Traefik forwards /api/auth/login to the backend verbatim, causing 404.
Nginx already strips the /api prefix correctly via proxy_pass with trailing
slash. Routing everything through frontend/nginx avoids the double-routing
and the need for a StripPrefix middleware.
- Fix trigger/env path: Helm/ -> helm/ (was wrong case)
- Add image_yq_path and dockerfile to matrix so each container uses its
own values.yaml key and Dockerfile path
- Fix yq paths: .django.image.* -> .frontend.image/.backend.image for
repo, .containers.version for tag (single source of truth)
- Add file: param to docker/build-push-action (Dockerfiles are in
frontend/ and backend/, not repo root)
- values.yaml: add registry prefix to image fields so k8s pulls from
git.baumann.gr; quote containers.version; drop per-component tag
fields (containers.version is now the single tag source)
- Deployment templates: use .containers.version for image tag
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove the secrets: block from values.yaml so no plaintext credentials
live in the chart or git history. Update values-prod.yaml to replace the
--set secrets.* instructions with a pointer to the create-secrets.sh script.
