Deployments and secrets

Your application changes through Git. A commit in the repository you connected describes the state you want; the platform moves the runtime there and keeps it there.

That is the only supported route, and the reason is practical: when the desired state lives in your repository, you answer "what changed and who wanted it" from your own history. A change someone pushed into the cluster by hand would not have that history, and would be gone at the next reconciliation anyway.

Connecting a repository

Under Projekte & Namespaces in the portal you will find where to enter your repository: address, branch, path, and how access works. Before you save, the portal shows you what it understood. Read that once, it saves you the first failed sync.

You can look at gh0stservice/ghc-gitops-example as a structural template. Copy the structure from it, not the values.

How to lay the repository out

Start small:

kustomize/
  base/
    app/
  overlays/
    gh0stcloud/
      kustomization.yaml

More layers are worth it only once the first path from commit to running application actually works. An elaborate overlay structure that has never deployed only hides where things are stuck.

Secrets do not belong in Git

Passwords, tokens and keys do not go into the repository, not in a private one, and not base64-encoded either. What lands in a Git history stays there, and wanting to remove it is considerably more work than never writing it in.

Instead: the value is stored where the portal shows you. Git holds only the name it is referenced by. At runtime the platform hands the actual secret to your application.

gh0stcli can walk you through storing it without the value ever appearing in the conversation with your AI assistant. Use that. A secret you paste into a chat is no longer secret.

Before your assistant writes manifests

It cannot invent anything that exists only in your account. Give it what it needs first: the namespace from the portal, your application's name and image tag, the port it answers on, the hostname if it should be public, the name and size of the volume if it keeps data, and the names of any secrets, never their values.