feat: deploy to Frostmoln production

The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se
context on the runners). Deploys now go to the Frostmoln production
cluster (namespace schemas), the way the sites do.

Frostmoln enforces restricted Pod Security: the pod runs as the image's
non-root user with a matching securityContext. The prod-only manifests
move to the prod-frostmoln target; the ALB ingress becomes a Traefik one
with a Let's Encrypt certificate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

.gitea/workflows/ci.yaml

@@ -83,16 +83,30 @@ jobs:
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod:
+  deploy-prod-frostmoln:
     needs: build
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
+      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
       - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Deploy to production
-        run: deploy prod
+      - name: Install fm
+        run: |
+          sudo install -d -m 0755 /etc/apt/keyrings
+          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
+          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
+          sudo apt-get update && sudo apt-get install -y fm
+      - name: Deploy to Frostmoln production
+        env:
+          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
+        # The cluster API is private: the kubeconfig's exec plugin opens an fm
+        # tunnel on demand. fm reads the key from its config file, not the env.
+        run: |
+          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
+          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
+          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n schemas

.gitea/workflows/pre-commit.yaml

@@ -19,7 +19,7 @@ jobs:
           go-version: 'stable'
       - uses: actions/setup-python@v7
         with:
-          python-version: '3.14'
+          python-version: '3.15'
       - name: Install goimports
         run: go install golang.org/x/tools/cmd/goimports@latest
       - uses: pre-commit/action@v3.0.1

.version

@@ -1,3 +1,3 @@
 {
-  "version": "v0.9.7"
+  "version": "v0.9.8"
 }

CHANGELOG.md

@@ -2,7 +2,164 @@
 
 All notable changes to this project will be documented in this file.
 
-## [0.9.7] - 2026-05-11
+## [0.9.8] - 2026-10-13
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.2.0 (#835)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.3.0 (#836)
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v3 to v3.2.0 (#837)
+- *(k8s)* Point OTEL endpoint to k8s-monitoring-alloy service (#839)
+- Raise Node heap cap to 512MB and bump pod memory limit (#838)
+- *(k8s)* Raise schemas CPU request from 20m to 100m (#840)
+- *(k8s)* Add scaleUp/scaleDown stabilization to schemas HPA (#844)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.3.1 (#845)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.0 (#846)
+- *(deps)* Update module golang.org/x/crypto to v0.52.0 (#848)
+- *(deps)* Update eventsourced (#849)
+- *(deps)* Update module gitlab.com/unboundsoftware/eventsourced/pg to v1.20.0 (#850)
+- Bump eventsourced/pg to v2.0.2 and harden startup error logging (#851)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.1 (#852)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.19.0 (#854)
+- *(deps)* Update opentelemetry-go monorepo (#853)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.2 (#856)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.3 (#857)
+- *(deps)* Update module golang.org/x/sync to v0.21.0 (#858)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.34 (#860)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.4 (#862)
+- *(deps)* Update module golang.org/x/crypto to v0.53.0 (#863)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.5 (#865)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.91 (#864)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.4.6 (#866)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.5.0 (#869)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.35 (#871)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.92 (#873)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.93 (#876)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.36 (#877)
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.27.2 (#878)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.5.1 (#879)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.6.0 (#880)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.7.0 (#881)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.8.0 (#882)
+- *(deps)* Update module golang.org/x/sync to v0.22.0 (#883)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.9.0 (#884)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.9.1 (#885)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.9.2 (#886)
+- *(deps)* Update module golang.org/x/crypto to v0.54.0 (#888)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.10.0 (#890)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.94 (#889)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.11.0 (#892)
+- *(deps)* Update module github.com/alecthomas/kong to v1.16.0 (#894)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.12.0 (#895)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.12.1 (#896)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.13.0 (#899)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.13.1 (#900)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.13.2 (#901)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.14.0 (#903)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.14.1 (#904)
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.27.3 (#905)
+- *(deps)* Update module github.com/auth0/go-jwt-middleware/v3 to v3.3.0 (#907)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.14.2 (#908)
+- *(deps)* Update opentelemetry-go monorepo (#909)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.20.0 (#911)
+- *(deps)* Update module github.com/alecthomas/kong to v1.16.1 (#914)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.15.0 (#915)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.15.1 (#917)
+- *(deps)* Update module golang.org/x/crypto to v0.55.0 (#918)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.16.0 (#919)
+- *(deps)* Update module github.com/stretchr/testify to v1.12.0 (#920)
+- *(deps)* Update module github.com/stretchr/testify to v1.12.1 (#923)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.17.0 (#925)
+- *(deps)* Update opentelemetry-go monorepo (#929)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.20.1 (#930)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.18.0 (#932)
+- *(deps)* Update module golang.org/x/crypto to v0.56.0 [security] (#934)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.37 (#935)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.19.0 (#936)
+- *(deps)* Update module github.com/pressly/goose/v3 to v3.28.0 (#938)
+- *(deps)* Update module github.com/99designs/gqlgen to v0.17.95 (#937)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.20.0 (#939)
+- *(deps)* Update module golang.org/x/sync to v0.23.0 (#940)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.20.2 (#943)
+- *(deps)* Update module golang.org/x/crypto to v0.57.0 (#945)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.20.3 (#947)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.21.0 (#957)
+- *(deps)* Update module codeberg.org/messaging/go-messaging-amqp to v0.0.6 (#959)
+- *(deps)* Update module codeberg.org/eventsourced/pg/v2 to v2.2.0 (#961)
+- *(deps)* Update module codeberg.org/eventsourced/pg/v2 to v2.2.1 (#963)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.21.1 (#964)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.22.0 (#970)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.22.1 (#972)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.23.0 (#974)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.58 (#976)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.24.0 (#977)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.25.0 (#982)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.26.0 (#984)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.59 (#988)
+- *(deps)* Update module codeberg.org/eventsourced/pg/v2 to v2.3.0 (#991)
+- *(deps)* Update opentelemetry-go monorepo (#990)
+- *(monitoring)* Use otel.SetLoggerProvider (#998)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.60 (#995)
+- *(deps)* Update module go.opentelemetry.io/contrib/bridges/otelslog to v0.21.0 (#993)
+- Release to the Gitea API on its public URL (#997)
+- *(deps)* Update module golang.org/x/crypto to v0.58.0 (#1010)
+- *(deps)* Update module github.com/vektah/gqlparser/v2 to v2.5.61 (#1007)
+- *(deps)* Update module github.com/wundergraph/graphql-go-tools/v2 to v2.27.0 (#1008)
+
+### 🚜 Refactor
+
+- Migrate eventsourced to codeberg and go-messaging-amqp (#949)
+
+### ⚡ Performance
+
+- *(graph)* Cache merged SDL and SchemaUpdate per ref (#841)
+- *(graph)* Warm schema cache on startup to kill cold-start spikes (#843)
+
+### ⚙️ Miscellaneous Tasks
+
+- *(deps)* Update golang:1.26.3 docker digest to 54d3246 (#842)
+- *(deps)* Update node.js to v24.16.0 (#847)
+- *(deps)* Update golang docker tag to v1.26.4 (#855)
+- *(deps)* Update node.js to fb71d01 (#859)
+- *(deps)* Update golang:1.26.4 docker digest to 62df9f3 (#861)
+- *(deps)* Update node.js to 21f403a (#867)
+- *(deps)* Update actions/checkout action to v7 (#868)
+- *(deps)* Update node.js to v24.17.0 (#870)
+- *(deps)* Update golang:1.26.4 docker digest to f83d235 (#872)
+- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.26.0 (#874)
+- *(deps)* Update node.js to v24.18.0 (#875)
+- *(deps)* Update golang docker tag to v1.26.5 (#887)
+- *(deps)* Update golang:1.26.5 docker digest to adde241 (#891)
+- *(deps)* Update actions/setup-go action to v7 (#897)
+- *(deps)* Update actions/setup-node action to v7 (#893)
+- *(deps)* Update actions/setup-python action to v7 (#902)
+- *(deps)* Update node.js to v24.18.1 (#906)
+- *(deps)* Update node.js to v24.19.0 (#910)
+- *(deps)* Update golang:1.26.5 docker digest to 046e320 (#912)
+- *(deps)* Update golang:1.26.5 docker digest to e8ab809 (#913)
+- *(deps)* Update golang docker tag to v1.26.6 (#916)
+- *(deps)* Update golang docker tag to v1.26.7 (#921)
+- *(deps)* Update golang docker tag to v1.27.0 (#922)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.13.1 (#924)
+- *(deps)* Update golang:1.27.0 docker digest to 47526c1 (#926)
+- *(deps)* Update node.js to v24.20.0 (#927)
+- *(deps)* Update node.js to e67514e (#928)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.13.2 (#931)
+- *(deps)* Update golang docker tag to v1.27.1 (#933)
+- *(deps)* Update node.js to v24.21.0 (#941)
+- *(deps)* Update node.js to 4b2d7ee (#951)
+- *(deps)* Update node.js to ebfe2f9 (#953)
+- *(deps)* Update golang:1.27.1 docker digest to 2c9f73f (#955)
+- *(deps)* Update dependency goreleaser/goreleaser to v2.18.2 (#965)
+- *(deps)* Update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.27.0 (#968)
+- *(deps)* Update pre-commit hook golangci/golangci-lint to v2.14.0 (#980)
+- *(k8s)* Take the image reference from build-tools (#986)
+- *(deps)* Update golang:1.27.1 docker digest to 45639bc (#996)
+- *(deps)* Update golang docker tag to v1.27.2 (#1004)
+- *(deps)* Update dependency goreleaser/goreleaser to v2.18.3 (#1009)
+- *(deps)* Update dependency python to 3.15 (#1015)
+
+## [0.9.7] - 2026-05-14
 
 ### 🐛 Bug Fixes
 

Dockerfile

@@ -42,4 +42,8 @@ COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 # Copy the service binary
 COPY --from=build /release/service /
 
+# The image's own non-root user: Frostmoln enforces restricted Pod Security.
+# The service only writes under /tmp (cosmo composition).
+USER node
+
 CMD ["/service"]

go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/auth0/go-jwt-middleware/v3 v3.3.0
 	github.com/google/uuid v1.6.0
 	github.com/jmoiron/sqlx v1.4.0
-	github.com/pressly/goose/v3 v3.28.0
+	github.com/pressly/goose/v3 v3.29.0
 	github.com/rs/cors v1.11.1
 	github.com/stretchr/testify v1.12.1
 	github.com/vektah/gqlparser/v2 v2.5.62
@@ -67,7 +67,7 @@ require (
 	github.com/prometheus/procfs v0.22.0 // indirect
 	github.com/rabbitmq/amqp091-go v1.15.0 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
-	github.com/sethvargo/go-retry v0.4.0 // indirect
+	github.com/sethvargo/go-retry v0.5.0 // indirect
 	github.com/sosodev/duration v1.4.0 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
@@ -87,12 +87,12 @@ require (
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/mod v0.41.0 // indirect
-	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
 	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/tools v0.51.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
-	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect
+	google.golang.org/grpc v1.84.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 )

go.sum

@@ -56,8 +56,8 @@ github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvw
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
 github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7cNTs5R6Hk4V2lcmLz2NsG2VnInyNo=
 github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
+github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
@@ -67,8 +67,8 @@ github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ4
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
-github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
+github.com/go-sql-driver/mysql v1.10.1 h1:arlSnNLq6a5yxGxV7qg9lF4j0C+KwD6NbQyKr9QL6ME=
+github.com/go-sql-driver/mysql v1.10.1/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
@@ -98,8 +98,8 @@ github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
 github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
 github.com/jpillora/backoff v0.0.0-20180909062703-3050d21c67d7/go.mod h1:2iMrUgbbvHEiQClaW2NsSzMyGHqN+rDFqY705q49KG0=
 github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
-github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
-github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
+github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -143,8 +143,8 @@ github.com/nats-io/nkeys v0.4.15 h1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=
 github.com/nats-io/nkeys v0.4.15/go.mod h1:CpMchTXC9fxA5zrMo4KpySxNjiDVvr8ANOSZdiNfUrs=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
-github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
-github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/ncruces/go-strftime v1.1.0 h1:vtPmPWMkb539RGV9WpWT9EwJGvrOCKvMNI4obWL47Hk=
+github.com/ncruces/go-strftime v1.1.0/go.mod h1:yVaq7iwCN09vHRrKBrrflXT0M9tTMG2KmZ9Fj7xeG/g=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -153,8 +153,8 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pressly/goose/v3 v3.28.0 h1:D2M+iL31GmpZxSHOhX8mqyqAT3CXnokUmm0eKoSP+Vc=
-github.com/pressly/goose/v3 v3.28.0/go.mod h1:v26MOuB8bL3kzzrt3Vqhb3R0PRVsl8hFQKdrht/L6Rk=
+github.com/pressly/goose/v3 v3.29.0 h1:dtEnBCT7CqkHIUCdgrXsrmeisaN8gFkRU4Y5OEwif4o=
+github.com/pressly/goose/v3 v3.29.0/go.mod h1:plA4aP4+u+Q3FMTgbFbhF8TuAWpAdfWpoFGkJsIFWh0=
 github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
@@ -181,8 +181,8 @@ github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
-github.com/sethvargo/go-retry v0.4.0 h1:9qy1OoIAxBL+gBYnkTnTnWle5wlfsXQlwRzIbbpdqPw=
-github.com/sethvargo/go-retry v0.4.0/go.mod h1:tvsjdKG6xfiCx4LSiUZ06kcv38xvdVQwv8R6/VnnVWg=
+github.com/sethvargo/go-retry v0.5.0 h1:JYfFKmVJ8ER06GReN1efzc5cm52BrVsFVzmcHiKJwfY=
+github.com/sethvargo/go-retry v0.5.0/go.mod h1:tvsjdKG6xfiCx4LSiUZ06kcv38xvdVQwv8R6/VnnVWg=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
 github.com/smartystreets/gunit v1.0.0/go.mod h1:qwPWnhz6pn0NnRBP++URONOVyNkPyr4SauJk4cUOwJs=
@@ -274,8 +274,8 @@ golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
 golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
@@ -294,12 +294,12 @@ golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
 golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE=
-google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
-google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
-google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
+google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8 h1:cFbkNigDInw+wVTXc+CyhUsoHGJCw0BR6mlNoRVfre0=
+google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8/go.mod h1:QK6p7IgD7IZEZJBhhSUCib5X2vMOzlrGCGUw2XyVDh0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 h1:0SXBqli5dnuCKMjI/X3FM226zEaEa0GUcSCJtN1vL2o=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -314,11 +314,11 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/libc v1.75.6 h1:yKk8qo+Di4gkmvRboK8ocCqH22FiUCR6jRy2OwtCRus=
-modernc.org/libc v1.75.6/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
+modernc.org/libc v1.78.0 h1:Lpm+e9K6ruVYEGwWfuBO1xXtYEaXDouFOG1SuWjFDP4=
+modernc.org/libc v1.78.0/go.mod h1:wvxR55nOF2/66NkJoNV7/coXBTCvT3HR22rcqW6lOuA=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
 modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/sqlite v1.57.0 h1:qNQP6xnx5M0ISNtlnxoOX0+cD5bJ0/gr9aMmndFczzg=
-modernc.org/sqlite v1.57.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
+modernc.org/sqlite v1.60.1 h1:/blz53O951KWFOso4QQvEs/Fq6cDBKLtMVrYNSeJVKw=
+modernc.org/sqlite v1.60.1/go.mod h1:1dIoEagfDE72QytD5scH1lxARtaUgKgHC/NuApA27r0=

k8s/deploy.yaml

@@ -26,6 +26,11 @@ spec:
       labels:
         app.kubernetes.io/name: schemas
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -40,6 +45,10 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: schemas
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         resources:
           requests:
             cpu: "100m"

k8s/ingress-prod-frostmoln.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: schemas
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: "schemas.unbound.se"
+    http:
+      paths:
+      - path: /query
+        pathType: Prefix
+        backend:
+          service:
+            name: schemas
+            port:
+              name: api

k8s/ingress-prod.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: schemas-ingress
-  annotations:
-    alb.ingress.kubernetes.io/group.name: "default"
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: "443"
-    alb.ingress.kubernetes.io/healthcheck-path: '/health'
-spec:
-  ingressClassName: "alb"
-  rules:
-  - host: "schemas.unbound.se"
-    http:
-      paths:
-      - path: /query
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: schemas
-            port:
-              name: api

k8s/secrets-prod-frostmoln.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: schemas
+spec:
+  refreshInterval: 1h
+  # The namespace's store (infra frostmoln/production/schemas.tf); the
+  # Frostmoln Secret holds POSTGRES_URL, AMQP_URL and API_KEY
+  # (infra frostmoln/production/scripts/seed-schemas.sh).
+  secretStoreRef:
+    name: frostmoln
+    kind: SecretStore
+  target:
+    name: schemas
+  dataFrom:
+  - extract:
+      key: schemas

k8s/secrets.yaml

@@ -1,24 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: schemas
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: external-secrets
-    kind: ClusterSecretStore
-  target:
-    creationPolicy: Owner
-    template:
-      mergePolicy: Merge
-      engineVersion: 'v2'
-      data:
-        POSTGRES_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_HOST }}:{{ .DB_PORT }}/schemas?sslmode=disable"
-        API_KEY: "{{ .API_KEY }}"
-  dataFrom:
-  - extract:
-      key: services/schemas
-  - extract:
-      key: rds/postgres/prod-psql
-  - extract:
-      key: mq/rabbit/prod