S5 Workloads — Gitea, Zulip, and other application Helm releases
tegwick
c5546ac729
INFD-WP-0001-T07 has been blocked since 2026-09-08 on an OIDC redirect URI it cannot publish without a real deployed origin, which in turn blocks key-cape's KEY-WP-0013-T02. The operator assigned decisions.coulomb.social; DNS already resolves to the cluster address. Adds the Ingress + letsencrypt-prod certificate for the host and a placeholder nginx backend, so the origin answers before the approver UI itself exists (INFD-WP-0001-T08 is still gated on approval-engine and on intake INFD-IN-0003). A redirect URI matches byte-exactly at /authorize, so a host that resolves but does not complete a TLS handshake fails closed at first login and presents as a rejected approval rather than a registration defect. The Ingress carries one path rule on purpose: reuse-surface reported on 2026-07-07 that an Exact rule alongside a catch-all Prefix rule on the same host was swallowed by the catch-all. That trap is worth avoiding on a host whose entire purpose is exact-match redirect handling. Dry-run clean against the live API; deliberately not applied. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EJbh7o7UWF4tQ5jxygnNGu Assistant: claude-code Assistant-Model: opus Assistant-Process: 2072522@bnt-lap001 Assistant-Session: 46173adf-7302-4ede-99d6-963b61359928 |
||
|---|---|---|
| .claude/rules | ||
| .forgejo/workflows | ||
| .gitea/workflows | ||
| bindings | ||
| charts | ||
| docs | ||
| helm | ||
| manifests | ||
| registry | ||
| tools | ||
| workplans | ||
| .custodian-brief.md | ||
| .repo-classification.yaml | ||
| .sops.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| INTENT.md | ||
| LICENSE | ||
| Makefile | ||
| SCOPE.md | ||
| STATE.md | ||
| WORK-RECORDS.md | ||