work

ops/deployment/notify/helm-overlays.md

@@ -0,0 +1,28 @@
+# Notifier Helm Overlays (DEPLOY-NOTIFY-38-001)
+
+## Values file
+- `deploy/helm/stellaops/values-notify.yaml` (added) with:
+  - `notify:`
+    - `image.repository`: `registry.stella-ops.org/notify`
+    - `image.tag`: set by pipeline
+    - `smtp.host`, `smtp.port`, `smtp.usernameSecret`, `smtp.passwordSecret`
+    - `webhook.allowedHosts`: list
+    - `chat.webhookSecret`: secret name for chat tokens
+    - `tls.secretName`: optional ingress cert
+
+## Secrets
+- SMTP creds secret `notify-smtp` with keys `username`, `password` (see `ops/deployment/notify/secrets-example.yaml`).
+- Chat/webhook secret `notify-chat` with key `token` (see example manifest).
+
+## Rollout
+- `helm upgrade --install notify deploy/helm/stellaops -f deploy/helm/stellaops/values-notify.yaml --set image.tag=$TAG`
+- Pre-flight: `helm lint`, `helm template`.
+- Post: `kubectl rollout status deploy/notify` and `curl /healthz`.
+
+## Rollback
+- `helm rollback notify <rev>`; confirm previous image tag exists.
+
+## Acceptance
+- Overlay renders without missing values.
+- Secrets documented and referenced.
+- Rollout/rollback steps documented.

ops/deployment/notify/secrets-example.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: notify-smtp
+stringData:
+  username: REPLACE_ME
+  password: REPLACE_ME
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: notify-chat
+stringData:
+  token: REPLACE_ME