feat(supabase): add services and statefulset for database management

feat(synapse): update ingress to use traefik ingress class and bump version

feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress

feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration

fix(taiga): update liveness and readiness probes to use tcpSocket for health checks

fix(taiga): change PVC access mode to ReadWriteMany for media and static storage

feat(traefik): add icon and ignore rules for traefik service

docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments

feat(ushahidi): implement dedicated Redis deployment for Ushahidi

fix(vllm): update deployment strategy and readiness/liveness probes for improved stability

fix(writefreely): pin writefreely image version to v0.15.1 for consistency

docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior

supabase/versions/1/scripts/generate-keys.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+# generate-keys.sh — Generate a new JWT secret and matching Supabase API keys.
+#
+# This script generates a cryptographically secure JWT_SECRET and derives
+# ANON_KEY and SERVICE_ROLE_KEY JWTs from it. Run this script and update
+# the supabase secrets in your Wild Cloud instance before going to production.
+#
+# Usage:
+#   wild app run supabase generate-keys [JWT_SECRET=<your-secret>]
+#
+# The script uses kubectl exec to run inside the cluster. Requires:
+#   - python3 with hmac, hashlib, base64, json modules (standard library)
+#   - The supabase namespace to exist
+#
+# After running, update secrets.yaml in your instance with the output values.
+
+set -e
+
+NAMESPACE="supabase"
+INSTANCE="${WILD_INSTANCE:-$(wild instance current 2>/dev/null || echo 'test-cloud')}"
+
+# Generate or use provided JWT secret
+if [ -n "$JWT_SECRET" ]; then
+    SECRET="$JWT_SECRET"
+else
+    SECRET=$(python3 -c "import secrets; print(secrets.token_urlsafe(48))")
+fi
+
+# Generate HS256 JWT tokens using python3 (no external deps needed)
+GENERATE_JWT=$(cat <<'PYEOF'
+import sys, hmac, hashlib, base64, json, time
+
+def b64url_encode(data):
+    if isinstance(data, str):
+        data = data.encode()
+    return base64.urlsafe_b64encode(data).rstrip(b'=').decode()
+
+def make_jwt(secret, role):
+    header = b64url_encode(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(',', ':')))
+    # Tokens valid for 10 years from now
+    now = int(time.time())
+    exp = now + (10 * 365 * 24 * 3600)
+    payload = b64url_encode(json.dumps({
+        "role": role,
+        "iss": "supabase",
+        "iat": now,
+        "exp": exp
+    }, separators=(',', ':')))
+    signing_input = f"{header}.{payload}"
+    sig = hmac.new(secret.encode(), signing_input.encode(), hashlib.sha256).digest()
+    signature = b64url_encode(sig)
+    return f"{signing_input}.{signature}"
+
+secret = sys.argv[1]
+role = sys.argv[2]
+print(make_jwt(secret, role))
+PYEOF
+)
+
+ANON_KEY=$(python3 -c "$GENERATE_JWT" "$SECRET" "anon")
+SERVICE_ROLE_KEY=$(python3 -c "$GENERATE_JWT" "$SECRET" "service_role")
+
+echo ""
+echo "=== Supabase JWT Keys ==="
+echo ""
+echo "Add these to your secrets.yaml (or update via 'wild secrets set'):"
+echo ""
+echo "  jwtSecret: |"
+echo "    $SECRET"
+echo ""
+echo "  anonKey: |"
+echo "    $ANON_KEY"
+echo ""
+echo "  serviceRoleKey: |"
+echo "    $SERVICE_ROLE_KEY"
+echo ""
+echo "IMPORTANT: After updating secrets.yaml, redeploy Supabase:"
+echo "  wild app deploy supabase"
+echo ""
+echo "The existing database will have its JWT secret updated on next pod restart."