Deploy coulomb-social image tag as string; pin 7067145

Helm --set-string for numeric git SHAs (InvalidImageName fix).
Ingress entrypoints web+websecure; values pin first release tag.

Makefile

@@ -278,14 +278,14 @@ check-coulomb-social-image-tag: ## Require an explicit coulomb-social image tag
 coulomb-social-dry-run: check-coulomb-social-image-tag ## helm template render for coulomb-social
 	helm template $(COULOMB_SOCIAL_RELEASE) $(COULOMB_SOCIAL_CHART) \
 	  -f $(COULOMB_SOCIAL_VALUES) \
-	  --set image.tag=$(COULOMB_SOCIAL_IMAGE_TAG) \
+	  --set-string image.tag=$(COULOMB_SOCIAL_IMAGE_TAG) \
 	  --namespace $(COULOMB_SOCIAL_NAMESPACE)
 
 coulomb-social-deploy: check-production-kubeconfig check-coulomb-social-image-tag ## Deploy / upgrade coulomb-social
 	kubectl create namespace $(COULOMB_SOCIAL_NAMESPACE) --dry-run=client -o yaml | kubectl apply -f -
 	helm upgrade --install $(COULOMB_SOCIAL_RELEASE) $(COULOMB_SOCIAL_CHART) \
 	  -f $(COULOMB_SOCIAL_VALUES) \
-	  --set image.tag=$(COULOMB_SOCIAL_IMAGE_TAG) \
+	  --set-string image.tag=$(COULOMB_SOCIAL_IMAGE_TAG) \
 	  --namespace $(COULOMB_SOCIAL_NAMESPACE) \
 	  --wait --timeout 5m
 

helm/coulomb-social-values.yaml

@@ -3,7 +3,7 @@
 
 image:
   repository: forgejo.coulomb.social/coulomb/coulomb-social
-  tag: "pending"   # pin to git SHA after first image publish
+  tag: "7067145"
 
 env:
   DJANGO_SETTINGS_MODULE: coulomb_social.settings.prod

manifests/coulomb-social-ingress.yaml

@@ -7,7 +7,8 @@ metadata:
   namespace: coulomb-social
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   ingressClassName: traefik
   tls: