Without DATABASE_URL, the editor uses a small fallback catalog. Production reads Buzz Sheet's existing catalog schema and images through S3_PUBLIC_URL. Team drafts stay in browser localStorage; the application never writes to PostgreSQL.

bun run test
bun run typecheck
bun run lint

Production

The gcsim-secrets Kubernetes secret only needs DATABASE_URL. Use a dedicated PostgreSQL role with read-only access to the Buzz Sheet catalog schema.

Create the local secret file and replace its database URL:

cp .env.example .env.production

Review the file, select the intended cluster context, and apply it without committing the generated Secret:

kubectl config current-context
kubectl apply -f k8s/namespace.yaml
kubectl --namespace gcsim create secret generic gcsim-secrets \
  --from-env-file=.env.production \
  --dry-run=client \
  -o yaml | kubectl apply -f -

Confirm only the key names, without printing their values:

kubectl --namespace gcsim get secret gcsim-secrets \
  -o go-template='{{range $key, $_ := .data}}{{printf "%s\\n" $key}}{{end}}'

After rotating the database credential, restart the application so the Deployment receives it:

kubectl --namespace gcsim rollout restart deployment/gcsim
kubectl --namespace gcsim rollout status deployment/gcsim --timeout=10m

Gitea Actions verifies every push and pull request, then builds and deploys main when DEPLOY_ENABLED=true and the repository-level KUBE_CONFIG_B64 Actions secret is configured. KUBE_CONFIG_B64 is a Gitea Actions secret, not part of gcsim-secrets.

The ingress hostname is gcsim.gunshiz.top. Buzz Sheet remains responsible for syncing Lunaris data and storing catalog images in Bun S3; this app only reads that shared catalog and public image base.