fix pathing

charts/app/values.yaml

@@ -0,0 +1,56 @@
+# ============================================================================
+# THE CONTRACT: this is the shape every lgkentang service fills in.
+# Most services only need to set: name, image.repository, image.tag,
+# and ingress.host. Everything else has a sensible default below.
+# ============================================================================
+
+# Resource name for the Deployment/Service/Ingress. Defaults to the ArgoCD
+# release name if left empty. Set it explicitly so names stay stable even if
+# the release is ever renamed.
+name: ""
+
+image:
+  repository: traefik/whoami
+  tag: latest
+  pullPolicy: IfNotPresent
+
+# How many pod replicas to run.
+replicas: 1
+
+# The port your container listens on inside the pod.
+containerPort: 80
+
+service:
+  # Cluster-internal Service port (what the Ingress routes to).
+  port: 80
+
+ingress:
+  # Set false for internal-only services that shouldn't be exposed/DNS'd.
+  enabled: true
+  className: traefik
+  # REQUIRED when enabled, e.g. myapp.dev.lgkentang.com. external-dns turns
+  # this into a DNS record and cert-manager into a cert (Phases 1-2).
+  host: ""
+  clusterIssuer: letsencrypt-prod
+  # tlsSecretName defaults to "<name>-tls" if left unset.
+  tlsSecretName: ""
+
+# Plain, non-secret environment variables as key: value pairs.
+# SECRET env vars are deliberately NOT here — those arrive in Phase 5 via the
+# External Secrets Operator, so we don't build a pattern now that fights it.
+env: {}
+  # LOG_LEVEL: info
+  # FEATURE_X_ENABLED: "true"
+
+# Name of a Kubernetes Secret whose keys are loaded as env vars (envFrom).
+# Empty = none. In Phase 5, the External Secrets Operator syncs a Secret from
+# Infisical/Vault and you point this at it — so app secrets never touch git.
+envFromSecret: ""
+
+# Resource requests/limits. Conservative defaults suited to the single node.
+resources:
+  requests:
+    cpu: 10m
+    memory: 32Mi
+  limits:
+    memory: 128Mi