chore(deps): update helm chart external-secrets to v2

apps/templates/external-secrets-helm.yaml

@@ -15,7 +15,7 @@ spec:
   sources:
     - chart: external-secrets
       repoURL: https://charts.external-secrets.io
-      targetRevision: 2.10.0
+      targetRevision: 2.9.0
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets

bolletjestrui/bolletjestrui-deployment.yaml

@@ -17,7 +17,7 @@ spec:
         app: bolletjestrui
     spec:
       containers:
-        - image: ghcr.io/rubenhensen/bolletjestrui:main-10268f1
+        - image: ghcr.io/rubenhensen/bolletjestrui:main-8f17b5d
           name: bolletjestrui
           ports:
             - containerPort: 3000
@@ -51,24 +51,6 @@ spec:
                 secretKeyRef:
                   name: bolletjestrui-secrets
                   key: key_secret
-            # Push notifications. optional:true is load-bearing: without it a missing
-            # key leaves the pod in CreateContainerConfigError and the site is down,
-            # which would make deploying this depend on the Vault entries landing
-            # first. The app already treats absent VAPID keys as "send nothing".
-            - name: VAPID_PUBLIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: vapid_public_key
-                  optional: true
-            - name: VAPID_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: vapid_private_key
-                  optional: true
-            - name: VAPID_SUBJECT
-              value: mailto:ruben.hensen@protonmail.com
           resources:
             requests:
               memory: "128Mi"

bolletjestrui/external-secret.yaml

@@ -23,14 +23,3 @@ spec:
       remoteRef:
         key: kv/bolletjestrui
         property: key_secret
-    # web-push keypair for the "de route is gekozen" notification.
-    # Generate once with `npx web-push generate-vapid-keys` and never rotate it:
-    # a new key invalidates every subscription on everyone's phone.
-    - secretKey: vapid_public_key
-      remoteRef:
-        key: kv/bolletjestrui
-        property: vapid_public_key
-    - secretKey: vapid_private_key
-      remoteRef:
-        key: kv/bolletjestrui
-        property: vapid_private_key

bolletjestrui/ingress.yaml

@@ -6,8 +6,7 @@ metadata:
     cert-manager.io/cluster-issuer: prod-cluster-issuer
     nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
     nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-    # matches the app's BODY_SIZE_LIMIT: a bulk route import posts every GPX at once
-    nginx.ingress.kubernetes.io/proxy-body-size: "25m"
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
 spec:
   ingressClassName: nginx
   rules: