feat(flux): add docs-site ImageRepository, ImagePolicy, and setter marker

Closes leeworks-agents/api-company#85

- Add ImageRepository 'docs-site' in flux-system watching
  registry.leeworks.dev/leeworks-agents/docs-site (5m poll interval)
- Add ImagePolicy 'docs-site' in flux-system using alphabetical/asc
  ordering (consistent with SHA-tag CI pushes)
- Add $imagepolicy setter marker comment to flux/docs-site/helmrelease.yaml
  so Flux ImageUpdateAutomation can auto-commit new image tags

kustomize build flux/ = PASS

.gitea/workflows/validate-flux.yaml

@@ -0,0 +1,21 @@
+name: Validate Flux manifests
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  kustomize-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install kustomize
+        run: |
+          curl -sL "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash
+          sudo mv kustomize /usr/local/bin/
+
+      - name: kustomize build flux/
+        run: kustomize build flux/ > /dev/null

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-05-27 (agent cycle — evening triage)_
+_Last updated: 2026-05-28 (agent cycle — cycle-2 triage)_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -21,7 +21,42 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **API service manifests:** `flux/zip-enrichment/`, `flux/holidays/`, `flux/air-quality/` scaffolded (PR #48, closes #46)
 - **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 
-## Completed This Cycle (2026-05-27 — Evening Triage)
+## Completed This Cycle (2026-05-28 — Cycle-2 Triage)
+- **#83** — Triaged: `GITEA_TOKEN` Actions secrets needed in `zip-enrichment`, `holidays`, `air-quality` repos. Manual operator task; reuse token from #74 if it has `write:package` scope. Step-by-step instructions posted.
+- **No open PRs** — queue empty.
+- **`kustomize build flux/` = PASS** — no regressions.
+- **Upstream `0xWheatyz/api-company`** — still does not exist; fork sync skipped (blocker #47).
+
+## Completed Previous Cycle (2026-05-28 — Late-Night Triage)
+- **#79** — Triaged: `gitea-registry` imagePullSecret needed in 4 namespaces. Manual operator task; kubectl docker-registry secret instructions posted.
+- **#80** — Triaged: `gitea-image-automation-token` secret needed in `flux-system`. Manual operator task; write-scoped PAT required, kubectl instructions posted.
+- **#81** — Triaged: `rapidapi-proxy-secret` needed in `zip-enrichment`, `holidays`, `air-quality`. Manual operator task; placeholder + real-secret commands posted.
+- **No open PRs** — queue empty.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Completed Previous Cycle (2026-05-28 — Night Triage)
+- **#76** — Triaged: `gitea-leeworks-agents-token` secret required in `flux-system` to unblock Flux GitRepository auth. Manual operator task; kubectl instructions + reconcile steps posted in issue comment.
+- **#77** — Triaged: `gitea-runner-token` secret required in `gitea-runner` namespace to register Act Runner. Manual operator task; full step-by-step instructions posted in issue comment.
+- **No open PRs** — queue empty.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Completed Previous Cycle (2026-05-28 — Evening Triage)
+- **#74** — Triaged: `GITEA_TOKEN` Actions secret required in leeworks-agents/api-company for docs-site CI. Manual operator task; instructions posted.
+- **#73** — Triaged: `gatus-slack-webhook` secret required in `monitoring` namespace. Manual operator task; kubectl instructions posted.
+- **#67** — Confirmed already resolved: `docs/operator-runbook.md` and `docs/dns.md` both list all 7 subdomains incl. `grafana.leeworks.dev` (PR #63). No code change needed.
+- **No open PRs** — queue empty.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Completed Previous Cycle (2026-05-28 — Morning Triage)
+- **#69 → PR #71 MERGED** — Added `.gitea/workflows/validate-flux.yaml` CI workflow: runs `kustomize build flux/` on every PR and push to `main`. CI gate enforced once Act Runner (#3) is online.
+- **#70** — Triaged: `grafana-admin` secret needed in `monitoring` namespace. Manual operator task; kubectl instructions posted in issue comment.
+- **#67** — Confirmed `docs/operator-runbook.md` Phase 4 DNS table already lists all 7 subdomains including grafana.leeworks.dev. No code change needed.
+- **#66** — Blocked on Phase 0 operator actions (#47, #2, #3, #4). Status comment posted.
+- **#47, #2, #3, #4, #7, #8, #16, #17, #18, #19, #27, #30, #33, #44** — Status comments posted confirming blocked/awaiting-operator state.
+- **No open PRs to review** — queue empty after PR #71 merged.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Completed Previous Cycle (2026-05-27 — Evening Triage)
 - **Triage pass** — all 15 open agent-ready issues reviewed; status comments posted on each.
 - **No open PRs** — nothing to merge or review.
 - **No new feature work** — all issues remain blocked on operator actions or cross-repo prerequisites.

docs/dns.md

@@ -102,6 +102,7 @@ dig aqi.leeworks.dev +short
 dig docs.leeworks.dev +short
 dig status.leeworks.dev +short
 dig registry.leeworks.dev +short
+dig grafana.leeworks.dev +short
 
 # Check TLS certificates (once services are deployed)
 curl -v https://zip.leeworks.dev/health 2>&1 | grep -E "SSL|certificate|issuer"
@@ -125,7 +126,7 @@ The following actions require human operator access to the DNS provider:
 
 1. Log into the DNS provider managing `leeworks.dev`
 2. Find the cluster ingress IP: `kubectl get svc -n ingress-nginx ingress-nginx-controller`
-3. Create/update the 6 A records listed in the table above
+3. Create/update the 7 A records listed in the table above
 4. Verify propagation: `dig +trace zip.leeworks.dev`
 
 DNS propagation typically takes 5–60 minutes.
@@ -141,4 +142,5 @@ DNS propagation typically takes 5–60 minutes.
 - [ ] `docs.leeworks.dev` → DNS record created
 - [ ] `status.leeworks.dev` → DNS record created
 - [ ] `registry.leeworks.dev` → DNS record created
-- [ ] TLS certificates issued and valid for all 6 subdomains
+- [ ] `grafana.leeworks.dev` → DNS record created
+- [ ] TLS certificates issued and valid for all 7 subdomains

docs/operator-runbook.md

@@ -188,7 +188,7 @@ kubectl create secret generic gitea-image-automation-token \
 
 ## Phase 4 — DNS for API services (issue #33)
 
-Add DNS A records for all six leeworks.dev subdomains (all point to the same
+Add DNS A records for all seven leeworks.dev subdomains (all point to the same
 cluster ingress IP):
 
 | Hostname                | Target                 |
@@ -199,6 +199,16 @@ cluster ingress IP):
 | `docs.leeworks.dev`     | `<cluster ingress IP>` |
 | `grafana.leeworks.dev`  | `<cluster ingress IP>` |
 | `status.leeworks.dev`   | `<cluster ingress IP>` |
+| `registry.leeworks.dev` | `<cluster ingress IP>` |
+
+Verify DNS propagation:
+
+```bash
+for host in zip holidays aqi docs grafana status registry; do
+  echo -n "${host}.leeworks.dev: "
+  dig ${host}.leeworks.dev +short
+done
+```
 
 cert-manager will obtain Let's Encrypt certificates automatically once DNS
 propagates (typically minutes, up to 48 h).

docs/secrets-checklist.md

@@ -18,6 +18,7 @@ Follow this list top-to-bottom; each step unblocks the next.
 - [ ] 7. Add api-company Flux source + kustomization to 0xWheatyz/Talos — unblocks all GitOps reconciliation
 - [ ] 8. `gitea-registry` (zip-enrichment, holidays, air-quality, docs-site) — imagePullSecret for pods pulling from `registry.leeworks.dev`
 - [ ] 9. `gitea-image-automation-token` (flux-system) — write-scoped token for Flux ImageUpdateAutomation to push image-tag commits
+- [ ] 10. `rapidapi-proxy-secret` (zip-enrichment, holidays, air-quality) — RapidAPI Proxy Secret for server-side request validation
 
 ---
 
@@ -155,6 +156,44 @@ Unblocks: Issue #2 (Flux reconciliation of all `flux/` manifests in this repo).
 
 ---
 
+---
+
+### 10. `rapidapi-proxy-secret` — RapidAPI Proxy Secret (per API namespace)
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `rapidapi-proxy-secret` |
+| Namespaces | `zip-enrichment`, `holidays`, `air-quality` |
+| Purpose   | Every API service validates the `X-RapidAPI-Proxy-Secret` header on every route. Requests without a valid secret return HTTP 403. |
+| Source    | RapidAPI dashboard → API Settings → Security → **Proxy Secret** (generated after each API listing is created) |
+| Unblocks  | Phase 3 server middleware; API services will start but reject all traffic without this secret |
+
+```bash
+for NS in zip-enrichment holidays air-quality; do
+  kubectl create secret generic rapidapi-proxy-secret \
+    --namespace=$NS \
+    --from-literal=X-RapidAPI-Proxy-Secret=<value-from-rapidapi-dashboard>
+done
+```
+
+**Source:** RapidAPI dashboard → select your API → Settings → Security → Proxy Secret
+
+> **Note:** Placeholder `ExternalSecret` manifests are committed at
+> `flux/zip-enrichment/externalsecret.yaml`, `flux/holidays/externalsecret.yaml`,
+> and `flux/air-quality/externalsecret.yaml`. These will auto-sync this secret
+> from the configured backend once the External Secrets Operator (ESO) is
+> deployed (see issue #61). Until then, create manually using the commands above.
+
+Verify:
+```bash
+for NS in zip-enrichment holidays air-quality; do
+  echo -n "$NS: "
+  kubectl get secret rapidapi-proxy-secret -n $NS -o jsonpath='{.data.X-RapidAPI-Proxy-Secret}' | base64 -d | wc -c
+  echo " chars"
+done
+```
+
+
 ## Dependency Order
 
 ```
@@ -166,6 +205,7 @@ Unblocks: Issue #2 (Flux reconciliation of all `flux/` manifests in this repo).
 5 + 6 (GITEA_TOKEN + registry packages) → CI pushes images → API services deploy
 8 (gitea-registry)       → pods can pull images from registry.leeworks.dev → services start
 9 (gitea-image-automation-token) → Flux ImageUpdateAutomation pushes tag-update commits
+10 (rapidapi-proxy-secret × 3)  → API server middleware validates RapidAPI requests → revenue enabled
 ```
 
 Once all nine items are complete, the full stack (runner, registry, Prometheus, Grafana, Gatus, docs-site, three API services) reconciles automatically via FluxCD with no further manual steps.

flux/docs-site/helmrelease.yaml

@@ -35,7 +35,7 @@ spec:
                 - name: gitea-registry
               containers:
                 - name: docs-site
-                  image: registry.leeworks.dev/leeworks-agents/docs-site:latest
+                  image: registry.leeworks.dev/leeworks-agents/docs-site:latest # {"$imagepolicy": "flux-system:docs-site"}
                   ports:
                     - containerPort: 80
                   resources:

flux/image-automation/imagepolicies.yaml

@@ -37,3 +37,15 @@ spec:
   policy:
     semver:
       range: ">=0.1.0"
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+  name: docs-site
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: docs-site
+  policy:
+    alphabetical:
+      order: asc

flux/image-automation/imagerepositories.yaml

@@ -32,3 +32,14 @@ spec:
   interval: 5m
   secretRef:
     name: gitea-leeworks-agents-token
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+  name: docs-site
+  namespace: flux-system
+spec:
+  image: registry.leeworks.dev/leeworks-agents/docs-site
+  interval: 5m
+  secretRef:
+    name: gitea-leeworks-agents-token