Conventions batch 2: flexible ingress standard, configurable probes

Establish the flexible ingress standard from #32 in template-chart and
document it in README/CLAUDE.md: ingress.domain and ingress.clusterIssuer
stay required, new ingress.className value (default nginx) replaces the
hardcoded ingressClassName, new optional ingress.annotations are merged
with the cert-manager cluster-issuer annotation, TLS secret name
unchanged (tls-<release>-<chart>-ingress).

Apply the standard to cyberchef and patchmon (the two charts without an
own batch-3 major PR) and make the patchmon probes values-configurable
(server + guacd, rendered through tpl so the default Host header keeps
following ingress.domain). Defaults render semantically identical to the
previous hardcoded output.

cyberchef 5.0.1 -> 5.1.0, patchmon 5.0.1 -> 5.1.0 (minor, additive).

patchmon/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/PatchMon/PatchMon/main/frontend/public/a
 
 type: application
 
-version: 5.0.1+up2.1.3
+version: 5.1.0+up2.1.3
 appVersion: "2.1.3"
 
 maintainers:

patchmon/templates/patchmon.deployment.yaml

@@ -143,44 +143,14 @@ spec:
             - name: GUACD_ADDRESS
               value: "127.0.0.1:4822"
             {{- end }}
-          # The server exposes GET /health returning {"status": "ok"}. The
-          # 2.x server rejects requests whose Host header is neither loopback
-          # nor a CORS_ORIGIN host with 403 — kubelet probes target the pod
-          # IP, so they must send the public hostname as Host header.
+          # Probe values are rendered through tpl (see values.yaml for the
+          # defaults and why the probes send a Host header).
           livenessProbe:
-            httpGet:
-              path: /health
-              port: 3000
-              httpHeaders:
-                - name: Host
-                  value: {{ .Values.ingress.domain }}
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
+            {{- tpl (toYaml .Values.patchmon.server.livenessProbe) . | nindent 12 }}
           readinessProbe:
-            httpGet:
-              path: /health
-              port: 3000
-              httpHeaders:
-                - name: Host
-                  value: {{ .Values.ingress.domain }}
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          # The startup probe gates liveness/readiness. The server waits for
-          # the database and runs migrations on startup; upstream warns that
-          # the first 2.x boot rebuilds database indexes, which can take
-          # minutes on slow storage: budget 10s * 60 = 600s.
+            {{- tpl (toYaml .Values.patchmon.server.readinessProbe) . | nindent 12 }}
           startupProbe:
-            httpGet:
-              path: /health
-              port: 3000
-              httpHeaders:
-                - name: Host
-                  value: {{ .Values.ingress.domain }}
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 60
+            {{- tpl (toYaml .Values.patchmon.server.startupProbe) . | nindent 12 }}
           resources:
             {{- include "patchmon.resources" .Values.patchmon.server.resources | nindent 12 }}
           volumeMounts:
@@ -199,23 +169,11 @@ spec:
               protocol: TCP
               name: guacd
           livenessProbe:
-            tcpSocket:
-              port: 4822
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
+            {{- tpl (toYaml .Values.patchmon.guacd.livenessProbe) . | nindent 12 }}
           readinessProbe:
-            tcpSocket:
-              port: 4822
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
+            {{- tpl (toYaml .Values.patchmon.guacd.readinessProbe) . | nindent 12 }}
           startupProbe:
-            tcpSocket:
-              port: 4822
-            periodSeconds: 5
-            timeoutSeconds: 5
-            failureThreshold: 30
+            {{- tpl (toYaml .Values.patchmon.guacd.startupProbe) . | nindent 12 }}
           resources:
             {{- include "patchmon.resources" .Values.patchmon.guacd.resources | nindent 12 }}
           volumeMounts:

patchmon/templates/patchmon.ingress.yaml

@@ -3,9 +3,12 @@ kind: Ingress
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
   annotations:
-    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
     - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       http:

patchmon/values.yaml

@@ -38,6 +38,45 @@ patchmon:
         cpu: 0.1
         memory: 256Mi
         ephemeral-storage: 10Mi
+    # Probes hit GET /health ({"status": "ok"}). The 2.x server rejects
+    # requests whose Host header is neither loopback nor a CORS_ORIGIN host
+    # with 403 — kubelet probes target the pod IP, so they must send the
+    # public hostname as Host header. Probe values are rendered through tpl,
+    # so the default Host header follows ingress.domain.
+    livenessProbe:
+      httpGet:
+        path: /health
+        port: 3000
+        httpHeaders:
+          - name: Host
+            value: "{{ .Values.ingress.domain }}"
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+    readinessProbe:
+      httpGet:
+        path: /health
+        port: 3000
+        httpHeaders:
+          - name: Host
+            value: "{{ .Values.ingress.domain }}"
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+    # The startup probe gates liveness/readiness. The server waits for the
+    # database and runs migrations on startup; upstream warns that the first
+    # 2.x boot rebuilds database indexes, which can take minutes on slow
+    # storage: budget 10s * 60 = 600s.
+    startupProbe:
+      httpGet:
+        path: /health
+        port: 3000
+        httpHeaders:
+          - name: Host
+            value: "{{ .Values.ingress.domain }}"
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 60
   guacd:
     # In-browser RDP for Windows hosts (beta) via the Apache Guacamole daemon,
     # run as a sidecar container in the server pod. Disabled by default; when
@@ -67,10 +106,34 @@ patchmon:
         cpu: 0.05
         memory: 64Mi
         ephemeral-storage: 10Mi
+    # Probe values are rendered through tpl.
+    livenessProbe:
+      tcpSocket:
+        port: 4822
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+    readinessProbe:
+      tcpSocket:
+        port: 4822
+      periodSeconds: 10
+      timeoutSeconds: 5
+      failureThreshold: 3
+    # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+    startupProbe:
+      tcpSocket:
+        port: 4822
+      periodSeconds: 5
+      timeoutSeconds: 5
+      failureThreshold: 30
 
 ingress:
   clusterIssuer: null
   domain: null
+  className: nginx
+  # Extra annotations for the Ingress; merged with the cert-manager
+  # cluster-issuer annotation the chart always sets.
+  annotations: {}
 
 secrets:
   redisSecretRef: null