changed deployment

deploy/helm/go-guess/templates/NOTES.txt

@@ -1,4 +1,5 @@
 Go Guess has been installed in namespace {{ .Release.Namespace }}.
+Protected interviewer routes authorize with Go Loose at {{ .Values.app.goLooseBaseURL }}.
 
 {{- if .Values.ingress.enabled }}
 Open {{ .Values.app.frontendURL }}

deploy/helm/go-guess/templates/app-deployment.yaml

@@ -48,6 +48,8 @@ spec:
               value: {{ .Values.app.tokenTTL | quote }}
             - name: MAX_UPLOAD_MB
               value: {{ .Values.app.maxUploadMB | quote }}
+            - name: GO_LOOSE_BASE_URL
+              value: {{ .Values.app.goLooseBaseURL | quote }}
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:

deploy/helm/go-guess/values.yaml

@@ -15,6 +15,8 @@ app:
   frontendURL: http://localhost:8080
   tokenTTL: 8h
   maxUploadMB: 10
+  # Authorize URL for Go Loose. %s is the request X-Tenant-Id.
+  goLooseBaseURL: https://%s.auth.dev
 
 secrets:
   jwtSecret: ""

deploy/nginx/README.md

@@ -54,3 +54,9 @@ curl --fail https://goguess.urpi.be/api/health
 
 The `go-guess` service should show `80:31374/TCP`. The PostgreSQL and RabbitMQ
 services should remain `ClusterIP` services without NodePorts.
+
+Protected interviewer routes also call Go Loose from the application pod, using
+`app.goLooseBaseURL` (default `https://%s.auth.dev`, where `%s` is the
+request tenant). That address must be reachable from the cluster. The browser
+sends `X-API-Key` only when the published frontend image was built with
+`VITE_GO_LOOSE_API_KEY`. Nginx does not add or strip that header.