Sync the self-hosting stack

kubernetes/09-browser.yaml

@@ -8,10 +8,11 @@
 # loud. PowerShell is in the api image and this is not, and the difference is exactly that: the
 # Exchange module talks to Microsoft, and a browser talks to whoever the model was told to look at.
 #
-# THE NETWORK POLICY BELOW IS THE REAL CONTROL. `browser.client.ts` refuses private addresses before
-# it asks, which is the half that can EXPLAIN itself to the model — but it cannot survive a redirect
-# and it cannot survive DNS rebinding, because by then the browser is already connecting. The policy
-# can, because it is enforced on the packet.
+# THE NETWORK POLICY BELOW IS THE REAL CONTROL. The api's `BrowserClient`
+# (src/Jarvis.Api/Connectors/BrowserClient.cs) refuses private addresses before it asks, which is
+# the half that can EXPLAIN itself to the model — but it cannot survive a redirect and it cannot
+# survive DNS rebinding, because by then the browser is already connecting. The policy can, because
+# it is enforced on the packet.
 #
 # DELETE THIS FILE (and its line in kustomization.yaml, and BROWSER_URL from 02-config.yaml) if you
 # would rather Jarvis had no web access. Nothing else stops working: the two web tools report
@@ -121,8 +122,8 @@ spec:
 #
 # NOTE THIS NEEDS A CNI THAT ENFORCES NetworkPolicy. Calico, Cilium and most managed clusters do;
 # plain kube-proxy with flannel does NOT, and on such a cluster this file is documentation rather
-# than a control. Check before relying on it — `browser.client.ts` still refuses private addresses
-# on the near side either way, but that half cannot survive a redirect.
+# than a control. Check before relying on it — the api's `BrowserClient` still refuses private
+# addresses on the near side either way, but that half cannot survive a redirect.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata: