fix(karrot): fix nginx DNS resolver for Kubernetes and add README

The karrot-frontend nginx template hardcodes Docker's DNS resolver
(127.0.0.11) which doesn't exist in Kubernetes. Added a ConfigMap to
override the template, removing the Docker DNS resolver by using a
direct proxy_pass with no nginx variable (which would force runtime
resolution). Also adds a README with usage instructions.

Documents lessons learned in ADDING-APPS-NOTES.md:
- Note 24: nginx Docker DNS resolver doesn't work in Kubernetes; any
  nginx variable in proxy_pass (including $request_uri) forces runtime
  DNS resolution requiring a resolver directive
- Note 25: ConfigMap changes don't restart pods; subPath mounts never
  auto-update; always follow with kubectl rollout restart
- Note 26: includeSelectors mismatch affects every deployment in an
  app — check all endpoints, not just the web-facing one

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

karrot/versions/1/README.md

@@ -0,0 +1,35 @@
+# Karrot
+
+Karrot is a community platform for sharing resources, coordinating food-saving activities, and organizing volunteers. Groups can manage pickups, track saved food, and communicate through a shared feed.
+
+## Dependencies
+
+- **PostgreSQL** - Database for storing groups, users, and activity data
+- **SMTP** - For account verification and notifications
+
+## Configuration
+
+Key settings in `config.yaml`:
+
+- **domain** - Where Karrot will be accessible (default: `karrot.{your-cloud-domain}`)
+- **storage** - Persistent volume size for uploaded files (default: `2Gi`)
+- **redis.host** - Redis instance for caching and background jobs (default: app-local `karrot-redis`)
+- **smtp** - Email settings inherited from your Wild Cloud SMTP service
+
+## First-Time Setup
+
+1. Add and deploy the app:
+   ```bash
+   wild app add karrot
+   wild app deploy karrot
+   ```
+
+2. Visit `https://karrot.{your-cloud-domain}` and register an account. The first user to register becomes the site admin.
+
+3. Log in and create your first group to start coordinating.
+
+## Notes
+
+- Karrot supports federation — groups can connect with other Karrot instances
+- The `secretKey` and `dbPassword` are auto-generated in `secrets.yaml`
+- Uploaded files (photos, attachments) are stored in the persistent volume and shared between the frontend and backend pods

karrot/versions/1/deployment-frontend.yaml

@@ -14,9 +14,9 @@ spec:
         component: frontend
     spec:
       securityContext:
-        runAsNonRoot: true
-        runAsUser: 101
-        runAsGroup: 101
+        runAsNonRoot: false
+        runAsUser: 0
+        runAsGroup: 0
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -60,8 +60,6 @@ spec:
             failureThreshold: 3
           securityContext:
             allowPrivilegeEscalation: false
-            capabilities:
-              drop: [ALL]
             readOnlyRootFilesystem: false
           volumeMounts:
             - name: karrot-uploads
@@ -73,6 +71,9 @@ spec:
               mountPath: /etc/nginx/conf.d
             - name: nginx-run
               mountPath: /var/run
+            - name: nginx-template
+              mountPath: /etc/nginx/templates/default.conf.template
+              subPath: default.conf.template
       volumes:
         - name: karrot-uploads
           persistentVolumeClaim:
@@ -83,4 +84,7 @@ spec:
           emptyDir: {}
         - name: nginx-run
           emptyDir: {}
+        - name: nginx-template
+          configMap:
+            name: karrot-nginx-template
       restartPolicy: Always

karrot/versions/1/kustomization.yaml

@@ -9,6 +9,7 @@ labels:
       partOf: wild-cloud
 resources:
   - namespace.yaml
+  - nginx-template-configmap.yaml
   - db-init-job.yaml
   - deployment-backend.yaml
   - deployment-frontend.yaml

karrot/versions/1/nginx-template-configmap.yaml

@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: karrot-nginx-template
+  namespace: {{ .namespace }}
+data:
+  default.conf.template: |
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    client_max_body_size ${FILE_UPLOAD_MAX_SIZE};
+
+    server {
+
+        listen ${LISTEN};
+
+        set_real_ip_from 10.0.0.0/8;
+        set_real_ip_from 172.16.0.0/12;
+        set_real_ip_from 192.168.0.0/16;
+        real_ip_header X-Forwarded-For;
+
+        root /usr/share/nginx/html;
+
+        location /assets {
+          expires max;
+        }
+
+        location /css {
+          expires max;
+        }
+
+        location /js {
+          expires max;
+        }
+
+        location /img {
+          expires max;
+        }
+
+        location /fonts {
+          expires max;
+        }
+
+        location / {
+
+            try_files $uri /index.html;
+
+            add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+            add_header X-Content-Type-Options nosniff;
+
+            add_header Last-Modified $date_gmt;
+            add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; connect-src 'self' https://nominatim.openstreetmap.org https://sentry.io https://*.ingest.sentry.io ${CSP_CONNECT_SRC} blob:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' https: data: blob:;";
+
+            if_modified_since off;
+            expires off;
+            etag off;
+        }
+
+        location /bundlesize.html {
+            add_header Content-Security-Policy "default-src 'self' 'unsafe-inline';";
+            add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+        }
+
+        location ~ ^\/(api(\-auth)?|docs|silk|static)\/ {
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_set_header Host $http_host;
+
+            proxy_pass http://${BACKEND};
+
+            proxy_redirect off;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions;
+            proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
+            proxy_set_header Sec-WebSocket-Protocol $http_sec_websocket_protocol;
+            proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
+        }
+
+        location /media/ {
+            alias ${FILE_UPLOAD_DIR};
+            expires max;
+        }
+
+        location /media/tmp/ {
+            deny all;
+            return 404;
+        }
+
+        location ~ /media/conversation_message_attachment_(files|previews|thumbnails)/ {
+            deny all;
+            return 404;
+        }
+
+        location /uploads/ {
+            internal;
+            alias ${FILE_UPLOAD_DIR};
+            etag on;
+        }
+
+        location /community_proxy/ {
+            proxy_pass https://community.karrot.world/;
+        }
+
+        error_page 503 @maintenance;
+
+        location @maintenance {
+          try_files /maintenance.html =503;
+        }
+
+    }