Sync the self-hosting stack

kubernetes/06-ingress.yaml

@@ -15,13 +15,16 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  # Last, so that the first traffic admitted from outside meets Services with endpoints behind
-  # them. An Ingress applied early is a route to a 503.
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
   name: jarvis
   namespace: jarvis
+  # ONE annotations map. This file used to carry two `annotations:` keys under metadata — the
+  # sync-wave above the name, the proxy settings below it — and tools disagree about a duplicated
+  # key: kustomize merged the two, while `kubectl apply -f` kept only the second and dropped the
+  # sync-wave without a warning. What a cluster received depended on which tool rendered the file.
   annotations:
+    # Last, so that the first traffic admitted from outside meets Services with endpoints behind
+    # them. An Ingress applied early is a route to a 503.
+    argocd.argoproj.io/sync-wave: "2"
     # An agent is idle between operations and the server pings every 30s, so this only has to
     # outlast a quiet period comfortably. Too short and a healthy fleet reconnects all day.
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
@@ -29,6 +32,10 @@ metadata:
     # Matches BODY_LIMIT in apps/api/src/main.ts. A document may hold 400,000 characters, which is
     # over a megabyte once accented text is UTF-8 encoded, and a diagram export posts back the SVG
     # the browser rendered. Below this they are rejected as a bare 413 with no message.
+    #
+    # File uploads need more and are NOT raised here: they post under /api/uploads/, which has its
+    # own Ingress in 06b-ingress-uploads.yaml, because ingress-nginx applies these annotations to
+    # every path of the object that carries them — 13376k here would be 13376k on every API route.
     nginx.ingress.kubernetes.io/proxy-body-size: "4m"
     #
     # NO affinity annotation, and none should be added. The reflex is understandable — there are