fix: correct the Kubernetes and chart claims the audit found

The install command was the serious one: the cloud values files hardcode a
placeholder domain in six places, and the documented command overrode only
`NEXT_PUBLIC_APP_URL`. Following the page literally left sign-in pointed at the
placeholder, realtime rejecting every socket upgrade, and the Ingress serving
the wrong host — the exact failure the page warns about further down.

- The PII recipe's `INTERNAL_API_BASE_URL` self-call is blocked by the
  NetworkPolicy the same page recommends enabling: the app policy permits
  Postgres, Redis, realtime, Ollama, PII, telemetry, DNS, and 443, but has no
  app-to-app rule. Redaction would fail closed.
- The GPU device-plugin DaemonSet is not `restricted`-compliant — it sets only
  two of the four controls and mounts three `hostPath` volumes — so enforcing
  the label namespace-wide breaks a GPU install.
- Under External Secrets the chart writes nothing from `app.env`; an unmapped
  key fails the render. The page said the two modes behave alike.
- The CronJob pods have no NetworkPolicy either.
- `app.env.DATABASE_URL` is silently discarded: the chart computes it and
  inlines it on the container, so the PgBouncer advice pointed at a key that
  does nothing.
- The PDB also renders from `autoscaling.minReplicas`, the reference topology
  could not render without an `externalDatabase.password`, `copilot`'s
  security-context keys nest one level deeper, and `NO_PROXY` needs the app's
  own Service name.
- Untangled a garbled `externalSecrets.apiVersion` comment that contradicted
  its own default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015BwsJTEQRzWJaY4BRCkPZt

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/kubernetes.mdx

@@ -70,9 +70,16 @@ helm upgrade --install sim ./helm/sim \
   --set app.env.CRON_SECRET="$CRON_SECRET" \
   --set postgresql.auth.password="$POSTGRES_PASSWORD" \
   --set app.env.NEXT_PUBLIC_APP_URL="https://sim.yourdomain.com" \
+  --set app.env.BETTER_AUTH_URL="https://sim.yourdomain.com" \
+  --set app.env.NEXT_PUBLIC_SOCKET_URL="https://sim-ws.yourdomain.com" \
+  --set realtime.env.ALLOWED_ORIGINS="https://sim.yourdomain.com" \
+  --set ingress.app.host="sim.yourdomain.com" \
+  --set ingress.realtime.host="sim-ws.yourdomain.com" \
   --namespace simstudio --create-namespace
 ```
 
+Every one of those overrides is required. The cloud values files hardcode a placeholder domain in all six places, and overriding only `NEXT_PUBLIC_APP_URL` leaves sign-in pointed at the placeholder, realtime rejecting every socket upgrade, and the Ingress serving the wrong host.
+
 Swap the `--values` file for your cloud: `values-aws.yaml` (EKS), `values-azure.yaml` (AKS), or `values-gcp.yaml` (GKE). Everything else is identical.
 
 ## Key Configuration

apps/docs/content/docs/platform/self-hosting/networking.mdx

@@ -336,7 +336,7 @@ The practical consequence: a mandatory-egress-proxy environment can route most L
   # Helm — for a release named `acme`
   app:
     env:
-      NO_PROXY: "localhost,127.0.0.1,.svc,.svc.cluster.local,acme-sim-realtime,acme-sim-pii,acme-sim-ollama"
+      NO_PROXY: "localhost,127.0.0.1,.svc,.svc.cluster.local,acme-sim-app,acme-sim-realtime,acme-sim-pii,acme-sim-ollama"
   ```
 
   ```yaml

apps/docs/content/docs/platform/self-hosting/scaling.mdx

@@ -41,7 +41,7 @@ The `resources` block above is the chart's default — it is shown so the number
 
 **Memory is the constraint, not CPU.** Workflow executions run inside the app process in isolated-vm sandboxes, and file parsing happens in memory. Production telemetry shows 4–8 GB steady with peaks to 12 GB under heavy execution load. Under-provision memory and you get OOMKills that terminate in-flight workflow runs — so raise `limits.memory` above the 8 Gi default if your workload shows those peaks.
 
-A PodDisruptionBudget is created automatically once `replicaCount > 1` (`maxUnavailable: 25%`). Tighten it with `podDisruptionBudget.minAvailable` if you need to.
+A PodDisruptionBudget is created automatically once `replicaCount > 1`, or once `autoscaling.enabled` with `minReplicas > 1` — for the app and realtime independently (`maxUnavailable: 25%`). Tighten it with `podDisruptionBudget.minAvailable` if you need to.
 
 ### Autoscaling
 
@@ -78,7 +78,7 @@ Each app replica opens a pool. Total connections grow with replica count, and Po
 
 Budget it: `replicas × pool size + realtime + cronjobs + migrations + headroom` must stay under `max_connections`.
 
-For anything beyond a handful of replicas, put **PgBouncer** in transaction pooling mode in front of the database and point `DATABASE_URL` at it. This is the single highest-leverage change for a large deployment — it decouples app replica count from database connection count.
+For anything beyond a handful of replicas, put **PgBouncer** in transaction pooling mode in front of the database and point the chart at it with `externalDatabase.host` / `externalDatabase.port` and `postgresql.enabled: false`. Setting `app.env.DATABASE_URL` does nothing — the chart computes `DATABASE_URL` itself and inlines it on the container, where it overrides anything from the Secret. This is the single highest-leverage change for a large deployment — it decouples app replica count from database connection count.
 
 ### Read replicas
 
@@ -147,6 +147,9 @@ externalDatabase:
   port: 6432
   database: simstudio
   sslMode: require
+  # Required — supply it here, through externalDatabase.existingSecret, or
+  # through External Secrets, or the chart refuses to render.
+  password: "<password>"
 
 autoscaling:
   enabled: true

apps/docs/content/docs/platform/self-hosting/security.mdx

@@ -32,7 +32,7 @@ In increasing order of production-readiness:
 2. **A pre-created Kubernetes Secret** — set `app.secrets.existingSecret.enabled: true` and the secret name. Works with Sealed Secrets and SOPS. The secret is consumed wholesale and must use the standard key names.
 3. **External Secrets Operator** — sync from Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Recommended.
 
-In the default and External Secrets modes, the chart writes every key under `app.env` and `realtime.env` into a chart-managed Secret mounted via `envFrom`, so no value is inlined into a pod spec. (In `existingSecret` mode the pre-created Secret is the source of truth and any `app.env` values you still pass are rendered inline — supply everything through the Secret in that mode.) Either way, a secret committed to `values.yaml` is a secret in your git history.
+In the default mode the chart writes every key under `app.env` and `realtime.env` into a chart-managed Secret mounted via `envFrom`, so no value is inlined into a pod spec. Under External Secrets the chart renders no Secret of its own: a Secret of the same name is populated by the operator from `externalSecrets.remoteRefs.app`, and a non-empty `app.env` key that is not mapped there fails the render. (In `existingSecret` mode the pre-created Secret is the source of truth and any `app.env` values you still pass are rendered inline — supply everything through the Secret in that mode.) Either way, a secret committed to `values.yaml` is a secret in your git history.
 
 ## Network boundaries
 
@@ -108,17 +108,17 @@ So a workflow can never reach instance metadata, but the pod-level block is only
 
 ### The `copilot` deployment ships no NetworkPolicy
 
-The `copilot` and `copilot-postgresql` workloads deliberately have no policy of their own. The `copilot` service requires `REDIS_URL` on a non-443 port, and the chart cannot know your Redis host at render time — a default egress rule would block Redis on most installs. If you run `networkPolicy.enabled: true` with `copilot.enabled: true`, those two pods are unisolated until you write dedicated NetworkPolicies for them. The chart-level `networkPolicy.egress` list does not reach them — it is only rendered into the policies the chart creates, and it creates none for these workloads.
+The `copilot` and `copilot-postgresql` workloads deliberately have no policy of their own, and neither do the CronJob pods — nothing in the chart's policies selects them, so they are unisolated whenever `networkPolicy.enabled: true`. The `copilot` service requires `REDIS_URL` on a non-443 port, and the chart cannot know your Redis host at render time — a default egress rule would block Redis on most installs. If you run `networkPolicy.enabled: true` with `copilot.enabled: true`, those two pods are unisolated until you write dedicated NetworkPolicies for them. The chart-level `networkPolicy.egress` list does not reach them — it is only rendered into the policies the chart creates, and it creates none for these workloads.
 
 ### Pod Security Standards
 
-All workloads set `runAsNonRoot`, drop all Linux capabilities, disable privilege escalation, and use `seccompProfile: RuntimeDefault` — the four controls the `restricted` profile requires. Label the namespace to enforce it:
+All workloads set `runAsNonRoot`, drop all Linux capabilities, disable privilege escalation, and use `seccompProfile: RuntimeDefault` — the four controls the `restricted` profile requires — with one exception. The NVIDIA device-plugin DaemonSet the chart renders when `ollama.gpu.enabled: true` sets only `allowPrivilegeEscalation` and `capabilities.drop`, and mounts three `hostPath` volumes that `restricted` forbids outright. Enforce it at the namespace level only when GPU Ollama is off, or exempt that DaemonSet. Label the namespace to enforce it:
 
 ```bash
 kubectl label namespace simstudio pod-security.kubernetes.io/enforce=restricted
 ```
 
-`readOnlyRootFilesystem` is not set by default: Postgres and Ollama need a writable root, and the app container writes to Next.js's `.next/cache`. It is viable on the genuinely stateless services (`realtime`, `pii`, `copilot`) — set `<component>.securityContext.readOnlyRootFilesystem: true` and mount an `emptyDir` at `/tmp` via `extraVolumes` / `extraVolumeMounts`.
+`readOnlyRootFilesystem` is not set by default: Postgres and Ollama need a writable root, and the app container writes to Next.js's `.next/cache`. It is viable on the genuinely stateless services — set `realtime.securityContext`, `pii.securityContext`, or `copilot.server.securityContext` (the copilot keys nest one level deeper) to `readOnlyRootFilesystem: true`, and mount an `emptyDir` at `/tmp` via the matching `extraVolumes` / `extraVolumeMounts`.
 
 ## Where user code runs
 
@@ -252,6 +252,22 @@ app:
 
 `INTERNAL_API_BASE_URL` must be the **in-cluster** Service URL. The redaction path calls the app's own API, and a public ingress URL is usually not hairpin-reachable from inside the cluster. Without a reachable value the path fails closed — affected fields are scrubbed to `[REDACTION_FAILED]` rather than leaking, but redaction does not actually run.
 
+With `networkPolicy.enabled: true` that self-call is blocked: the chart's app policy permits Postgres, Redis, realtime, Ollama, PII, telemetry, DNS, and TCP 443, but has no app-to-app rule. Add one, or set `networkPolicy.allowExternalEgress: true`:
+
+```yaml
+networkPolicy:
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: sim
+              app.kubernetes.io/instance: <release>
+              app.kubernetes.io/component: app
+      ports:
+        - protocol: TCP
+          port: 3000
+```
+
 The service bundles ~2.2 GB of spaCy models, so first start takes around three minutes and it needs at least 4 GB of memory.
 
 ## The shipped Compose file publishes Postgres

helm/sim/values.yaml

@@ -1892,10 +1892,9 @@ externalSecrets:
   # Enable External Secrets Operator integration
   enabled: false
 
-  # ESO API version. Default "v1beta1" — supported by every ESO release from
-  # Current ESO releases serve only external-secrets.io/v1 (the v1beta1
-  # compatibility path was removed in 2026). Set to "v1beta1" only for
-  # clusters still running ESO < 0.17.
+  # ESO API version. Current ESO releases serve only external-secrets.io/v1
+  # (the v1beta1 compatibility path was removed in 2026). Set this to
+  # "v1beta1" only for clusters still running ESO < 0.17.
   apiVersion: "v1"
 
   # How often to sync secrets from the external store