Sub2API

Git owner: argocd/ops-docs, source https://github.com/AaronYang0628/docs.git, path manifests
ArgoCD Application: argocd/sub2api
Namespace: application
OCI chart: ghcr.io/aaronyang0628/helm-chart-mirror/sub2api (0.1.15)
Application image: ghcr.io/wei-shaw/sub2api@sha256:4c5dffab6e5ba4d3bd5382f19aad9654847b4e23de1a3d48e190146a3e6eb977
Public API and OAuth host: token.72602.space
Ingress class: nginx
TLS certificate: token.72602.space-tls (Ready)
External PostgreSQL: postgresql.database.svc.cluster.local:5432 (database/user: sub2api)
Application PVC: sub2api-data, 10Gi, local-path, RWO
Redis PVC: 8Gi, local-path, RWO; AOF is enabled
RollingUpdate: maxUnavailable: 0, maxSurge: 1

Use the 72602 public URL: https://token.72602.space.
Google OAuth is enabled in the live application. The start endpoint is /api/v1/auth/oauth/google/start and the callback URI generated by the running application is: https://token.72602.space/api/v1/auth/oauth/google/callback.
The application sets the OAuth state, redirect, and provider cookies with HttpOnly, Secure, SameSite=Lax, and Path=/api/v1/auth/oauth. The frontend callback page is /auth/oauth/callback.
The Pod requires the cluster egress proxy for Google token exchange. The GitOps source sets HTTP_PROXY and HTTPS_PROXY to http://192.168.0.25:17890 and bypasses that proxy for cluster-local ranges.
sub2api.home.geekcity.tech:32443 is a separate external endpoint, not the 72602 ingress. It returns 404 for the 72602 OAuth start path and must not be used for this login flow.
If Google reports a redirect URI mismatch, register only the exact callback URI above in the Google OAuth client. Google Cloud Console changes are not managed by this Kubernetes repository.

Docs

Backup & Restore
Sub2API pre-upgrade backup and recovery runbook
Install (ArgoCD)
Deploy Sub2API through the 72602 GitOps parent and OCI Helm child Application
Ops
GitOps upgrades and daily operations for Sub2API