**fix(supabase): update cookie domain handling and enhance manifest-generation with new paths**

conf/gke.cfg

@@ -1,5 +1,5 @@
 ; Prole Master Configuration File
-; Generated by install.py on 2026-04-20 22:44:30
+; Generated by install.py on 2026-04-21 20:06:41
 ; This file is used as input for Ansible deployment and k8s cluster creation.
 
 [User]
@@ -79,8 +79,8 @@ init_password.cluster_name = ${CLUSTER_NAME}
 init_password.db_cluster_name = knoe-dev-cnpg-0
 init_password.db_host_port = 5432
 init_password.db_namespace = ${DATABASE_NAMESPACE}
-init_password.db_password = ${PROLE_SECRET:v1:rNg0cdK0dMk1kxsb:0Eu8yWnNpdwTDLnAaUItgMV6VjMZPDTQRMrU09mKQzozWE05U-7LLQ==}
-init_password.db_password_confirm = ${PROLE_SECRET:v1:rNg0cdK0dMk1kxsb:0Eu8yWnNpdwTDLnAaUItgMV6VjMZPDTQRMrU09mKQzozWE05U-7LLQ==}
+init_password.db_password = ${PROLE_SECRET:v1:ZFFldOYIZkB0YP4L:hPhu1R9jyKh5lYPsbrtLdd8F0leQ_yBODT6f4cYL9lU9GrBh}
+init_password.db_password_confirm = ${PROLE_SECRET:v1:ZFFldOYIZkB0YP4L:hPhu1R9jyKh5lYPsbrtLdd8F0leQ_yBODT6f4cYL9lU9GrBh}
 init_password.db_username = chrisfu
 init_password.generate_ssh_key = true
 init_scripts.run_scripts = true
@@ -114,7 +114,7 @@ CNPG_SIZE_PROFILE = small
 DATABASE_NAMESPACE = knoe-db-0
 DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0
 DB_HOST_PORT = 5432
-DB_PASSWORD = ${PROLE_SECRET:v1:AX1bdMcT41sPTZbS:wvvf8AVN-hvKOcJWg1EIBtly78nrTL7rBrjfLXboqqMUD_qw-lSoSQ==}
+DB_PASSWORD = ${PROLE_SECRET:v1:MnnRuv9H3uhhWQp2:-oCq5ybT1tVEOjAiH5DjrTDrPa8hYituYyK1gdxlcuLFfmXa}
 DEPLOYMENT_MODE = k8s
 DEPLOYMENT_TARGET = prole-prod-cluster
 DOCKER_IMPORT_DIR = 
@@ -128,12 +128,7 @@ GITLAB_OIDC_CLIENT_ID = secretref://google-oidc-client-id
 GITLAB_OIDC_CLIENT_SECRET = secretref://google-oidc-client-secret
 GITLAB_OIDC_ISSUER = https://accounts.google.com
 GITLAB_PUBLIC_HOSTS = git.knoe.dev
-; AUTOCLEAN was turned OFF on 2026-04-20 after it destructively deleted the
-; gitaly PVC on every init_gitlab.sh run (has_legacy false-positive via
-; bare PVC-exists check — fixed in setup_gitlab_storage). With the fix in
-; place the flag is safe to re-enable, but 0 is the conservative default:
-; a repair_blocked message is preferable to a silent data wipe.
-GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 0
+GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 1
 GITLAB_SHELL_LOADBALANCER_IP = 34.106.243.154
 GITLAB_SSH_HOST = git-ssh.knoe.dev
 GITLAB_WEBSERVICE_LIMITS_MEMORY = 3Gi

prole-auth/target/classes/application.yml

@@ -11,7 +11,7 @@ prole:
   auth:
     enabled: false
     cookieName: prole_session
-    cookieDomain: .prole.org
+    cookieDomain: ${PROLE_AUTH_COOKIE_DOMAIN:.prole.org}
     sessionTtl: 8h
     # REQUIRED in production when enabled. Provide via env: PROLE_AUTH_SESSION_SECRET
     sessionSecret: ""

supabase/helm/generated/manifest-summary.json

@@ -3,6 +3,8 @@
   "manifests": "/Users/chrisfu/dev/prole/supabase/k8s/supabase-helm.yaml",
   "manifests_app": "/Users/chrisfu/dev/prole/supabase/helm/generated/supabase-helm.app.yaml",
   "manifests_frontdoor_db": "/Users/chrisfu/dev/prole/supabase/helm/generated/supabase-helm.frontdoor-db.yaml",
-  "db_host": "knoe-db-rw.knoe-db-0.svc.cluster.local",
+  "manifests_public_ingress_tls": "/Users/chrisfu/dev/prole/supabase/k8s/public-ingress-tls.yaml",
+  "manifests_public_ingress_kong": "/Users/chrisfu/dev/prole/supabase/k8s/public-ingress-kong.yaml",
+  "db_host": "10.180.15.236",
   "supabase_namespace": "supabase"
 }