From 6cec18cdd9dabc0ef03fae1b56d46d41fcbf134c Mon Sep 17 00:00:00 2001
From: Hermes DevOps <hermes@devops.local>
Date: Mon, 25 May 2026 06:44:14 +0000
Subject: [PATCH 1/2] fix(dashboard): add ProxyGroup for trading dashboard
 tailnet exposure

The Tailscale operator v0.40+ requires a ProxyGroup CRD to actually
expose services via the operator - annotations on the Service alone
are insufficient. This adds the missing ProxyGroup resource.

Also fixes the tailnet kustomization.yaml which referenced proxygroup
files that did not exist in that directory (they live in controllers/
and are deployed separately).
---
 infrastructure/tailnet/kustomization.yaml              |  3 +--
 .../tailnet/proxygroup-trading-dashboard.yaml          | 10 ++++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)
 create mode 100644 infrastructure/tailnet/proxygroup-trading-dashboard.yaml

diff --git a/infrastructure/tailnet/kustomization.yaml b/infrastructure/tailnet/kustomization.yaml
index 18e5e80..c0dc562 100644
--- a/infrastructure/tailnet/kustomization.yaml
+++ b/infrastructure/tailnet/kustomization.yaml
@@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - proxygroup-rtx6000.yaml
-  - proxygroup-grafana.yaml
+  - proxygroup-trading-dashboard.yaml
diff --git a/infrastructure/tailnet/proxygroup-trading-dashboard.yaml b/infrastructure/tailnet/proxygroup-trading-dashboard.yaml
new file mode 100644
index 0000000..f30a8bb
--- /dev/null
+++ b/infrastructure/tailnet/proxygroup-trading-dashboard.yaml
@@ -0,0 +1,10 @@
+apiVersion: tailscale.com/v1alpha1
+kind: ProxyGroup
+metadata:
+  name: trading-dashboard
+  namespace: customer1
+spec:
+  type: ingress
+  hostnamePrefix: trade
+  tags:
+    - tag:k8s-operator

From 113324abc1ab5827b48f5936a8112b3cd4672428 Mon Sep 17 00:00:00 2001
From: Hermes DevOps <hermes@devops.local>
Date: Mon, 25 May 2026 07:05:45 +0000
Subject: [PATCH 2/2] fix(platform): add port 3000 to trading-platform
 NetworkPolicy ingress rules

Dashboard listens on port 3000 but NetworkPolicy only allowed 8000-8003.
This blocked all traffic including Tailscale proxy connections to trade:3000.
---
 .../network-policies/trading-network-policies.yaml            | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml b/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
index a553f07..d62cada 100644
--- a/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
+++ b/apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml
@@ -23,6 +23,8 @@ spec:
             matchLabels:
               kubernetes.io/metadata.name: customer1
       ports:
+        - port: 3000
+          protocol: TCP
         - port: 8000
           protocol: TCP
         - port: 8001
@@ -43,6 +45,8 @@ spec:
                   - trading-news-service
                   - trading-dashboard
       ports:
+        - port: 3000
+          protocol: TCP
         - port: 8000
           protocol: TCP
         - port: 8001