From 67fac76f3b87a5877d9951327d7fd6a884d7b4ae Mon Sep 17 00:00:00 2001
From: palehazy <austinrpg@live.com>
Date: Sat, 25 Jul 2026 20:58:36 -0500
Subject: [PATCH 1/2] Deploy Chat2DB to Anvil Primaris

---
 .../namespace/chat2db/deploy.yaml             | 35 +++++++++++++++++++
 .../encryption-key-external-secret.yaml       | 22 ++++++++++++
 .../manifests/ghcr-creds-external-secret.yaml | 21 +++++++++++
 3 files changed, 78 insertions(+)
 create mode 100644 .hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml
 create mode 100644 .hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/encryption-key-external-secret.yaml
 create mode 100644 .hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/ghcr-creds-external-secret.yaml

diff --git a/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml
new file mode 100644
index 0000000000..94bdcb743c
--- /dev/null
+++ b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml
@@ -0,0 +1,35 @@
+helmChartPath: charts/chat2db
+
+image:
+  repository: ghcr.io/hazyforge/chat2db
+  tag: sha-3b7cd49
+  digest: sha256:615b172094e476cf9e1af48bc8d41ef75d7a1ee241d62d4728d1080f4c833d28
+  pullPolicy: IfNotPresent
+
+imagePullSecrets:
+  - name: ghcr-creds
+
+persistence:
+  storageClassName: observability-local
+  accessModes:
+    - ReadWriteOnce
+  size: 10Gi
+
+encryptionKey:
+  existingSecret: chat2db-encryption-key
+  secretKey: encryption.key
+  mountPath: /run/secrets/chat2db-community-encryption.key
+
+resources:
+  requests:
+    cpu: 500m
+    memory: 1Gi
+  limits:
+    cpu: "2"
+    memory: 4Gi
+
+nodeSelector:
+  kubernetes.io/hostname: z400
+
+networkPolicy:
+  enabled: true
diff --git a/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/encryption-key-external-secret.yaml b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/encryption-key-external-secret.yaml
new file mode 100644
index 0000000000..904a7eff4c
--- /dev/null
+++ b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/encryption-key-external-secret.yaml
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: chat2db-encryption-key
+  namespace: chat2db
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: azurekv-cluster-secret-store
+  target:
+    name: chat2db-encryption-key
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        encryption.key: "{{ .encryptionKey }}"
+  data:
+    - secretKey: encryptionKey
+      remoteRef:
+        key: secret/chat2db-community-encryption-key
diff --git a/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/ghcr-creds-external-secret.yaml b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/ghcr-creds-external-secret.yaml
new file mode 100644
index 0000000000..1209cc8014
--- /dev/null
+++ b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/ghcr-creds-external-secret.yaml
@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ghcr-creds
+  namespace: chat2db
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: azurekv-cluster-secret-store
+  target:
+    name: ghcr-creds
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: '{"auths":{"ghcr.io":{"username":"hazyforge","password":"{{ .pat }}","auth":"{{ printf "%s:%s" "hazyforge" .pat | b64enc }}"}}}'
+  data:
+    - secretKey: pat
+      remoteRef:
+        key: secret/anvil-primaris-ghcr-read-pat

From 4db9e4e9aa186d0a5d959eb23a955e0705bd0dfb Mon Sep 17 00:00:00 2001
From: palehazy <austinrpg@live.com>
Date: Sat, 25 Jul 2026 22:09:38 -0500
Subject: [PATCH 2/2] Secure Chat2DB behind shared OIDC proxy

---
 .../anvil-primaris/namespace/chat2db/deploy.yaml     | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml
index 94bdcb743c..4dd714a5f2 100644
--- a/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml
+++ b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml
@@ -2,8 +2,8 @@ helmChartPath: charts/chat2db
 
 image:
   repository: ghcr.io/hazyforge/chat2db
-  tag: sha-3b7cd49
-  digest: sha256:615b172094e476cf9e1af48bc8d41ef75d7a1ee241d62d4728d1080f4c833d28
+  tag: sha-ffc6a41
+  digest: sha256:1f7d6beeddbb3a25cb463ce507f1c13f2fb6aeb821239032e0efa66678b13a57
   pullPolicy: IfNotPresent
 
 imagePullSecrets:
@@ -20,6 +20,9 @@ encryptionKey:
   secretKey: encryption.key
   mountPath: /run/secrets/chat2db-community-encryption.key
 
+cors:
+  allowedOrigin: https://chat2db.hazyforge.io
+
 resources:
   requests:
     cpu: 500m
@@ -33,3 +36,8 @@ nodeSelector:
 
 networkPolicy:
   enabled: true
+  allowedIngress:
+    namespace: oauth2-proxy
+    podLabels:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: chat2db