole/conf"
-export PROLE_DATA="$HOME/dev/prole/data"
-export PROLE_LOGS="$HOME/dev/prole/logs"
-export KNOE_SERVICE="$HOME/dev/prole/etc"
+export KNOE_CONF="$KNOE_HOME/conf"
+export PROLE_DATA="$KNOE_HOME/data"
+export PROLE_LOGS="$KNOE_HOME/logs"
+export KNOE_SERVICE="$KNOE_HOME/etc"
 
 # Ensure PATH works for GUI-launched shells (Docker, etc.)
 _knoe_add_path() { case ":${PATH}:" in *":$1:"*) ;; *) PATH="$1:${PATH:-}" ;; esac; }
diff --git a/etc/init_grafana_oauth_prole.sh b/etc/init_grafana_oauth_prole.sh
old mode 100755
new mode 100644
diff --git a/etc/init_oauth2_proxy_prole.sh b/etc/init_oauth2_proxy_prole.sh
old mode 100755
new mode 100644
diff --git a/infrastructure/inventory/group_vars/all/dns.yml b/infrastructure/inventory/group_vars/all/dns.yml
index 6c467f5..9b1e453 100644
--- a/infrastructure/inventory/group_vars/all/dns.yml
+++ b/infrastructure/inventory/group_vars/all/dns.yml
@@ -111,6 +111,11 @@ prole_dns_records:
     value: 10.0.0.207
     ttl: 300
 
+  - name: git
+    type: A
+    value: 73.15.20.166
+    ttl: 300
+
   - name: svc
     type: A
     value: 73.15.20.166
diff --git a/modes/k3d/knoe-db/.version b/modes/k3d/knoe-db/.version
index dec2bf5..410b14d 100644
--- a/modes/k3d/knoe-db/.version
+++ b/modes/k3d/knoe-db/.version
@@ -1 +1 @@
-19
\ No newline at end of file
+25
\ No newline at end of file
diff --git a/supabase/helm/generated/manifest-summary.json b/supabase/helm/generated/manifest-summary.json
index 4fac2ad..0818283 100644
--- a/supabase/helm/generated/manifest-summary.json
+++ b/supabase/helm/generated/manifest-summary.json
@@ -1,10 +1,10 @@
 {
-  "values": "/Users/chrisfu/dev/knoe/supabase/helm/generated/values.generated.json",
-  "manifests": "/Users/chrisfu/dev/knoe/supabase/k8s/supabase-helm.yaml",
-  "manifests_app": "/Users/chrisfu/dev/knoe/supabase/helm/generated/supabase-helm.app.yaml",
-  "manifests_frontdoor_db": "/Users/chrisfu/dev/knoe/supabase/helm/generated/supabase-helm.frontdoor-db.yaml",
-  "manifests_public_ingress_tls": "/Users/chrisfu/dev/knoe/supabase/k8s/public-ingress-tls.yaml",
-  "manifests_public_ingress_kong": "/Users/chrisfu/dev/knoe/supabase/k8s/public-ingress-kong.yaml",
-  "db_host": "10.180.15.236",
+  "values": "/Users/chrisfu/dev/prole/supabase/helm/generated/values.generated.json",
+  "manifests": "/Users/chrisfu/dev/prole/supabase/k8s/supabase-helm.yaml",
+  "manifests_app": "/Users/chrisfu/dev/prole/supabase/helm/generated/supabase-helm.app.yaml",
+  "manifests_frontdoor_db": "/Users/chrisfu/dev/prole/supabase/helm/generated/supabase-helm.frontdoor-db.yaml",
+  "manifests_public_ingress_tls": "/Users/chrisfu/dev/prole/supabase/k8s/public-ingress-tls.yaml",
+  "manifests_public_ingress_kong": "/Users/chrisfu/dev/prole/supabase/k8s/public-ingress-kong.yaml",
+  "db_host": "knoe-db-rw.knoe-db.svc.cluster.local",
   "supabase_namespace": "supabase"
 }
\ No newline at end of file
diff --git a/supabase/helm/generated/supabase-helm.app.yaml b/supabase/helm/generated/supabase-helm.app.yaml
index d352d24..c874175 100644
--- a/supabase/helm/generated/supabase-helm.app.yaml
+++ b/supabase/helm/generated/supabase-helm.app.yaml
@@ -10,8 +10,6 @@
 ---
 {"apiVersion": "v1", "kind": "ServiceAccount", "metadata": {"name": "supabase-meta", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}}
 ---
-{"apiVersion": "v1", "kind": "ServiceAccount", "metadata": {"name": "supabase-minio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}}
----
 {"apiVersion": "v1", "kind": "ServiceAccount", "metadata": {"name": "supabase-realtime", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}}
 ---
 {"apiVersion": "v1", "kind": "ServiceAccount", "metadata": {"name": "supabase-rest", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}}
@@ -24,11 +22,11 @@
 ---
 {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-analytics", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"privateAccessToken": "eW91ci1zdXBlci1zZWNyZXQtYW5kLWxvbmctbG9nZmxhcmUta2V5LXByaXZhdGU=", "publicAccessToken": "eW91ci1zdXBlci1zZWNyZXQtYW5kLWxvbmctbG9nZmxhcmUta2V5LXB1YmxpYw=="}}
 ---
-{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-dashboard", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"openAiApiKey": "a2V5X3N1cGVyX3NlY3JldA==", "password": "dGhpc19wYXNzd29yZF9pc19pbnNlY3VyZV9hbmRfc2hvdWxkX2JlX3VwZGF0ZWQ=", "username": "c3VwYWJhc2U="}}
+{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-openai", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"apiKey": "a2V5X3N1cGVyX3NlY3JldA=="}}
 ---
 {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-db", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"database": "cG9zdGdyZXM=", "password": "dnp4LndDNEFrZDR4LURqNldndWg=", "password_encoded": "dnp4LndDNEFrZDR4LURqNldndWg="}}
 ---
-{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-jwt", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"anonKey": "ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaVlXNXZiaUlzSW1semN5STZJbXR1YjJVdGMzVndZV0poYzJVaUxDSnBZWFFpT2pFM056WTRNamN3T0Rjc0ltVjRjQ0k2TWpBNU1qRTROekE0TjMwLkJFbHZWemJkZ05tbHRZV3VtcnhwaWg3RU9LeU5NeXdveWtPLVo2UUZUdHc=", "secret": "NGU1M2UxZWNiOThlYjMyZWU4M2I4OTBiZWE3OWU2NzhlOTUyYzZhZTIzN2VkZjNmNjVmMzdiZjZkZDIyNjJlYg==", "serviceKey": "ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaWMyVnlkbWxqWlY5eWIyeGxJaXdpYVhOeklqb2lhMjV2WlMxemRYQmhZbUZ6WlNJc0ltbGhkQ0k2TVRjM05qZ3lOekE0Tnl3aVpYaHdJam95TURreU1UZzNNRGczZlEuakVzTUZQdDFnYjhxQWkzb1VPTnNoNVROY2dYeV8zZW8wMC1TVzVjU2dLWQ=="}}
+{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-jwt", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"anonKey": "ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaVlXNXZiaUlzSW1semN5STZJbXR1YjJVdGMzVndZV0poYzJVaUxDSnBZWFFpT2pFM056YzROekExTlRRc0ltVjRjQ0k2TWpBNU16SXpNRFUxTkgwLmdIUDdTcWE2TW1JOHBzbE1OZkt4WmhGVXpPS0FNWDUteGs3WFQwblFZcWc=", "secret": "NGU1M2UxZWNiOThlYjMyZWU4M2I4OTBiZWE3OWU2NzhlOTUyYzZhZTIzN2VkZjNmNjVmMzdiZjZkZDIyNjJlYg==", "serviceKey": "ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaWMyVnlkbWxqWlY5eWIyeGxJaXdpYVhOeklqb2lhMjV2WlMxemRYQmhZbUZ6WlNJc0ltbGhkQ0k2TVRjM056ZzNNRFUxTkN3aVpYaHdJam95TURrek1qTXdOVFUwZlEuQjBNMFY4VExaQzBoUzQ2OU8tbGVpY0R0OHVRRXFPY21EYWpsV1ppR1Zzdw=="}}
 ---
 {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-meta", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"cryptoKey": "eW91ci1lbmNyeXB0aW9uLWtleS0zMi1jaGFycy1taW4="}}
 ---
@@ -36,29 +34,25 @@
 ---
 {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-realtime", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"secretKeyBase": "VXBOVm50bjNjRHhISnBxOTlZTWMxVDFBUWdRcGM4a2ZZVHVSZ0JpWWExNUJMcng4ZXRRb1h6M2dadjEvdTJvcQ=="}}
 ---
-{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-s3", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"accessKey": "OWQzNmQ0MzRkMjZkZGRiOTcyZGNmZjJkOTI2NjYxMmI4ZTYxOGQ2YTYzYmIwOGM2ZTEyZTdlOTYzOGQ4MDQyMQ==", "keyId": "R0s5NmQ1ZmZlOGIxMWYzYTNkYzdhMDlhNzY="}}
+{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-s3", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"accessKey": "NWZmNDBmMDY3NzI4YTc5ZGViMTNiMTc5Y2NkZmQxMTVkN2MwOTY2YmQxOGZhMzhkMjc5OGNmMzg5YTEzN2JmZA==", "keyId": "R0tmZTQ4NmE4NmVhMDg5MWY4ZTUzMzQ1NmE="}}
 ---
 {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-smtp", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"password": "ZmFrZV9tYWlsX3Bhc3N3b3Jk", "username": "ZmFrZV9tYWlsX3VzZXI="}}
 ---
 {"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "supabase-functions-main", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "data": {"index.ts": "import * as jose from 'https://deno.land/x/jose@v4.14.4/index.ts'\n\nconsole.log('main function started')\n\nconst JWT_SECRET = Deno.env.get('JWT_SECRET')\nconst VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'\n\nfunction getAuthToken(req: Request) {\nconst authHeader = req.headers.get('authorization')\nif (!authHeader) {\n    throw new Error('Missing authorization header')\n}\nconst [bearer, token] = authHeader.split(' ')\nif (bearer !== 'Bearer') {\n    throw new Error(`Auth header is not 'Bearer {token}'`)\n}\nreturn token\n}\n\nasync function verifyJWT(jwt: string): Promise<boolean> {\nconst encoder = new TextEncoder()\nconst secretKey = encoder.encode(JWT_SECRET)\ntry {\n    await jose.jwtVerify(jwt, secretKey)\n} catch (err) {\n    console.error(err)\n    return false\n}\nreturn true\n}\n\nDeno.serve(async (req: Request) => {\nif (req.method !== 'OPTIONS' && VERIFY_JWT) {\n    try {\n    const token = getAuthToken(req)\n    const isValidJWT = await verifyJWT(token)\n\n    if (!isValidJWT) {\n        return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {\n        status: 401,\n        headers: { 'Content-Type': 'application/json' },\n        })\n    }\n    } catch (e) {\n    console.error(e)\n    return new Response(JSON.stringify({ msg: e.toString() }), {\n        status: 401,\n        headers: { 'Content-Type': 'application/json' },\n    })\n    }\n}\n\nconst url = new URL(req.url)\nconst { pathname } = url\nconst path_parts = pathname.split('/')\nconst service_name = path_parts[1]\n\nif (!service_name || service_name === '') {\n    const error = { msg: 'missing function name in request' }\n    return new Response(JSON.stringify(error), {\n    status: 400,\n    headers: { 'Content-Type': 'application/json' },\n    })\n}\n\nconst servicePath = `/home/deno/functions/${service_name}`\nconsole.error(`serving the request with ${servicePath}`)\n\nconst memoryLimitMb = 150\nconst workerTimeoutMs = 1 * 60 * 1000\nconst noModuleCache = false\nconst importMapPath = null\nconst envVarsObj = Deno.env.toObject()\nconst envVars = Object.keys(envVarsObj).map((k) => [k, envVarsObj[k]])\n\ntry {\n    const worker = await EdgeRuntime.userWorkers.create({\n    servicePath,\n    memoryLimitMb,\n    workerTimeoutMs,\n    noModuleCache,\n    importMapPath,\n    envVars,\n    })\n    return await worker.fetch(req)\n} catch (e) {\n    const error = { msg: e.toString() }\n    return new Response(JSON.stringify(error), {\n    status: 500,\n    headers: { 'Content-Type': 'application/json' },\n    })\n}\n})\n"}}
 ---
-{"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "supabase-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "data": {"wrapper.sh": "#!/bin/bash\n\nset -euo pipefail\n\necho \"Replacing env placeholders of /usr/local/kong/kong.yml\"\n\nsed \\\n-e \"s|\\${SUPABASE_ANON_KEY}|${SUPABASE_ANON_KEY}|\" \\\n-e \"s|\\${SUPABASE_SERVICE_KEY}|${SUPABASE_SERVICE_KEY}|\" \\\n-e \"s|\\${DASHBOARD_USERNAME}|${DASHBOARD_USERNAME}|\" \\\n-e \"s|\\${DASHBOARD_PASSWORD}|${DASHBOARD_PASSWORD}|\" \\\n/usr/local/kong/template.yml \\\n> /usr/local/kong/kong.yml\n\nexec /docker-entrypoint.sh kong docker-start\n", "template.yml": "_format_version: '2.1'\n_transform: true\n\nconsumers:\n  - username: DASHBOARD\n  - username: anon\n    keyauth_credentials:\n        - key: ${SUPABASE_ANON_KEY}\n  - username: service_role\n    keyauth_credentials:\n        - key: ${SUPABASE_SERVICE_KEY}\nacls:\n  - consumer: anon\n    group: anon\n  - consumer: service_role\n    group: admin\nbasicauth_credentials:\n  - consumer: DASHBOARD\n    username: ${DASHBOARD_USERNAME}\n    password: ${DASHBOARD_PASSWORD}\nservices:\n  # Dedicated health endpoint used by the GCE LB BackendConfig.\n  # request-termination returns 200 synchronously without hitting any\n  # upstream, so the probe passes as long as the Kong proxy itself is\n  # accepting requests -- same liveness semantics as the TCP check we\n  # originally wanted, but using the HTTP protocol that GCE's L7\n  # BackendConfig CRD actually accepts (TCP is rejected with\n  # `Protocol \"TCP\" is not valid, must be one of [HTTP,HTTPS,HTTP2]`).\n  #\n  # URL is a RFC-2606 reserved `.invalid` hostname that never resolves.\n  # We originally tried `http://127.0.0.1:8000/` here, which is Kong's\n  # own proxy port -- this crashlooped the pod on startup (rollout timed\n  # out waiting for new pod to become Ready). Suspected cause: Kong's\n  # declarative-config parser rejects the self-reference. Since the\n  # request-termination plugin short-circuits before any DNS lookup or\n  # upstream connection, using a non-resolvable placeholder URL is\n  # equivalent in behavior but avoids the loop detection.\n  - name: healthz\n    url: http://knoe.healthz.invalid/\n    routes:\n      - name: healthz\n        strip_path: true\n        paths:\n          - /healthz\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 200\n          message: ok\n  - name: auth-v1-open\n    url: http://supabase-auth:9999/verify\n    routes:\n      - name: auth-v1-open\n        strip_path: true\n        paths:\n          - /auth/v1/verify\n    plugins:\n      - name: cors\n  - name: auth-v1-open-callback\n    url: http://supabase-auth:9999/callback\n    routes:\n      - name: auth-v1-open-callback\n        strip_path: true\n        paths:\n          - /auth/v1/callback\n    plugins:\n      - name: cors\n  - name: auth-v1-open-authorize\n    url: http://supabase-auth:9999/authorize\n    routes:\n      - name: auth-v1-open-authorize\n        strip_path: true\n        paths:\n          - /auth/v1/authorize\n    plugins:\n      - name: cors\n  - name: auth-v1\n    _comment: \"GoTrue: /auth/v1/* -> http://supabase-auth:9999/*\"\n    url: http://supabase-auth:9999\n    routes:\n      - name: auth-v1-all\n        strip_path: true\n        paths:\n          - /auth/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: rest-v1\n    _comment: \"PostgREST: /rest/v1/* -> http://supabase-rest:3000/*\"\n    url: http://supabase-rest:3000/\n    routes:\n      - name: rest-v1-all\n        strip_path: true\n        paths:\n          - /rest/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: graphql-v1\n    _comment: 'PostgREST: /graphql/v1/* -> http://supabase-rest:3000/rpc/graphql'\n    url: http://supabase-rest:3000/rpc/graphql\n    routes:\n      - name: graphql-v1-all\n        strip_path: true\n        paths:\n          - /graphql/v1\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - Content-Profile:graphql_public\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: realtime-v1-ws\n    _comment: \"Realtime: /realtime/v1/* -> ws://supabase-realtime:4000/socket/*\"\n    url: http://supabase-realtime:4000/socket\n    protocol: ws\n    routes:\n      - name: realtime-v1-ws\n        strip_path: true\n        paths:\n          - /realtime/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: realtime-v1-rest\n    _comment: 'Realtime: /realtime/v1/* -> http://supabase-realtime:4000/api/*'\n    url: http://supabase-realtime:4000/api\n    protocol: http\n    routes:\n      - name: realtime-v1-rest\n        strip_path: true\n        paths:\n          - /realtime/v1/api\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: storage-v1\n    _comment: \"Storage: /storage/v1/* -> http://supabase-storage:5000/*\"\n    url: http://supabase-storage:5000/\n    routes:\n      - name: storage-v1-all\n        strip_path: true\n        paths:\n          - /storage/v1/\n    plugins:\n      - name: cors\n  - name: functions-v1\n    _comment: 'Edge Functions: /functions/v1/* -> http://supabase-functions:9000/*'\n    url: http://supabase-functions:9000/\n    routes:\n      - name: functions-v1-all\n        strip_path: true\n        paths:\n          - /functions/v1/\n    plugins:\n      - name: cors\n\n\n\n\n  - name: meta\n    _comment: \"pg-meta: /pg/* -> http://supabase-meta:8080/*\"\n    url: http://supabase-meta:8080/\n    routes:\n      - name: meta-all\n        strip_path: true\n        paths:\n          - /pg/\n    plugins:\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n  - name: dashboard\n    _comment: 'Studio: /* -> http://supabase-studio:3000/*'\n    url: http://supabase-studio:3000/\n    routes:\n      - name: dashboard-all\n        strip_path: true\n        paths:\n          - /\n    plugins:\n      - name: cors\n      - name: basic-auth\n        config:\n          hide_credentials: true\n"}}
+{"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "supabase-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "data": {"wrapper.sh": "#!/bin/bash\n\nset -euo pipefail\n\necho \"Replacing env placeholders of /usr/local/kong/kong.yml\"\n\nsed \\\n-e \"s|\\${SUPABASE_ANON_KEY}|${SUPABASE_ANON_KEY}|\" \\\n-e \"s|\\${SUPABASE_SERVICE_KEY}|${SUPABASE_SERVICE_KEY}|\" \\\n/usr/local/kong/template.yml \\\n> /usr/local/kong/kong.yml\n\nexec /docker-entrypoint.sh kong docker-start\n", "template.yml": "_format_version: '2.1'\n_transform: true\n\nconsumers:\n  - username: anon\n    keyauth_credentials:\n        - key: ${SUPABASE_ANON_KEY}\n  - username: service_role\n    keyauth_credentials:\n        - key: ${SUPABASE_SERVICE_KEY}\nacls:\n  - consumer: anon\n    group: anon\n  - consumer: service_role\n    group: admin\nservices:\n  # Dedicated health endpoint used by the GCE LB BackendConfig.\n  # request-termination returns 200 synchronously without hitting any\n  # upstream, so the probe passes as long as the Kong proxy itself is\n  # accepting requests -- same liveness semantics as the TCP check we\n  # originally wanted, but using the HTTP protocol that GCE's L7\n  # BackendConfig CRD actually accepts (TCP is rejected with\n  # `Protocol \"TCP\" is not valid, must be one of [HTTP,HTTPS,HTTP2]`).\n  #\n  # URL is a RFC-2606 reserved `.invalid` hostname that never resolves.\n  # We originally tried `http://127.0.0.1:8000/` here, which is Kong's\n  # own proxy port -- this crashlooped the pod on startup (rollout timed\n  # out waiting for new pod to become Ready). Suspected cause: Kong's\n  # declarative-config parser rejects the self-reference. Since the\n  # request-termination plugin short-circuits before any DNS lookup or\n  # upstream connection, using a non-resolvable placeholder URL is\n  # equivalent in behavior but avoids the loop detection.\n  - name: healthz\n    url: http://knoe.healthz.invalid/\n    routes:\n      - name: healthz\n        strip_path: true\n        paths:\n          - /healthz\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 200\n          message: ok\n  # Stop-gap support endpoint -- 302s to mailto:support@knoe.dev so any user\n  # who lands at https://db.0.knoe.dev/support gets a working escape hatch.\n  # The in-Studio \"Report a problem\" / \"Send feedback\" buttons in upstream\n  # Studio are hardcoded to supabase.com endpoints and are not yet rewired\n  # (would require forking the Studio image -- tracked in docs/TODO.md).\n  # In the meantime we tell users: \"for help, go to db.0.knoe.dev/support\".\n  # request-termination synthesizes a 302 status; response-transformer\n  # injects the Location header (request-termination alone can't set it).\n  - name: support\n    url: http://knoe.support.invalid/\n    routes:\n      - name: support-redirect\n        strip_path: true\n        paths:\n          - /support\n    plugins:\n      - name: request-termination\n        config:\n          status_code: 302\n          message: \"Redirecting to support@knoe.dev\"\n      - name: response-transformer\n        config:\n          add:\n            headers:\n              - \"Location:mailto:support@knoe.dev\"\n  - name: auth-v1-open\n    url: http://supabase-auth:9999/verify\n    routes:\n      - name: auth-v1-open\n        strip_path: true\n        paths:\n          - /auth/v1/verify\n    plugins:\n      - name: cors\n  - name: auth-v1-open-callback\n    url: http://supabase-auth:9999/callback\n    routes:\n      - name: auth-v1-open-callback\n        strip_path: true\n        paths:\n          - /auth/v1/callback\n    plugins:\n      - name: cors\n  - name: auth-v1-open-authorize\n    url: http://supabase-auth:9999/authorize\n    routes:\n      - name: auth-v1-open-authorize\n        strip_path: true\n        paths:\n          - /auth/v1/authorize\n    plugins:\n      - name: cors\n  - name: auth-v1\n    _comment: \"GoTrue: /auth/v1/* -> http://supabase-auth:9999/*\"\n    url: http://supabase-auth:9999\n    routes:\n      - name: auth-v1-all\n        strip_path: true\n        paths:\n          - /auth/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: rest-v1\n    _comment: \"PostgREST: /rest/v1/* -> http://supabase-rest:3000/*\"\n    url: http://supabase-rest:3000/\n    routes:\n      - name: rest-v1-all\n        strip_path: true\n        paths:\n          - /rest/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: graphql-v1\n    _comment: 'PostgREST: /graphql/v1/* -> http://supabase-rest:3000/rpc/graphql'\n    url: http://supabase-rest:3000/rpc/graphql\n    routes:\n      - name: graphql-v1-all\n        strip_path: true\n        paths:\n          - /graphql/v1\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: true\n      - name: request-transformer\n        config:\n          add:\n            headers:\n              - Content-Profile:graphql_public\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: realtime-v1-ws\n    _comment: \"Realtime: /realtime/v1/* -> ws://supabase-realtime:4000/socket/*\"\n    url: http://supabase-realtime:4000/socket\n    protocol: ws\n    routes:\n      - name: realtime-v1-ws\n        strip_path: true\n        paths:\n          - /realtime/v1/\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: realtime-v1-rest\n    _comment: 'Realtime: /realtime/v1/* -> http://supabase-realtime:4000/api/*'\n    url: http://supabase-realtime:4000/api\n    protocol: http\n    routes:\n      - name: realtime-v1-rest\n        strip_path: true\n        paths:\n          - /realtime/v1/api\n    plugins:\n      - name: cors\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n            - anon\n  - name: storage-v1\n    _comment: \"Storage: /storage/v1/* -> http://supabase-storage:5000/*\"\n    url: http://supabase-storage:5000/\n    routes:\n      - name: storage-v1-all\n        strip_path: true\n        paths:\n          - /storage/v1/\n    plugins:\n      - name: cors\n  - name: functions-v1\n    _comment: 'Edge Functions: /functions/v1/* -> http://supabase-functions:9000/*'\n    url: http://supabase-functions:9000/\n    routes:\n      - name: functions-v1-all\n        strip_path: true\n        paths:\n          - /functions/v1/\n    plugins:\n      - name: cors\n\n\n\n\n  - name: meta\n    _comment: \"pg-meta: /pg/* -> http://supabase-meta:8080/*\"\n    url: http://supabase-meta:8080/\n    routes:\n      - name: meta-all\n        strip_path: true\n        paths:\n          - /pg/\n    plugins:\n      - name: key-auth\n        config:\n          hide_credentials: false\n      - name: acl\n        config:\n          hide_groups_header: true\n          allow:\n            - admin\n  # Onboarding reveal page (knoe-onboard nginx pod). Listed BEFORE the\n  # /-wildcard dashboard route so Kong's longest-prefix match picks\n  # /onboard.html over the dashboard. The page itself is also exempted\n  # from oauth2-proxy gating (`--skip-auth-route=^/onboard\\.html$`) since\n  # URL fragments don't survive an OAuth redirect; URL secrecy + 24h\n  # expiry + immediate-rotation is the security envelope.\n  - name: onboard\n    _comment: 'Onboarding reveal: /onboard.html -> knoe-onboard nginx pod'\n    url: http://knoe-onboard:80/\n    routes:\n      - name: onboard-html\n        strip_path: false\n        paths:\n          - /onboard.html\n    plugins:\n      - name: cors\n  - name: dashboard\n    _comment: 'Studio: /* -> http://supabase-studio:3000/*'\n    url: http://supabase-studio:3000/\n    routes:\n      - name: dashboard-all\n        strip_path: true\n        paths:\n          - /\n    plugins:\n      - name: cors\n"}}
 ---
 {"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "supabase-vector-config", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "data": {"vector.yml": "api:\n  enabled: true\n  address: 0.0.0.0:9001\n\nsources:\n  kubernetes_host:\n    type: kubernetes_logs\n    extra_label_selector: app.kubernetes.io/instance=supabase,app.kubernetes.io/name!=knoe-supabase-vector\n\ntransforms:\n  project_logs:\n    type: remap\n    inputs:\n      - kubernetes_host\n    source: |-\n      .project = \"default\"\n      .event_message = del(.message)\n      .appname = del(.kubernetes.container_name)\n      del(.file)\n      del(.kubernetes)\n      del(.source_type)\n      del(.stream)\n  router:\n    type: route\n    inputs:\n      - project_logs\n    route:\n      kong: '.appname == \"knoe-supabase-kong\"'\n      auth: '.appname == \"knoe-supabase-auth\"'\n      rest: '.appname == \"knoe-supabase-rest\"'\n      realtime: '.appname == \"knoe-supabase-realtime\"'\n      storage: '.appname == \"knoe-supabase-storage\"'\n      functions: '.appname == \"knoe-supabase-functions\"'\n      db: '.appname == \"knoe-supabase-db\"'\n  # Ignores non nginx errors since they are related with kong booting up\n  kong_logs:\n    type: remap\n    inputs:\n      - router.kong\n    source: |-\n      req, err = parse_nginx_log(.event_message, \"combined\")\n      if err == null {\n          .timestamp = req.timestamp\n          .metadata.request.headers.referer = req.referer\n          .metadata.request.headers.user_agent = req.agent\n          .metadata.request.headers.cf_connecting_ip = req.client\n          .metadata.response.status_code = req.status\n          url, split_err = split(req.request, \" \")\n          if split_err == null {\n              .metadata.request.method = url[0]\n              .metadata.request.path = url[1]\n              .metadata.request.protocol = url[2]\n          }\n      }\n      if err != null {\n        abort\n      }\n  # Ignores non nginx errors since they are related with kong booting up\n  kong_err:\n    type: remap\n    inputs:\n      - router.kong\n    source: |-\n      .metadata.request.method = \"GET\"\n      .metadata.response.status_code = 200\n      parsed, err = parse_nginx_log(.event_message, \"error\")\n      if err == null {\n          .timestamp = parsed.timestamp\n          .severity = parsed.severity\n          .metadata.request.host = parsed.host\n          .metadata.request.headers.cf_connecting_ip = parsed.client\n          url, err = split(parsed.request, \" \")\n          if err == null {\n              .metadata.request.method = url[0]\n              .metadata.request.path = url[1]\n              .metadata.request.protocol = url[2]\n          }\n      }\n      if err != null {\n        abort\n      }\n  # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.\n  auth_logs:\n    type: remap\n    inputs:\n      - router.auth\n    source: |-\n      parsed, err = parse_json(.event_message)\n      if err == null {\n          .metadata.timestamp = parsed.time\n          .metadata = merge!(.metadata, parsed)\n      }\n  # PostgREST logs are structured so we separate timestamp from message using regex\n  rest_logs:\n    type: remap\n    inputs:\n      - router.rest\n    source: |-\n      parsed, err = parse_regex(.event_message, r'^(?P<time>.*): (?P<msg>.*)$')\n      if err == null {\n          .event_message = parsed.msg\n          .timestamp = parse_timestamp!(value: parsed.time,format: \"%d/%b/%Y:%H:%M:%S %z\")\n          .metadata.host = .project\n      }\n  # Filter out healthcheck logs from Realtime\n  realtime_logs_filtered:\n    type: filter\n    inputs:\n      - router.realtime\n    condition: '!contains(string!(.event_message), \"/health\")' \n  # Realtime logs are structured so we parse the severity level using regex (ignore time because it has no date)\n  realtime_logs:\n    type: remap\n    inputs:\n      - realtime_logs_filtered\n    source: |-\n      .metadata.project = del(.project)\n      .metadata.external_id = .metadata.project\n      parsed, err = parse_regex(.event_message, r'^(?P<time>\\d+:\\d+:\\d+\\.\\d+) \\[(?P<level>\\w+)\\] (?P<msg>.*)$')\n      if err == null {\n          .event_message = parsed.msg\n          .metadata.level = parsed.level\n      }\n  # Function logs are unstructured messages on stderr\n  functions_logs:\n    type: remap\n    inputs:\n      - router.functions\n    source: |-\n      .metadata.project_ref = del(.project)\n  # Storage logs may contain json objects so we parse them for completeness\n  storage_logs:\n    type: remap\n    inputs:\n      - router.storage\n    source: |-\n      .metadata.project = del(.project)\n      .metadata.tenantId = .metadata.project\n      parsed, err = parse_json(.event_message)\n      if err == null {\n          .event_message = parsed.msg\n          .metadata.level = parsed.level\n          .metadata.timestamp = parsed.time\n          .metadata.context[0].host = parsed.hostname\n          .metadata.context[0].pid = parsed.pid\n      }\n  # Postgres logs some messages to stderr which we map to warning severity level\n  db_logs:\n    type: remap\n    inputs:\n      - router.db\n    source: |-\n      .metadata.host = \"db-default\"\n      .metadata.parsed.timestamp = .timestamp\n      \n      parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true)\n\n      if err != null || parsed == null {\n        .metadata.parsed.error_severity = \"info\"\n      }\n      if parsed.level != null {\n      .metadata.parsed.error_severity = parsed.level\n      }\n      if .metadata.parsed.error_severity == \"info\" {\n          .metadata.parsed.error_severity = \"log\"\n      }\n      .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)\nsinks:\n  logflare_auth:\n    type: 'http'\n    inputs:\n      - auth_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 30\n      headers:\n        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=gotrue.logs.prod'\n  logflare_realtime:\n    type: 'http'\n    inputs:\n      - realtime_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 30\n      headers:\n        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=realtime.logs.prod'\n  logflare_rest:\n    type: 'http'\n    inputs:\n      - rest_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 30\n      headers:\n        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=postgREST.logs.prod'\n  logflare_db:\n    type: 'http'\n    inputs:\n      - db_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 30\n      headers:\n        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}\n    # We must route the sink through kong because ingesting logs before logflare is fully initialised will\n    # lead to broken queries from studio. This works by the assumption that containers are started in the\n    # following order: vector > db > logflare > kong\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=postgres.logs'\n  logflare_functions:\n    type: 'http'\n    inputs:\n      - functions_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 30\n      headers:\n        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=deno-relay-logs'\n  logflare_storage:\n    type: 'http'\n    inputs:\n      - storage_logs\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 30\n      headers:\n        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=storage.logs.prod.2'\n  logflare_kong:\n    type: 'http'\n    inputs:\n      - kong_logs\n      - kong_err\n    encoding:\n      codec: 'json'\n    method: 'post'\n    request:\n      retry_max_duration_secs: 30\n      headers:\n        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}\n    uri: 'http://supabase-analytics:4000/api/logs?source_name=cloudflare.logs.prod'\n"}}
 ---
-{"apiVersion": "storage.k8s.io/v1", "kind": "StorageClass", "metadata": {"name": "supabase-standard", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "provisioner": "pd.csi.storage.gke.io", "parameters": {"type": "pd-standard"}, "reclaimPolicy": "Retain", "volumeBindingMode": "WaitForFirstConsumer", "allowVolumeExpansion": true}
+{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-functions", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-functions"}}, "spec": {"storageClassName": "local-path", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
 ---
-{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-functions", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-functions"}}, "spec": {"storageClassName": "supabase-standard", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
+{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-imgproxy", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-imgproxy"}}, "spec": {"storageClassName": "local-path", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
 ---
-{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-imgproxy", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-imgproxy"}}, "spec": {"storageClassName": "supabase-standard", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
+{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-snippets", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-snippets"}}, "spec": {"storageClassName": "local-path", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
 ---
-{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-minio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-minio"}}, "spec": {"storageClassName": "supabase-standard", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
+{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-storage", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-storage"}}, "spec": {"storageClassName": "local-path", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
 ---
-{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-snippets", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-snippets"}}, "spec": {"storageClassName": "supabase-standard", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
----
-{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-storage", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-storage"}}, "spec": {"storageClassName": "supabase-standard", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
----
-{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-deno", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-deno"}}, "spec": {"storageClassName": "supabase-standard", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
+{"apiVersion": "v1", "kind": "PersistentVolumeClaim", "metadata": {"name": "supabase-deno", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "synology.storage/pvc": "supabase-deno"}}, "spec": {"storageClassName": "local-path", "accessModes": ["ReadWriteOnce"], "resources": {"requests": {"storage": "1Gi"}}}}
 ---
 {"apiVersion": "rbac.authorization.k8s.io/v1", "kind": "ClusterRole", "metadata": {"name": "supabase-reader"}, "rules": [{"apiGroups": [""], "resources": ["nodes", "namespaces", "pods"], "verbs": ["list", "watch"]}, {"apiGroups": [""], "resources": ["pods/log"], "resourceNames": ["supabase-*"], "verbs": ["get"]}]}
 ---
@@ -68,64 +62,48 @@
 ---
 {"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-auth", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 9999, "targetPort": 9999, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-auth", "app.kubernetes.io/instance": "supabase"}}}
 ---
+{"apiVersion": "v1", "kind": "Service", "metadata": {"name": "db", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ExternalName", "externalName": "knoe-db-rw.knoe-db.svc.cluster.local", "ports": [{"name": "postgres", "port": 5432, "protocol": "TCP"}]}}
+---
 {"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-functions", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 9000, "targetPort": 9000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-functions", "app.kubernetes.io/instance": "supabase"}}}
 ---
 {"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-imgproxy", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 5001, "targetPort": 5001, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-imgproxy", "app.kubernetes.io/instance": "supabase"}}}
 ---
-{"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"cloud.google.com/backend-config": "{\"default\":\"supabase-kong-backendconfig\"}"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 8000, "targetPort": 8000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-kong", "app.kubernetes.io/instance": "supabase"}}}
----
 {"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-meta", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 8080, "targetPort": 8080, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-meta", "app.kubernetes.io/instance": "supabase"}}}
 ---
-{"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-minio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 9000, "targetPort": 9000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-minio", "app.kubernetes.io/instance": "supabase"}}}
----
 {"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-realtime", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 4000, "targetPort": 4000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-realtime", "app.kubernetes.io/instance": "supabase"}}}
 ---
 {"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-rest", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 3000, "targetPort": 3000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-rest", "app.kubernetes.io/instance": "supabase"}}}
 ---
 {"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-storage", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 5000, "targetPort": 5000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-storage", "app.kubernetes.io/instance": "supabase"}}}
 ---
-{"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-studio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 3000, "targetPort": 3000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-studio", "app.kubernetes.io/instance": "supabase"}}}
----
 {"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-vector", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"type": "ClusterIP", "ports": [{"port": 9001, "targetPort": 9001, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-vector", "app.kubernetes.io/instance": "supabase"}}}
 ---
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-analytics", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-analytics", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-analytics", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-analytics", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_USER", "value": "$(DB_USERNAME)"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-analytics", "securityContext": {}, "image": "supabase/logflare:1.31.2", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DATABASE", "value": "_supabase"}, {"name": "DB_DRIVER", "value": "postgresql"}, {"name": "DB_SCHEMA", "value": "_analytics"}, {"name": "DB_USERNAME", "value": "supabase_admin"}, {"name": "LOGFLARE_FEATURE_FLAG_OVERRIDE", "value": "multibackend=true"}, {"name": "LOGFLARE_NODE_HOST", "value": "127.0.0.1"}, {"name": "LOGFLARE_SINGLE_TENANT", "value": "true"}, {"name": "LOGFLARE_SUPABASE_MODE", "value": "true"}, {"name": "POSTGRES_BACKEND_SCHEMA", "value": "_analytics"}, {"name": "DB_HOSTNAME", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "LOGFLARE_PUBLIC_ACCESS_TOKEN", "valueFrom": {"secretKeyRef": {"name": "supabase-analytics", "key": "publicAccessToken"}}}, {"name": "LOGFLARE_PRIVATE_ACCESS_TOKEN", "valueFrom": {"secretKeyRef": {"name": "supabase-analytics", "key": "privateAccessToken"}}}, {"name": "POSTGRES_BACKEND_URL", "value": "$(DB_DRIVER)://$(DB_USERNAME):$(DB_PASSWORD_ENC)@$(DB_HOSTNAME):$(DB_PORT)/$(DB_DATABASE)"}], "ports": [{"containerPort": 4000, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
+{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-analytics", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-analytics", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-analytics", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-analytics", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "db"}, {"name": "DB_USER", "value": "$(DB_USERNAME)"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-analytics", "securityContext": {}, "image": "supabase/logflare:1.31.2", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DATABASE", "value": "_supabase"}, {"name": "DB_DRIVER", "value": "postgresql"}, {"name": "DB_SCHEMA", "value": "_analytics"}, {"name": "DB_USERNAME", "value": "supabase_admin"}, {"name": "LOGFLARE_FEATURE_FLAG_OVERRIDE", "value": "multibackend=true"}, {"name": "LOGFLARE_NODE_HOST", "value": "127.0.0.1"}, {"name": "LOGFLARE_SINGLE_TENANT", "value": "true"}, {"name": "LOGFLARE_SUPABASE_MODE", "value": "true"}, {"name": "POSTGRES_BACKEND_SCHEMA", "value": "_analytics"}, {"name": "DB_HOSTNAME", "value": "db"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "LOGFLARE_PUBLIC_ACCESS_TOKEN", "valueFrom": {"secretKeyRef": {"name": "supabase-analytics", "key": "publicAccessToken"}}}, {"name": "LOGFLARE_PRIVATE_ACCESS_TOKEN", "valueFrom": {"secretKeyRef": {"name": "supabase-analytics", "key": "privateAccessToken"}}}, {"name": "POSTGRES_BACKEND_URL", "value": "$(DB_DRIVER)://$(DB_USERNAME):$(DB_PASSWORD_ENC)@$(DB_HOSTNAME):$(DB_PORT)/$(DB_DATABASE)"}], "ports": [{"containerPort": 4000, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
 ---
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-auth", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-auth", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-auth", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-auth", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-auth", "securityContext": {}, "image": "supabase/gotrue:v2.186.0", "imagePullPolicy": "IfNotPresent", "env": [{"name": "API_EXTERNAL_URL", "value": "https://api.0.knoe.dev"}, {"name": "DB_DRIVER", "value": "postgres"}, {"name": "DB_USER", "value": "supabase_auth_admin"}, {"name": "GOTRUE_API_HOST", "value": "0.0.0.0"}, {"name": "GOTRUE_API_PORT", "value": "9999"}, {"name": "GOTRUE_DISABLE_SIGNUP", "value": "false"}, {"name": "GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED", "value": "false"}, {"name": "GOTRUE_EXTERNAL_EMAIL_ENABLED", "value": "true"}, {"name": "GOTRUE_EXTERNAL_PHONE_ENABLED", "value": "false"}, {"name": "GOTRUE_JWT_ADMIN_ROLES", "value": "service_role"}, {"name": "GOTRUE_JWT_AUD", "value": "authenticated"}, {"name": "GOTRUE_JWT_DEFAULT_GROUP_NAME", "value": "authenticated"}, {"name": "GOTRUE_JWT_EXP", "value": "3600"}, {"name": "GOTRUE_MAILER_AUTOCONFIRM", "value": "true"}, {"name": "GOTRUE_MAILER_URLPATHS_CONFIRMATION", "value": "/auth/v1/verify"}, {"name": "GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE", "value": "/auth/v1/verify"}, {"name": "GOTRUE_MAILER_URLPATHS_INVITE", "value": "/auth/v1/verify"}, {"name": "GOTRUE_MAILER_URLPATHS_RECOVERY", "value": "/auth/v1/verify"}, {"name": "GOTRUE_SITE_URL", "value": "https://db.0.knoe.dev"}, {"name": "GOTRUE_SMS_AUTOCONFIRM", "value": "false"}, {"name": "GOTRUE_SMTP_ADMIN_EMAIL", "value": "SMTP_ADMIN_MAIL"}, {"name": "GOTRUE_SMTP_HOST", "value": "SMTP_HOST"}, {"name": "GOTRUE_SMTP_PORT", "value": "123"}, {"name": "GOTRUE_SMTP_SENDER_NAME", "value": "SMTP_SENDER_NAME"}, {"name": "GOTRUE_URI_ALLOW_LIST", "value": "https://db.0.knoe.dev/**,https://api.0.knoe.dev/**"}, {"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "GOTRUE_DB_DATABASE_URL", "value": "$(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@10.180.15.236:5432/postgres?search_path=auth&sslmode=disable"}, {"name": "GOTRUE_DB_DRIVER", "value": "$(DB_DRIVER)"}, {"name": "GOTRUE_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "GOTRUE_SMTP_USER", "valueFrom": {"secretKeyRef": {"name": "supabase-smtp", "key": "username"}}}, {"name": "GOTRUE_SMTP_PASS", "valueFrom": {"secretKeyRef": {"name": "supabase-smtp", "key": "password"}}}], "ports": [{"name": "http", "containerPort": 9999, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
+{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-auth", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-auth", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-auth", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-auth", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-auth", "securityContext": {}, "image": "supabase/gotrue:v2.186.0", "imagePullPolicy": "IfNotPresent", "env": [{"name": "API_EXTERNAL_URL", "value": "https://db.knoe.org"}, {"name": "DB_DRIVER", "value": "postgres"}, {"name": "DB_USER", "value": "supabase_auth_admin"}, {"name": "GOTRUE_API_HOST", "value": "0.0.0.0"}, {"name": "GOTRUE_API_PORT", "value": "9999"}, {"name": "GOTRUE_DISABLE_SIGNUP", "value": "false"}, {"name": "GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED", "value": "false"}, {"name": "GOTRUE_EXTERNAL_EMAIL_ENABLED", "value": "true"}, {"name": "GOTRUE_EXTERNAL_PHONE_ENABLED", "value": "false"}, {"name": "GOTRUE_JWT_ADMIN_ROLES", "value": "service_role"}, {"name": "GOTRUE_JWT_AUD", "value": "authenticated"}, {"name": "GOTRUE_JWT_DEFAULT_GROUP_NAME", "value": "authenticated"}, {"name": "GOTRUE_JWT_EXP", "value": "3600"}, {"name": "GOTRUE_MAILER_AUTOCONFIRM", "value": "true"}, {"name": "GOTRUE_MAILER_URLPATHS_CONFIRMATION", "value": "/auth/v1/verify"}, {"name": "GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE", "value": "/auth/v1/verify"}, {"name": "GOTRUE_MAILER_URLPATHS_INVITE", "value": "/auth/v1/verify"}, {"name": "GOTRUE_MAILER_URLPATHS_RECOVERY", "value": "/auth/v1/verify"}, {"name": "GOTRUE_SITE_URL", "value": "https://db.knoe.org"}, {"name": "GOTRUE_SMS_AUTOCONFIRM", "value": "false"}, {"name": "GOTRUE_SMTP_ADMIN_EMAIL", "value": "SMTP_ADMIN_MAIL"}, {"name": "GOTRUE_SMTP_HOST", "value": "SMTP_HOST"}, {"name": "GOTRUE_SMTP_PORT", "value": "123"}, {"name": "GOTRUE_SMTP_SENDER_NAME", "value": "SMTP_SENDER_NAME"}, {"name": "GOTRUE_URI_ALLOW_LIST", "value": "https://db.knoe.org/**"}, {"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "GOTRUE_DB_DATABASE_URL", "value": "$(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@db:5432/postgres?search_path=auth&sslmode=disable"}, {"name": "GOTRUE_DB_DRIVER", "value": "$(DB_DRIVER)"}, {"name": "GOTRUE_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "GOTRUE_SMTP_USER", "valueFrom": {"secretKeyRef": {"name": "supabase-smtp", "key": "username"}}}, {"name": "GOTRUE_SMTP_PASS", "valueFrom": {"secretKeyRef": {"name": "supabase-smtp", "key": "password"}}}], "ports": [{"name": "http", "containerPort": 9999, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
 ---
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-functions", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"replicas": 1, "selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-functions", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-functions", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-functions", "securityContext": null, "containers": [{"args": ["start", "--main-service", "/home/deno/functions/main"], "name": "knoe-supabase-functions", "securityContext": {}, "image": "supabase/edge-runtime:v1.70.3", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DRIVER", "value": "postgresql"}, {"name": "DB_USERNAME", "value": "postgres"}, {"name": "VERIFY_JWT", "value": "false"}, {"name": "SUPABASE_URL", "value": "http://supabase-kong:8000"}, {"name": "DB_HOSTNAME", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "DB_DATABASE", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "SUPABASE_ANON_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "anonKey"}}}, {"name": "SUPABASE_SERVICE_ROLE_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "serviceKey"}}}, {"name": "SUPABASE_DB_URL", "value": "$(DB_DRIVER)://$(DB_USERNAME):$(DB_PASSWORD_ENC)@10.180.15.236:5432/postgres?search_path=auth&sslmode=disable"}], "volumeMounts": [{"name": "functions-storage", "mountPath": "/home/deno/functions"}, {"name": "deno-cache", "mountPath": "/root/.cache/deno"}, {"mountPath": "/home/deno/functions/main/index.ts", "name": "functions-main", "subPath": "index.ts"}]}], "volumes": [{"name": "functions-storage", "persistentVolumeClaim": {"claimName": "supabase-functions"}}, {"name": "deno-cache", "persistentVolumeClaim": {"claimName": "supabase-deno"}}, {"name": "functions-main", "configMap": {"name": "supabase-functions-main"}}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
+{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-functions", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-functions", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-functions", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-functions", "securityContext": null, "containers": [{"args": ["start", "--main-service", "/home/deno/functions/main"], "name": "knoe-supabase-functions", "securityContext": {}, "image": "supabase/edge-runtime:v1.70.3", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DRIVER", "value": "postgresql"}, {"name": "DB_USERNAME", "value": "postgres"}, {"name": "VERIFY_JWT", "value": "false"}, {"name": "SUPABASE_URL", "value": "http://supabase-kong:8000"}, {"name": "DB_HOSTNAME", "value": "db"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "DB_DATABASE", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "SUPABASE_ANON_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "anonKey"}}}, {"name": "SUPABASE_SERVICE_ROLE_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "serviceKey"}}}, {"name": "SUPABASE_DB_URL", "value": "$(DB_DRIVER)://$(DB_USERNAME):$(DB_PASSWORD_ENC)@db:5432/postgres?search_path=auth&sslmode=disable"}], "volumeMounts": [{"name": "functions-storage", "mountPath": "/home/deno/functions"}, {"name": "deno-cache", "mountPath": "/root/.cache/deno"}, {"mountPath": "/home/deno/functions/main/index.ts", "name": "functions-main", "subPath": "index.ts"}]}], "volumes": [{"name": "functions-storage", "persistentVolumeClaim": {"claimName": "supabase-functions"}}, {"name": "deno-cache", "persistentVolumeClaim": {"claimName": "supabase-deno"}}, {"name": "functions-main", "configMap": {"name": "supabase-functions-main"}}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
 ---
 {"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-imgproxy", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-imgproxy", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-imgproxy", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-imgproxy", "securityContext": null, "containers": [{"name": "knoe-supabase-imgproxy", "securityContext": {}, "image": "darthsim/imgproxy:v3.30.1", "imagePullPolicy": "IfNotPresent", "env": [{"name": "IMGPROXY_BIND", "value": ":5001"}, {"name": "IMGPROXY_ENABLE_WEBP_DETECTION", "value": "true"}, {"name": "IMGPROXY_LOCAL_FILESYSTEM_ROOT", "value": "/"}, {"name": "IMGPROXY_USE_ETAG", "value": "true"}], "ports": [{"name": "http", "containerPort": 8080, "protocol": "TCP"}], "volumeMounts": [{"mountPath": "/var/lib/storage", "name": "imgproxy-volume"}]}], "volumes": [{"name": "imgproxy-volume", "persistentVolumeClaim": {"claimName": "supabase-imgproxy"}}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
 ---
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-kong", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"annotations": {"checksum/config": "a9545a21ecaa147ff9267ea33288c07a17432d17717fb2e30d621f406cfd6b2a"}, "labels": {"app.kubernetes.io/name": "knoe-supabase-kong", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-kong", "securityContext": null, "containers": [{"name": "knoe-supabase-kong", "securityContext": {}, "image": "kong:2.8.1", "imagePullPolicy": "IfNotPresent", "command": ["/bin/bash"], "args": ["/scripts/wrapper.sh"], "env": [{"name": "KONG_DATABASE", "value": "off"}, {"name": "KONG_DECLARATIVE_CONFIG", "value": "/usr/local/kong/kong.yml"}, {"name": "KONG_DNS_ORDER", "value": "LAST,A,CNAME"}, {"name": "KONG_LOG_LEVEL", "value": "warn"}, {"name": "KONG_NGINX_PROXY_PROXY_BUFFERS", "value": "64 160k"}, {"name": "KONG_NGINX_PROXY_PROXY_BUFFER_SIZE", "value": "160k"}, {"name": "KONG_PLUGINS", "value": "request-transformer,cors,key-auth,acl,basic-auth,request-termination"}, {"name": "SUPABASE_ANON_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "anonKey"}}}, {"name": "SUPABASE_SERVICE_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "serviceKey"}}}, {"name": "DASHBOARD_USERNAME", "valueFrom": {"secretKeyRef": {"name": "supabase-dashboard", "key": "username"}}}, {"name": "DASHBOARD_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-dashboard", "key": "password"}}}], "ports": [{"name": "http", "containerPort": 8000, "protocol": "TCP"}], "volumeMounts": [{"mountPath": "/usr/local/kong/template.yml", "name": "config", "subPath": "template.yml"}, {"mountPath": "/scripts", "name": "wrapper"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}, "volumes": [{"name": "config", "configMap": {"name": "supabase-kong", "defaultMode": 511, "items": [{"key": "template.yml", "path": "template.yml"}]}}, {"name": "wrapper", "configMap": {"name": "supabase-kong", "defaultMode": 511, "items": [{"key": "wrapper.sh", "path": "wrapper.sh"}]}}]}}}}
+{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-meta", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-meta", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-meta", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-meta", "securityContext": null, "containers": [{"name": "knoe-supabase-meta", "securityContext": {}, "image": "supabase/postgres-meta:v0.95.2", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DRIVER", "value": "postgres"}, {"name": "DB_USER", "value": "supabase_admin"}, {"name": "PG_META_PORT", "value": "8080"}, {"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "PG_META_DB_HOST", "value": "db"}, {"name": "PG_META_DB_PORT", "value": "5432"}, {"name": "PG_META_DB_NAME", "value": "postgres"}, {"name": "PG_META_DB_USER", "value": "$(DB_USER)"}, {"name": "PG_META_DB_PASSWORD", "value": "$(DB_PASSWORD)"}, {"name": "PG_META_DB_SSL_MODE", "value": "disable"}, {"name": "CRYPTO_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-meta", "key": "cryptoKey"}}}], "ports": [{"name": "http", "containerPort": 8080, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
 ---
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-meta", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-meta", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-meta", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-meta", "securityContext": null, "containers": [{"name": "knoe-supabase-meta", "securityContext": {}, "image": "supabase/postgres-meta:v0.95.2", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DRIVER", "value": "postgres"}, {"name": "DB_USER", "value": "supabase_admin"}, {"name": "PG_META_PORT", "value": "8080"}, {"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "PG_META_DB_HOST", "value": "10.180.15.236"}, {"name": "PG_META_DB_PORT", "value": "5432"}, {"name": "PG_META_DB_NAME", "value": "postgres"}, {"name": "PG_META_DB_USER", "value": "$(DB_USER)"}, {"name": "PG_META_DB_PASSWORD", "value": "$(DB_PASSWORD)"}, {"name": "PG_META_DB_SSL_MODE", "value": "disable"}, {"name": "CRYPTO_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-meta", "key": "cryptoKey"}}}], "ports": [{"name": "http", "containerPort": 8080, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
+{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-realtime", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-realtime", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-realtime", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-realtime", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-realtime", "securityContext": {}, "image": "supabase/realtime:v2.76.5", "imagePullPolicy": "IfNotPresent", "command": ["/bin/sh"], "args": ["-c", "/app/bin/migrate && /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)' && /app/bin/server"], "env": [{"name": "APP_NAME", "value": "realtime"}, {"name": "DB_AFTER_CONNECT_QUERY", "value": "SET search_path TO _realtime"}, {"name": "DB_ENC_KEY", "value": "supabaserealtime"}, {"name": "DB_USER", "value": "supabase_admin"}, {"name": "DNS_NODES", "value": "''"}, {"name": "ENABLE_TAILSCALE", "value": "false"}, {"name": "ERL_AFLAGS", "value": "-proto_dist inet_tcp"}, {"name": "FLY_ALLOC_ID", "value": "fly123"}, {"name": "FLY_APP_NAME", "value": "realtime"}, {"name": "PORT", "value": "4000"}, {"name": "RLIMIT_NOFILE", "value": "10000"}, {"name": "RUN_JANITOR", "value": "true"}, {"name": "SEED_SELF_HOST", "value": "true"}, {"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "false"}, {"name": "SELF_HOST_TENANT_NAME", "value": "supabase-realtime"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "API_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "SECRET_KEY_BASE", "valueFrom": {"secretKeyRef": {"name": "supabase-realtime", "key": "secretKeyBase"}}}], "ports": [{"name": "http", "containerPort": 4000, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
 ---
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-minio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-minio", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-minio", "app.kubernetes.io/instance": "supabase"}}, "spec": {"restartPolicy": "Always", "serviceAccountName": "supabase-minio", "securityContext": {"fsGroup": 65532, "fsGroupChangePolicy": "OnRootMismatch", "runAsGroup": 65532, "runAsUser": 65532}, "containers": [{"name": "knoe-supabase-minio", "securityContext": {"allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "runAsGroup": 65532, "runAsNonRoot": true, "runAsUser": 65532}, "image": "cgr.dev/chainguard/minio:latest", "imagePullPolicy": "IfNotPresent", "args": ["server", "--console-address", ":9001", "/data"], "env": [{"name": "MINIO_ROOT_USER", "valueFrom": {"secretKeyRef": {"name": "supabase-minio", "key": "user"}}}, {"name": "MINIO_ROOT_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-minio", "key": "password"}}}], "ports": [{"name": "http", "containerPort": 9000, "protocol": "TCP"}], "resources": {"limits": {"cpu": "500m", "memory": "512Mi"}, "requests": {"cpu": "100m", "memory": "256Mi"}}, "volumeMounts": [{"mountPath": "/data", "name": "minio-data"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}, "volumes": [{"name": "minio-data", "persistentVolumeClaim": {"claimName": "supabase-minio"}}]}}}}
+{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-rest", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-rest", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-rest", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-rest", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-rest", "securityContext": {}, "image": "postgrest/postgrest:v14.5", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DRIVER", "value": "postgres"}, {"name": "DB_USER", "value": "authenticator"}, {"name": "PGRST_APP_SETTINGS_JWT_EXP", "value": "3600"}, {"name": "PGRST_DB_ANON_ROLE", "value": "anon"}, {"name": "PGRST_DB_SCHEMAS", "value": "public,storage,graphql_public"}, {"name": "PGRST_DB_USE_LEGACY_GUCS", "value": "false"}, {"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "PGRST_DB_URI", "value": "$(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@db:5432/postgres?sslmode=disable"}, {"name": "PGRST_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "PGRST_APP_SETTINGS_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}], "ports": [{"name": "http", "containerPort": 3000, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
 ---
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-realtime", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-realtime", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-realtime", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-realtime", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-realtime", "securityContext": {}, "image": "supabase/realtime:v2.76.5", "imagePullPolicy": "IfNotPresent", "command": ["/bin/sh"], "args": ["-c", "/app/bin/migrate && /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)' && /app/bin/server"], "env": [{"name": "APP_NAME", "value": "realtime"}, {"name": "DB_AFTER_CONNECT_QUERY", "value": "SET search_path TO _realtime"}, {"name": "DB_ENC_KEY", "value": "supabaserealtime"}, {"name": "DB_USER", "value": "supabase_admin"}, {"name": "DNS_NODES", "value": "''"}, {"name": "ENABLE_TAILSCALE", "value": "false"}, {"name": "ERL_AFLAGS", "value": "-proto_dist inet_tcp"}, {"name": "FLY_ALLOC_ID", "value": "fly123"}, {"name": "FLY_APP_NAME", "value": "realtime"}, {"name": "PORT", "value": "4000"}, {"name": "RLIMIT_NOFILE", "value": "10000"}, {"name": "RUN_JANITOR", "value": "true"}, {"name": "SEED_SELF_HOST", "value": "true"}, {"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "false"}, {"name": "SELF_HOST_TENANT_NAME", "value": "supabase-realtime"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "API_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "SECRET_KEY_BASE", "valueFrom": {"secretKeyRef": {"name": "supabase-realtime", "key": "secretKeyBase"}}}], "ports": [{"name": "http", "containerPort": 4000, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
----
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-rest", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-rest", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-rest", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-rest", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-rest", "securityContext": {}, "image": "postgrest/postgrest:v14.5", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DRIVER", "value": "postgres"}, {"name": "DB_USER", "value": "authenticator"}, {"name": "PGRST_APP_SETTINGS_JWT_EXP", "value": "3600"}, {"name": "PGRST_DB_ANON_ROLE", "value": "anon"}, {"name": "PGRST_DB_SCHEMAS", "value": "public,storage,graphql_public"}, {"name": "PGRST_DB_USE_LEGACY_GUCS", "value": "false"}, {"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "PGRST_DB_URI", "value": "$(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@10.180.15.236:5432/postgres?sslmode=disable"}, {"name": "PGRST_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "PGRST_APP_SETTINGS_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}], "ports": [{"name": "http", "containerPort": 3000, "protocol": "TCP"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
----
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-storage", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-storage", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-storage", "app.kubernetes.io/instance": "supabase"}}, "spec": {"restartPolicy": "Always", "serviceAccountName": "supabase-storage", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}, {"name": "init-bucket", "image": "cgr.dev/chainguard/minio-client:latest-dev", "env": [{"name": "MINIO_ROOT_USER", "valueFrom": {"secretKeyRef": {"name": "supabase-minio", "key": "user"}}}, {"name": "MINIO_ROOT_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-minio", "key": "password"}}}, {"name": "GLOBAL_S3_BUCKET", "value": "supabase-storage"}], "imagePullPolicy": "IfNotPresent", "command": ["/bin/sh", "-c", "until /usr/bin/mc alias set supa-minio http://supabase-minio:9000 $MINIO_ROOT_USER $MINIO_ROOT_PASSWORD; do\n  echo \"Waiting for minio to start...\"\n  sleep 2\ndone\n/usr/bin/mc mb --ignore-existing supa-minio/$GLOBAL_S3_BUCKET\n"]}], "containers": [{"name": "knoe-supabase-storage", "securityContext": {}, "image": "supabase/storage-api:v1.37.8", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DRIVER", "value": "postgres"}, {"name": "DB_USER", "value": "supabase_storage_admin"}, {"name": "ENABLE_IMAGE_TRANSFORMATION", "value": "true"}, {"name": "FILE_SIZE_LIMIT", "value": "52428800"}, {"name": "GLOBAL_S3_BUCKET", "value": "supabase-storage"}, {"name": "GLOBAL_S3_ENDPOINT", "value": ""}, {"name": "GLOBAL_S3_FORCE_PATH_STYLE", "value": "true"}, {"name": "GLOBAL_S3_PROTOCOL", "value": "http"}, {"name": "REGION", "value": "garage"}, {"name": "REQUEST_ALLOW_X_FORWARDED_PATH", "value": "true"}, {"name": "STORAGE_BACKEND", "value": "s3"}, {"name": "TENANT_ID", "value": "stub"}, {"name": "DB_HOST", "value": "10.180.15.236"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "POSTGREST_URL", "value": "http://supabase-rest:3000"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "DATABASE_URL", "value": "$(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@10.180.15.236:5432/postgres?search_path=storage,public&sslmode=disable"}, {"name": "PGRST_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "ANON_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "anonKey"}}}, {"name": "SERVICE_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "serviceKey"}}}, {"name": "S3_PROTOCOL_ACCESS_KEY_ID", "valueFrom": {"secretKeyRef": {"name": "supabase-s3", "key": "keyId"}}}, {"name": "S3_PROTOCOL_ACCESS_KEY_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-s3", "key": "accessKey"}}}, {"name": "IMGPROXY_URL", "value": "http://supabase-imgproxy:5001"}, {"name": "GLOBAL_S3_PROTOCOl", "value": "http"}, {"name": "AWS_ACCESS_KEY_ID", "valueFrom": {"secretKeyRef": {"name": "supabase-s3", "key": "keyId"}}}, {"name": "AWS_SECRET_ACCESS_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-s3", "key": "accessKey"}}}], "ports": [{"name": "http", "containerPort": 5000, "protocol": "TCP"}], "volumeMounts": [{"mountPath": "/var/lib/storage", "name": "storage-data"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}, "volumes": [{"name": "storage-data", "persistentVolumeClaim": {"claimName": "supabase-storage"}}]}}}}
----
-{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-studio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-studio", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-studio", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-studio", "securityContext": null, "containers": [{"name": "knoe-supabase-studio", "securityContext": {}, "image": "supabase/studio:2026.02.16-sha-26c615c", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DEFAULT_ORGANIZATION_NAME", "value": "Default Organization"}, {"name": "DEFAULT_PROJECT_NAME", "value": "Default Project"}, {"name": "HOSTNAME", "value": "::"}, {"name": "NEXT_ANALYTICS_BACKEND_PROVIDER", "value": "postgres"}, {"name": "NEXT_PUBLIC_ENABLE_LOGS", "value": "true"}, {"name": "STUDIO_PORT", "value": "3000"}, {"name": "SUPABASE_PUBLIC_URL", "value": "https://db.0.knoe.dev"}, {"name": "SUPABASE_URL", "value": "http://supabase-kong:8000"}, {"name": "STUDIO_PG_META_URL", "value": "http://supabase-meta:8080"}, {"name": "POSTGRES_HOST", "value": "10.180.15.236"}, {"name": "POSTGRES_PORT", "value": "5432"}, {"name": "POSTGRES_DB", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "POSTGRES_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "PG_META_CRYPTO_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-meta", "key": "cryptoKey"}}}, {"name": "OPENAI_API_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-dashboard", "key": "openAiApiKey"}}}, {"name": "SUPABASE_ANON_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "anonKey"}}}, {"name": "SUPABASE_SERVICE_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "serviceKey"}}}, {"name": "AUTH_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "LOGFLARE_URL", "value": "http://supabase-analytics:4000"}, {"name": "LOGFLARE_PUBLIC_ACCESS_TOKEN", "valueFrom": {"secretKeyRef": {"name": "supabase-analytics", "key": "publicAccessToken"}}}, {"name": "LOGFLARE_PRIVATE_ACCESS_TOKEN", "valueFrom": {"secretKeyRef": {"name": "supabase-analytics", "key": "privateAccessToken"}}}, {"name": "EDGE_FUNCTIONS_MANAGEMENT_FOLDER", "value": "/home/deno/functions"}, {"name": "SNIPPETS_MANAGEMENT_FOLDER", "value": "/app/snippets"}], "ports": [{"name": "http", "containerPort": 3000, "protocol": "TCP"}], "volumeMounts": [{"name": "functions-storage", "mountPath": "/home/deno/functions"}, {"name": "snippets-storage", "mountPath": "/app/snippets"}]}], "volumes": [{"name": "functions-storage", "persistentVolumeClaim": {"claimName": "supabase-functions"}}, {"name": "snippets-storage", "persistentVolumeClaim": {"claimName": "supabase-snippets"}}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
+{"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-storage", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-storage", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"labels": {"app.kubernetes.io/name": "knoe-supabase-storage", "app.kubernetes.io/instance": "supabase"}}, "spec": {"restartPolicy": "Always", "serviceAccountName": "supabase-storage", "securityContext": null, "initContainers": [{"name": "init-db", "image": "postgres:15-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}], "command": ["/bin/sh", "-c"], "args": ["until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do\necho \"Waiting for database to start...\"\nsleep 2\ndone\n", "echo \"Database is ready\""]}], "containers": [{"name": "knoe-supabase-storage", "securityContext": {}, "image": "supabase/storage-api:v1.37.8", "imagePullPolicy": "IfNotPresent", "env": [{"name": "DB_DRIVER", "value": "postgres"}, {"name": "DB_USER", "value": "supabase_storage_admin"}, {"name": "ENABLE_IMAGE_TRANSFORMATION", "value": "true"}, {"name": "FILE_SIZE_LIMIT", "value": "52428800"}, {"name": "GLOBAL_S3_BUCKET", "value": "supabase-storage"}, {"name": "GLOBAL_S3_ENDPOINT", "value": ""}, {"name": "GLOBAL_S3_FORCE_PATH_STYLE", "value": "true"}, {"name": "GLOBAL_S3_PROTOCOL", "value": "http"}, {"name": "REGION", "value": "garage"}, {"name": "REQUEST_ALLOW_X_FORWARDED_PATH", "value": "true"}, {"name": "STORAGE_BACKEND", "value": "s3"}, {"name": "TENANT_ID", "value": "stub"}, {"name": "DB_HOST", "value": "db"}, {"name": "DB_PORT", "value": "5432"}, {"name": "DB_SSL", "value": "disable"}, {"name": "POSTGREST_URL", "value": "http://supabase-rest:3000"}, {"name": "DB_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password"}}}, {"name": "DB_PASSWORD_ENC", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "password_encoded"}}}, {"name": "DB_NAME", "valueFrom": {"secretKeyRef": {"name": "supabase-db", "key": "database"}}}, {"name": "DATABASE_URL", "value": "$(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@db:5432/postgres?search_path=storage,public&sslmode=disable"}, {"name": "PGRST_JWT_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "secret"}}}, {"name": "ANON_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "anonKey"}}}, {"name": "SERVICE_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-jwt", "key": "serviceKey"}}}, {"name": "S3_PROTOCOL_ACCESS_KEY_ID", "valueFrom": {"secretKeyRef": {"name": "supabase-s3", "key": "keyId"}}}, {"name": "S3_PROTOCOL_ACCESS_KEY_SECRET", "valueFrom": {"secretKeyRef": {"name": "supabase-s3", "key": "accessKey"}}}, {"name": "IMGPROXY_URL", "value": "http://supabase-imgproxy:5001"}, {"name": "AWS_ACCESS_KEY_ID", "valueFrom": {"secretKeyRef": {"name": "supabase-s3", "key": "keyId"}}}, {"name": "AWS_SECRET_ACCESS_KEY", "valueFrom": {"secretKeyRef": {"name": "supabase-s3", "key": "accessKey"}}}], "ports": [{"name": "http", "containerPort": 5000, "protocol": "TCP"}], "volumeMounts": [{"mountPath": "/var/lib/storage", "name": "storage-data"}]}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}, "volumes": [{"name": "storage-data", "persistentVolumeClaim": {"claimName": "supabase-storage"}}]}}}}
 ---
 {"apiVersion": "apps/v1", "kind": "Deployment", "metadata": {"name": "supabase-vector", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm", "vector.dev/exclude": "true"}}, "spec": {"selector": {"matchLabels": {"app.kubernetes.io/name": "knoe-supabase-vector", "app.kubernetes.io/instance": "supabase"}}, "template": {"metadata": {"annotations": {"checksum/config": "b2d029176dcadcbbe36e452d40b409cab841bb6f133b8d8549d13df159849e4e"}, "labels": {"app.kubernetes.io/name": "knoe-supabase-vector", "app.kubernetes.io/instance": "supabase"}}, "spec": {"serviceAccountName": "supabase-vector", "securityContext": null, "containers": [{"args": ["--config", "/etc/vector/vector.yml"], "name": "knoe-supabase-vector", "securityContext": {}, "image": "timberio/vector:0.53.0-alpine", "imagePullPolicy": "IfNotPresent", "env": [{"name": "VECTOR_SELF_NODE_NAME", "valueFrom": {"fieldRef": {"fieldPath": "spec.nodeName"}}}, {"name": "LOGFLARE_PUBLIC_ACCESS_TOKEN", "valueFrom": {"secretKeyRef": {"name": "supabase-analytics", "key": "publicAccessToken"}}}], "ports": [{"containerPort": 9001, "protocol": "TCP"}], "volumeMounts": [{"mountPath": "/etc/vector/vector.yml", "name": "vector-config", "subPath": "vector.yml"}, {"name": "varlog", "mountPath": "/var/log", "readOnly": true}, {"name": "varlibdockercontainers", "mountPath": "/var/lib/docker/containers", "readOnly": true}]}], "volumes": [{"name": "vector-config", "configMap": {"name": "supabase-vector-config", "defaultMode": 511}}, {"name": "varlog", "hostPath": {"path": "/var/log"}}, {"name": "varlibdockercontainers", "hostPath": {"path": "/var/lib/docker/containers"}}], "nodeSelector": {"knoe.dev/node-role": "general"}, "affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "knoe.dev/node-role", "operator": "In", "values": ["general"]}]}]}}}}}}}
 ---
-{"apiVersion": "cloud.google.com/v1", "kind": "BackendConfig", "metadata": {"name": "supabase-kong-backendconfig", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "spec": {"healthCheck": {"type": "HTTP", "requestPath": "/healthz", "port": 8000, "checkIntervalSec": 15, "timeoutSec": 5, "healthyThreshold": 1, "unhealthyThreshold": 3}, "connectionDraining": {"drainingTimeoutSec": 30}}}
----
 {"apiVersion": "batch/v1", "kind": "Job", "metadata": {"name": "supabase-test-analytics", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"helm.sh/hook": "test"}}, "spec": {"ttlSecondsAfterFinished": 100, "template": {"spec": {"containers": [{"name": "test-analytics", "image": "kdevup/curljq", "imagePullPolicy": "IfNotPresent", "command": ["/bin/bash", "-c", "curl -sfo /dev/null \\\n  http://supabase-analytics:4000/health\necho \"Sevice supabase-analytics is healthy.\"\n"]}], "restartPolicy": "Never"}}}}
 ---
 {"apiVersion": "batch/v1", "kind": "Job", "metadata": {"name": "supabase-test-auth", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"helm.sh/hook": "test"}}, "spec": {"ttlSecondsAfterFinished": 100, "template": {"spec": {"containers": [{"name": "test-auth", "image": "kdevup/curljq", "imagePullPolicy": "IfNotPresent", "command": ["/bin/bash", "-c", "curl -sfo /dev/null \\\n  http://supabase-auth:9999/health\necho \"Sevice supabase-auth is healthy.\"\n"]}], "restartPolicy": "Never"}}}}
 ---
 {"apiVersion": "batch/v1", "kind": "Job", "metadata": {"name": "supabase-test-imgproxy", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"helm.sh/hook": "test"}}, "spec": {"ttlSecondsAfterFinished": 100, "template": {"spec": {"containers": [{"name": "test-imgproxy", "image": "kdevup/curljq", "imagePullPolicy": "IfNotPresent", "command": ["/bin/bash", "-c", "curl -sfo /dev/null \\\n  http://supabase-imgproxy:5001/health\necho \"Sevice supabase-imgproxy is healthy.\"\n"]}], "restartPolicy": "Never"}}}}
 ---
-{"apiVersion": "batch/v1", "kind": "Job", "metadata": {"name": "supabase-test-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"helm.sh/hook": "test"}}, "spec": {"ttlSecondsAfterFinished": 100, "template": {"spec": {"containers": [{"env": [{"name": "DASHBOARD_USERNAME", "valueFrom": {"secretKeyRef": {"name": "supabase-dashboard", "key": "username"}}}, {"name": "DASHBOARD_PASSWORD", "valueFrom": {"secretKeyRef": {"name": "supabase-dashboard", "key": "password"}}}], "name": "test-kong", "image": "kdevup/curljq", "imagePullPolicy": "IfNotPresent", "command": ["/bin/bash", "-c", "echo \"Attempting to access dashboard with provided credentials...\"\ncurl -sL --fail \\\n  -o /dev/null \\\n  \"http://${DASHBOARD_USERNAME}:${DASHBOARD_PASSWORD}@supabase-kong:8000\" \\\n  || ( echo -e \"\\e[0;31mFailed to get a valid response.\" && exit 1 )\necho \"Successfully connected.\"\n"]}], "restartPolicy": "Never"}}}}
----
 {"apiVersion": "batch/v1", "kind": "Job", "metadata": {"name": "supabase-test-meta", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"helm.sh/hook": "test"}}, "spec": {"ttlSecondsAfterFinished": 100, "template": {"spec": {"containers": [{"name": "test-meta", "image": "kdevup/curljq", "imagePullPolicy": "IfNotPresent", "command": ["/bin/bash", "-c", "curl -sfo /dev/null \\\n  http://supabase-meta:8080/health\necho \"Sevice supabase-meta is healthy.\"\n"]}], "restartPolicy": "Never"}}}}
 ---
-{"apiVersion": "batch/v1", "kind": "Job", "metadata": {"name": "supabase-test-minio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"helm.sh/hook": "test"}}, "spec": {"ttlSecondsAfterFinished": 100, "template": {"spec": {"containers": [{"name": "test-minio", "image": "kdevup/curljq", "command": ["/bin/bash", "-c", "curl -sfo /dev/null \\\n  http://supabase-minio:9000/minio/health/live\necho \"Sevice supabase-minio is healthy.\"\n"]}], "restartPolicy": "Never"}}}}
----
 {"apiVersion": "batch/v1", "kind": "Job", "metadata": {"name": "supabase-test-realtime", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"helm.sh/hook": "test"}}, "spec": {"ttlSecondsAfterFinished": 100, "template": {"spec": {"containers": [{"name": "test-realtime", "image": "kdevup/curljq", "imagePullPolicy": "IfNotPresent", "command": ["/bin/bash", "-c", "curl -sfo /dev/null \\\n  http://supabase-realtime:4000\necho \"Sevice supabase-realtime is healthy.\"\n"]}], "restartPolicy": "Never"}}}}
 ---
 {"apiVersion": "batch/v1", "kind": "Job", "metadata": {"name": "supabase-test-rest", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"helm.sh/hook": "test"}}, "spec": {"ttlSecondsAfterFinished": 100, "template": {"spec": {"containers": [{"name": "test-rest", "image": "kdevup/curljq", "imagePullPolicy": "IfNotPresent", "command": ["/bin/bash", "-c", "curl -sfo /dev/null \\\n  http://supabase-rest:3000\necho \"Sevice supabase-rest is healthy.\"\n"]}], "restartPolicy": "Never"}}}}
diff --git a/supabase/helm/generated/supabase-helm.frontdoor-db.yaml b/supabase/helm/generated/supabase-helm.frontdoor-db.yaml
index e69de29..a4df5e9 100644
--- a/supabase/helm/generated/supabase-helm.frontdoor-db.yaml
+++ b/supabase/helm/generated/supabase-helm.frontdoor-db.yaml
@@ -0,0 +1,9 @@
+{"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-functions", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase-frontdoor-db", "app.kubernetes.io/managed-by": "Helm"}, "namespace": "supabase"}, "spec": {"type": "ClusterIP", "ports": [{"port": 9000, "targetPort": 9000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-functions", "app.kubernetes.io/instance": "supabase-frontdoor-db"}}}
+---
+{"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase-frontdoor-db", "app.kubernetes.io/managed-by": "Helm"}, "namespace": "supabase"}, "spec": {"type": "ClusterIP", "ports": [{"port": 8000, "targetPort": 8000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-kong", "app.kubernetes.io/instance": "supabase-frontdoor-db"}}}
+---
+{"apiVersion": "v1", "kind": "Service", "metadata": {"name": "supabase-studio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase-frontdoor-db", "app.kubernetes.io/managed-by": "Helm"}, "namespace": "supabase"}, "spec": {"type": "ClusterIP", "ports": [{"port": 3000, "targetPort": 3000, "protocol": "TCP", "name": "http"}], "selector": {"app.kubernetes.io/name": "knoe-supabase-studio", "app.kubernetes.io/instance": "supabase-frontdoor-db"}}}
+---
+{"apiVersion": "networking.k8s.io/v1", "kind": "Ingress", "metadata": {"name": "supabase-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase-frontdoor-db", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"nginx.ingress.kubernetes.io/rewrite-target": "/"}, "namespace": "supabase"}, "spec": {"ingressClassName": "traefik", "rules": [{"host": "db.knoe.org", "http": {"paths": [{"path": "/", "pathType": "Prefix", "backend": {"service": {"name": "supabase-kong", "port": {"number": 8000}}}}]}}]}}
+---
+{"apiVersion": "networking.k8s.io/v1", "kind": "Ingress", "metadata": {"name": "supabase-studio", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase-frontdoor-db", "app.kubernetes.io/managed-by": "Helm"}, "annotations": {"nginx.ingress.kubernetes.io/auth-response-headers": "X-Knoe-User,X-Knoe-Email,X-Knoe-Groups", "nginx.ingress.kubernetes.io/auth-signin": "https://api.knoe.org/auth/login?next=$scheme://$host$escaped_request_uri", "nginx.ingress.kubernetes.io/auth-url": "https://api.knoe.org/auth/verify"}, "namespace": "supabase"}, "spec": {"ingressClassName": "traefik", "rules": [{"host": "db.knoe.org", "http": {"paths": [{"path": "/", "pathType": "Prefix", "backend": {"service": {"name": "supabase-studio", "port": {"number": 3000}}}}]}}]}}