feat: extend Flux image automation, Gatus, and docs for VIN Decoder

Closes leeworks-agents/api-company#133 Closes leeworks-agents/api-company#134 Closes leeworks-agents/api-company#135 Closes leeworks-agents/api-company#136 - flux/image-automation/imagerepositories.yaml: add vin-decoder ImageRepository pointing at registry.leeworks.dev/vin-decoder/api (#133) - flux/image-automation/imagepolicies.yaml: add vin-decoder ImagePolicy with semver range >=0.1.0 (#133) - flux/monitoring/gatus-helmrelease.yaml: add VIN Decoder API endpoint check targeting https://vin.leeworks.dev/v1/health with Slack alert (#134) - docs/pre-launch-checklist.md: add vin-decoder to Infrastructure, DNS & TLS, Functional Verification, and Legal sections; update status page line to reference all four APIs (#135) - docs/secrets-checklist.md: add items #11-13 for vin-decoder GITEA_TOKEN, gitea-registry, and rapidapi-proxy-secret; add detail sections for each (#136) kustomize build flux/ passes with zero errors.
2026-05-31 00:04:20 +00:00
parent b810c17681
commit b8ba748db7
5 changed files with 106 additions and 2 deletions
@@ -19,6 +19,9 @@ Follow this list top-to-bottom; each step unblocks the next.
 - [ ] 8. `gitea-registry` (zip-enrichment, holidays, air-quality, docs-site) — imagePullSecret for pods pulling from `registry.leeworks.dev`
 - [ ] 9. `gitea-image-automation-token` (flux-system) — write-scoped token for Flux ImageUpdateAutomation to push image-tag commits
 - [ ] 10. `rapidapi-proxy-secret` (zip-enrichment, holidays, air-quality) — RapidAPI Proxy Secret for server-side request validation
+- [ ] 11. `GITEA_TOKEN` Actions secret in `leeworks-agents/vin-decoder` repo — enables CI image push for VIN Decoder (leeworks-agents/api-company#126)
+- [ ] 12. `gitea-registry` imagePullSecret in `vin-decoder` namespace — enables pod image pulls from `registry.leeworks.dev` (leeworks-agents/api-company#127)
+- [ ] 13. `rapidapi-proxy-secret` in `vin-decoder` namespace — enables RapidAPI proxy-secret header validation (leeworks-agents/api-company#128)

 ---

@@ -194,6 +197,68 @@ done
 ```


+### 11. `GITEA_TOKEN` Actions secret in `leeworks-agents/vin-decoder`
+
+| Field    | Value |
+|----------|-------|
+| Name     | `GITEA_TOKEN` |
+| Scope    | Gitea Actions Secret — set in repo Settings |
+| Purpose  | CI workflow pushes container image to `registry.leeworks.dev/vin-decoder/api:<sha>` |
+| Source   | Gitea token with `write:packages` scope (reuse from item #5 if it has `write:packages`) |
+| Tracked  | leeworks-agents/api-company#126 |
+| Unblocks | CI image push for VIN Decoder |
+
+Path: **Gitea → leeworks-agents/vin-decoder → Settings → Secrets → `GITEA_TOKEN`**
+
+---
+
+### 12. `gitea-registry` imagePullSecret in `vin-decoder` namespace
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `gitea-registry` |
+| Namespace | `vin-decoder` |
+| Type      | `kubernetes.io/dockerconfigjson` |
+| Purpose   | Allows VIN Decoder pods to pull images from `registry.leeworks.dev` without ImagePullBackOff |
+| Tracked   | leeworks-agents/api-company#127 |
+
+```bash
+kubectl create namespace vin-decoder --dry-run=client -o yaml | kubectl apply -f -
+kubectl create secret docker-registry gitea-registry \
+  --namespace=vin-decoder \
+  --docker-server=registry.leeworks.dev \
+  --docker-username=leeworks-agents \
+  --docker-password=<GITEA_TOKEN_WITH_READ_PACKAGES> \
+  --docker-email=agent@leeworks.dev
+```
+
+---
+
+### 13. `rapidapi-proxy-secret` in `vin-decoder` namespace
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `rapidapi-proxy-secret` |
+| Namespace | `vin-decoder` |
+| Purpose   | VIN Decoder validates `X-RapidAPI-Proxy-Secret` header; returns HTTP 403 if missing/wrong |
+| Source    | RapidAPI dashboard → VIN Decoder listing → Settings → Security → Proxy Secret |
+| Tracked   | leeworks-agents/api-company#128 |
+
+```bash
+# Placeholder (unblocks deploy testing):
+kubectl create secret generic rapidapi-proxy-secret \
+  --namespace=vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=PLACEHOLDER_REPLACE_AFTER_RAPIDAPI_LISTING
+
+# Update with real value after RapidAPI listing (#131) is live:
+kubectl create secret generic rapidapi-proxy-secret \
+  -n vin-decoder \
+  --from-literal=X-RapidAPI-Proxy-Secret=<VIN_RAPIDAPI_PROXY_SECRET> \
+  --save-config --dry-run=client -o yaml | kubectl apply -f -
+```
+
+---
+
 ## Dependency Order

 ```