Deploy to main

CLAUDE.md

@@ -0,0 +1,42 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+This is the Docusaurus 3 site for [docs.sleakops.com](https://docs.sleakops.com), edited via Sveltia CMS. Content lives under `content/docs/<en|es>/<section>/`, `content/tutorials/<en|es>/`, and `content/changelog/<en|es>/`. For the full writing style guide (voice, doc article vs tutorial structure, FAQ format, tags, image conventions), see `.claude/skills/sleakops-docs` — this file only covers repo mechanics.
+
+## Development Commands
+
+```bash
+make install     # yarn install (via docker compose)
+make run         # docker compose up -d — dev server on :4000 (English content)
+make run-es      # dev server with locale=es
+make build       # production build, all locales
+make build-en / make build-es   # single-locale build
+make serve       # serve the production build locally
+make collections # regenerate Sveltia CMS config.yml from the content/ folder structure
+make tutorials   # regenerate tutorials-generated.json from tutorial MDX files
+make clear       # clear Docusaurus cache
+```
+
+**Always start via `yarn start`/`make run`, never `npx docusaurus start` directly.** The `prestart`/`prebuild` npm hooks run `sync_content.js`, which builds the symlinks Docusaurus actually reads (`docs/ → content/docs/en`, `i18n/es/docusaurus-plugin-content-docs/current/ → content/docs/es`, etc.) from the CMS-friendly `content/<type>/<locale>/` structure. Skipping the hook leaves stale or broken symlinks and the dev server fails with "the docs folder does not exist".
+
+Other repo scripts run as part of those hooks — `clean_frontmatter.js` (strips empty frontmatter fields that fail validation), `cleanup_cms_temp.js` (removes Sveltia's temp hex-named folders), `generate_tutorials.js` (builds the tutorials showcase index), `fix_links.js` (one-off ES link-prefix repair, not part of the normal hook chain).
+
+The Docusaurus dev server does not SSR content in dev mode (`view-source` just shows an empty `<div id="__docusaurus">` shell) — verifying rendered output requires a real browser, not `curl`.
+
+## FAQ `<details>`/`<summary>` gotcha
+
+Docusaurus's `<Details>` component looks for a `<summary>` element among its JSX children to use as the disclosure title. If `<summary>`, its text, and `</summary>` are collapsed onto **one line**, MDX parses it in a way that breaks that lookup, and the component silently falls back to the literal placeholder text **"Details"** instead of showing the question. Always split it across separate lines:
+
+```mdx
+<details>
+  <summary>
+    ### Your question here?
+  </summary>
+  Your answer.
+</details>
+```
+
+not `<summary>### Your question here?</summary>` on a single line.

content/docs/en/cli.mdx

@@ -55,15 +55,15 @@ As previously mentioned the key might be an input here or a environment variable
 
 Also, you might mark if you want the process to **wait** the build to be finished or not.
 
-When you use **wait**, you can also set a **timeout** (in minutes) to cap how long the CLI waits for the build to finish. It defaults to **180 minutes**; pass `0` to wait indefinitely. You can also set it through the `BUILD_TIMEOUT_MINUTES` environment variable.
+You can set a **timeout** (in minutes) for a build. This is the build's maximum lifetime on the backend: if the build runs longer, SleakOps stops it and marks it as failed, so a stuck build can't hang forever. It defaults to **180 minutes**, and every build is bounded even if you don't pass it. When you also use **wait**, `--timeout` caps how long the CLI watches the build too. The CLI's default can be set through the `BUILD_TIMEOUT_MINUTES` environment variable.
 
 | **Option**    | **Description**                                                              |
 | ------------- | --------------------------------------------------------------------------- |
 | **--wait**    | Wait for the build to finish before returning.                              |
-| **--timeout** | Minutes to wait when using `--wait`. Default `180`. Use `0` for no timeout.  |
+| **--timeout** | Maximum build lifetime in minutes; also caps how long the CLI watches with `--wait`. Default `180`. `0` keeps the platform default and lets `--wait` watch indefinitely.  |
 
 :::tip
-The timeout is client-side: it controls how long the CLI watches the build, not the build itself on the backend. When it expires, the CLI prints a message and exits with code `1`, so a stuck build fails your CI pipeline instead of silently passing.
+`--timeout` works on two levels: the backend stops the build once it exceeds the limit (this happens for every build, even without `--wait`), and — when you pass `--wait` — the CLI also stops watching after the same time and exits with code `1`, so a stuck build fails your CI pipeline instead of hanging.
 :::
 
 ### 3. Make a Deploy
@@ -78,6 +78,31 @@ SleakOps seamlessly handles the deployment process, ensuring that your applicati
 
 Here **project** and **environment** are the required arguments. User might add a **build** or **tag** image to specify an image. Here the **wait** and **key** options are present to, the usage is the same as in the build command.
 
+### Injecting values on deploy
+
+You can inject Helm values into a single deployment, on top of everything configured in the platform (see [Values](/docs/project/values) for the override levels):
+
+```plain
+sleakops deploy -p myapp -e prod -f values.prod.yaml
+sleakops deploy -p myapp -e prod --set api_web.replicas=3
+cat values.yaml | sleakops deploy -p myapp -e prod -f -
+```
+
+| **Option**       | **Description**                                                                                          |
+| ---------------- | --------------------------------------------------------------------------------------------------------- |
+| **-f, --values** | YAML file with values for this deploy (repeatable; `-` reads stdin; later files win).                       |
+| **--set**        | Set a single value, `key.path=value` (repeatable; wins over `-f`). YAML coercion applies: `5` → int, `true` → bool. |
+| **--set-string** | Like `--set` but the value is always kept as a string (no coercion).                                        |
+
+:::warning Ephemeral by design
+Deploy-time values apply to **that deployment only** — they win over every value configured in the platform, and the next deploy without `-f`/`--set`/`--set-string` reverts to the platform values. They are the right tool for one-off tweaks, not for durable configuration: make durable changes at the project or workload level instead.
+:::
+
+Two caveats:
+
+- **For secrets prefer `-f`** (or stdin): `--set` and `--set-string` arguments stay in your shell history and CI logs.
+- **Two different list semantics**: between your own inputs (`-f` files and `--set` flags) a list replaces the previous one, exactly like Helm. But when your deploy values merge against the platform levels, lists are **combined** instead of replaced — an entry you pass is added to the generated ones, it doesn't drop them.
+
 ## CI/CD Examples
 
 With SleakOps CLI, you can integrate your CI/CD pipelines, automate the build and deployment process, and focus on delivering exceptional applications without the hassle of manual intervention.

content/docs/en/domain/delegation.mdx

@@ -69,7 +69,9 @@ ns-012.awsdns-01.co.uk
 ### Common Registrars
 
 <details>
-<summary><strong>GoDaddy</strong></summary>
+<summary>
+<strong>GoDaddy</strong>
+</summary>
 
 1. Go to [Domain Manager](https://account.godaddy.com/products)
 2. Click on your domain
@@ -81,7 +83,9 @@ ns-012.awsdns-01.co.uk
 </details>
 
 <details>
-<summary><strong>Namecheap</strong></summary>
+<summary>
+<strong>Namecheap</strong>
+</summary>
 
 1. Go to [Domain List](https://ap.www.namecheap.com/domains/list/)
 2. Click "Manage" next to your domain
@@ -92,7 +96,9 @@ ns-012.awsdns-01.co.uk
 </details>
 
 <details>
-<summary><strong>Cloudflare</strong></summary>
+<summary>
+<strong>Cloudflare</strong>
+</summary>
 
 **Note:** If using Cloudflare, you must disable Cloudflare proxy for proper delegation.
 

content/docs/en/project/build/build.mdx

@@ -31,6 +31,34 @@ SleakOps has its own CLI Tool that you can use to automate Builds and Deployment
 
 :::
 
+## Build timeout
+
+Every build runs with a maximum lifetime. If a build gets stuck — waiting on a lock, pulling an image that never becomes available, or looping inside a build step — SleakOps stops it automatically and marks it as failed instead of letting it run forever. When you don't set a limit, a platform default of 180 minutes applies, so every build is always bounded.
+
+Set the limit per build from the [SleakOps CLI](/docs/cli) with the `--timeout` flag, in minutes:
+
+```bash
+sleakops build --project my-app --branch main --timeout 30
+```
+
+| **`--timeout` value** | **Effect**                                                                              |
+| --------------------- | --------------------------------------------------------------------------------------- |
+| **Omitted**           | The platform default of 180 minutes applies.                                            |
+| **A positive number** | The build is stopped and marked as failed after that many minutes.                      |
+| **`0`**               | The build is still bounded by the platform default. With `--wait`, it also removes the CLI's wait cap, so the CLI polls until the build finishes; without `--wait` it behaves like omitting `--timeout`. |
+
+When combined with `--wait`, `--timeout` also caps how long the CLI waits for the build to finish before exiting with an error. This is useful in CI/CD pipelines, where a stuck build would otherwise block the job indefinitely:
+
+```bash
+sleakops build --project my-app --branch main --wait --timeout 30
+```
+
+If the build hasn't finished within the timeout, the CLI exits with a non-zero status so the pipeline step fails fast.
+
+:::tip
+For CI/CD, set `--timeout` to a value slightly above your normal build duration. That way a genuinely stuck build is caught quickly, while healthy builds always have room to finish.
+:::
+
 ## FAQs
 
 <details>

content/docs/en/project/chart/extra_templates.mdx

@@ -7,6 +7,10 @@ import { FiExternalLink } from "react-icons/fi";
 
 # Extra Templates
 
+:::warning Deprecated in favor of Manifests
+Extending templates & values is deprecated. To add or edit custom resources, use the Project's **Manifests** section instead — each resource becomes its own manifest, with validation, preview and per-Workload scoping. See the [Manifests documentation](/docs/project/manifests). Existing Extra Templates keep deploying as before until you migrate them.
+:::
+
 Extra Templates enable you to deploy custom Kubernetes resources beyond SleakOps' built-in components. This powerful feature allows you to extend your project with specialized resources such as custom Ingresses, testing pods, or other Kubernetes objects tailored to your specific requirements.
 
 ## Use Cases

content/docs/en/project/chart/index.mdx

@@ -69,30 +69,40 @@ Values that apply across the entire Project:
 ## Frequently Asked Questions
 
 <details>
-  <summary>### Where can I find my Project's Chart?</summary>
+  <summary>
+    ### Where can I find my Project's Chart?
+  </summary>
   Currently, Charts are not viewable directly in the platform. However, you can
   download the Chart from the ECR repository created for your Project in the
   corresponding AWS Account.
 </details>
 
 <details>
-  <summary>### Can I modify the Chart deployed by a Project?</summary>
-  Yes, with some limitations. You can: - Add custom templates using [**Extra
-  Templates**](/docs/project/chart/extra_templates) - Add chart dependencies using [**Chart
-  Dependencies**](/docs/project/chart/chart_dependencies), similar to [Helm Chart Dependencies{" "}
-  <FiExternalLink />
-  ](https://helm.sh/docs/helm/helm_dependency/)
+  <summary>
+    ### Can I modify the Chart deployed by a Project?
+  </summary>
+  Yes. You can:
+
+  - Customize or add [**Manifests**](/docs/project/manifests) per Workload or shared across the Project
+  - Override [**Values**](/docs/project/values) at the project or workload level
+  - Add chart dependencies using [**Chart Dependencies**](/docs/project/chart/chart_dependencies), similar to [Helm Chart Dependencies <FiExternalLink />](https://helm.sh/docs/helm/helm_dependency/)
 </details>
 
 <details>
-  <summary>### Can I add a custom Ingress to my Project?</summary>
-  Yes, this is one of the primary use cases for the **Extra Templates** feature.
-  See the [Extra Templates documentation](/docs/project/chart/extra_templates) for detailed
-  instructions.
+  <summary>
+    ### Can I add a custom Ingress to my Project?
+  </summary>
+  Yes — add it as a manifest from the Workload's Advanced view or the project
+  bucket. See the [Manifests documentation](/docs/project/manifests). The legacy
+  [Extra Templates](/docs/project/chart/extra_templates) path still works but is
+  deprecated.
 </details>
 
 <details>
-  <summary>### Can I modify existing Kubernetes Service templates?</summary>
-  No, modifying SleakOps built-in templates is not currently supported. We are
-  working on enabling modifications to built-in templates in future releases.
+  <summary>
+    ### Can I modify existing Kubernetes Service templates?
+  </summary>
+  Yes. Open the Workload's **Advanced** view, click the manifest and edit its
+  YAML — your copy is preserved and never overwritten by SleakOps. See
+  [Manifests](/docs/project/manifests).
 </details>

content/docs/en/project/dependency/index.mdx

@@ -45,17 +45,23 @@ These dependencies integrate seamlessly with SleakOps, providing a comprehensive
 </details>
 
 <details>
-  <summary>### Can the same dependency be used for multiple Projects?</summary>
+  <summary>
+    ### Can the same dependency be used for multiple Projects?
+  </summary>
   At the moment this is not possible, you need one dependency per each project.
 </details>
 
 <details>
-  <summary>### How do I delete a Dependency?</summary>
+  <summary>
+    ### How do I delete a Dependency?
+  </summary>
   By accessing the *Dependency Listing* and clicking the delete option.
 </details>
 
 <details>
-  <summary>### What happens when I delete a dependency?</summary>
+  <summary>
+    ### What happens when I delete a dependency?
+  </summary>
   By deleting a dependency, SleakOps will remove all the information related to
   it and all what is related to it will stop working. To solve that SleakOps
   create a Deployment in PENDING_APPROVAL status, that must be run manually ASAP
@@ -106,3 +112,70 @@ To move forward choose between the following guides.
 [Memcached](/docs/project/dependency/memcached-aws).
 [OpenSearch](/docs/project/dependency/opensearch-aws).
 [SQS](/docs/project/dependency/sqs-aws).
+
+## Dependency Access
+
+Dependency access refers to the security and connectivity mechanisms that let your application's workloads interact securely with external dependencies. SleakOps automatically manages these access patterns to ensure secure communication between your services and their dependencies.
+
+### Access Management
+
+#### Automatic Service Account Configuration
+When you create a dependency, SleakOps automatically:
+- **Creates IAM roles** with appropriate permissions for the specific dependency type
+- **Configures service accounts** in your Kubernetes namespace
+- **Establishes secure connections** between your workloads and the dependency
+- **Manages credentials** through Kubernetes secrets and IAM roles
+
+#### Network Security
+- **VPC Integration**: Dependencies are created inside your project's VPC for secure network access
+- **Security Groups**: Automatically configured to allow the traffic needed between services
+- **Private Endpoints**: Dependencies use private endpoints when available to minimize exposure
+
+### Access Patterns
+
+#### Database Access
+For database dependencies (MySQL, PostgreSQL, etc.):
+- **Connection Strings**: Automatically generated and stored as Kubernetes secrets
+- **Authentication**: Managed through IAM roles and database-specific credentials
+- **SSL/TLS**: Encrypted connections are configured by default
+- **At-Rest Encryption**: Enabled by default on new dependencies
+  - You can turn it off or configure your own KMS key when you create it
+  - Aurora (PostgreSQL/MySQL) is always encrypted, with no way to opt out
+  - If the dependency was created before this improvement shipped, check the specific case: it may not be encrypted
+- **Connection Pooling**: Optimized connection management for better performance
+
+#### Cache Access
+For caching services (Redis, Memcached):
+- **Endpoint Configuration**: Automatically configured in your application's environment
+- **Authentication**: Secure access through IAM roles and service-specific credentials
+- **Network Policies**: Access restricted to authorized workloads only
+
+#### Storage Access
+For storage services (S3, etc.):
+- **Bucket Policies**: Automatically configured with least-privilege access
+- **IAM Permissions**: Service accounts receive only the permissions they need
+- **Access Keys**: Managed through AWS IAM roles for greater security
+
+### Security Best Practices
+
+#### Principle of Least Privilege
+- **Minimal Permissions**: Dependencies receive only the minimum required permissions
+- **Resource-Specific Access**: Access is scoped to specific resources whenever possible
+- **Regular Audits**: SleakOps provides tools to review and audit dependency access
+
+#### Credential Management
+- **Automatic Rotation**: Credentials are rotated automatically when possible
+- **Secure Storage**: All credentials are stored as Kubernetes secrets
+- **No Hardcoded Secrets**: Applications access dependencies through environment variables
+
+:::info Access Monitoring
+SleakOps provides monitoring and logging capabilities to track dependency access patterns, helping you identify potential security issues and optimize performance.
+:::
+
+:::tip Troubleshooting Access Issues
+If you run into access issues with dependencies:
+1. Check the dependency's status in the SleakOps console
+2. Confirm your workload has the correct service account
+3. Review the IAM role permissions for the dependency
+4. Verify network connectivity and security group configurations
+:::

content/docs/en/project/dependency/oracle-aws.mdx

@@ -12,14 +12,18 @@ SleakOps facilitates the integration of Oracle databases through Amazon RDS (Rel
 ## FAQs
 
 <details>
-  <summary>### License</summary>
+  <summary>
+    ### License
+  </summary>
   When creating an Oracle DB using Sleakops License Included (LI). Currently
   Bring Your Own License (BYOL) is not supported, however, contact support for
   more information.
 </details>
 
 <details>
-  <summary>### How does SleakOps manage Oracle credentials?</summary>
+  <summary>
+    ### How does SleakOps manage Oracle credentials?
+  </summary>
   When you create an Oracle dependency in SleakOps, it automatically generates a
   Vargroup for your database. This Variable Group securely stores the Oracle
   credentials and other important configuration details, such as the database
@@ -28,7 +32,9 @@ SleakOps facilitates the integration of Oracle databases through Amazon RDS (Rel
 </details>
 
 <details>
-  <summary>### What is Multi-AZ deployment and should I enable it?</summary>
+  <summary>
+    ### What is Multi-AZ deployment and should I enable it?
+  </summary>
   Multi-AZ (Availability Zone) deployment ensures high availability and failover
   support by replicating your database in another availability zone. It's
   recommended for production environments to prevent downtime. Keep in mind that