fix(myorg-assistant): git-sync self-heals clone + normalizes gitea host to git.rogi.casa

Root cause of the git-sync failure: the cron pod only ran git pull/push
against /data/myorg but never ensured the repo existed, and the GIT_REPO_URL
secret historically pointed at the wrong Gitea subdomain (gitea.rogi.casa),
which 526s through Cloudflare -> 'Not a git repository: /data/myorg'.

Fixes:
1. Add an idempotent git-clone initContainer (guarded by [ ! -d /data/myorg/.git ])
   so the cron job self-heals and actually clones on first run.
2. Normalize GIT_REPO_URL host to git.rogi.casa at runtime (sed), so the clone
   works even if the cluster secret still contains the stale gitea.rogi.casa host.
   The working subdomain is git.rogi.casa.

Evidence (Loki, last 24h+):
  {namespace="myorg-assistant",pod=~"myorg-git-sync.+"}
  -> Pull/Push: Error: Not a git repository: /data/myorg (every run)
  -> job swallowed error, exited 0, so looked successful

Risk: low. initContainer mirrors the Deployment's; host-normalization is
idempotent. No RBAC/CRD/ArgoCD/volume changes.

argocd/argocd-cm.yaml

@@ -7,6 +7,11 @@ metadata:
     app.kubernetes.io/name: argocd-cm
     app.kubernetes.io/part-of: argocd
 data:
+  # Serve HTTP (no redirect to HTTPS) so the TLS-terminating Traefik ingress works.
+  # Without this, argocd-server redirects HTTP->HTTPS, causing an infinite
+  # redirect loop behind the ingress (argocd.rogi.casa unreachable).
+  server.insecure: "true"
+
   # add an additional local user with apiKey and login capabilities
   #   apiKey - allows generating API keys
   #   login - allows to login using UI

homeassistant/homeassistant.yaml

@@ -58,9 +58,9 @@ spec:
         image: ghcr.io/home-assistant/home-assistant:stable
         resources:
           requests:
-            memory: "256Mi"
-          limits:
             memory: "512Mi"
+          limits:
+            memory: "1Gi"
         ports:
         - containerPort: 8123
         volumeMounts:

litellm/litellm.yaml

@@ -11,18 +11,30 @@ metadata:
 data:
   config.yaml: |
     model_list:
-      - model_name: gpt-5-mini
+      - model_name: gpt-5.6-luna
         litellm_params:
-          model: openai/gpt-5-mini-2025-08-07
+          model: openai/gpt-5.6-luna
           api_key: "os.environ/OPENAI_API_KEY"
-      - model_name: claude-4.5-haiku
+      - model_name: claude-haiku-4.5
         litellm_params:
           model: "anthropic/claude-haiku-4-5-20251001"
           api_key: "os.environ/ANTHROPIC_API_KEY"
+      - model_name: claude-sonnet-5
+        litellm_params:
+          model: "anthropic/claude-sonnet-5"
+          api_key: "os.environ/ANTHROPIC_API_KEY"
       - model_name: gemini-3-flash
         litellm_params:
           model: gemini/gemini-3-flash-preview
           api_key: "os.environ/GEMINI_API_KEY"
+      - model_name: tencent/hy3:free
+        litellm_params:
+          model: openrouter/tencent/hy3:free
+          api_key: "os.environ/OPENROUTER_API_KEY"
+      - model_name: z-ai/glm-5.2
+        litellm_params:
+          model: openrouter/z-ai/glm-5.2
+          api_key: "os.environ/OPENROUTER_API_KEY"
       - model_name: glm-4.7-flash
         litellm_params:
           model: ollama/glm-4.7-flash

myorg-assistant/cronjobs/deadline-checker.yaml

@@ -30,7 +30,8 @@ spec:
             imagePullPolicy: Always
             command:
             - python
-            - run_job.py
+            - -c
+            - "from src.scheduler.jobs import run_job; import sys; run_job(sys.argv[1])"
             - deadline-checker
             env:
             - name: MYORG_REPO_PATH
@@ -53,6 +54,16 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
+            - name: GIT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: GIT_TOKEN
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/evening-summary.yaml

@@ -30,7 +30,8 @@ spec:
             imagePullPolicy: Always
             command:
             - python
-            - run_job.py
+            - -c
+            - "from src.scheduler.jobs import run_job; import sys; run_job(sys.argv[1])"
             - evening-summary
             env:
             - name: MYORG_REPO_PATH
@@ -53,6 +54,16 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
+            - name: GIT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: GIT_TOKEN
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/git-sync.yaml

@@ -24,13 +24,55 @@ spec:
           restartPolicy: OnFailure
           imagePullSecrets:
           - name: gitea-registry
+          initContainers:
+          - name: git-clone
+            image: alpine/git:latest
+            command:
+            - sh
+            - -c
+            - |
+              # Normalize the repo URL host to the correct Gitea subdomain.
+              # The GIT_REPO_URL secret historically contained gitea.rogi.casa,
+              # which 526s through Cloudflare; the working subdomain is git.rogi.casa.
+              export GIT_REPO_URL="$(echo "${GIT_REPO_URL}" | sed -E 's#https?://[^/@]+@?gitea\.rogi\.casa#https://'"${GIT_USERNAME}"':'"${GIT_TOKEN}"'@git.rogi.casa#')"
+              if [ ! -d /data/myorg/.git ]; then
+                echo "Cloning repository from ${GIT_REPO_URL}..."
+                git clone ${GIT_REPO_URL} /data/myorg
+                cd /data/myorg
+                git config user.name "${GIT_USERNAME}"
+                git config user.email "${GIT_USERNAME}@rogi.casa"
+                git config credential.helper store
+                echo "https://${GIT_USERNAME}:${GIT_TOKEN}@git.rogi.casa" > ~/.git-credentials
+              else
+                echo "Repository already exists, skipping clone."
+              fi
+            env:
+            - name: GIT_REPO_URL
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: GIT_REPO_URL
+            - name: GIT_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: GIT_USERNAME
+            - name: GIT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: GIT_TOKEN
+            volumeMounts:
+            - name: myorg-data
+              mountPath: /data/myorg
           containers:
           - name: git-sync
             image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
             imagePullPolicy: Always
             command:
             - python
-            - run_job.py
+            - -c
+            - "from src.scheduler.jobs import run_job; import sys; run_job(sys.argv[1])"
             - git-sync
             env:
             - name: MYORG_REPO_PATH
@@ -68,6 +110,11 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/morning-briefing.yaml

@@ -30,7 +30,8 @@ spec:
             imagePullPolicy: Always
             command:
             - python
-            - run_job.py
+            - -c
+            - "from src.scheduler.jobs import run_job; import sys; run_job(sys.argv[1])"
             - morning-briefing
             env:
             # From ConfigMap
@@ -60,6 +61,16 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
+            - name: GIT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: GIT_TOKEN
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/waiting-followup.yaml

@@ -30,7 +30,8 @@ spec:
             imagePullPolicy: Always
             command:
             - python
-            - run_job.py
+            - -c
+            - "from src.scheduler.jobs import run_job; import sys; run_job(sys.argv[1])"
             - waiting-followup
             env:
             - name: MYORG_REPO_PATH
@@ -53,6 +54,16 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
+            - name: GIT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: GIT_TOKEN
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/deployment.yaml

@@ -34,7 +34,7 @@ spec:
               git config user.name "${GIT_USERNAME}"
               git config user.email "${GIT_USERNAME}@rogi.casa"
               git config credential.helper store
-              echo "https://${GIT_USERNAME}:${GIT_TOKEN}@gitea.rogi.casa" > ~/.git-credentials
+              echo "https://${GIT_USERNAME}:${GIT_TOKEN}@git.rogi.casa" > ~/.git-credentials
             else
               echo "Repository already exists, pulling latest changes..."
               cd /data/myorg

n8n/n8n-deployment.yaml

@@ -53,15 +53,17 @@ spec:
               value: http
             - name: N8N_PORT
               value: "5678"
+            - name: NODE_OPTIONS
+              value: "--max-old-space-size=768"
           image: n8nio/n8n
           name: n8n
           ports:
             - containerPort: 5678
           resources:
             requests:
-              memory: "250Mi"
+              memory: "512Mi"
             limits:
-              memory: "500Mi"
+              memory: "1Gi"
           volumeMounts:
             - mountPath: /home/node/.n8n
               name: n8n-claim0

platform-engineer/configmap.yaml

@@ -59,6 +59,16 @@ data:
     cron:
       wrap_response: false
 
+    discord:
+      allowed_channels: '1470909384162017444'        # DISCORD_HOME_CHANNEL
+      free_response_channels: '1470909384162017444'  # no @mention needed here
+      # Per-platform gateway auth. Paired with GATEWAY_ALLOW_ALL_USERS=true in
+      # the env (secret.yaml), this lets the bot reply to inbound DMs and
+      # group messages from anyone. Tighten later by switching to
+      # DISCORD_ALLOWED_USERS=<id> in the secret and dropping these two lines.
+      dm_policy: open
+      group_policy: open
+
     memory:
       memory_enabled: true
       user_profile_enabled: true

platform-engineer/deployment.yaml

@@ -86,6 +86,7 @@ spec:
             : > /opt/data/.env
             chmod 600 /opt/data/.env
             for k in OPENAI_API_KEY OPENAI_BASE_URL DISCORD_BOT_TOKEN DISCORD_HOME_CHANNEL \
+                     DISCORD_ALLOW_ALL_USERS DISCORD_FREE_RESPONSE_CHANNELS \
                      GITEA_TOKEN GITEA_REPO_URL ARGOCD_API_TOKEN ARGOCD_SERVER \
                      HERMES_DASHBOARD HERMES_DASHBOARD_BASIC_AUTH_USERNAME \
                      HERMES_DASHBOARD_BASIC_AUTH_PASSWORD HERMES_DASHBOARD_BASIC_AUTH_SECRET; do