feat(supabase): add services and statefulset for database management

feat(synapse): update ingress to use traefik ingress class and bump version

feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress

feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration

fix(taiga): update liveness and readiness probes to use tcpSocket for health checks

fix(taiga): change PVC access mode to ReadWriteMany for media and static storage

feat(traefik): add icon and ignore rules for traefik service

docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments

feat(ushahidi): implement dedicated Redis deployment for Ushahidi

fix(vllm): update deployment strategy and readiness/liveness probes for improved stability

fix(writefreely): pin writefreely image version to v0.15.1 for consistency

docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior

docs/python.md

@@ -0,0 +1,65 @@
+# Python (Django / FastAPI)
+
+## Health probe host header
+
+Kubernetes sends probe requests directly to the pod IP. Django's `ALLOWED_HOSTS` rejects requests without a matching `Host` header, causing every probe to return 400 and the pod to restart. Add a `Host` header to all HTTP probes:
+
+```yaml
+livenessProbe:
+  httpGet:
+    path: /
+    port: 8000
+    httpHeaders:
+      - name: Host
+        value: "{{ .domain }}"
+readinessProbe:
+  httpGet:
+    path: /
+    port: 8000
+    httpHeaders:
+      - name: Host
+        value: "{{ .domain }}"
+```
+
+FastAPI and Flask apps with explicit host validation have the same issue.
+
+## Startup delay (apps that run migrations)
+
+Django apps that run `migrate` on startup need extra time before the liveness probe fires. The default 60-second delay is too short for large migration sets.
+
+```yaml
+livenessProbe:
+  httpGet:
+    path: /
+    port: 8000
+    httpHeaders:
+      - name: Host
+        value: "{{ .domain }}"
+  initialDelaySeconds: 90
+  periodSeconds: 30
+  failureThreshold: 6
+readinessProbe:
+  httpGet:
+    path: /
+    port: 8000
+    httpHeaders:
+      - name: Host
+        value: "{{ .domain }}"
+  initialDelaySeconds: 60
+  periodSeconds: 15
+  failureThreshold: 3
+```
+
+## Celery workers
+
+Celery workers are full Python processes. Size them at 256–512Mi and deploy them as a separate Deployment from the web process. They do not need an HTTP probe — use a `tcpSocket` or `exec` check if a liveness probe is needed at all.
+
+## Non-interactive superuser creation
+
+```bash
+kubectl exec -n <ns> <pod> -- \
+    env DJANGO_SUPERUSER_PASSWORD="${PASSWORD}" \
+    python manage.py createsuperuser --email "${EMAIL}" --noinput
+```
+
+`--noinput` reads the password from `DJANGO_SUPERUSER_PASSWORD`.