feat(supabase): add services and statefulset for database management

feat(synapse): update ingress to use traefik ingress class and bump version

feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress

feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration

fix(taiga): update liveness and readiness probes to use tcpSocket for health checks

fix(taiga): change PVC access mode to ReadWriteMany for media and static storage

feat(traefik): add icon and ignore rules for traefik service

docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments

feat(ushahidi): implement dedicated Redis deployment for Ushahidi

fix(vllm): update deployment strategy and readiness/liveness probes for improved stability

fix(writefreely): pin writefreely image version to v0.15.1 for consistency

docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior

docs/traefik.md

@@ -0,0 +1,47 @@
+# Traefik
+
+## "No available server" after redeploy `[WC-SEL]`
+
+If a Deployment was originally created without kustomize labels in its selector, re-deploying cannot fix it — `spec.selector` is immutable once set. The Service selector updates (it's mutable) but pods won't match it, leaving the Service with no endpoints.
+
+**Symptom**: Traefik returns "No available server" even though pods are Running.
+
+**Diagnosis**:
+```bash
+kubectl get endpoints <app> -n <namespace>
+# shows <none> — pods aren't matching the service
+kubectl get pods -n <namespace> --show-labels
+# pod labels don't include app: <name> / managedBy: kustomize / partOf: wild-cloud
+```
+
+**Fix**: delete the Deployment and re-deploy:
+```bash
+kubectl delete deployment <name> -n <ns>
+wild app deploy <app>
+```
+
+## Same-origin iframes
+
+The global Traefik `security-headers` middleware sets `X-Frame-Options: SAMEORIGIN`. Apps that embed their own sub-pages in iframes (e.g. Etherpad's pad editor) work correctly with this setting.
+
+`DENY` was the previous setting and broke same-origin iframes. If you see:
+```
+Blocked a frame with origin "https://..." from accessing a cross-origin frame
+```
+the app is likely creating a same-origin iframe that a stale `DENY` header is blocking. Verify the cluster's Traefik middleware is using `SAMEORIGIN`.
+
+**Note**: route-level Traefik middlewares run before entrypoint middlewares on the response path. A per-app middleware cannot override the global one.
+
+## TLS-terminating reverse proxy (DISABLE_HTTPS)
+
+Some apps (e.g. Zulip) redirect port 80 → HTTPS internally. When Traefik terminates TLS and forwards plain HTTP, this causes an infinite redirect loop.
+
+Set these env vars to disable the internal redirect and trust the forwarded proto:
+```yaml
+- name: DISABLE_HTTPS
+  value: "true"
+- name: LOADBALANCER_IPS
+  value: "10.244.0.0/16"  # Kubernetes pod CIDR (Flannel default)
+```
+
+Also update liveness/readiness probes from HTTPS port 443 to HTTP port 80.