fix(platform): apply production hardening from audit plan

Close billing, tenancy, migration, build, and CI/CD gaps identified in the audit: wallet/gateway guards, full-UUID namespaces, idempotent migrations with base schema, stateful service stability, safer Dockerfiles/git builds, and platform chart hardening (Redis auth, RollingUpdate, backups, Swagger off). Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-02 19:35:07 +03:30
parent 34c110be6a
commit 22359be40e
55 changed files with 4883 additions and 381 deletions
@@ -46,6 +46,16 @@ Database deployment name
 {{- printf "%s-db" .Values.app.name }}
 {{- end }}

+{{/*
+Optional mirror registry prefix for Docker Hub images.
+Usage: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" "redis:7.2-alpine") }}
+*/}}
+{{- define "cloudhost-app.baseImage" -}}
+{{- $reg := "" -}}
+{{- with .root.Values.images -}}{{- $reg = .baseRegistry | default "" -}}{{- end -}}
+{{- if $reg -}}{{ printf "%s/%s" $reg .image }}{{- else -}}{{ .image }}{{- end -}}
+{{- end }}
+
 {{/*
 Database image — auto-computed from type + version if not explicitly set
 */}}
@@ -53,13 +63,13 @@ Database image — auto-computed from type + version if not explicitly set
 {{- if .Values.database.image }}
  {{- .Values.database.image }}
 {{- else if eq .Values.database.type "postgresql" }}
-  {{- printf "postgres:%s-alpine" .Values.database.version }}
+  {{- include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "postgres:%s-alpine" .Values.database.version)) }}
 {{- else if eq .Values.database.type "mariadb" }}
-  {{- printf "mariadb:%s" .Values.database.version }}
+  {{- include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "mariadb:%s" .Values.database.version)) }}
 {{- else if eq .Values.database.type "mongodb" }}
-  {{- printf "mongo:%s" .Values.database.version }}
+  {{- include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "mongo:%s" .Values.database.version)) }}
 {{- else }}
-  {{- printf "mysql:%s" .Values.database.version }}
+  {{- include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "mysql:%s" .Values.database.version)) }}
 {{- end }}
 {{- end }}

@@ -5,7 +5,7 @@
 {{- define "cloudhost-app.logShipperContainers" -}}
 {{- if .root.Values.elasticsearch.enabled }}
 - name: log-shipper
-  image: fluent/fluent-bit:2.2
+  image: {{ include "cloudhost-app.baseImage" (dict "root" .root "image" "fluent/fluent-bit:2.2") }}
  resources:
    requests:
      cpu: "10m"
@@ -16,6 +16,10 @@ metadata:
    {{- include "cloudhost-app.labels" . | nindent 4 }}
 spec:
  replicas: 1
+  # RWO volume + single replica: recreate the old pod before starting the new
+  # one — a rolling update would deadlock on the attached PVC.
+  strategy:
+    type: Recreate
  selector:
    matchLabels:
      app: {{ $dbName }}
@@ -114,7 +118,7 @@ spec:
              command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
            {{- else if eq .Values.database.type "mongodb" }}
            exec:
-              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
+              command: ["sh", "-c", "mongosh --quiet -u \"$MONGO_INITDB_ROOT_USERNAME\" -p \"$MONGO_INITDB_ROOT_PASSWORD\" --eval \"db.adminCommand('ping')\""]
            {{- else }}
            exec:
              command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
@@ -131,7 +135,7 @@ spec:
              command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
            {{- else if eq .Values.database.type "mongodb" }}
            exec:
-              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
+              command: ["sh", "-c", "mongosh --quiet -u \"$MONGO_INITDB_ROOT_USERNAME\" -p \"$MONGO_INITDB_ROOT_PASSWORD\" --eval \"db.adminCommand('ping')\""]
            {{- else }}
            exec:
              command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
@@ -217,7 +217,7 @@ spec:
            {{- end }}
        {{- if .Values.elasticsearch.enabled }}
        - name: fluent-bit
-          image: fluent/fluent-bit:2.2
+          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" "fluent/fluent-bit:2.2") }}
          resources:
            requests:
              cpu: "10m"
@@ -1,4 +1,7 @@
 {{- if .Values.elasticsearch.enabled }}
+{{- if not .Values.elasticsearch.fluentbitPassword }}
+{{- fail "elasticsearch.fluentbitPassword is required when elasticsearch.enabled=true — no hardcoded default is shipped" }}
+{{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,7 +11,7 @@ metadata:
    {{- include "cloudhost-app.labels" . | nindent 4 }}
 type: Opaque
 stringData:
-  ELASTIC_PASSWORD: {{ .Values.elasticsearch.elasticPassword | default "CloudHost2024!Secure" | quote }}
-  FLUENTBIT_PASSWORD: {{ .Values.elasticsearch.fluentbitPassword | default "FluentBit2024!Writer" | quote }}
-  KIBANA_SYSTEM_PASSWORD: {{ .Values.elasticsearch.kibanaPassword | default "Kibana2024!System" | quote }}
+  ELASTIC_PASSWORD: {{ .Values.elasticsearch.elasticPassword | quote }}
+  FLUENTBIT_PASSWORD: {{ .Values.elasticsearch.fluentbitPassword | quote }}
+  KIBANA_SYSTEM_PASSWORD: {{ .Values.elasticsearch.kibanaPassword | quote }}
 {{- end }}
@@ -2,11 +2,22 @@
 {{- $name       := include "cloudhost-app.name" . -}}
 {{- $ns         := include "cloudhost-app.namespace" . -}}
 {{- $rabbitName := printf "%s-rabbitmq" $name -}}
+{{- /* Preserve the existing password across upgrades — RabbitMQ only applies
+       RABBITMQ_DEFAULT_PASS on first boot, so a regenerated secret would
+       diverge from the credentials stored in the persisted volume. */ -}}
+{{- $rabbitSecretName := printf "%s-secret" $rabbitName -}}
+{{- $existingRabbit := lookup "v1" "Secret" $ns $rabbitSecretName -}}
+{{- $rabbitPass := "" -}}
+{{- if and $existingRabbit $existingRabbit.data (index $existingRabbit.data "password") -}}
+{{- $rabbitPass = index $existingRabbit.data "password" | b64dec -}}
+{{- else -}}
+{{- $rabbitPass = randAlphaNum 16 -}}
+{{- end -}}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ $rabbitName }}-secret
+  name: {{ $rabbitSecretName }}
  namespace: {{ $ns }}
  labels:
    app: {{ $rabbitName }}
@@ -16,7 +27,7 @@ metadata:
 type: Opaque
 data:
  username: {{ "appuser" | b64enc | quote }}
-  password: {{ randAlphaNum 16 | b64enc | quote }}
+  password: {{ $rabbitPass | b64enc | quote }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -48,6 +59,9 @@ metadata:
    {{- include "cloudhost-app.labels" . | nindent 4 }}
 spec:
  replicas: 1
+  # RWO volume + single replica: recreate instead of rolling update.
+  strategy:
+    type: Recreate
  selector:
    matchLabels:
      app: {{ $rabbitName }}
@@ -58,7 +72,7 @@ spec:
    spec:
      containers:
        - name: rabbitmq
-          image: {{ printf "rabbitmq:%s-management-alpine" (.Values.rabbitmq.version | default "3.13") }}
+          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "rabbitmq:%s-management-alpine" (.Values.rabbitmq.version | default "3.13"))) }}
          ports:
            - containerPort: 5672
              name: amqp
@@ -68,12 +82,12 @@ spec:
            - name: RABBITMQ_DEFAULT_USER
              valueFrom:
                secretKeyRef:
-                  name: {{ $rabbitName }}-secret
+                  name: {{ $rabbitSecretName }}
                  key: username
            - name: RABBITMQ_DEFAULT_PASS
              valueFrom:
                secretKeyRef:
-                  name: {{ $rabbitName }}-secret
+                  name: {{ $rabbitSecretName }}
                  key: password
          volumeMounts:
            - name: rabbitmq-data
@@ -2,11 +2,21 @@
 {{- $name    := include "cloudhost-app.name" . -}}
 {{- $ns      := include "cloudhost-app.namespace" . -}}
 {{- $redisName := printf "%s-redis" $name -}}
+{{- /* Preserve the existing password across upgrades — regenerating it every
+       upgrade would break app↔Redis auth against the persisted volume. */ -}}
+{{- $redisSecretName := printf "%s-secret" $redisName -}}
+{{- $existingRedis := lookup "v1" "Secret" $ns $redisSecretName -}}
+{{- $redisPass := "" -}}
+{{- if and $existingRedis $existingRedis.data (index $existingRedis.data "password") -}}
+{{- $redisPass = index $existingRedis.data "password" | b64dec -}}
+{{- else -}}
+{{- $redisPass = randAlphaNum 16 -}}
+{{- end -}}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ $redisName }}-secret
+  name: {{ $redisSecretName }}
  namespace: {{ $ns }}
  labels:
    app: {{ $redisName }}
@@ -15,7 +25,7 @@ metadata:
    "helm.sh/resource-policy": keep
 type: Opaque
 data:
-  password: {{ randAlphaNum 16 | b64enc | quote }}
+  password: {{ $redisPass | b64enc | quote }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -47,6 +57,10 @@ metadata:
    {{- include "cloudhost-app.labels" . | nindent 4 }}
 spec:
  replicas: 1
+  # RWO volume + single replica: recreate the old pod before starting the new
+  # one, otherwise a rolling update deadlocks on the attached PVC.
+  strategy:
+    type: Recreate
  selector:
    matchLabels:
      app: {{ $redisName }}
@@ -57,7 +71,7 @@ spec:
    spec:
      containers:
        - name: redis
-          image: {{ printf "redis:%s-alpine" (.Values.redis.version | default "7.2") }}
+          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "redis:%s-alpine" (.Values.redis.version | default "7.2"))) }}
          args: ["--requirepass", "$(REDIS_PASSWORD)"]
          ports:
            - containerPort: 6379
@@ -65,7 +79,14 @@ spec:
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: {{ $redisName }}-secret
+                  name: {{ $redisSecretName }}
+                  key: password
+            # redis-cli in the probes auto-authenticates from REDISCLI_AUTH,
+            # so `redis-cli ping` works even with --requirepass set.
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $redisSecretName }}
                  key: password
          volumeMounts:
            - name: redis-data
@@ -101,3 +101,9 @@ changeCause: ""
 # ── Registry (for imagePullSecret) ──────────────────────
 registry:
  url: "localhost:30500"
+
+# ── Base images ──────────────────────────────────────────
+images:
+  # Optional mirror registry prefix for Docker Hub images (postgres, mysql,
+  # redis, rabbitmq, fluent-bit, …), e.g. "mirror.example.com".
+  baseRegistry: ""
@@ -1,16 +1,20 @@
 -- Temporary external access grants (Redis, RabbitMQ, database)
-CREATE TYPE service_access_target AS ENUM (
-  'database',
-  'redis',
-  'rabbitmq_amqp',
-  'rabbitmq_management'
-);
+DO $$ BEGIN
+  CREATE TYPE service_access_target AS ENUM (
+    'database',
+    'redis',
+    'rabbitmq_amqp',
+    'rabbitmq_management'
+  );
+EXCEPTION WHEN duplicate_object THEN null; END $$;

-CREATE TYPE service_access_grant_status AS ENUM (
-  'active',
-  'expired',
-  'revoked'
-);
+DO $$ BEGIN
+  CREATE TYPE service_access_grant_status AS ENUM (
+    'active',
+    'expired',
+    'revoked'
+  );
+EXCEPTION WHEN duplicate_object THEN null; END $$;

 CREATE TABLE IF NOT EXISTS service_access_grants (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -3,7 +3,7 @@ ALTER TABLE applications
  ADD COLUMN IF NOT EXISTS product_type VARCHAR(32) NOT NULL DEFAULT 'application';

 CREATE INDEX IF NOT EXISTS idx_applications_user_product_type
-  ON applications (user_id, product_type);
+  ON applications ("userId", product_type);

 ALTER TABLE resource_credits
  ADD COLUMN IF NOT EXISTS product_type VARCHAR(32) NOT NULL DEFAULT 'application';
@@ -9,8 +9,14 @@ metadata:
    {{- include "cloudhost-platform.labels" . | nindent 4 }}
 spec:
  replicas: {{ .Values.backend.replicas }}
+  # Zero-downtime rollouts: DB migrations run in a pre-upgrade hook Job, so the
+  # new pod only starts against a ready schema. The uploads PVC is RWO but
+  # local-path volumes pin pods to the same node, so surge pods can attach.
  strategy:
-    type: Recreate
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
  selector:
    matchLabels:
      app: {{ include "cloudhost-platform.backend.fullname" . }}
@@ -72,6 +78,11 @@ spec:
              value: {{ include "cloudhost-platform.redis.fullname" . }}
            - name: REDIS_PORT
              value: "6379"
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: redis-password
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
@@ -7,7 +7,9 @@ metadata:
  labels:
    {{- include "cloudhost-platform.labels" . | nindent 4 }}
  annotations:
-    helm.sh/hook: post-install,post-upgrade
+    # Run BEFORE the backend rolls out so schema-dependent code never starts
+    # against an unmigrated database.
+    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-weight: "5"
    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 spec:
@@ -47,9 +49,20 @@ spec:
            - -c
            - |
              set -e
+              # Track applied migrations so each file runs exactly once — the
+              # loop is idempotent across every helm upgrade.
+              psql -v ON_ERROR_STOP=1 -c "CREATE TABLE IF NOT EXISTS schema_migrations (filename TEXT PRIMARY KEY, applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW());"
              for f in $(ls /migrations/*.sql | sort); do
-                echo ">>> Applying $f"
-                psql -v ON_ERROR_STOP=1 -f "$f"
+                name=$(basename "$f")
+                applied=$(psql -tA -c "SELECT 1 FROM schema_migrations WHERE filename = '$name';")
+                if [ "$applied" = "1" ]; then
+                  echo ">>> Skipping $name (already applied)"
+                  continue
+                fi
+                echo ">>> Applying $name"
+                psql -v ON_ERROR_STOP=1 --single-transaction \
+                  -f "$f" \
+                  -c "INSERT INTO schema_migrations (filename) VALUES ('$name');"
              done
              echo ">>> All migrations applied"
          volumeMounts:
@@ -41,6 +41,8 @@ spec:
                  FILE="/backup/cloudhost-${STAMP}.sql.gz"
                  pg_dump | gzip > "$FILE"
                  echo "Backup written to $FILE"
+                  # Retention: keep the last {{ .Values.backups.postgres.retentionDays | default 7 }} days
+                  find /backup -name 'cloudhost-*.sql.gz' -mtime +{{ .Values.backups.postgres.retentionDays | default 7 }} -delete
              volumeMounts:
                - name: backup
                  mountPath: /backup
@@ -19,6 +19,10 @@ spec:
      labels:
        app: {{ include "cloudhost-platform.postgres.fullname" . }}
    spec:
+      {{- with .Values.postgres.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
      containers:
        - name: postgres
          image: {{ .Values.images.postgres | quote }}
@@ -19,9 +19,26 @@ spec:
      labels:
        app: {{ include "cloudhost-platform.redis.fullname" . }}
    spec:
+      {{- with .Values.redis.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
      containers:
        - name: redis
          image: {{ .Values.images.redis | quote }}
+          args: ["--requirepass", "$(REDIS_PASSWORD)"]
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: redis-password
+            # redis-cli reads REDISCLI_AUTH so authenticated probes need no -a flag
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: redis-password
          ports:
            - containerPort: 6379
          volumeMounts:
@@ -22,6 +22,10 @@ Secret out-of-band (e.g. SealedSecret in the gitops repo).
 {{- if not $kubeconfigKey }}
 {{- if and $existing (hasKey $existing.data "cluster-kubeconfig-key") }}{{- $kubeconfigKey = index $existing.data "cluster-kubeconfig-key" | b64dec }}{{- else }}{{- $kubeconfigKey = randAlphaNum 32 }}{{- end }}
 {{- end }}
+{{- $redisPass := .Values.redis.password }}
+{{- if not $redisPass }}
+{{- if and $existing (hasKey $existing.data "redis-password") }}{{- $redisPass = index $existing.data "redis-password" | b64dec }}{{- else }}{{- $redisPass = randAlphaNum 24 }}{{- end }}
+{{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -35,4 +39,5 @@ stringData:
  jwt-secret: {{ $jwt | quote }}
  jwt-refresh-secret: {{ $jwtRefresh | quote }}
  cluster-kubeconfig-key: {{ $kubeconfigKey | quote }}
+  redis-password: {{ $redisPass | quote }}
 {{- end }}
@@ -8,6 +8,11 @@ global:
  storageClass: local-path   # k3s example

 images:
+  # Mirror Docker Hub images through your private registry so cluster nodes
+  # never pull from docker.io directly (matches the kaniko/Harbor setup).
+  postgres: registry.example.com/mirror/postgres:16-alpine
+  redis: registry.example.com/mirror/redis:7-alpine
+  busybox: registry.example.com/mirror/busybox:1.36
  backend:
    repository: registry.example.com/cloudhost-backend
    tag: "1.0.0"
@@ -19,6 +24,15 @@ images:

 postgres:
  password: "CHANGE_ME_STRONG_POSTGRES_PASSWORD"
+  # Pull secret for the mirrored postgres image
+  imagePullSecrets:
+    - name: registry-pull-secret
+
+redis:
+  # Auto-generated and persisted in the platform Secret when left empty.
+  password: ""
+  imagePullSecrets:
+    - name: registry-pull-secret

 secrets:
  jwtSecret: "CHANGE_ME_LONG_JWT_SECRET"
@@ -44,6 +58,20 @@ backend:
    PLATFORM_DOMAIN: apps.example.com
    REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
    REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
+    # Mirror prefix for base images in generated Dockerfiles + managed services
+    BASE_IMAGE_REGISTRY: registry.example.com/mirror
+    # Elastic log-stack credentials (must match the logging namespace Secret)
+    ELASTIC_PASSWORD: "CHANGE_ME_ELASTIC_PASSWORD"
+    FLUENTBIT_PASSWORD: "CHANGE_ME_FLUENTBIT_PASSWORD"
+    KIBANA_SYSTEM_PASSWORD: "CHANGE_ME_KIBANA_PASSWORD"
+    # Swagger stays off in production; set SWAGGER_ENABLED: "true" to expose it

 migrations:
  enabled: true
+
+backups:
+  postgres:
+    enabled: true
+    schedule: "0 3 * * *"
+    storageSize: 10Gi
+    retentionDays: 7
@@ -12,6 +12,9 @@ createNamespace: true
 global:
  storageClass: ""

+# For clusters without direct docker.io access, point these at your mirror,
+# e.g. registry.abrban.com/abrban/postgres:16-alpine, and set
+# postgres.imagePullSecrets / redis.imagePullSecrets accordingly.
 images:
  postgres: postgres:16-alpine
  redis: redis:7-alpine
@@ -32,12 +35,31 @@ postgres:
  # Leave empty to auto-generate on first install (stored in Secret)
  password: ""
  storage: 10Gi
-  resources: {}
+  # Needed when images.postgres points at a private mirror
+  imagePullSecrets: []
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi

 redis:
  enabled: true
  storage: 1Gi
-  resources: {}
+  # Leave empty to auto-generate on first install (stored in Secret as redis-password).
+  # With secrets.existingSecret, that Secret must also contain a redis-password key.
+  password: ""
+  # Needed when images.redis points at a private mirror
+  imagePullSecrets: []
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi

 backend:
  enabled: true
@@ -49,7 +71,13 @@ backend:
  sourceStorage:
    enabled: false
    existingSecret: ceph-app-sources-credentials
-  resources: {}
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
  extraEnv: {}
  env:
    NODE_ENV: production
@@ -73,7 +101,13 @@ frontend:
  replicas: 1
  imagePullSecrets:
    - name: registry-pull-secret
-  resources: {}
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi

 # JWT secrets — set in production (values-production.example.yaml)
 secrets:
@@ -117,6 +151,7 @@ monitoring:

 backups:
  postgres:
-    enabled: false
+    enabled: true
    schedule: "0 3 * * *"
    storageSize: 10Gi
+    retentionDays: 7
@@ -9,18 +9,16 @@ metadata:
  labels:
    app.kubernetes.io/managed-by: cloudhost
 ---
-# Elasticsearch credentials secret
-apiVersion: v1
-kind: Secret
-metadata:
-  name: elasticsearch-credentials
-  namespace: logging
-type: Opaque
-stringData:
-  # Admin credentials - change in production!
-  ELASTIC_PASSWORD: "CloudHost2024!Secure"
-  # For Fluent Bit to send logs
-  FLUENTBIT_PASSWORD: "FluentBit2024!Writer"
+# Elasticsearch credentials — managed OUT-OF-BAND, never committed to git.
+# Create the Secret before applying this manifest (or use a SealedSecret in
+# the GitOps repo):
+#
+#   kubectl -n logging create secret generic elasticsearch-credentials \
+#     --from-literal=ELASTIC_PASSWORD="$(openssl rand -base64 24)" \
+#     --from-literal=FLUENTBIT_PASSWORD="$(openssl rand -base64 24)"
+#
+# The backend reads the same values from ELASTIC_PASSWORD / FLUENTBIT_PASSWORD
+# env vars (see cloudhost-platform values: backend.extraEnv or an extra Secret).
 ---
 # ConfigMap for Elasticsearch configuration
 apiVersion: v1
@@ -1,16 +1,20 @@
 -- Temporary external access grants (Redis, RabbitMQ, database)
-CREATE TYPE service_access_target AS ENUM (
-  'database',
-  'redis',
-  'rabbitmq_amqp',
-  'rabbitmq_management'
-);
+DO $$ BEGIN
+  CREATE TYPE service_access_target AS ENUM (
+    'database',
+    'redis',
+    'rabbitmq_amqp',
+    'rabbitmq_management'
+  );
+EXCEPTION WHEN duplicate_object THEN null; END $$;

-CREATE TYPE service_access_grant_status AS ENUM (
-  'active',
-  'expired',
-  'revoked'
-);
+DO $$ BEGIN
+  CREATE TYPE service_access_grant_status AS ENUM (
+    'active',
+    'expired',
+    'revoked'
+  );
+EXCEPTION WHEN duplicate_object THEN null; END $$;

 CREATE TABLE IF NOT EXISTS service_access_grants (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -3,7 +3,7 @@ ALTER TABLE applications
  ADD COLUMN IF NOT EXISTS product_type VARCHAR(32) NOT NULL DEFAULT 'application';

 CREATE INDEX IF NOT EXISTS idx_applications_user_product_type
-  ON applications (user_id, product_type);
+  ON applications ("userId", product_type);

 ALTER TABLE resource_credits
  ADD COLUMN IF NOT EXISTS product_type VARCHAR(32) NOT NULL DEFAULT 'application';
@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+/**
+ * Generate the greenfield base schema (000_base_schema.sql) by letting TypeORM
+ * `synchronize` build every table from the entities against a throwaway
+ * Postgres, then dumping the schema. Run when entities change materially:
+ *
+ *   docker run -d --name ch-schemagen -e POSTGRES_PASSWORD=pass \
+ *     -e POSTGRES_USER=cloudhost -e POSTGRES_DB=cloudhost \
+ *     -p 55432:5432 postgres:16-alpine
+ *   node scripts/generate-base-schema.mjs
+ *
+ * The output is wrapped so it is safe to run on an already-populated database
+ * (every statement uses IF NOT EXISTS / duplicate_object guards where possible;
+ * the migration runner also records it in schema_migrations so it runs once).
+ */
+import 'reflect-metadata';
+import { DataSource } from 'typeorm';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const backendRoot = path.resolve(__dirname, '..');
+const outPath = path.join(backendRoot, 'migrations', '000_base_schema.sql');
+
+// Use the COMPILED entities (run `npm run build` first) — union-typed columns
+// only carry correct decorator metadata through the project's tsc build.
+const ds = new DataSource({
+  type: 'postgres',
+  host: process.env.SCHEMA_DB_HOST || '127.0.0.1',
+  port: parseInt(process.env.SCHEMA_DB_PORT || '55432', 10),
+  username: 'cloudhost',
+  password: 'pass',
+  database: 'cloudhost',
+  entities: [path.join(backendRoot, 'dist/**/*.entity.js')],
+  synchronize: true,
+});
+
+await ds.initialize();
+await ds.destroy();
+
+// Dump schema-only from the container, then strip owner/ACL noise.
+const dumped = execFileSync('docker', [
+  'exec', 'ch-schemagen',
+  'pg_dump', '-U', 'cloudhost', '-d', 'cloudhost',
+  '--schema-only', '--no-owner', '--no-privileges',
+], { maxBuffer: 32 * 1024 * 1024 }).toString();
+
+// Strip:
+//  - psql client meta-commands that are version-specific (\restrict is
+//    pg_dump 16.13+ only) and would break on the migrations image's psql;
+//  - the `search_path = ''` reset, which otherwise persists into the trailing
+//    `INSERT INTO schema_migrations` the runner appends (unqualified) and the
+//    footer below, causing "no schema has been selected to create in".
+const raw = dumped
+  .split('\n')
+  .filter(
+    (line) =>
+      !/^\\(restrict|unrestrict)\b/.test(line) &&
+      !/set_config\('search_path'/.test(line),
+  )
+  .join('\n');
+
+const header = `-- 000_base_schema.sql — greenfield base schema (generated from TypeORM entities).
+-- Auto-generated by scripts/generate-base-schema.mjs. Do not edit by hand.
+-- Incremental migrations (001+) run afterwards on top of this schema.
+
+`;
+
+// The legacy pricing-catalog migrations (004-009) target a superseded
+// snake_case pricing schema that is incompatible with the current entities.
+// On greenfield the base schema already creates the entity-shaped pricing
+// tables and the app self-seeds their rows (PricingCatalogService.ensureDefaults
+// on boot), so mark those migrations as already applied to skip them.
+const supersededPricingMigrations = [
+  '004_pricing_catalog.sql',
+  '005_pricing_catalog_all_runtimes.sql',
+  '006_addon_rate_resources.sql',
+  '007_optional_service_pricing_matrix.sql',
+  '008_application_optional_service_resources.sql',
+  '009_optional_service_deploy_defaults.sql',
+];
+const footer = `
+
+-- Mark superseded legacy pricing migrations as applied (see generator note).
+CREATE TABLE IF NOT EXISTS schema_migrations (filename TEXT PRIMARY KEY, applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW());
+INSERT INTO schema_migrations (filename) VALUES
+${supersededPricingMigrations.map((m) => `  ('${m}')`).join(',\n')}
+ON CONFLICT (filename) DO NOTHING;
+`;
+
+fs.writeFileSync(outPath, header + raw + footer);
+console.log(`Wrote ${outPath} (${raw.length} bytes)`);
@@ -53,6 +53,7 @@ import configuration from './config/configuration';
        redis: {
          host: configService.get('redis.host'),
          port: configService.get('redis.port'),
+          password: configService.get('redis.password'),
        },
      }),
      inject: [ConfigService],
@@ -387,6 +387,29 @@ export class ApplicationsController {
      throw new BadRequestException('Replicas can only be changed for the main application workload.');
    }

+    // Non-staff users must go through the billed upgrade flow for any change
+    // that increases cost — direct PATCH must not bypass payment.
+    if (!isStaff) {
+      const upgradeDto =
+        workload === 'app'
+          ? {
+              cpuLimit: dto.cpuLimit,
+              memoryLimit: dto.memoryLimit,
+              replicas: dto.replicas,
+            }
+          : workload === 'database'
+            ? { databaseResources: { cpuLimit: dto.cpuLimit, memoryLimit: dto.memoryLimit } }
+            : workload === 'redis'
+              ? { redisResources: { cpuLimit: dto.cpuLimit, memoryLimit: dto.memoryLimit } }
+              : { rabbitmqResources: { cpuLimit: dto.cpuLimit, memoryLimit: dto.memoryLimit } };
+      const cost = await this.billingService.calculateUpgradeCost(app, upgradeDto as any);
+      if (cost.proratedAmount > 0) {
+        throw new BadRequestException(
+          'This change increases the plan cost. Use the resource upgrade flow (with invoice payment) instead.',
+        );
+      }
+    }
+
    // Update in K8s (live)
    await this.kubernetesService.updateResources(app, dto, workload);

@@ -22,6 +22,7 @@ import {
  detectRuntimeFromArchive,
 } from '../build/runtime-detector';
 import { SourceStorageService } from '../storage/source-storage.service';
+import { userIdSlug } from '../kubernetes/k8s-workload.util';
 import * as os from 'os';

@Injectable()
@@ -67,6 +68,18 @@ export class ApplicationsService {
    dto = normalizeCreateApplicationDto(dto);
    const productType = dto.productType ?? ProductType.APPLICATION;

+    // WordPress only runs on MySQL/MariaDB — reject PostgreSQL/Mongo/none up
+    // front instead of failing at runtime inside the WordPress container.
+    if (dto.runtime === AppRuntime.WORDPRESS) {
+      if (!dto.databaseType || dto.databaseType === DatabaseType.NONE) {
+        dto.databaseType = DatabaseType.MYSQL;
+      } else if (![DatabaseType.MYSQL, DatabaseType.MARIADB].includes(dto.databaseType)) {
+        throw new BadRequestException(
+          `WordPress requires a MySQL or MariaDB database — "${dto.databaseType}" is not supported.`,
+        );
+      }
+    }
+
    // Placement is always decided automatically by the allocator.
    const allocation = await this.clustersService.selectClusterForApplication(dto, userId);
    const clusterId = allocation.cluster.id;
@@ -96,7 +109,7 @@ export class ApplicationsService {

    const baseLabel = dto.name;
    const subdomain = customDomain
-      ? `${this.toDnsLabel(baseLabel)}-${this.toDnsLabel(userId.split('-')[0])}`
+      ? `${this.toDnsLabel(baseLabel)}-${this.toDnsLabel(userIdSlug(userId).slice(0, 12))}`
      : await this.generateRandomSubdomain(baseLabel);
    const platformDomain = this.configService.get('platform.domain') || 'apps.cloudhost.ir';

@@ -16,6 +16,7 @@ import {
  CustomDomainStatus,
  ProductType,
 } from '../../common/enums';
+import { Exclude, Expose } from 'class-transformer';
 import { User } from '../../users/entities/user.entity';
 import { Deployment } from '../../deployments/entities/deployment.entity';

@@ -111,8 +112,19 @@ export class Application {
  @Column({ nullable: true })
  gitUrl: string;

+  /**
+   * Personal access token for private repos. Never serialized into API
+   * responses (see hasGitToken) — it is a credential to an external system.
+   */
+  @Exclude({ toPlainOnly: true })
  @Column({ nullable: true })
-  gitToken: string; // Personal access token for private repos
+  gitToken: string;
+
+  /** Whether a git token is configured (safe indicator for the UI). */
+  @Expose()
+  get hasGitToken(): boolean {
+    return !!this.gitToken;
+  }

  @Column({ nullable: true })
  gitBranch: string; // Branch to clone (default: main)
@@ -14,7 +14,11 @@ import {
 import { AuthGuard } from '@nestjs/passport';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { BillingService } from './billing.service';
-import { assertStubGatewayAllowed } from './payment-gateway.util';
+import {
+  assertStubGatewayAllowed,
+  issueGatewayTrackingCode,
+  assertGatewayTrackingCodeValid,
+} from './payment-gateway.util';
 import { AppLifecycleService } from '../lifecycle/app-lifecycle.service';
 import { ApplicationsService } from '../applications/applications.service';
 import { ChargeWalletDto, PayApplicationDto } from './dto/billing.dto';
@@ -43,8 +47,11 @@ export class BillingWalletController {
  }

  @Post('wallet/charge')
-  @ApiOperation({ summary: 'Charge my wallet (self top-up)' })
+  @ApiOperation({ summary: 'Charge my wallet (self top-up — stub gateway, dev/staging only)' })
  async chargeMyWallet(@Request() req: any, @Body() dto: ChargeWalletDto) {
+    // Direct self-credit is only for environments with the stub gateway enabled.
+    // In production a real payment gateway must credit wallets.
+    assertStubGatewayAllowed();
    return this.billingService.chargeWallet(req.user.id, dto.amount, dto.description || 'Self top-up');
  }

@@ -160,7 +167,7 @@ export class BillingWalletController {
    @Body() body: { amount: number; description?: string; callbackUrl: string },
  ) {
    assertStubGatewayAllowed();
-    const trackingCode = `PAY-${Date.now()}-${Math.random().toString(36).substring(2, 8).toUpperCase()}`;
+    const trackingCode = issueGatewayTrackingCode(req.user.id, body.amount);
    return {
      success: true,
      trackingCode,
@@ -176,6 +183,8 @@ export class BillingWalletController {
    @Body() body: { trackingCode: string; amount: number },
  ) {
    assertStubGatewayAllowed();
+    // The tracking code binds user + amount at initiate time; reject tampered amounts.
+    assertGatewayTrackingCodeValid(body.trackingCode, req.user.id, body.amount);
    await this.billingService.chargeWallet(
      req.user.id,
      body.amount,
@@ -1,6 +1,6 @@
 import { Injectable, Logger, BadRequestException, NotFoundException, ForbiddenException } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
-import { Repository, IsNull, MoreThan, FindOptionsWhere } from 'typeorm';
+import { Repository, IsNull, MoreThan, FindOptionsWhere, EntityManager } from 'typeorm';
 import { Wallet } from './entities/wallet.entity';
 import { WalletTransaction } from './entities/wallet-transaction.entity';
 import { Invoice } from './entities/invoice.entity';
@@ -172,6 +172,32 @@ export class BillingService {
    return { balance: Number(wallet.balance) };
  }

+  /**
+   * Load the user's wallet inside a transaction with a row-level lock
+   * (SELECT ... FOR UPDATE) so concurrent charge/deduct operations serialize
+   * instead of racing on read-modify-write.
+   */
+  private async lockWallet(em: EntityManager, userId: string): Promise<Wallet> {
+    let wallet = await em.getRepository(Wallet).findOne({
+      where: { userId },
+      lock: { mode: 'pessimistic_write' },
+    });
+    if (!wallet) {
+      // First-time wallet creation may race; the unique userId column makes
+      // one insert win — re-read with the lock afterwards.
+      try {
+        await em.getRepository(Wallet).insert({ userId, balance: 0 });
+      } catch {
+        /* concurrent insert won — fall through to locked re-read */
+      }
+      wallet = await em.getRepository(Wallet).findOneOrFail({
+        where: { userId },
+        lock: { mode: 'pessimistic_write' },
+      });
+    }
+    return wallet;
+  }
+
  async chargeWallet(
    userId: string,
    amount: number,
@@ -180,21 +206,23 @@ export class BillingService {
  ): Promise<WalletTransaction> {
    if (amount <= 0) throw new BadRequestException('Amount must be positive');

-    const wallet = await this.getOrCreateWallet(userId);
-    wallet.balance = Number(wallet.balance) + amount;
-    await this.walletRepo.save(wallet);
+    const saved = await this.walletRepo.manager.transaction(async (em) => {
+      const wallet = await this.lockWallet(em, userId);
+      wallet.balance = Number(wallet.balance) + amount;
+      await em.getRepository(Wallet).save(wallet);

-    const tx = this.txRepo.create({
-      walletId: wallet.id,
-      type: TransactionType.CHARGE,
-      amount,
-      balanceAfter: wallet.balance,
-      description: description || 'Wallet charge',
-      invoiceId,
+      const tx = em.getRepository(WalletTransaction).create({
+        walletId: wallet.id,
+        type: TransactionType.CHARGE,
+        amount,
+        balanceAfter: wallet.balance,
+        description: description || 'Wallet charge',
+        invoiceId,
+      });
+      return em.getRepository(WalletTransaction).save(tx);
    });
-    const saved = await this.txRepo.save(tx);

-    this.logger.log(`Charged wallet of user ${userId}: +${amount} Toman → balance: ${wallet.balance}`);
+    this.logger.log(`Charged wallet of user ${userId}: +${amount} Toman → balance: ${saved.balanceAfter}`);
    return saved;
  }

@@ -207,26 +235,28 @@ export class BillingService {
  ): Promise<WalletTransaction> {
    if (amount <= 0) throw new BadRequestException('Amount must be positive');

-    const wallet = await this.getOrCreateWallet(userId);
-    if (Number(wallet.balance) < amount) {
-      throw new BadRequestException('Insufficient wallet balance');
-    }
+    const saved = await this.walletRepo.manager.transaction(async (em) => {
+      const wallet = await this.lockWallet(em, userId);
+      if (Number(wallet.balance) < amount) {
+        throw new BadRequestException('Insufficient wallet balance');
+      }

-    wallet.balance = Number(wallet.balance) - amount;
-    await this.walletRepo.save(wallet);
+      wallet.balance = Number(wallet.balance) - amount;
+      await em.getRepository(Wallet).save(wallet);

-    const tx = this.txRepo.create({
-      walletId: wallet.id,
-      type: TransactionType.DEDUCTION,
-      amount,
-      balanceAfter: wallet.balance,
-      description: description || 'Service payment',
-      applicationId,
-      invoiceId,
+      const tx = em.getRepository(WalletTransaction).create({
+        walletId: wallet.id,
+        type: TransactionType.DEDUCTION,
+        amount,
+        balanceAfter: wallet.balance,
+        description: description || 'Service payment',
+        applicationId,
+        invoiceId,
+      });
+      return em.getRepository(WalletTransaction).save(tx);
    });
-    const saved = await this.txRepo.save(tx);

-    this.logger.log(`Deducted from wallet of user ${userId}: -${amount} Toman → balance: ${wallet.balance}`);
+    this.logger.log(`Deducted from wallet of user ${userId}: -${amount} Toman → balance: ${saved.balanceAfter}`);
    return saved;
  }

@@ -743,7 +773,9 @@ export class BillingService {
      yearly: newCost.yearly - currentCost.yearly,
    };

-    // Calculate prorated amount based on remaining time in billing period
+    // Calculate prorated amount based on remaining time in billing period.
+    // Use the price difference of the app's own billing cycle scaled by the
+    // fraction of the cycle that remains — not the hourly rate for all cycles.
    let proratedAmount = 0;
    let remainingHours = 0;

@@ -752,9 +784,18 @@ export class BillingService {
      const expiresAt = new Date(app.planExpiresAt);
      remainingHours = Math.max(0, (expiresAt.getTime() - now.getTime()) / (1000 * 60 * 60));

+      const cycleDifference = this.amountForCycle(difference, app.billingCycle);
+      const cycleHours =
+        app.billingCycle === BillingCycle.HOURLY
+          ? 1
+          : app.billingCycle === BillingCycle.MONTHLY
+            ? 30 * 24
+            : 365 * 24;
+
      // Only charge difference if upgrading (not downgrading)
-      if (difference.hourly > 0) {
-        proratedAmount = Math.ceil(difference.hourly * remainingHours);
+      if (cycleDifference > 0) {
+        const remainingFraction = Math.min(1, remainingHours / cycleHours);
+        proratedAmount = Math.ceil(cycleDifference * remainingFraction);
      }
    }

@@ -1,4 +1,5 @@
-import { ForbiddenException } from '@nestjs/common';
+import { BadRequestException, ForbiddenException } from '@nestjs/common';
+import { createHmac, timingSafeEqual } from 'node:crypto';

 /**
 * Stub gateway endpoints auto-approve payments without a real provider.
@@ -12,3 +13,49 @@ export function assertStubGatewayAllowed(): void {
    throw new ForbiddenException('Payment gateway is not configured');
  }
 }
+
+function gatewaySigningSecret(): string {
+  return (
+    process.env.PAYMENT_GATEWAY_SIGNING_SECRET ||
+    process.env.JWT_SECRET ||
+    'default-jwt-secret'
+  );
+}
+
+function hmacSignature(payload: string): string {
+  return createHmac('sha256', gatewaySigningSecret()).update(payload).digest('hex').slice(0, 24);
+}
+
+/**
+ * Issue a tracking code that cryptographically binds the initiating user and
+ * amount, so `verify` cannot be replayed with a different (larger) amount.
+ * Format: PAY-<ts>-<rand>-<hmac(userId|amount|ts|rand)>
+ */
+export function issueGatewayTrackingCode(userId: string, amount: number): string {
+  const ts = Date.now().toString(36);
+  const rand = Math.random().toString(36).substring(2, 8).toUpperCase();
+  const sig = hmacSignature(`${userId}|${amount}|${ts}|${rand}`);
+  return `PAY-${ts}-${rand}-${sig}`;
+}
+
+/**
+ * Validate a tracking code issued by {@link issueGatewayTrackingCode} against
+ * the calling user and the amount being credited. Throws on any mismatch.
+ */
+export function assertGatewayTrackingCodeValid(
+  trackingCode: string,
+  userId: string,
+  amount: number,
+): void {
+  const parts = String(trackingCode || '').split('-');
+  if (parts.length !== 4 || parts[0] !== 'PAY') {
+    throw new BadRequestException('Invalid gateway tracking code');
+  }
+  const [, ts, rand, sig] = parts;
+  const expected = hmacSignature(`${userId}|${amount}|${ts}|${rand}`);
+  const a = Buffer.from(sig);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    throw new BadRequestException('Gateway tracking code does not match the payment details');
+  }
+}
@@ -4,8 +4,24 @@ import Redis from 'ioredis';
 import type { BuildProgress } from './build.service';

 const KEY_PREFIX = 'build:progress:';
+const SESSION_KEY_PREFIX = 'build:session:';
 const TTL_SECONDS = 3600;

+/**
+ * Serializable subset of an active build session, persisted to Redis so that
+ * after a backend restart the orphaned cluster resources (job, PVC, secret,
+ * helper pod) of interrupted builds can still be located and cleaned up.
+ */
+export interface PersistedBuildSession {
+  deploymentId: string;
+  applicationId?: string;
+  namespace?: string;
+  buildPodName?: string;
+  sourcePvcName?: string;
+  helperPodName?: string;
+  gitSecretName?: string;
+}
+
@Injectable()
 export class BuildProgressStore implements OnModuleDestroy {
  private readonly redis: Redis;
@@ -14,6 +30,7 @@ export class BuildProgressStore implements OnModuleDestroy {
    this.redis = new Redis({
      host: this.configService.get<string>('redis.host'),
      port: this.configService.get<number>('redis.port'),
+      password: this.configService.get<string>('redis.password'),
      lazyConnect: true,
      maxRetriesPerRequest: 1,
    });
@@ -52,6 +69,36 @@ export class BuildProgressStore implements OnModuleDestroy {
    }
  }

+  async setSession(session: PersistedBuildSession): Promise<void> {
+    try {
+      await this.redis.set(
+        `${SESSION_KEY_PREFIX}${session.deploymentId}`,
+        JSON.stringify(session),
+        'EX',
+        TTL_SECONDS,
+      );
+    } catch {
+      // Best-effort — cleanup falls back to prefix-based resource scan.
+    }
+  }
+
+  async getSession(deploymentId: string): Promise<PersistedBuildSession | null> {
+    try {
+      const raw = await this.redis.get(`${SESSION_KEY_PREFIX}${deploymentId}`);
+      return raw ? (JSON.parse(raw) as PersistedBuildSession) : null;
+    } catch {
+      return null;
+    }
+  }
+
+  async clearSession(deploymentId: string): Promise<void> {
+    try {
+      await this.redis.del(`${SESSION_KEY_PREFIX}${deploymentId}`);
+    } catch {
+      // ignore
+    }
+  }
+
  onModuleDestroy(): void {
    this.redis.disconnect();
  }
@@ -31,12 +31,14 @@ export class BuildCancelledError extends Error {

 interface ActiveBuildSession {
  cancelled: boolean;
+  applicationId?: string;
  coreApi?: k8s.CoreV1Api;
  batchApi?: k8s.BatchV1Api;
  namespace?: string;
  buildPodName?: string;
  sourcePvcName?: string;
  helperPodName?: string;
+  gitSecretName?: string;
  processes: ChildProcess[];
  socket?: net.Socket;
 }
@@ -68,8 +70,71 @@ export class BuildService {
    private sourceStorage: SourceStorageService,
  ) {}

-  private beginBuildSession(deploymentId: string): void {
-    this.activeBuilds.set(deploymentId, { cancelled: false, processes: [] });
+  /**
+   * Prefix Docker Hub base images with the configured mirror registry
+   * (BASE_IMAGE_REGISTRY), so generated Dockerfiles work on clusters that
+   * cannot reach docker.io. Images already pinned to another registry
+   * (gcr.io, mcr.microsoft.com, …) are returned unchanged.
+   */
+  private baseImage(image: string): string {
+    const prefix = this.configService.get<string>('build.baseImageRegistry');
+    if (!prefix) return image;
+    const firstSegment = image.split('/')[0];
+    const hasRegistry = firstSegment.includes('.') || firstSegment.includes(':');
+    if (hasRegistry) return image;
+    return `${prefix}/${image}`;
+  }
+
+  /**
+   * Git branch names come from users and end up in a shell command — accept
+   * only conservative ref characters and reject anything option-like.
+   */
+  private assertSafeGitBranch(branch: string): string {
+    const b = (branch || '').trim();
+    if (!b || b.length > 255 || b.startsWith('-') || b.includes('..') || !/^[A-Za-z0-9._/-]+$/.test(b)) {
+      throw new Error(`Invalid git branch name: "${branch}"`);
+    }
+    return b;
+  }
+
+  /**
+   * SSRF guard for user-supplied repo URLs: only http(s), no embedded
+   * credentials, and no loopback/link-local/private or cluster-internal hosts.
+   */
+  private assertSafeGitUrl(gitUrl: string): void {
+    let url: URL;
+    try {
+      url = new URL(gitUrl);
+    } catch {
+      throw new Error(`Invalid git URL: "${gitUrl}"`);
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+      throw new Error(`Unsupported git URL protocol: "${url.protocol}" — only http(s) is allowed`);
+    }
+    if (url.username || url.password) {
+      throw new Error('Git URL must not contain embedded credentials — use the git token field instead');
+    }
+    const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    const blockedHosts = ['localhost', 'metadata.google.internal'];
+    const blockedSuffixes = ['.local', '.localhost', '.internal', '.svc', '.svc.cluster.local', '.cluster.local'];
+    const isPrivateIPv4 =
+      /^(127\.|10\.|192\.168\.|169\.254\.|0\.)/.test(host) ||
+      /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+    const isIPv6Internal = host === '::1' || host.startsWith('fe80:') || host.startsWith('fc') || host.startsWith('fd');
+    if (
+      blockedHosts.includes(host) ||
+      blockedSuffixes.some((s) => host.endsWith(s)) ||
+      isPrivateIPv4 ||
+      isIPv6Internal ||
+      !host.includes('.')
+    ) {
+      throw new Error(`Git URL host "${url.hostname}" is not allowed`);
+    }
+  }
+
+  private beginBuildSession(deploymentId: string, applicationId?: string): void {
+    this.activeBuilds.set(deploymentId, { cancelled: false, processes: [], applicationId });
+    this.persistSession(deploymentId);
  }

  private getSession(deploymentId?: string): ActiveBuildSession | undefined {
@@ -80,6 +145,26 @@ export class BuildService {
  private updateBuildSession(deploymentId: string, update: Partial<ActiveBuildSession>): void {
    const session = this.activeBuilds.get(deploymentId);
    if (session) Object.assign(session, update);
+    this.persistSession(deploymentId);
+  }
+
+  /**
+   * Mirror the serializable part of the session to Redis, so interrupted
+   * builds can be detected and their cluster resources cleaned up after a
+   * backend restart (the in-memory map does not survive restarts).
+   */
+  private persistSession(deploymentId: string): void {
+    const session = this.activeBuilds.get(deploymentId);
+    if (!session) return;
+    void this.progressStore.setSession({
+      deploymentId,
+      applicationId: session.applicationId,
+      namespace: session.namespace,
+      buildPodName: session.buildPodName,
+      sourcePvcName: session.sourcePvcName,
+      helperPodName: session.helperPodName,
+      gitSecretName: session.gitSecretName,
+    });
  }

  private registerProcess(deploymentId: string | undefined, proc: ChildProcess): void {
@@ -122,7 +207,10 @@ export class BuildService {
  }

  private endBuildSession(deploymentId?: string): void {
-    if (deploymentId) this.activeBuilds.delete(deploymentId);
+    if (deploymentId) {
+      this.activeBuilds.delete(deploymentId);
+      void this.progressStore.clearSession(deploymentId);
+    }
  }

  async cancelBuild(deploymentId: string): Promise<void> {
@@ -154,7 +242,7 @@ export class BuildService {
      }
    }

-    const { coreApi, batchApi, namespace, buildPodName, sourcePvcName, helperPodName } = session;
+    const { coreApi, batchApi, namespace, buildPodName, sourcePvcName, helperPodName, gitSecretName } = session;
    if (coreApi && namespace) {
      const cleanup: Promise<unknown>[] = [];
      if (helperPodName) {
@@ -200,6 +288,11 @@ export class BuildService {
            .catch(() => undefined),
        );
      }
+      if (gitSecretName) {
+        cleanup.push(
+          coreApi.deleteNamespacedSecret({ name: gitSecretName, namespace }).catch(() => undefined),
+        );
+      }
      await Promise.all(cleanup);
      this.logger.log(`Cleaned up K8s build resources for deployment ${deploymentId}`);
    }
@@ -209,7 +302,7 @@ export class BuildService {
      percent: 0,
      message: 'Cancelled by user',
    });
-    this.activeBuilds.delete(deploymentId);
+    this.endBuildSession(deploymentId);
  }

  /** Delete all in-flight build artifacts for an app (helper pods, jobs, PVCs, configmaps). */
@@ -226,13 +319,14 @@ export class BuildService {

    const cleanup: Promise<unknown>[] = [];

-    const [pods, pvcs, jobs, configMaps] = await Promise.all([
+    const [pods, pvcs, jobs, configMaps, secrets] = await Promise.all([
      coreApi.listNamespacedPod({ namespace: buildNamespace }),
      coreApi.listNamespacedPersistentVolumeClaim({
        namespace: buildNamespace,
      }),
      batchApi.listNamespacedJob({ namespace: buildNamespace }),
      coreApi.listNamespacedConfigMap({ namespace: buildNamespace }),
+      coreApi.listNamespacedSecret({ namespace: buildNamespace }),
    ]);

    for (const pod of pods.items) {
@@ -283,6 +377,12 @@ export class BuildService {
        cleanup.push(coreApi.deleteNamespacedConfigMap({ name, namespace: buildNamespace }).catch(() => undefined));
      }
    }
+    for (const secret of secrets.items) {
+      const name = secret.metadata?.name || '';
+      if (name.startsWith(prefix)) {
+        cleanup.push(coreApi.deleteNamespacedSecret({ name, namespace: buildNamespace }).catch(() => undefined));
+      }
+    }

    await Promise.all(cleanup);
    this.logger.log(`Cleaned up all build resources matching "${prefix}*" in ${buildNamespace}`);
@@ -320,7 +420,7 @@ export class BuildService {
    this.logger.log(`Starting image build for ${app.name} → ${imageUri}`);

    if (deploymentId) {
-      this.beginBuildSession(deploymentId);
+      this.beginBuildSession(deploymentId, app.id);
    }

    const hasUploadedCode = !!app.codePath;
@@ -389,6 +489,8 @@ export class BuildService {

    // If we have uploaded code, create a PVC and upload via kubectl cp
    let sourcePvcName: string | undefined;
+    // Secret holding the git token for private-repo clones (created lazily)
+    let gitSecretName: string | undefined;
    if (hasUploadedCode && localZipPath) {
      sourcePvcName = `${buildPodName}-source`;
      if (deploymentId) {
@@ -446,7 +548,7 @@ export class BuildService {
      // Add init container that unzips the source code from PVC
      initContainers.push({
        name: 'unzip-source',
-        image: 'alpine:3.19',
+        image: this.baseImage('alpine:3.19'),
        imagePullPolicy: 'IfNotPresent',
        command: [
          'sh',
@@ -493,36 +595,60 @@ export class BuildService {
        ],
      });
    } else if (hasGitUrl) {
-      // Build the git clone URL — inject token for private repos
-      let cloneUrl = app.gitUrl!;
+      // Validate user-controlled values before they get anywhere near a shell.
+      this.assertSafeGitUrl(app.gitUrl!);
+      const branch = this.assertSafeGitBranch(app.gitBranch || 'main');
+
+      // The token never appears in the command line or the clone URL — it is
+      // delivered via a Secret env var and handed to git through GIT_ASKPASS,
+      // so it can't leak through pod specs, `ps`, or job logs.
      if (app.gitToken) {
-        // Convert https://github.com/user/repo.git → https://<token>@github.com/user/repo.git
-        // Also works for GitLab, Bitbucket, etc.
-        try {
-          const url = new URL(cloneUrl);
-          url.username = app.gitToken;
-          url.password = ''; // Some providers use token as username, others as password
-          cloneUrl = url.toString();
-        } catch {
-          // If URL parsing fails, try simple injection after protocol
-          cloneUrl = cloneUrl.replace('https://', `https://${app.gitToken}@`);
-        }
+        gitSecretName = `${buildPodName}-git`;
+        if (deploymentId) this.updateBuildSession(deploymentId, { gitSecretName });
+        await coreApi.createNamespacedSecret({
+          namespace: buildNamespace!,
+          body: {
+            apiVersion: 'v1',
+            kind: 'Secret',
+            metadata: { name: gitSecretName, namespace: buildNamespace },
+            type: 'Opaque',
+            stringData: { GIT_TOKEN: app.gitToken },
+          },
+        });
      }
-      const branch = app.gitBranch || 'main';

      // Clone git repo into /workspace/source, then copy our generated Dockerfile
      initContainers.push({
        name: 'git-clone',
-        image: 'alpine/git:2.43.0',
+        image: this.baseImage('alpine/git:2.43.0'),
        imagePullPolicy: 'IfNotPresent',
+        env: [
+          { name: 'GIT_URL', value: app.gitUrl! },
+          { name: 'GIT_BRANCH', value: branch },
+          ...(gitSecretName
+            ? [
+                {
+                  name: 'GIT_TOKEN',
+                  valueFrom: { secretKeyRef: { name: gitSecretName, key: 'GIT_TOKEN' } },
+                },
+              ]
+            : []),
+        ],
        command: [
          'sh',
          '-c',
          `
-          echo ">>> Cloning branch '${branch}' from ${app.gitUrl}" &&
-          git clone --depth 1 --branch ${branch} ${cloneUrl} /workspace-out/source &&
-          cp /dockerfile/Dockerfile /workspace-out/Dockerfile &&
-          echo ">>> Workspace contents:" &&
+          set -e
+          if [ -n "\${GIT_TOKEN:-}" ]; then
+            printf '#!/bin/sh\\necho "$GIT_TOKEN"\\n' > /tmp/git-askpass.sh
+            chmod +x /tmp/git-askpass.sh
+            export GIT_ASKPASS=/tmp/git-askpass.sh
+            export GIT_TERMINAL_PROMPT=0
+          fi
+          echo ">>> Cloning branch '$GIT_BRANCH' from $GIT_URL"
+          git clone --depth 1 --branch "$GIT_BRANCH" "$GIT_URL" /workspace-out/source
+          cp /dockerfile/Dockerfile /workspace-out/Dockerfile
+          echo ">>> Workspace contents:"
          ls -la /workspace-out/source/
        `,
        ],
@@ -545,7 +671,7 @@ export class BuildService {
      // add an init container that creates empty source dir + copies Dockerfile
      initContainers.push({
        name: 'prepare-workspace',
-        image: 'alpine:3.19',
+        image: this.baseImage('alpine:3.19'),
        imagePullPolicy: 'IfNotPresent',
        command: [
          'sh',
@@ -586,8 +712,14 @@ export class BuildService {
                args: kanikoArgs,
                volumeMounts: kanikoVolumeMounts,
                resources: {
-                  requests: { cpu: '500m', memory: '1Gi' },
-                  limits: { cpu: '2', memory: '4Gi' },
+                  requests: {
+                    cpu: this.configService.get<string>('build.kaniko.cpuRequest') || '500m',
+                    memory: this.configService.get<string>('build.kaniko.memoryRequest') || '1Gi',
+                  },
+                  limits: {
+                    cpu: this.configService.get<string>('build.kaniko.cpuLimit') || '2',
+                    memory: this.configService.get<string>('build.kaniko.memoryLimit') || '4Gi',
+                  },
                },
              },
            ],
@@ -666,6 +798,17 @@ export class BuildService {
      } catch (e: any) {
        this.logger.warn(`Failed to clean up ConfigMap: ${e.message}`);
      }
+      // Clean up git-token Secret
+      if (gitSecretName) {
+        try {
+          await coreApi.deleteNamespacedSecret({
+            name: gitSecretName,
+            namespace: buildNamespace!,
+          });
+        } catch (e: any) {
+          this.logger.warn(`Failed to clean up git Secret: ${e.message}`);
+        }
+      }
      this.endBuildSession(deploymentId);
      cleanupSource?.();
    }
@@ -780,6 +923,8 @@ export class BuildService {
        metadata: { name: pvcName, namespace },
        spec: {
          accessModes: ['ReadWriteOnce'],
+          // Explicit StorageClass — don't rely on a cluster default existing
+          storageClassName: this.configService.get<string>('platform.storageClass') || undefined,
          resources: { requests: { storage: `${sizeGi}Gi` } },
        },
      },
@@ -797,7 +942,7 @@ export class BuildService {
        containers: [
          {
            name: 'helper',
-            image: 'alpine:3.19',
+            image: this.baseImage('alpine:3.19'),
            imagePullPolicy: 'IfNotPresent',
            command: ['sh', '-c', 'sleep 3600'],
            volumeMounts: [{ name: 'source', mountPath: '/data' }],
@@ -1012,10 +1157,12 @@ export class BuildService {
    const port = app.port || 3000;
    const nodeVersion = app.runtimeVersion || '20';
    return `# --- Build stage ---
-FROM node:${nodeVersion}-alpine AS builder
+FROM ${this.baseImage(`node:${nodeVersion}-alpine`)} AS builder
 WORKDIR /app
 COPY package*.json ./
-RUN npm install --legacy-peer-deps && npm cache clean --force
+# Reproducible install from the lockfile when present
+RUN if [ -f package-lock.json ]; then npm ci --legacy-peer-deps; else npm install --legacy-peer-deps; fi \\
+    && npm cache clean --force
 COPY . .

 # Auto-detect Next.js and enable standalone output
@@ -1031,13 +1178,19 @@ RUN for cfg in next.config.js next.config.mjs next.config.ts; do \\
      break; \\
    done

-RUN npm run build || echo ">>> Build script failed or not found — continuing"
+# Run the build script when one exists — and FAIL the image build if it fails,
+# instead of silently shipping a broken image.
+RUN if node -e "const s=(require('./package.json').scripts||{});process.exit(s.build?0:1)"; then \\
+      echo ">>> Running build script" && npm run build; \\
+    else \\
+      echo ">>> No build script defined — skipping"; \\
+    fi

 # Clean up dev dependencies and caches to reduce image size
 RUN rm -rf node_modules/.cache .next/cache /tmp/* /root/.npm 2>/dev/null; true

 # --- Production stage ---
-FROM node:${nodeVersion}-alpine AS runner
+FROM ${this.baseImage(`node:${nodeVersion}-alpine`)} AS runner
 WORKDIR /app
 RUN addgroup -g 1001 -S appgroup && adduser -S appuser -u 1001

@@ -1070,9 +1223,9 @@ CMD ["sh", "-c", "if [ \\"$(cat /app/.mode)\\" = \\"standalone\\" ] && [ -f serv
    const phpVersion = app.phpVersion || '8.3';
    const port = app.port || 80;
    return `# --- Build stage (match production PHP version for Composer) ---
-FROM php:${phpVersion}-cli-alpine AS composer
+FROM ${this.baseImage(`php:${phpVersion}-cli-alpine`)} AS composer
 RUN apk add --no-cache git unzip
-COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+COPY --from=${this.baseImage('composer:2')} /usr/bin/composer /usr/bin/composer
 WORKDIR /app
 COPY composer.json composer.lock* ./
 RUN composer install --no-dev --no-scripts --no-autoloader --prefer-dist --ignore-platform-reqs
@@ -1080,11 +1233,15 @@ COPY . .
 RUN composer dump-autoload --optimize --no-dev --no-scripts

 # --- Production stage ---
-FROM php:${phpVersion}-fpm-alpine
+FROM ${this.baseImage(`php:${phpVersion}-fpm-alpine`)}

-RUN apk add --no-cache nginx supervisor curl openssl \\
-    && docker-php-ext-install pdo pdo_mysql opcache \\
-    && docker-php-ext-install pdo_pgsql 2>/dev/null || true
+# Laravel needs bcmath/gd/intl/zip beyond the built-in set; pdo_pgsql is built
+# properly against libpq instead of being silently skipped.
+RUN apk add --no-cache nginx supervisor curl openssl icu-libs libzip libpng libjpeg-turbo freetype postgresql-libs \\
+    && apk add --no-cache --virtual .build-deps icu-dev libzip-dev libpng-dev libjpeg-turbo-dev freetype-dev postgresql-dev \\
+    && docker-php-ext-configure gd --with-jpeg --with-freetype \\
+    && docker-php-ext-install -j$(nproc) pdo pdo_mysql pdo_pgsql opcache bcmath zip gd intl exif pcntl \\
+    && apk del .build-deps

 WORKDIR /var/www/html
 COPY --from=composer /app .
@@ -1163,7 +1320,7 @@ CMD ["/usr/local/bin/cloudhost-laravel-entrypoint.sh"]
    const phpVersion = app.phpVersion || '8.3';
    const hasUploadedCode = !!app.codePath;

-    return `FROM wordpress:${wpVersion}-php${phpVersion}-apache
+    return `FROM ${this.baseImage(`wordpress:${wpVersion}-php${phpVersion}-apache`)}

 # Install additional PHP extensions commonly needed by WordPress
 RUN docker-php-ext-install opcache
@@ -1281,7 +1438,7 @@ CMD []`
    const port = app.port || 8080;
    const buildTarget = detectGoBuildTarget(archiveEntries);
    return `# --- Build stage ---
-FROM golang:${goVersion}-alpine AS builder
+FROM ${this.baseImage(`golang:${goVersion}-alpine`)} AS builder
 WORKDIR /app

 # Install git for fetching dependencies
@@ -1297,8 +1454,13 @@ COPY . .
 # Build the application
 RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -ldflags="-w -s" -o main ${buildTarget}

+# Collect optional runtime asset dirs — COPY has no shell so "|| true" is not
+# valid there; stage them in the builder instead.
+RUN mkdir -p /assets \\
+    && for d in static templates public; do [ -d "$d" ] && cp -r "$d" /assets/ || true; done
+
 # --- Production stage ---
-FROM alpine:3.19
+FROM ${this.baseImage('alpine:3.19')}
 WORKDIR /app

 # Add CA certificates for HTTPS requests
@@ -1307,11 +1469,9 @@ RUN apk --no-cache add ca-certificates tzdata
 # Create non-root user
 RUN addgroup -g 1001 -S appgroup && adduser -S appuser -u 1001 -G appgroup

-# Copy the binary from builder
+# Copy the binary and any staged asset dirs from the builder
 COPY --from=builder /app/main .
-COPY --from=builder /app/static ./static 2>/dev/null || true
-COPY --from=builder /app/templates ./templates 2>/dev/null || true
-COPY --from=builder /app/public ./public 2>/dev/null || true
+COPY --from=builder /assets/ ./

 # Create data directory for persistent storage
 RUN mkdir -p /app/data && chown -R appuser:appgroup /app
@@ -1331,16 +1491,14 @@ CMD ["./main"]
  private phpDockerfile(app: Application): string {
    const phpVersion = app.phpVersion || '8.3';
    const port = app.port || 80;
-    return `FROM php:${phpVersion}-fpm-alpine
+    return `FROM ${this.baseImage(`php:${phpVersion}-fpm-alpine`)}

-RUN apk add --no-cache nginx supervisor curl \\
-    && docker-php-ext-install pdo pdo_mysql opcache \\
-    && docker-php-ext-install pdo_pgsql 2>/dev/null || true
-
-# Install common PHP extensions
-RUN apk add --no-cache libpng-dev libjpeg-turbo-dev freetype-dev \\
+# Install common PHP extensions (pdo_pgsql built properly against libpq)
+RUN apk add --no-cache nginx supervisor curl postgresql-libs libpng libjpeg-turbo freetype \\
+    && apk add --no-cache --virtual .build-deps postgresql-dev libpng-dev libjpeg-turbo-dev freetype-dev \\
    && docker-php-ext-configure gd --with-freetype --with-jpeg \\
-    && docker-php-ext-install gd
+    && docker-php-ext-install -j$(nproc) pdo pdo_mysql pdo_pgsql opcache gd \\
+    && apk del .build-deps

 WORKDIR /var/www/html
 COPY . .
@@ -1401,7 +1559,7 @@ CMD ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
    const pythonVersion = app.runtimeVersion || '3.12';
    const port = app.port || 8000;
    return `# --- Build stage ---
-FROM python:${pythonVersion}-slim AS builder
+FROM ${this.baseImage(`python:${pythonVersion}-slim`)} AS builder
 WORKDIR /app

 # Install build dependencies
@@ -1409,13 +1567,20 @@ RUN apt-get update && apt-get install -y --no-install-recommends \\
    build-essential libpq-dev \\
    && rm -rf /var/lib/apt/lists/*

-# Copy requirements and install dependencies
-COPY requirements.txt* ./
-RUN pip install --no-cache-dir --user -r requirements.txt 2>/dev/null || \\
-    pip install --no-cache-dir --user flask gunicorn
+# Install dependencies from requirements.txt or pyproject.toml. A failing
+# install FAILS the build — no silent fallback that hides missing deps.
+COPY . .
+RUN if [ -f requirements.txt ]; then \\
+      echo ">>> Installing from requirements.txt" && pip install --no-cache-dir --user -r requirements.txt; \\
+    elif [ -f pyproject.toml ]; then \\
+      echo ">>> Installing from pyproject.toml" && pip install --no-cache-dir --user .; \\
+    else \\
+      echo ">>> No requirements.txt or pyproject.toml — installing default flask+gunicorn" \\
+      && pip install --no-cache-dir --user flask gunicorn; \\
+    fi

 # --- Production stage ---
-FROM python:${pythonVersion}-slim
+FROM ${this.baseImage(`python:${pythonVersion}-slim`)}
 WORKDIR /app

 # Install runtime dependencies
@@ -1455,21 +1620,28 @@ CMD sh -c "if [ -f main.py ]; then if grep -qi fastapi main.py; then exec uvicor
    const port = app.port || 8000;
    const settingsModule = detectDjangoSettingsModule(archiveEntries);
    return `# --- Build stage ---
-FROM python:${pythonVersion}-slim AS builder
+FROM ${this.baseImage(`python:${pythonVersion}-slim`)} AS builder
 WORKDIR /app

 # Install build dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \\
-    build-essential libpq-dev \\
+    build-essential libpq-dev default-libmysqlclient-dev pkg-config \\
    && rm -rf /var/lib/apt/lists/*

-# Copy requirements and install dependencies
-COPY requirements.txt* ./
-RUN pip install --no-cache-dir --user -r requirements.txt 2>/dev/null || \\
-    pip install --no-cache-dir --user django gunicorn psycopg2-binary mysqlclient
+# Install dependencies from requirements.txt or pyproject.toml. A failing
+# install FAILS the build — no silent fallback that hides missing deps.
+COPY . .
+RUN if [ -f requirements.txt ]; then \\
+      echo ">>> Installing from requirements.txt" && pip install --no-cache-dir --user -r requirements.txt; \\
+    elif [ -f pyproject.toml ]; then \\
+      echo ">>> Installing from pyproject.toml" && pip install --no-cache-dir --user .; \\
+    else \\
+      echo ">>> No requirements.txt or pyproject.toml — installing Django defaults" \\
+      && pip install --no-cache-dir --user django gunicorn psycopg2-binary mysqlclient; \\
+    fi

 # --- Production stage ---
-FROM python:${pythonVersion}-slim
+FROM ${this.baseImage(`python:${pythonVersion}-slim`)}
 WORKDIR /app

 # Install runtime dependencies
@@ -82,6 +82,7 @@ export default () => ({
  redis: {
    host: process.env.REDIS_HOST || 'localhost',
    port: parseInt(process.env.REDIS_PORT || '6379', 10),
+    password: process.env.REDIS_PASSWORD || undefined,
  },

  cluster: {
@@ -133,6 +134,20 @@ export default () => ({
  build: {
    namespace: process.env.BUILD_NAMESPACE || 'cloudhost-builds',
    serviceAccount: process.env.BUILD_SERVICE_ACCOUNT || 'kaniko-builder',
+    /**
+     * Optional registry prefix for Docker Hub base images used in generated
+     * Dockerfiles and managed-service charts (e.g. "mirror.example.com" makes
+     * `node:20-alpine` → `mirror.example.com/node:20-alpine`). Useful when
+     * cluster nodes cannot reach docker.io directly.
+     */
+    baseImageRegistry: (process.env.BASE_IMAGE_REGISTRY || '').trim().replace(/\/+$/, ''),
+    /** Kaniko build container resources — tune for large images. */
+    kaniko: {
+      cpuRequest: process.env.KANIKO_CPU_REQUEST || '500m',
+      cpuLimit: process.env.KANIKO_CPU_LIMIT || '2',
+      memoryRequest: process.env.KANIKO_MEMORY_REQUEST || '1Gi',
+      memoryLimit: process.env.KANIKO_MEMORY_LIMIT || '4Gi',
+    },
  },

  elasticsearch: {
@@ -28,12 +28,24 @@ describe('validateProductionConfig', () => {
    expect(() => validateProductionConfig()).toThrow(/CLUSTER_KUBECONFIG_KEY/);
  });

+  it('throws in production when elastic credentials keep the well-known defaults', () => {
+    process.env.NODE_ENV = 'production';
+    process.env.JWT_SECRET = 'a-very-long-random-production-secret';
+    process.env.JWT_REFRESH_SECRET = 'another-very-long-random-refresh-secret';
+    process.env.DB_PASSWORD = 'strong-db-password-here';
+    process.env.CLUSTER_KUBECONFIG_KEY = '0123456789abcdef0123456789abcdef';
+    process.env.ELASTIC_PASSWORD = 'CloudHost2024!Secure';
+
+    expect(() => validateProductionConfig()).toThrow(/ELASTIC_PASSWORD/);
+  });
+
  it('passes in production with strong secrets', () => {
    process.env.NODE_ENV = 'production';
    process.env.JWT_SECRET = 'a-very-long-random-production-secret';
    process.env.JWT_REFRESH_SECRET = 'another-very-long-random-refresh-secret';
    process.env.DB_PASSWORD = 'strong-db-password-here';
    process.env.CLUSTER_KUBECONFIG_KEY = '0123456789abcdef0123456789abcdef';
+    process.env.ELASTIC_PASSWORD = 'a-strong-rotated-elastic-password';

    expect(() => validateProductionConfig()).not.toThrow();
  });
@@ -25,6 +25,14 @@ export function validateProductionConfig(): void {
  if (!process.env.CLUSTER_KUBECONFIG_KEY?.trim()) {
    errors.push('CLUSTER_KUBECONFIG_KEY must be set in production to encrypt stored kubeconfigs');
  }
+  // Elastic log-stack credentials must not fall back to the well-known dev defaults.
+  const elasticDefaults = ['CloudHost2024!Secure', 'FluentBit2024!Writer', 'Kibana2024!System'];
+  if (!process.env.ELASTIC_PASSWORD || elasticDefaults.includes(process.env.ELASTIC_PASSWORD)) {
+    errors.push('ELASTIC_PASSWORD must be set to a strong random value in production');
+  }
+  if (process.env.FLUENTBIT_PASSWORD && elasticDefaults.includes(process.env.FLUENTBIT_PASSWORD)) {
+    errors.push('FLUENTBIT_PASSWORD must be changed from the default in production');
+  }

  if (errors.length > 0) {
    throw new Error(
@@ -1,6 +1,6 @@
-import { Injectable, NotFoundException, BadRequestException, Logger, Inject, forwardRef } from '@nestjs/common';
+import { Injectable, NotFoundException, BadRequestException, Logger, Inject, forwardRef, OnModuleInit } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
+import { In, Repository } from 'typeorm';
 import * as fs from 'fs';
 import { Deployment } from './entities/deployment.entity';
 import { ApplicationsService } from '../applications/applications.service';
@@ -16,7 +16,7 @@ import {
 import { ClustersService } from '../clusters/clusters.service';

@Injectable()
-export class DeploymentsService {
+export class DeploymentsService implements OnModuleInit {
  private readonly logger = new Logger(DeploymentsService.name);

  constructor(
@@ -29,6 +29,46 @@ export class DeploymentsService {
    private clustersService: ClustersService,
  ) {}

+  /**
+   * Recover from a backend restart: any deployment still marked as in-flight
+   * belonged to a pipeline running in the old process and will never finish.
+   * Mark it failed and best-effort clean up its orphaned build resources
+   * (Kaniko job, source PVC, helper pod, git secret) in the cluster.
+   */
+  onModuleInit(): void {
+    void this.failInterruptedDeployments().catch((err) =>
+      this.logger.error('Failed to recover interrupted deployments on startup', err),
+    );
+  }
+
+  private async failInterruptedDeployments(): Promise<void> {
+    const stuck = await this.deploymentsRepository.find({
+      where: {
+        status: In([DeploymentStatus.PENDING, DeploymentStatus.BUILDING, DeploymentStatus.DEPLOYING]),
+      },
+    });
+    if (stuck.length === 0) return;
+
+    this.logger.warn(`Found ${stuck.length} deployment(s) interrupted by a restart — marking as failed`);
+    for (const deployment of stuck) {
+      await this.deploymentsRepository.update(deployment.id, {
+        status: DeploymentStatus.FAILED,
+        errorMessage: 'Build interrupted by a platform restart — please redeploy',
+      });
+      this.buildService.setProgress(deployment.id, {
+        phase: 'failed',
+        percent: 0,
+        message: 'Build interrupted by a platform restart',
+      });
+      try {
+        const app = await this.applicationsService.findOne(deployment.applicationId);
+        if (app) await this.buildService.cleanupBuildResourcesForApp(app);
+      } catch (err: any) {
+        this.logger.warn(`Cleanup of interrupted deployment ${deployment.id} failed: ${err.message}`);
+      }
+    }
+  }
+
  /**
   * Random 7-digit suffix for the preview host: <userId>-<7-digit>.<baseDomain>.
   * Generated once per application (see resolvePreviewNumber) and persisted.
@@ -58,6 +98,8 @@ export class DeploymentsService {
  async triggerDeployment(applicationId: string, userId: string): Promise<Deployment> {
    const app = await this.applicationsService.findOne(applicationId, userId);

+    this.ensureAppPaidAndActive(app, 'deploying');
+
    // Create deployment record
    const deployment = this.deploymentsRepository.create({
      applicationId: app.id,
@@ -451,15 +493,20 @@ export class DeploymentsService {
    return app.latestImageTag === MANAGED_DEPLOY_MARKER;
  }

-  private ensureRedeployAllowed(app: any): void {
-    if (!app.billingCycle) return;
-
+  /**
+   * All deploy/start/redeploy operations require the app to be paid for:
+   * activated (billingCycle set via wallet/pay), lifecycle ACTIVE, and paid
+   * time remaining. Prevents deploying/resuming without payment.
+   */
+  private ensureAppPaidAndActive(app: any, action = 'deploying'): void {
    const isActive = app.lifecycleStatus === AppLifecycleStatus.ACTIVE;
    const expiresAt = app.planExpiresAt ? new Date(app.planExpiresAt) : null;
    const hasPaidTimeRemaining = !!expiresAt && expiresAt > new Date();

-    if (!isActive || !hasPaidTimeRemaining) {
-      throw new BadRequestException('Payment must be completed successfully before redeploying this application.');
+    if (!app.billingCycle || !isActive || !hasPaidTimeRemaining) {
+      throw new BadRequestException(
+        `Payment must be completed successfully before ${action} this application.`,
+      );
    }
  }

@@ -636,6 +683,9 @@ export class DeploymentsService {

  async startDeployment(applicationId: string, userId: string): Promise<Deployment | null> {
    const app = await this.applicationsService.findOne(applicationId, userId);
+    // Prevent resuming a billing-suspended/expired app without payment —
+    // otherwise `start` bypasses the lifecycle suspension entirely.
+    this.ensureAppPaidAndActive(app, 'starting');
    await this.kubernetesService.resumeApplication(app);
    await this.applicationsService.clearSuspendedReplicas(app.id);

@@ -671,7 +721,7 @@ export class DeploymentsService {
      throw new NotFoundException('No source code available. Upload code or set a git URL first.');
    }

-    this.ensureRedeployAllowed(app);
+    this.ensureAppPaidAndActive(app, 'redeploying');

    // Create new deployment record
    const deployment = this.deploymentsRepository.create({
@@ -5,6 +5,7 @@ import * as crypto from 'crypto';
 import { ChildProcess, spawn } from 'child_process';
 import { ClustersService } from '../clusters/clusters.service';
 import { HelmService, LOGGING_HELM_NAMESPACE, LOGGING_HELM_RELEASE } from './helm.service';
+import { userNamespace } from './k8s-workload.util';

 interface ElasticsearchCredentials {
  username: string;
@@ -97,9 +98,9 @@ export class ElasticsearchService implements OnModuleInit, OnModuleDestroy {
    private configService: ConfigService,
    private helmService: HelmService,
  ) {
-    this.ELASTIC_PASSWORD = this.configService.get('elasticsearch.password') || 'CloudHost2024!Secure';
-    this.FLUENTBIT_PASSWORD = this.configService.get('elasticsearch.fluentbitPassword') || 'FluentBit2024!Writer';
-    this.KIBANA_SYSTEM_PASSWORD = this.configService.get('elasticsearch.kibanaPassword') || 'Kibana2024!System';
+    this.ELASTIC_PASSWORD = this.configService.get('elasticsearch.password') || '';
+    this.FLUENTBIT_PASSWORD = this.configService.get('elasticsearch.fluentbitPassword') || '';
+    this.KIBANA_SYSTEM_PASSWORD = this.configService.get('elasticsearch.kibanaPassword') || '';
  }

  async onModuleInit(): Promise<void> {
@@ -649,7 +650,7 @@ export class ElasticsearchService implements OnModuleInit, OnModuleDestroy {
  generateUserCredentials(userId: string): ElasticsearchCredentials {
    const hash = crypto.createHash('sha256').update(`${userId}-${this.ELASTIC_PASSWORD}`).digest('hex');
    return {
-      username: `user-${userId.split('-')[0]}`,
+      username: userNamespace(userId),
      password: hash.substring(0, 24),
    };
  }
@@ -666,16 +667,16 @@ export class ElasticsearchService implements OnModuleInit, OnModuleDestroy {
   * Get index pattern for a user's applications
   */
  getIndexPattern(userId: string): string {
-    const userPrefix = userId.split('-')[0];
-    return `logs-user-${userPrefix}-*`;
+    return `logs-${userNamespace(userId)}-*`;
  }

  /**
   * Build must clauses for user log isolation (new + legacy fields).
   */
  buildUserLogMustClauses(userId: string, filters: LogSearchFilters = {}): any[] {
-    const userPrefix = userId.split('-')[0];
-    const namespace = `user-${userPrefix}`;
+    // Full-UUID namespace — a truncated prefix would match other tenants'
+    // namespaces and leak their logs.
+    const namespace = userNamespace(userId);

    const must: any[] = [
      {
@@ -758,7 +759,7 @@ export class ElasticsearchService implements OnModuleInit, OnModuleDestroy {
  }

  getUserIndexPattern(userId: string): string {
-    return `logs-user-${userId.split('-')[0]}-*`;
+    return `logs-${userNamespace(userId)}-*`;
  }

  private elasticsearchFetch(url: string, auth: string, body: unknown): Promise<Response> {
@@ -125,11 +125,11 @@ describe('KubernetesService — k8s v1 client shape', () => {
    expect(logs).toBe('hello logs');

    const listArg = coreApi.listNamespacedPod.mock.calls[0][0];
-    expect(listArg).toMatchObject({ namespace: 'user-abc123' });
+    expect(listArg).toMatchObject({ namespace: 'user-abc123def456' });
    expect(typeof listArg.labelSelector).toBe('string');

    const logArg = coreApi.readNamespacedPodLog.mock.calls[0][0];
-    expect(logArg).toMatchObject({ name: 'pod-1', namespace: 'user-abc123', tailLines: 200 });
+    expect(logArg).toMatchObject({ name: 'pod-1', namespace: 'user-abc123def456', tailLines: 200 });
  });

  it('getDatabasePvcSize reads the PVC with v1 object args and unwrapped spec', async () => {
@@ -144,7 +144,7 @@ describe('KubernetesService — k8s v1 client shape', () => {

    expect(size).toBe('5Gi');
    const arg = coreApi.readNamespacedPersistentVolumeClaim.mock.calls[0][0];
-    expect(arg).toMatchObject({ name: 'my-app-db', namespace: 'user-abc123' });
+    expect(arg).toMatchObject({ name: 'my-app-db', namespace: 'user-abc123def456' });
  });

  it('scaleDeployment patches with the v1 object body and a header-options 2nd arg', async () => {
@@ -157,7 +157,7 @@ describe('KubernetesService — k8s v1 client shape', () => {
    const [param, options] = appsApi.patchNamespacedDeployment.mock.calls[0];
    expect(param).toMatchObject({
      name: 'my-app',
-      namespace: 'user-abc123',
+      namespace: 'user-abc123def456',
      body: { spec: { replicas: 3 } },
    });
    // v1 takes the merge-patch content-type via the 2nd ConfigurationOptions arg
@@ -1,9 +1,18 @@
 import { Application } from '../applications/entities/application.entity';
 import { DatabaseType, isManagedProductType } from '../common/enums';

-/** Kubernetes namespace for a user's applications. */
+/**
+ * Collision-free slug for a user id: the full UUID with dashes stripped
+ * (32 hex chars). Never truncate the UUID — truncated prefixes collide
+ * between users and break tenant isolation (shared namespaces/logs).
+ */
+export function userIdSlug(userId: string): string {
+  return userId.replace(/-/g, '');
+}
+
+/** Kubernetes namespace for a user's applications ("user-" + 32 chars ≤ 63). */
 export function userNamespace(userId: string): string {
-  return `user-${userId.split('-')[0]}`;
+  return `user-${userIdSlug(userId)}`;
 }

 /** Primary pod label selector target for an application workload. */
@@ -15,7 +15,7 @@ describe('buildHelmValues logic', () => {
    return {
      app: {
        name: app.name,
-        namespace: `user-${app.userId.split('-')[0]}`,
+        namespace: `user-${app.userId.replace(/-/g, '')}`,
        runtime: app.runtime,
        image: imageUri,
        port: app.port,
@@ -72,7 +72,7 @@ describe('buildHelmValues logic', () => {

  it('should set correct namespace from userId', () => {
    const values = buildHelmValues(baseApp, 'registry/my-app:123');
-    expect(values.app.namespace).toBe('user-abc123');
+    expect(values.app.namespace).toBe('user-abc123def456');
  });

  it('should disable database when type is NONE', () => {
@@ -4,6 +4,7 @@ import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import * as k8s from '@kubernetes/client-node';
 import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
@@ -17,6 +18,7 @@ import { HelmService } from './helm.service';
 import { RegistryService } from './registry.service';
 import { K8sClientService } from './k8s-client.service';
 import { K8sLifecycleService } from './k8s-lifecycle.service';
+import { userNamespace, userIdSlug } from './k8s-workload.util';
 import { registerKubeconfigNoProxy } from '../common/kubernetes-proxy.util';

 const execFileAsync = promisify(execFile);
@@ -209,8 +211,27 @@ export class KubernetesService implements OnModuleInit {
  }

  /** Helm values for managed_database / managed_redis / managed_rabbitmq (no app workload). */
+  /**
+   * Return the app's database password, generating and PERSISTING one if it is
+   * missing. Without persistence a fresh password would be generated on every
+   * helm upgrade, breaking auth against the database's persisted volume.
+   */
+  private ensureDbPassword(app: Application): string {
+    if (!app.dbPassword) {
+      app.dbPassword = this.generatePassword();
+      this.deploymentsRepository.manager
+        .getRepository(Application)
+        .update(app.id, { dbPassword: app.dbPassword })
+        .catch((e: any) =>
+          this.logger.warn(`Failed to persist generated dbPassword for ${app.name}: ${e.message}`),
+        );
+      this.logger.warn(`App ${app.name} had no dbPassword — generated and persisted one`);
+    }
+    return app.dbPassword;
+  }
+
  private buildManagedHelmValues(app: Application): Record<string, any> {
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const pullRegistryUrl = this.registryService.getRegistryUrl();
    const isPostgres = app.databaseType === DatabaseType.POSTGRESQL;
    const productType = app.productType;
@@ -247,7 +268,10 @@ export class KubernetesService implements OnModuleInit {
        type: app.databaseType,
        version: app.dbVersion || (isPostgres ? '16' : '8.0'),
        username: app.dbUsername || 'appuser',
-        password: app.dbPassword || this.generatePassword(),
+        password:
+          app.databaseType && app.databaseType !== DatabaseType.NONE
+            ? this.ensureDbPassword(app)
+            : '',
        storageSize: app.dbStorageSize || '1Gi',
        resources: this.resolveDatabaseResources(app),
      },
@@ -260,6 +284,7 @@ export class KubernetesService implements OnModuleInit {
        ownerId: app.userId,
        applicationId: app.id,
      },
+      images: { baseRegistry: this.configService.get<string>('build.baseImageRegistry') || '' },
      changeCause: `Helm provision ${app.name} (${productType}) at ${new Date().toISOString()}`,
    };

@@ -287,7 +312,7 @@ export class KubernetesService implements OnModuleInit {
  private buildHelmValues(app: Application, imageUri: string, previewNumber?: string | null): Record<string, any> {
    const domain = this.configService.get('platform.domain');
    const previewRootDomain = this.configService.get<string>('platform.previewRootDomain') || domain;
-    const namespacePrefix = app.userId.split('-')[0];
+    const namespacePrefix = userIdSlug(app.userId);
    const previewHost = previewNumber && !app.customDomain ? `${namespacePrefix}-${previewNumber}.${previewRootDomain}` : '';
    const pullRegistryUrl = this.registryService.getRegistryUrl();
    const isWordPress = app.runtime === AppRuntime.WORDPRESS;
@@ -299,7 +324,7 @@ export class KubernetesService implements OnModuleInit {
      app: {
        enabled: true,
        name: app.name,
-        namespace: `user-${app.userId.split('-')[0]}`,
+        namespace: this.getUserNamespace(app.userId),
        runtime: app.runtime,
        image: imageUri,
        port: app.port,
@@ -330,7 +355,7 @@ export class KubernetesService implements OnModuleInit {
        type: app.databaseType,
        version: app.dbVersion || (isPostgres ? '16' : '8.0'),
        username: app.dbUsername || 'appuser',
-        password: app.dbPassword || this.generatePassword(),
+        password: hasDb ? this.ensureDbPassword(app) : '',
        storageSize: app.dbStorageSize || '1Gi',
        resources: this.resolveDatabaseResources(app),
      },
@@ -344,10 +369,11 @@ export class KubernetesService implements OnModuleInit {
        logPaths: app.logPaths || [],
        ownerId: app.userId,
        applicationId: app.id,
-        elasticPassword: this.configService.get<string>('elasticsearch.password') || 'CloudHost2024!Secure',
-        fluentbitPassword: this.configService.get<string>('elasticsearch.fluentbitPassword') || 'FluentBit2024!Writer',
-        kibanaPassword: this.configService.get<string>('elasticsearch.kibanaPassword') || 'Kibana2024!System',
+        elasticPassword: this.configService.get<string>('elasticsearch.password'),
+        fluentbitPassword: this.configService.get<string>('elasticsearch.fluentbitPassword'),
+        kibanaPassword: this.configService.get<string>('elasticsearch.kibanaPassword'),
      },
+      images: { baseRegistry: this.configService.get<string>('build.baseImageRegistry') || '' },
      changeCause: `Deploy ${imageUri} at ${new Date().toISOString()}`,
    };

@@ -389,7 +415,7 @@ export class KubernetesService implements OnModuleInit {

  async waitForApplicationReady(app: Application, timeoutMs = 600_000, shouldAbort?: () => Promise<boolean>): Promise<void> {
    const { coreApi, appsApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const managed = isManagedProductType(app.productType);
    const workloads = [
      ...(!managed ? [{ name: app.name, replicas: app.replicas || 1 }] : []),
@@ -429,7 +455,7 @@ export class KubernetesService implements OnModuleInit {
  async updateIngress(app: Application): Promise<void> {
    const domain = this.configService.get('platform.domain');
    const subdomain = app.subdomain || app.name;
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const customDomain = app.customDomain && app.customDomainStatus === CustomDomainStatus.VERIFIED ? app.customDomain : undefined;

    // When there's no verified custom domain, restore the stable preview host so
@@ -528,7 +554,7 @@ export class KubernetesService implements OnModuleInit {
    const { coreApi, appsApi } = await this.k8sClientService.getK8sClient(app.clusterId);
    const kubeconfig = await this.k8sClientService.getKubeconfig(app.clusterId);
    await this.ensurePlatformStorageClass(kubeconfig);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const context: ManifestContext = {
      appName: app.name,
      namespace,
@@ -545,7 +571,10 @@ export class KubernetesService implements OnModuleInit {
      domain: this.configService.get('platform.domain') || 'apps.cloudhost.ir',
      subdomain: app.subdomain || app.name,
      dbUsername: app.dbUsername || 'appuser',
-      dbPassword: app.dbPassword || this.generatePassword(),
+      dbPassword:
+        app.databaseType && app.databaseType !== DatabaseType.NONE
+          ? this.ensureDbPassword(app)
+          : '',
      dbVersion: app.dbVersion || '',
      dbStorageSize: app.dbStorageSize || '1Gi',
      dbCpuRequest: this.resolveDatabaseResources(app).cpuRequest,
@@ -602,7 +631,7 @@ export class KubernetesService implements OnModuleInit {

    const context: ManifestContext = {
      appName: app.name,
-      namespace: `user-${app.userId.split('-')[0]}`,
+      namespace: this.getUserNamespace(app.userId),
      image: imageUri,
      port: app.port,
      replicas: app.replicas,
@@ -616,7 +645,10 @@ export class KubernetesService implements OnModuleInit {
      domain: domain,
      subdomain: app.subdomain || app.name,
      dbUsername: app.dbUsername || 'appuser',
-      dbPassword: app.dbPassword || this.generatePassword(),
+      dbPassword:
+        app.databaseType && app.databaseType !== DatabaseType.NONE
+          ? this.ensureDbPassword(app)
+          : '',
      dbVersion: app.dbVersion || '',
      dbStorageSize: app.dbStorageSize || '1Gi',
      dbCpuRequest: this.resolveDatabaseResources(app).cpuRequest,
@@ -1172,10 +1204,10 @@ export class KubernetesService implements OnModuleInit {
  /** Replicate logging credentials into the app namespace for Fluent Bit sidecars. */
  private async ensureElasticsearchCredentialsSecret(coreApi: k8s.CoreV1Api, namespace: string): Promise<void> {
    const name = 'elasticsearch-credentials';
-    const stringData = {
-      ELASTIC_PASSWORD: this.configService.get<string>('elasticsearch.password') || 'CloudHost2024!Secure',
-      FLUENTBIT_PASSWORD: this.configService.get<string>('elasticsearch.fluentbitPassword') || 'FluentBit2024!Writer',
-      KIBANA_SYSTEM_PASSWORD: this.configService.get<string>('elasticsearch.kibanaPassword') || 'Kibana2024!System',
+    const stringData: { [key: string]: string } = {
+      ELASTIC_PASSWORD: this.configService.get<string>('elasticsearch.password') || '',
+      FLUENTBIT_PASSWORD: this.configService.get<string>('elasticsearch.fluentbitPassword') || '',
+      KIBANA_SYSTEM_PASSWORD: this.configService.get<string>('elasticsearch.kibanaPassword') || '',
    };

    try {
@@ -1512,7 +1544,7 @@ export class KubernetesService implements OnModuleInit {
    }

    const previewRootDomain = this.configService.get<string>('platform.previewRootDomain') || ctx.domain;
-    const namespacePrefix = ctx.ownerId.split('-')[0];
+    const namespacePrefix = userIdSlug(ctx.ownerId);
    const previewHost = previewNumber && !customDomain ? `${namespacePrefix}-${previewNumber}.${previewRootDomain}` : '';
    if (previewHost) {
      rules.push({
@@ -2228,7 +2260,7 @@ export class KubernetesService implements OnModuleInit {

  async scaleDeployment(app: Application, replicas: number): Promise<void> {
    const { appsApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);

    await appsApi.patchNamespacedDeployment({ name: app.name, namespace, body: { spec: { replicas } } }, k8s.setHeaderOptions('Content-Type', 'application/merge-patch+json'));
  }
@@ -2268,7 +2300,7 @@ export class KubernetesService implements OnModuleInit {

  async captureWorkloadReplicaSnapshot(app: Application): Promise<Record<string, number>> {
    const { appsApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const snapshot: Record<string, number> = {};

    for (const workload of this.getApplicationWorkloadDeployments(app)) {
@@ -2297,7 +2329,7 @@ export class KubernetesService implements OnModuleInit {
   */
  async suspendApplication(app: Application): Promise<Record<string, number>> {
    const { appsApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);

    this.logger.log(`Suspending application ${app.name} in namespace ${namespace}`);

@@ -2323,7 +2355,7 @@ export class KubernetesService implements OnModuleInit {
   */
  async resumeApplication(app: Application): Promise<void> {
    const { appsApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);

    this.logger.log(`Resuming application ${app.name} in namespace ${namespace}`);

@@ -2355,7 +2387,7 @@ export class KubernetesService implements OnModuleInit {

  async restartDeployment(app: Application): Promise<void> {
    const { appsApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const deploymentName = isManagedProductType(app.productType) ? this.primaryWorkloadLabel(app) : app.name;

    await appsApi.patchNamespacedDeployment(
@@ -2550,7 +2582,7 @@ export class KubernetesService implements OnModuleInit {
   */
  async getResourceUsage(app: Application): Promise<any> {
    const { coreApi, appsApi, kc } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);

    const workloads: any[] = [];

@@ -2640,7 +2672,7 @@ export class KubernetesService implements OnModuleInit {
    workload: 'app' | 'database' | 'redis' | 'rabbitmq' = 'app',
  ): Promise<void> {
    const { appsApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);

    const target = this.workloadDeploymentTarget(app, workload);
    if (!target) {
@@ -2685,7 +2717,7 @@ export class KubernetesService implements OnModuleInit {
  }

  getUserNamespace(userId: string): string {
-    return `user-${userId.split('-')[0]}`;
+    return userNamespace(userId);
  }

  private getClusterHostIp(kc: k8s.KubeConfig): string {
@@ -2979,7 +3011,7 @@ export class KubernetesService implements OnModuleInit {
    const subdomain = app.subdomain || app.name;
    const verifiedCustomDomain = app.customDomain && app.customDomainStatus === CustomDomainStatus.VERIFIED ? app.customDomain : null;
    const previewRootDomain = this.configService.get<string>('platform.previewRootDomain') || domain;
-    const namespacePrefix = app.userId.split('-')[0];
+    const namespacePrefix = userIdSlug(app.userId);

    let ingressUrl = `https://${subdomain}.${domain}`;
    if (verifiedCustomDomain) {
@@ -3362,7 +3394,7 @@ export class KubernetesService implements OnModuleInit {
   */
  async waitForDatabaseReady(app: Application, timeoutMs = 120_000): Promise<void> {
    const { coreApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const dbLabel = `${app.name}-db`;
    const start = Date.now();

@@ -3469,14 +3501,12 @@ export class KubernetesService implements OnModuleInit {
  async restoreDatabaseDump(app: Application, dumpFilePath: string): Promise<{ success: boolean; logs: string }> {
    const { coreApi, kc } = await this.k8sClientService.getK8sClient(app.clusterId);
    const batchApi = kc.makeApiClient(k8s.BatchV1Api);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const dbName = `${app.name}-db`;
    const ts = Date.now();
    const pvcName = `${app.name}-db-dump-${ts}`;
    const helperPodName = `${pvcName}-helper`;
    const jobName = `${app.name}-db-restore-${ts}`;
-    const isPostgres = app.databaseType === DatabaseType.POSTGRESQL;
-    const dbDatabase = app.name.replace(/-/g, '_');

    const dumpSize = fs.statSync(dumpFilePath).size;
    const pvcSizeGi = Math.max(1, Math.ceil((dumpSize * 2) / (1024 * 1024 * 1024)));
@@ -3562,14 +3592,8 @@ export class KubernetesService implements OnModuleInit {
      } catch {}
    }

-    // ── 4. Build restore command ──
-    const command = isPostgres
-      ? ['sh', '-c', `PGPASSWORD="$DB_PASSWORD" psql -h ${dbName} -U "$DB_USER" -d ${dbDatabase} -f /dump/dump.sql 2>&1`]
-      : ['sh', '-c', `mysql -h ${dbName} -u "$DB_USER" -p"$DB_PASSWORD" ${dbDatabase} < /dump/dump.sql 2>&1`];
-
-    const defaultDbVer = isPostgres ? '16' : '8.0';
-    const restoreDbVer = app.dbVersion || defaultDbVer;
-    const image = isPostgres ? `postgres:${restoreDbVer}-alpine` : `mysql:${restoreDbVer}`;
+    // ── 4. Build restore command (per database type) ──
+    const { image, restoreCommand: command } = this.databaseDumpSpec(app, dbName);

    // ── 5. Create the restore Job ──
    const job: k8s.V1Job = {
@@ -3777,7 +3801,7 @@ export class KubernetesService implements OnModuleInit {
  private async migrateDatabasePvcToResizableStorage(app: Application, newSize: string, storageClassName: string): Promise<{ success: boolean; message: string }> {
    const { coreApi, appsApi, kc } = await this.k8sClientService.getK8sClient(app.clusterId);
    const batchApi = kc.makeApiClient(k8s.BatchV1Api);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const oldPvcName = `${app.name}-db`;
    const newPvcName = `${app.name}-db-resizable`;
    const deploymentName = `${app.name}-db`;
@@ -3952,7 +3976,7 @@ export class KubernetesService implements OnModuleInit {
   */
  async resizeDatabasePvc(app: Application, newSize: string): Promise<{ success: boolean; message: string }> {
    const { coreApi, kc } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const pvcName = `${app.name}-db`;

    try {
@@ -4025,7 +4049,7 @@ export class KubernetesService implements OnModuleInit {
  async getDatabasePvcSize(app: Application): Promise<string> {
    try {
      const { coreApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-      const namespace = `user-${app.userId.split('-')[0]}`;
+      const namespace = this.getUserNamespace(app.userId);
      const pvcName = `${app.name}-db`;

      const pvc = await coreApi.readNamespacedPersistentVolumeClaim({
@@ -4051,7 +4075,7 @@ export class KubernetesService implements OnModuleInit {
    totalUsedGb: number;
  }> {
    const { coreApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);

    const result = {
      database: null as StorageUsageSlice | null,
@@ -4260,7 +4284,7 @@ export class KubernetesService implements OnModuleInit {
   */
  async resizeNamedPvc(app: Application, pvcName: string, newSize: string, label: string): Promise<{ success: boolean; message: string }> {
    const { coreApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);

    try {
      const pvc = await coreApi.readNamespacedPersistentVolumeClaim({
@@ -4317,7 +4341,7 @@ export class KubernetesService implements OnModuleInit {
   */
  async resizeAppStoragePvc(app: Application, newSize: string): Promise<{ success: boolean; message: string }> {
    const { coreApi } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);

    // Try new unified name first, then legacy wp-content name
    let pvcName = `${app.name}-storage`;
@@ -4374,6 +4398,60 @@ export class KubernetesService implements OnModuleInit {

  // ─── Snapshot helpers ───────────────────────────────

+  /**
+   * Per-database tooling for dump/restore jobs. `dumpCommand` writes to
+   * `outputPath`; `restoreCommand` reads from `/dump/dump.sql` (the copied
+   * dump file keeps that name regardless of format — mongodump archives are
+   * binary but mongorestore does not care about the extension).
+   */
+  private databaseDumpSpec(app: Application, dbHost: string): {
+    image: string;
+    outputPath: string;
+    dumpCommand: string[];
+    restoreCommand: string[];
+  } {
+    const dbDatabase = app.name.replace(/-/g, '_');
+    switch (app.databaseType) {
+      case DatabaseType.POSTGRESQL: {
+        const image = `postgres:${app.dbVersion || '16'}-alpine`;
+        return {
+          image,
+          outputPath: '/dump/output.sql',
+          dumpCommand: ['sh', '-c', `PGPASSWORD="$DB_PASSWORD" pg_dump -h ${dbHost} -U "$DB_USER" -d ${dbDatabase} --no-owner --no-acl > /dump/output.sql 2>/tmp/err; cat /tmp/err >&2; echo "DUMP_DONE"; sleep 900`],
+          restoreCommand: ['sh', '-c', `PGPASSWORD="$DB_PASSWORD" psql -h ${dbHost} -U "$DB_USER" -d ${dbDatabase} -f /dump/dump.sql 2>&1`],
+        };
+      }
+      case DatabaseType.MONGODB: {
+        const image = `mongo:${app.dbVersion || '7.0'}`;
+        const auth = `-u "$DB_USER" -p "$DB_PASSWORD" --authenticationDatabase admin`;
+        return {
+          image,
+          outputPath: '/dump/output.archive',
+          dumpCommand: ['sh', '-c', `mongodump --host ${dbHost} ${auth} --db ${dbDatabase} --archive=/dump/output.archive --gzip 2>/tmp/err; cat /tmp/err >&2; echo "DUMP_DONE"; sleep 900`],
+          restoreCommand: ['sh', '-c', `mongorestore --host ${dbHost} ${auth} --nsInclude '${dbDatabase}.*' --archive=/dump/dump.sql --gzip --drop 2>&1`],
+        };
+      }
+      case DatabaseType.MARIADB: {
+        const image = `mariadb:${app.dbVersion || '11'}`;
+        return {
+          image,
+          outputPath: '/dump/output.sql',
+          dumpCommand: ['sh', '-c', `mariadb-dump -h ${dbHost} -u "$DB_USER" -p"$DB_PASSWORD" ${dbDatabase} > /dump/output.sql 2>/tmp/err; cat /tmp/err >&2; echo "DUMP_DONE"; sleep 900`],
+          restoreCommand: ['sh', '-c', `mariadb -h ${dbHost} -u "$DB_USER" -p"$DB_PASSWORD" ${dbDatabase} < /dump/dump.sql 2>&1`],
+        };
+      }
+      default: {
+        const image = `mysql:${app.dbVersion || '8.0'}`;
+        return {
+          image,
+          outputPath: '/dump/output.sql',
+          dumpCommand: ['sh', '-c', `mysqldump -h ${dbHost} -u "$DB_USER" -p"$DB_PASSWORD" ${dbDatabase} > /dump/output.sql 2>/tmp/err; cat /tmp/err >&2; echo "DUMP_DONE"; sleep 900`],
+          restoreCommand: ['sh', '-c', `mysql -h ${dbHost} -u "$DB_USER" -p"$DB_PASSWORD" ${dbDatabase} < /dump/dump.sql 2>&1`],
+        };
+      }
+    }
+  }
+
  /**
   * Export (dump) the application database to a local file via a K8s Job.
   * Returns the dump as a Buffer, or null on failure.
@@ -4383,20 +4461,12 @@ export class KubernetesService implements OnModuleInit {
  async exportDatabaseDump(app: Application, onProgress?: (percent: number) => void): Promise<{ data: Buffer | null; logs: string }> {
    const { coreApi, kc } = await this.k8sClientService.getK8sClient(app.clusterId);
    const batchApi = kc.makeApiClient(k8s.BatchV1Api);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const dbName = `${app.name}-db`;
    const jobName = `${app.name}-db-dump-${Date.now()}`;
-    const isPostgres = app.databaseType === DatabaseType.POSTGRESQL;
-    const dbDatabase = app.name.replace(/-/g, '_');

-    const defaultDbVer = isPostgres ? '16' : '8.0';
-    const dbVer = app.dbVersion || defaultDbVer;
-    const image = isPostgres ? `postgres:${dbVer}-alpine` : `mysql:${dbVer}`;
-
-    // Dump command writes to /dump/output.sql, then sleeps to allow exec retrieval
-    const command = isPostgres
-      ? ['sh', '-c', `PGPASSWORD="$DB_PASSWORD" pg_dump -h ${dbName} -U "$DB_USER" -d ${dbDatabase} --no-owner --no-acl > /dump/output.sql 2>/tmp/err; cat /tmp/err >&2; echo "DUMP_DONE"; sleep 900`]
-      : ['sh', '-c', `mysqldump -h ${dbName} -u "$DB_USER" -p"$DB_PASSWORD" ${dbDatabase} > /dump/output.sql 2>/tmp/err; cat /tmp/err >&2; echo "DUMP_DONE"; sleep 900`];
+    // Dump command writes to spec.outputPath, then sleeps to allow exec retrieval
+    const { image, outputPath, dumpCommand: command } = this.databaseDumpSpec(app, dbName);

    const job: k8s.V1Job = {
      apiVersion: 'batch/v1',
@@ -4519,7 +4589,7 @@ export class KubernetesService implements OnModuleInit {
        });

        await new Promise<void>((resolve, reject) => {
-          exec.exec(namespace, podName!, 'dump', ['cat', '/dump/output.sql'], stdoutStream, stderrStream, null, false, (status: k8s.V1Status) => {
+          exec.exec(namespace, podName!, 'dump', ['cat', outputPath], stdoutStream, stderrStream, null, false, (status: k8s.V1Status) => {
            if (status.status === 'Success') resolve();
            else reject(new Error(status.message || 'exec failed'));
          });
@@ -4564,7 +4634,7 @@ export class KubernetesService implements OnModuleInit {
  async archiveWpContent(app: Application): Promise<{ data: Buffer | null; logs: string }> {
    const { coreApi, kc } = await this.k8sClientService.getK8sClient(app.clusterId);
    const batchApi = kc.makeApiClient(k8s.BatchV1Api);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const pvcName = `${app.name}-storage`;
    const jobName = `${app.name}-wp-archive-${Date.now()}`;

@@ -4712,127 +4782,92 @@ export class KubernetesService implements OnModuleInit {

  /**
   * Restore wp-content from a tar.gz archive into the WordPress PVC.
+   *
+   * The archive is streamed into a helper pod with `kubectl cp` (a Secret
+   * would be capped at ~1MiB — far too small for real wp-content) and
+   * extracted in place onto the mounted PVC.
   */
  async restoreWpContent(app: Application, archiveBuffer: Buffer): Promise<{ success: boolean; logs: string }> {
    const { coreApi, kc } = await this.k8sClientService.getK8sClient(app.clusterId);
-    const batchApi = kc.makeApiClient(k8s.BatchV1Api);
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const pvcName = `${app.name}-storage`;
-    const jobName = `${app.name}-wp-restore-${Date.now()}`;
-    const secretName = `${jobName}-archive`;
+    const ts = Date.now();
+    const helperPodName = `${app.name}-wp-restore-${ts}`;

-    // Store archive in a secret
-    const archiveSecret = {
+    const helperPod: k8s.V1Pod = {
      apiVersion: 'v1',
-      kind: 'Secret',
-      metadata: { name: secretName, namespace },
-      data: { 'wp-content.tar.gz': archiveBuffer.toString('base64') },
-    };
-
-    try {
-      await coreApi.createNamespacedSecret({ namespace, body: archiveSecret });
-    } catch (e: any) {
-      return {
-        success: false,
-        logs: `Failed to create archive secret: ${e.message}`,
-      };
-    }
-
-    const job: k8s.V1Job = {
-      apiVersion: 'batch/v1',
-      kind: 'Job',
-      metadata: { name: jobName, namespace },
+      kind: 'Pod',
+      metadata: { name: helperPodName, namespace },
      spec: {
-        ttlSecondsAfterFinished: 120,
-        backoffLimit: 0,
-        template: {
-          spec: {
-            restartPolicy: 'Never',
-            containers: [
-              {
-                name: 'restore',
-                image: 'alpine:3.19',
-                command: ['sh', '-c', 'apk add --no-cache tar gzip > /dev/null 2>&1 && rm -rf /wp-content/* && cd /wp-content && tar xzf /archive/wp-content.tar.gz && echo "RESTORE_DONE"'],
-                volumeMounts: [
-                  { name: 'wp-content', mountPath: '/wp-content' },
-                  { name: 'archive', mountPath: '/archive', readOnly: true },
-                ],
-                resources: {
-                  requests: { cpu: '100m', memory: '64Mi' },
-                  limits: { cpu: '500m', memory: '256Mi' },
-                },
-              },
-            ],
-            volumes: [
-              {
-                name: 'wp-content',
-                persistentVolumeClaim: { claimName: pvcName },
-              },
-              { name: 'archive', secret: { secretName } },
-            ],
+        containers: [
+          {
+            name: 'restore',
+            image: 'alpine:3.19',
+            command: ['sh', '-c', 'sleep 3600'],
+            volumeMounts: [{ name: 'wp-content', mountPath: '/wp-content' }],
+            resources: {
+              requests: { cpu: '100m', memory: '128Mi' },
+              limits: { cpu: '500m', memory: '512Mi' },
+            },
          },
-        },
+        ],
+        volumes: [{ name: 'wp-content', persistentVolumeClaim: { claimName: pvcName } }],
+        restartPolicy: 'Never',
      },
    };

-    try {
-      await batchApi.createNamespacedJob({ namespace, body: job });
-    } catch (e: any) {
-      try {
-        await coreApi.deleteNamespacedSecret({ name: secretName, namespace });
-      } catch {}
-      return {
-        success: false,
-        logs: `Failed to create restore job: ${e.message}`,
-      };
-    }
+    const tmpArchive = path.join(os.tmpdir(), `wp-content-restore-${ts}.tar.gz`);
+    const tmpKubeconfig = path.join(os.tmpdir(), `kubeconfig-wprestore-${ts}.yaml`);

-    // Wait
-    const timeout = 300_000;
-    const start = Date.now();
-    let succeeded = false;
-    let failed = false;
-    while (Date.now() - start < timeout) {
-      await new Promise((r) => setTimeout(r, 3000));
-      try {
-        const st = await batchApi.readNamespacedJob({
-          name: jobName,
-          namespace,
-        });
-        if (st.status?.succeeded && st.status.succeeded > 0) {
-          succeeded = true;
-          break;
-        }
-        if (st.status?.failed && st.status.failed > 0) {
-          failed = true;
-          break;
-        }
-      } catch {}
-    }
-
-    let logs = '';
    try {
-      const pods = await coreApi.listNamespacedPod({
-        namespace,
-        labelSelector: `job-name=${jobName}`,
-      });
-      if (pods.items.length > 0 && pods.items[0].metadata?.name) {
-        const logRes = await coreApi.readNamespacedPodLog({
-          name: pods.items[0].metadata.name,
-          namespace,
-        });
-        logs = logRes || '';
+      fs.writeFileSync(tmpArchive, archiveBuffer);
+      fs.writeFileSync(tmpKubeconfig, kc.exportConfig());
+
+      await coreApi.createNamespacedPod({ namespace, body: helperPod });
+
+      // Wait for helper pod Running
+      const podTimeout = 120_000;
+      const podStart = Date.now();
+      while (Date.now() - podStart < podTimeout) {
+        const pod = await coreApi.readNamespacedPod({ name: helperPodName, namespace });
+        if (pod.status?.phase === 'Running') break;
+        if (pod.status?.phase === 'Failed') throw new Error('wp-content restore helper pod failed to start');
+        await new Promise((r) => setTimeout(r, 2000));
      }
-    } catch {}

-    try {
-      await coreApi.deleteNamespacedSecret({ name: secretName, namespace });
-    } catch {}
+      await execFileAsync(
+        'kubectl',
+        ['--kubeconfig', tmpKubeconfig, 'cp', tmpArchive, `${namespace}/${helperPodName}:/tmp/wp-content.tar.gz`, '--retries', '3'],
+        { maxBuffer: 50 * 1024 * 1024, timeout: 600_000 },
+      );

-    return {
-      success: succeeded && !failed,
-      logs: logs || (succeeded ? 'Restore completed' : 'Restore failed or timed out'),
-    };
+      const { stdout, stderr } = await execFileAsync(
+        'kubectl',
+        [
+          '--kubeconfig', tmpKubeconfig, 'exec', '-n', namespace, helperPodName, '--',
+          'sh', '-c',
+          'rm -rf /wp-content/* /wp-content/.[!.]* 2>/dev/null; tar xzf /tmp/wp-content.tar.gz -C /wp-content && echo RESTORE_DONE',
+        ],
+        { maxBuffer: 10 * 1024 * 1024, timeout: 600_000 },
+      );
+
+      const logs = `${stdout || ''}${stderr || ''}`;
+      const success = logs.includes('RESTORE_DONE');
+      return { success, logs: logs || (success ? 'Restore completed' : 'Restore failed') };
+    } catch (e: any) {
+      this.logger.error(`wp-content restore failed for ${app.name}: ${e.message}`);
+      return { success: false, logs: e.message || 'wp-content restore failed' };
+    } finally {
+      try {
+        fs.unlinkSync(tmpArchive);
+      } catch {}
+      try {
+        fs.unlinkSync(tmpKubeconfig);
+      } catch {}
+      try {
+        await coreApi.deleteNamespacedPod({ name: helperPodName, namespace });
+      } catch {}
+    }
  }

  // ─── K8s Revision-based Rollback ─────────────────────
@@ -4852,7 +4887,7 @@ export class KubernetesService implements OnModuleInit {
    }>;
    currentRevision: number;
  }> {
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const releaseName = app.name;

    try {
@@ -4890,7 +4925,7 @@ export class KubernetesService implements OnModuleInit {
   * Rollback a Helm release to a specific revision.
   */
  async rollbackDeploymentRevision(app: Application, targetRevision: number): Promise<{ success: boolean; message: string }> {
-    const namespace = `user-${app.userId.split('-')[0]}`;
+    const namespace = this.getUserNamespace(app.userId);
    const releaseName = app.name;

    try {
@@ -18,6 +18,7 @@ import { AuthGuard } from '@nestjs/passport';
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import { ElasticsearchService } from './elasticsearch.service';
+import { userNamespace } from './k8s-workload.util';
 import { Application } from '../applications/entities/application.entity';
 import { RolesGuard } from '../common/guards/roles.guard';
 import { Roles } from '../common/decorators/roles.decorator';
@@ -225,7 +226,7 @@ export class LogsController {
    if (appFilters.applicationName) {
      filterParts.push(`applicationName:${appFilters.applicationName}`);
    }
-    filterParts.push(`namespace:user-${userId.split('-')[0]}`);
+    filterParts.push(`namespace:${userNamespace(userId)}`);

    const kibanaHost = connInfo.host.replace('elasticsearch', 'kibana');
    const query = filterParts.length > 0 ? filterParts.join(' AND ') : '*';
@@ -1,5 +1,5 @@
-import { NestFactory } from '@nestjs/core';
-import { Logger, ValidationPipe } from '@nestjs/common';
+import { NestFactory, Reflector } from '@nestjs/core';
+import { ClassSerializerInterceptor, Logger, ValidationPipe } from '@nestjs/common';
 import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
 import helmet from 'helmet';
 import { AppModule } from './app.module';
@@ -47,22 +47,31 @@ async function bootstrap() {
    }),
  );

+  // Strip @Exclude()-marked fields (e.g. gitToken) from serialized responses.
+  app.useGlobalInterceptors(new ClassSerializerInterceptor(app.get(Reflector)));
+
  // API prefix
  app.setGlobalPrefix('api/v1');

-  // Swagger
-  const config = new DocumentBuilder()
-    .setTitle('CloudHost PaaS API')
-    .setDescription('Self-service PaaS platform API')
-    .setVersion('1.0')
-    .addBearerAuth()
-    .build();
-  const document = SwaggerModule.createDocument(app, config);
-  SwaggerModule.setup('api/docs', app, document);
+  // Swagger — disabled in production unless explicitly opted in (SWAGGER_ENABLED=true)
+  const swaggerEnabled =
+    process.env.NODE_ENV !== 'production' || process.env.SWAGGER_ENABLED === 'true';
+  if (swaggerEnabled) {
+    const config = new DocumentBuilder()
+      .setTitle('CloudHost PaaS API')
+      .setDescription('Self-service PaaS platform API')
+      .setVersion('1.0')
+      .addBearerAuth()
+      .build();
+    const document = SwaggerModule.createDocument(app, config);
+    SwaggerModule.setup('api/docs', app, document);
+  }

  const port = process.env.PORT || 4000;
  await app.listen(port);
  console.log(`🚀 CloudHost API running on http://localhost:${port}`);
-  console.log(`📚 Swagger docs at http://localhost:${port}/api/docs`);
+  if (swaggerEnabled) {
+    console.log(`📚 Swagger docs at http://localhost:${port}/api/docs`);
+  }
 }
 bootstrap();
@@ -6,6 +6,7 @@ import {
  UpdateDateColumn,
  OneToMany,
 } from 'typeorm';
+import { Exclude } from 'class-transformer';
 import { UserRole } from '../../common/enums';
 import { Application } from '../../applications/entities/application.entity';

@@ -30,6 +31,8 @@ export class User {
  @Column({ default: false })
  phoneVerified: boolean;

+  /** Bcrypt hash — never serialized into API responses. */
+  @Exclude({ toPlainOnly: true })
  @Column()
  password: string;

@@ -12,6 +12,7 @@ import * as bcrypt from 'bcrypt';
 import { User } from './entities/user.entity';
 import { UserRole } from '../common/enums';
 import { normalizeIranMobile } from '../common/phone.util';
+import { userNamespace } from '../kubernetes/k8s-workload.util';

@Injectable()
 export class UsersService {
@@ -22,9 +23,10 @@ export class UsersService {

  async create(data: Partial<User>): Promise<User> {
    const user = this.usersRepository.create(data);
-    // Assign a unique namespace based on user ID
+    // Assign a unique namespace based on the FULL user UUID (truncated
+    // prefixes collide between users and break tenant isolation).
    const saved = await this.usersRepository.save(user);
-    saved.namespace = `user-${saved.id.split('-')[0]}`;
+    saved.namespace = userNamespace(saved.id);
    return this.usersRepository.save(saved);
  }