feat(supabase): add services and statefulset for database management

feat(synapse): update ingress to use traefik ingress class and bump version

feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress

feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration

fix(taiga): update liveness and readiness probes to use tcpSocket for health checks

fix(taiga): change PVC access mode to ReadWriteMany for media and static storage

feat(traefik): add icon and ignore rules for traefik service

docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments

feat(ushahidi): implement dedicated Redis deployment for Ushahidi

fix(vllm): update deployment strategy and readiness/liveness probes for improved stability

fix(writefreely): pin writefreely image version to v0.15.1 for consistency

docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior

loomio/app.yaml

@@ -4,3 +4,5 @@ description: Loomio is a collaborative decision-making tool that makes it easy f
 category: community
 icon: https://www.loomio.com/brand/logo_gold.svg
 latest: "3"
+ignoreRules:
+  - WC-IMG  # loomio_channel_server has no versioned tags; stable is the best available pin

loomio/notes.md

@@ -0,0 +1,24 @@
+# Loomio — Notes
+
+## Custom startup command must reproduce ENTRYPOINT setup steps
+
+Loomio's Docker image uses `docker_start.sh` as its ENTRYPOINT, which copies
+`client3-build/` → `public/client3/` before starting Rails. Overriding the entrypoint with a
+direct Rails command skips this step, leaving `client3/` unpopulated and causing 500 errors on
+all routes serving the SPA.
+
+**Fix**: reproduce the copy step explicitly in the deployment `command:`:
+
+```yaml
+command: ["/bin/bash", "-c"]
+args:
+  - |
+    set -e
+    mkdir -p /loomio/public/client3
+    cp -r /loomio/client3-build/* /loomio/public/client3/
+    bundle exec rake db:migrate db:seed
+    bundle exec thrust puma -C config/puma.rb
+```
+
+**General rule**: whenever you override `command:`, inspect the image's `ENTRYPOINT`/`CMD`
+(via `docker inspect` or the Dockerfile) and reproduce any required setup steps.

loomio/versions/3/deployment-channels.yaml

@@ -12,9 +12,14 @@ spec:
       labels:
         component: channels
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: channels
-        image: loomio/loomio_channel_server:latest
+        image: loomio/loomio_channel_server:stable
         ports:
         - containerPort: 3000
           name: http

loomio/versions/3/deployment-worker.yaml

@@ -12,9 +12,12 @@ spec:
       labels:
         component: worker
     spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: worker
-        image: loomio/loomio:latest
+        image: loomio/loomio:3.0.24
         env:
         - name: TASK
           value: worker

loomio/versions/3/deployment.yaml

@@ -14,14 +14,19 @@ spec:
       labels:
         component: web
     spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: loomio
-        image: loomio/loomio:latest
+        image: loomio/loomio:3.0.24
         command:
         - /bin/bash
         - -c
         - |
           set -e
+          mkdir -p /loomio/public/client3
+          cp -r /loomio/client3-build/* /loomio/public/client3/
           bundle exec rake db:migrate db:seed
           bundle exec thrust puma -C config/puma.rb
         ports:

loomio/versions/3/manifest.yaml

@@ -1,4 +1,4 @@
-version: 3.0.11-5
+version: 3.0.24-2
 requires:
   - name: postgres
     installed_as: postgres
@@ -34,7 +34,7 @@ defaultSecrets:
   - key: dbPassword
     default: "{{ random.AlphaNum 32 }}"
   - key: dbUrl
-    default: "postgresql://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?pool=30"
+    default: "postgresql://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?pool=30&sslmode=disable"
   - key: deviseSecret
     default: "{{ random.AlphaNum 32 }}"
   - key: secretCookieToken