@bluedynamics/cdk8s-plone 0.1.35 → 0.1.37

package/documentation/sources/reference/api/index.md

@@ -1,4 +1,13 @@
-# API Reference
+---
+myst:
+  html_meta:
+    "description": "Auto-generated API reference for cdk8s-plone constructs, interfaces, and enums."
+    "property=og:description": "Auto-generated API reference for cdk8s-plone constructs, interfaces, and enums."
+    "property=og:title": "API reference"
+    "keywords": "Plone, cdk8s, Kubernetes, API, reference, TypeScript, Python"
+---
+
+# API reference
 
 Complete API reference for cdk8s-plone constructs, generated from TypeScript source code.
 
@@ -9,7 +18,7 @@ The cdk8s-plone library provides the following main constructs:
 - **Plone**: Main construct for deploying Plone CMS with support for both Volto (React frontend) and Classic UI variants
 - **PloneHttpcache**: HTTP caching layer using Varnish for improved performance
 
-## Language Support
+## Language support
 
 This API documentation shows TypeScript usage examples. The library is also available for Python via JSII transpilation:
 

package/documentation/sources/reference/configuration-options.md

@@ -1,8 +1,17 @@
-# Configuration Options
+---
+myst:
+  html_meta:
+    "description": "Complete reference for cdk8s-plone constructs and configuration options: Plone, PloneHttpcache, PloneVinylCache."
+    "property=og:description": "Complete reference for cdk8s-plone constructs and configuration options: Plone, PloneHttpcache, PloneVinylCache."
+    "property=og:title": "Configuration options"
+    "keywords": "Plone, cdk8s, Kubernetes, configuration, reference, Volto, Varnish"
+---
+
+# Configuration options
 
 Complete reference for all configuration options in cdk8s-plone.
 
-## Key Constructs
+## Key constructs
 
 ### `Plone`
 
@@ -56,7 +65,7 @@ new PloneHttpcache(chart, 'cache', {
 
 ---
 
-## Configuration Interfaces
+## Configuration interfaces
 
 ### `PloneOptions`
 
@@ -89,14 +98,14 @@ const options: PloneOptions = {
 
 Configuration for backend or frontend components.
 
-#### Container Configuration
+#### Container configuration
 
 | Property | Type | Required | Default | Description |
 |----------|------|----------|---------|-------------|
-| `image` | `string` | Yes | - | Container image (e.g., 'plone/plone-backend:6.1.3') |
-| `imagePullPolicy` | `string` | No | `'IfNotPresent'` | Image pull policy |
+| `image` | `string` | No | `plone/plone-backend:latest` (backend) / `plone/plone-frontend:latest` (frontend) | Container image |
+| `imagePullPolicy` | `string` | No | `IfNotPresent` | Image pull policy |
 | `replicas` | `number` | No | `2` | Number of pod replicas |
-| `environment` | `Env` | No | - | Environment variables (cdk8s-plus-30.Env) |
+| `environment` | `Env` | No | - | Environment variables (cdk8s-plus-30 `Env`) |
 
 **Example:**
 ```typescript
@@ -115,14 +124,14 @@ backend: {
 }
 ```
 
-#### Resource Configuration
+#### Resource configuration
 
-| Property | Type | Description |
-|----------|------|-------------|
-| `requestCpu` | `string` | CPU request (e.g., '500m', '1') |
-| `limitCpu` | `string` | CPU limit |
-| `requestMemory` | `string` | Memory request (e.g., '512Mi', '1Gi') |
-| `limitMemory` | `string` | Memory limit |
+| Property | Type | Default | Description |
+|----------|------|---------|-------------|
+| `requestCpu` | `string` | `200m` | CPU request |
+| `limitCpu` | `string` | `500m` | CPU limit |
+| `requestMemory` | `string` | `256Mi` | Memory request |
+| `limitMemory` | `string` | `512Mi` (backend) / `1Gi` (frontend) | Memory limit |
 
 **Example:**
 ```typescript
@@ -135,12 +144,12 @@ backend: {
 }
 ```
 
-#### High Availability
+#### High availability
 
 | Property | Type | Description |
 |----------|------|-------------|
-| `minAvailable` | `number` | Minimum pods available during updates (for PodDisruptionBudget) |
-| `maxUnavailable` | `number` | Maximum unavailable pods during updates |
+| `minAvailable` | `number \| string` | Minimum pods available during updates (for PodDisruptionBudget). Accepts an absolute number or a percentage string such as `"50%"`. |
+| `maxUnavailable` | `number \| string` | Maximum unavailable pods during updates. Accepts an absolute number or a percentage string such as `"50%"`. |
 
 **Example:**
 ```typescript
@@ -151,16 +160,16 @@ backend: {
 }
 ```
 
-#### Readiness Probe
+#### Readiness probe
 
 | Property | Type | Default | Description |
 |----------|------|---------|-------------|
 | `readinessEnabled` | `boolean` | `true` | Enable readiness probe |
-| `readinessInitialDelaySeconds` | `number` | - | Seconds before first probe |
-| `readinessTimeoutSeconds` | `number` | - | Probe timeout |
-| `readinessPeriodSeconds` | `number` | - | Probe frequency |
-| `readinessSuccessThreshold` | `number` | - | Consecutive successes required |
-| `readinessFailureThreshold` | `number` | - | Consecutive failures before marking unready |
+| `readinessInitialDelaySeconds` | `number` | `10` | Seconds before first probe |
+| `readinessTimeoutSeconds` | `number` | `15` | Probe timeout |
+| `readinessPeriodSeconds` | `number` | `10` | Probe frequency |
+| `readinessSuccessThreshold` | `number` | `1` | Consecutive successes required |
+| `readinessFailureThreshold` | `number` | `3` | Consecutive failures before marking unready |
 
 **Example:**
 ```typescript
@@ -174,16 +183,16 @@ backend: {
 }
 ```
 
-#### Liveness Probe
+#### Liveness probe
 
 | Property | Type | Default | Description |
 |----------|------|---------|-------------|
 | `livenessEnabled` | `boolean` | `false` | Enable liveness probe (recommended `true` for frontend) |
-| `livenessInitialDelaySeconds` | `number` | - | Seconds before first probe |
-| `livenessTimeoutSeconds` | `number` | - | Probe timeout |
-| `livenessPeriodSeconds` | `number` | - | Probe frequency |
-| `livenessSuccessThreshold` | `number` | - | Consecutive successes required |
-| `livenessFailureThreshold` | `number` | - | Consecutive failures before restart |
+| `livenessInitialDelaySeconds` | `number` | `30` | Seconds before first probe |
+| `livenessTimeoutSeconds` | `number` | `5` | Probe timeout |
+| `livenessPeriodSeconds` | `number` | `10` | Probe frequency |
+| `livenessSuccessThreshold` | `number` | `1` | Consecutive successes required |
+| `livenessFailureThreshold` | `number` | `3` | Consecutive failures before restart |
 
 **Example:**
 ```typescript
@@ -219,6 +228,94 @@ backend: {
 }
 ```
 
+(monitoring)=
+
+#### Prometheus monitoring
+
+| Property | Type | Default | Description |
+|----------|------|---------|-------------|
+| `servicemonitor` | `boolean` | `false` | Create a Prometheus `ServiceMonitor` for this component. Requires the Prometheus Operator. |
+| `metricsPort` | `string \| number` | main service port | Service port name or number that exposes metrics. |
+| `metricsPath` | `string` | `/metrics` | HTTP path the Prometheus scraper requests. |
+
+You must instrument the backend or frontend container to expose metrics at the configured endpoint.
+For step-by-step setup, see {doc}`/how-to/enable-prometheus-monitoring`.
+
+**Example:**
+```typescript
+backend: {
+  image: 'plone/plone-backend:6.1.3',
+  servicemonitor: true,
+  metricsPath: '/metrics',
+},
+frontend: {
+  image: 'plone/plone-frontend:16.0.0',
+  servicemonitor: true,
+  metricsPort: 9090,
+}
+```
+
+#### Scheduling
+
+| Property | Type | Default | Description |
+|----------|------|---------|-------------|
+| `nodeSelector` | `Record<string, string>` | - | Constrain pods to nodes whose labels match all entries. |
+
+For tainted nodes and taint-based scheduling, see {doc}`/how-to/schedule-pods`.
+
+**Example:**
+```typescript
+backend: {
+  image: 'plone/plone-backend:6.1.3',
+  nodeSelector: {
+    'topology.kubernetes.io/region': 'fsn1',
+  },
+}
+```
+
+#### Security context
+
+| Property | Type | Default | Description |
+|----------|------|---------|-------------|
+| `securityContext` | `PloneSecurityContext` | - | Container security settings (capabilities, UID/GID, read-only root, privilege escalation). |
+
+**`PloneSecurityContext` fields:**
+
+| Property | Type | Description |
+|----------|------|-------------|
+| `capabilities` | `PloneCapabilities` | Linux capabilities to add or drop. |
+| `runAsUser` | `number` | Run the container as this UID. |
+| `runAsGroup` | `number` | Run the container as this GID. |
+| `runAsNonRoot` | `boolean` | Require the container to run as non-root. |
+| `readOnlyRootFilesystem` | `boolean` | Mount the root filesystem read-only. |
+| `allowPrivilegeEscalation` | `boolean` | Allow the process to gain more privileges than its parent. |
+| `privileged` | `boolean` | Run the container in privileged mode. |
+
+**`PloneCapabilities` fields:**
+
+| Property | Type | Description |
+|----------|------|-------------|
+| `add` | `string[]` | Capabilities to add (e.g., `'SYS_PTRACE'`). |
+| `drop` | `string[]` | Capabilities to drop (e.g., `'ALL'`). |
+
+For a hardening walk-through, see {doc}`/how-to/configure-security-context`.
+
+**Example:**
+```typescript
+backend: {
+  image: 'plone/plone-backend:6.1.3',
+  securityContext: {
+    runAsNonRoot: true,
+    runAsUser: 500,
+    readOnlyRootFilesystem: true,
+    allowPrivilegeEscalation: false,
+    capabilities: {
+      drop: ['ALL'],
+    },
+  },
+}
+```
+
 ---
 
 ### `PloneHttpcacheOptions`
@@ -228,18 +325,36 @@ Configuration for the Varnish HTTP cache layer.
 | Property | Type | Required | Default | Description |
 |----------|------|----------|---------|-------------|
 | `plone` | `Plone` | Yes | - | Plone construct to attach cache to |
-| `varnishVcl` | `string` | No | - | VCL configuration as string |
-| `varnishVclFile` | `string` | No | - | Path to VCL configuration file |
+| `varnishVcl` | `string` | No | - | VCL configuration as string. Takes precedence over `varnishVclFile`. |
+| `varnishVclFile` | `string` | No | built-in `config/varnish.tpl.vcl` | Path to a VCL template file |
 | `existingSecret` | `string` | No | - | Kubernetes secret for Varnish admin credentials |
 | `replicas` | `number` | No | `2` | Number of Varnish replicas |
-| `requestCpu` | `string` | No | - | CPU request |
-| `limitCpu` | `string` | No | - | CPU limit |
-| `requestMemory` | `string` | No | - | Memory request |
-| `limitMemory` | `string` | No | - | Memory limit |
-| `servicemonitor` | `boolean` | No | `false` | Enable Prometheus ServiceMonitor |
+| `requestCpu` | `string` | No | `100m` | CPU request |
+| `limitCpu` | `string` | No | `500m` | CPU limit |
+| `requestMemory` | `string` | No | `100Mi` | Memory request |
+| `limitMemory` | `string` | No | `500Mi` | Memory limit |
+| `servicemonitor` | `boolean` | No | `false` | Enable Prometheus `ServiceMonitor` |
 | `exporterEnabled` | `boolean` | No | `true` | Enable Prometheus exporter sidecar |
-| `chartVersion` | `string` | No | latest | kube-httpcache Helm chart version |
-| `extraEnvVars` | `HttpcacheEnvVar[]` | No | - | Additional env vars for kube-httpcache container |
+| `chartVersion` | `string` | No | chart latest | kube-httpcache Helm chart version |
+| `appVersion` | `string` | No | matches `chartVersion` | kube-httpcache container image tag |
+| `extraEnvVars` | `HttpcacheEnvVar[]` | No | - | Additional env vars for the kube-httpcache container |
+| `tolerations` | `HttpcacheToleration[]` | No | - | Pod tolerations for tainted nodes |
+
+**`HttpcacheEnvVar` fields:**
+
+| Property | Type | Description |
+|----------|------|-------------|
+| `name` | `string` | Environment variable name |
+| `value` | `string` | Environment variable value |
+
+**`HttpcacheToleration` fields:**
+
+| Property | Type | Default | Description |
+|----------|------|---------|-------------|
+| `key` | `string` | - | Taint key to tolerate |
+| `operator` | `string` | `Equal` | `Equal` or `Exists` |
+| `value` | `string` | - | Taint value (required for `Equal`) |
+| `effect` | `string` | - | `NoSchedule`, `PreferNoSchedule`, or `NoExecute`. Omit to tolerate all effects. |
 
 **Example:**
 ```typescript
@@ -302,18 +417,37 @@ Requires the [cloud-vinyl operator](https://github.com/bluedynamics/cloud-vinyl)
 | Property | Type | Required | Default | Description |
 |----------|------|----------|---------|-------------|
 | `plone` | `Plone` | Yes | - | Plone construct to attach cache to |
+| `image` | `string` | No | `varnish:7.6` | Container image for the Varnish pods |
 | `replicas` | `number` | No | `2` | Number of Varnish replicas |
 | `requestCpu` | `string` | No | `100m` | CPU request |
 | `limitCpu` | `string` | No | `500m` | CPU limit |
 | `requestMemory` | `string` | No | `256Mi` | Memory request |
 | `limitMemory` | `string` | No | `512Mi` | Memory limit |
 | `storage` | `VinylCacheStorage[]` | No | - | Varnish storage backends. If omitted, the operator falls back to the varnishd default (~100 MB malloc), which is almost always too small. |
-| `director` | `string` | No | `shard` | Director type: shard, round_robin, random, hash |
-| `vclRecvSnippet` | `string` | No | built-in | Custom VCL snippet for vcl_recv |
-| `vclBackendResponseSnippet` | `string` | No | built-in | Custom VCL snippet for vcl_backend_response |
+| `extraBackends` | `VinylCacheBackend[]` | No | - | Additional backends appended after the auto-generated Plone backends. |
+| `director` | `string` | No | `shard` | Director type: `shard`, `round_robin`, `random`, `hash` |
+| `shardBy` | `string` | No | operator default (`HASH`) | Shard director: value to hash (`HASH` or `URL`). Requires cloud-vinyl ≥ 0.4.2. |
+| `shardHealthy` | `string` | No | operator default (`CHOSEN`) | Shard director: backend health requirement (`CHOSEN` or `ALL`). Requires cloud-vinyl ≥ 0.4.2. |
+| `shardRampup` | `string` | No | operator default (`30s`) | Shard director: ramp-up window for newly added backends. |
+| `shardReplicas` | `number` | No | operator default (`67`) | Shard director: Ketama replicas per backend. |
+| `vclRecvSnippet` | `string` | No | built-in `plone-vinyl-recv.vcl` | Custom VCL snippet for `vcl_recv` |
+| `vclBackendResponseSnippet` | `string` | No | built-in `plone-vinyl-backend-response.vcl` | Custom VCL snippet for `vcl_backend_response` |
+| `vclDeliverSnippet` | `string` | No | - | Custom VCL snippet for `vcl_deliver` |
+| `vclHitSnippet` | `string` | No | - | Custom VCL snippet for `vcl_hit` |
+| `vclMissSnippet` | `string` | No | - | Custom VCL snippet for `vcl_miss` |
+| `vclPassSnippet` | `string` | No | - | Custom VCL snippet for `vcl_pass` |
+| `vclPipeSnippet` | `string` | No | - | Custom VCL snippet for `vcl_pipe` |
+| `vclSynthSnippet` | `string` | No | - | Custom VCL snippet for `vcl_synth` |
+| `vclPurgeSnippet` | `string` | No | - | Custom VCL snippet for `vcl_purge` |
+| `vclHashSnippet` | `string` | No | - | Custom VCL snippet for `vcl_hash` |
+| `vclInitSnippet` | `string` | No | - | Custom VCL snippet for `vcl_init` |
+| `vclFiniSnippet` | `string` | No | - | Custom VCL snippet for `vcl_fini` |
+| `vclBackendFetchSnippet` | `string` | No | - | Custom VCL snippet for `vcl_backend_fetch` |
+| `vclBackendErrorSnippet` | `string` | No | - | Custom VCL snippet for `vcl_backend_error` |
 | `invalidation` | `boolean` | No | `true` | Enable PURGE/BAN/xkey cache invalidation |
-| `monitoring` | `boolean` | No | `false` | Enable Prometheus metrics and ServiceMonitor |
-| `tolerations` | `VinylCacheToleration[]` | No | - | Node tolerations for Varnish pods |
+| `monitoring` | `boolean` | No | `false` | Enable Prometheus metrics and `ServiceMonitor` |
+| `tolerations` | `VinylCacheToleration[]` | No | - | Pod tolerations for tainted nodes |
+| `nodeSelector` | `Record<string, string>` | No | - | Constrain Varnish pods to nodes matching all labels. |
 
 **`VinylCacheStorage` fields:**
 
@@ -324,6 +458,36 @@ Requires the [cloud-vinyl operator](https://github.com/bluedynamics/cloud-vinyl)
 | `size` | `string` | Yes | Kubernetes resource quantity (e.g. `"1Gi"`, `"500M"`) |
 | `path` | `string` | for `file` | Filesystem path for file-type storage |
 
+**`VinylCacheBackend` fields:**
+
+| Property | Type | Required | Default | Description |
+|----------|------|----------|---------|-------------|
+| `name` | `string` | Yes | - | VCL identifier (must match `^[a-zA-Z][a-zA-Z0-9_]*$`) |
+| `serviceName` | `string` | Yes | - | Kubernetes Service name to use as backend |
+| `port` | `number` | Yes | - | Service port |
+| `probe` | `VinylCacheBackendProbe` | No | - | Health probe configuration |
+| `weight` | `number` | No | operator default | Relative weight in the director. `0` marks the backend as standby. |
+
+**`VinylCacheBackendProbe` fields:**
+
+| Property | Type | Default | Description |
+|----------|------|---------|-------------|
+| `url` | `string` | `/` | URL to probe |
+| `interval` | `string` | `5s` | Probe interval |
+| `timeout` | `string` | `2s` | Probe timeout |
+| `window` | `number` | `10` | Number of recent probes evaluated |
+| `threshold` | `number` | `8` | Healthy threshold within the window |
+| `expectedResponse` | `number` | `200` | Expected HTTP status code |
+
+**`VinylCacheToleration` fields:**
+
+| Property | Type | Default | Description |
+|----------|------|---------|-------------|
+| `key` | `string` | - | Taint key to tolerate |
+| `operator` | `string` | `Equal` | `Equal` or `Exists` |
+| `value` | `string` | - | Taint value (required for `Equal`) |
+| `effect` | `string` | - | `NoSchedule`, `PreferNoSchedule`, or `NoExecute`. Omit to tolerate all effects. |
+
 **Example:**
 ```typescript
 const cache = new PloneVinylCache(chart, 'cache', {
@@ -373,7 +537,7 @@ Without an explicit `storage` entry, varnishd runs with its stock default (~100
 
 ---
 
-## PloneVariant Enum
+## PloneVariant enum
 
 Defines the deployment variant:
 
@@ -395,7 +559,7 @@ variant: PloneVariant.CLASSICUI
 
 ---
 
-## Complete Example
+## Complete example
 
 ```typescript
 import { App, Chart } from 'cdk8s';
@@ -457,9 +621,12 @@ app.synth();
 
 ---
 
-## See Also
+## See also
 
-- [API Documentation](api/) - Complete API reference
-- [Quick Start Tutorial](../tutorials/01-quick-start.md) - Get started guide
-- [Scale Resources](../how-to/scale-resources.md) - How to adjust resources
-- [Configure Monitoring](../how-to/configure-monitoring.md) - Prometheus setup
+- {doc}`/tutorials/01-quick-start` — Get started guide
+- {doc}`/how-to/deploy-production-volto` — Production-ready Volto deployment
+- {doc}`/how-to/deploy-classic-ui` — Classic UI deployment
+- {doc}`/how-to/deploy-with-vinyl-cache` — `PloneVinylCache` walk-through
+- {doc}`/how-to/enable-prometheus-monitoring` — Wire up `ServiceMonitor`
+- {doc}`/how-to/configure-security-context` — Harden backend and frontend pods
+- {doc}`/how-to/schedule-pods` — `nodeSelector` and `tolerations`

package/documentation/sources/reference/index.md

@@ -1,3 +1,12 @@
+---
+myst:
+  html_meta:
+    "description": "Information-oriented technical reference for cdk8s-plone constructs, configuration options, and APIs."
+    "property=og:description": "Information-oriented technical reference for cdk8s-plone constructs, configuration options, and APIs."
+    "property=og:title": "Reference"
+    "keywords": "Plone, cdk8s, Kubernetes, reference, API, configuration"
+---
+
 ```{image} ../_static/kup6s-icon-reference.svg
 :align: center
 :class: section-icon-large
@@ -9,7 +18,7 @@
 
 Reference guides provide detailed technical information about cdk8s-plone's API, configuration options, and component specifications. They describe how things work and what parameters are available.
 
-## API Reference
+## API reference
 
 *This section will contain auto-generated or detailed documentation for:*
 - Main chart classes
@@ -17,7 +26,7 @@ Reference guides provide detailed technical information about cdk8s-plone's API,
 - Individual construct classes
 - Utility functions and validators
 
-## Configuration Reference
+## Configuration reference
 
 ```{toctree}
 ---
@@ -27,7 +36,7 @@ titlesonly: true
 configuration-options
 ```
 
-## Component Specifications
+## Component specifications
 
 ```{toctree}
 ---
@@ -38,7 +47,7 @@ titlesonly: true
 
 *Component specifications will be added in future releases.*
 
-## API Documentation
+## API documentation
 
 See the `api/` directory for detailed construct documentation:
 

package/documentation/sources/tutorials/01-quick-start.md

@@ -1,4 +1,13 @@
-# Quick Start
+---
+myst:
+  html_meta:
+    "description": "Deploy your first Plone instance to Kubernetes using cdk8s-plone, from project setup to a running Volto site."
+    "property=og:description": "Deploy your first Plone instance to Kubernetes using cdk8s-plone, from project setup to a running Volto site."
+    "property=og:title": "Quick start"
+    "keywords": "Plone, cdk8s, Kubernetes, tutorial, Volto, getting started"
+---
+
+# Quick start
 
 This tutorial will guide you through deploying your first Plone instance using cdk8s-plone.
 
@@ -13,11 +22,11 @@ Before you start, ensure you have:
 
 For detailed prerequisites, see [Setup Prerequisites](../how-to/setup-prerequisites.md).
 
-## Step 1: Create a CDK8S Project
+## Step 1: Create a CDK8S project
 
 Create a new CDK8S TypeScript project:
 
-```bash
+```shell
 # Create project directory
 mkdir my-plone-deployment
 cd my-plone-deployment
@@ -32,17 +41,17 @@ This creates a basic CDK8S project structure.
 
 Install the cdk8s-plone library:
 
-```bash
+```shell
 npm install @bluedynamics/cdk8s-plone
 ```
 
 The library is also available for Python via PyPI:
 
-```bash
+```shell
 pip install cdk8s-plone
 ```
 
-## Step 3: Create a Basic Plone Deployment
+## Step 3: Create a basic Plone deployment
 
 Edit `main.ts` with the following code:
 
@@ -73,11 +82,11 @@ This creates:
 - A Volto frontend with 2 replicas
 - All necessary Kubernetes services and deployments
 
-## Step 4: Generate Kubernetes Manifests
+## Step 4: Generate Kubernetes manifests
 
 Generate the Kubernetes manifests:
 
-```bash
+```shell
 cdk8s synth
 ```
 
@@ -87,22 +96,22 @@ This creates YAML files in the `dist/` directory containing all Kubernetes resou
 
 Apply the generated manifests to your cluster:
 
-```bash
+```shell
 kubectl apply -f dist/
 ```
 
 Check the deployment status:
 
-```bash
+```shell
 kubectl get pods
 kubectl get services
 ```
 
-## Step 6: Access Your Plone Site
+## Step 6: Access your Plone site
 
 Once all pods are running, access your Plone site:
 
-```bash
+```shell
 # Port-forward to the frontend service
 kubectl port-forward service/my-plone-frontend 3000:3000
 
@@ -110,7 +119,7 @@ kubectl port-forward service/my-plone-frontend 3000:3000
 open http://localhost:3000
 ```
 
-## Adding HTTP Caching (Optional)
+## Adding HTTP caching (optional)
 
 For production deployments, add Varnish HTTP caching:
 
@@ -132,13 +141,14 @@ new PloneHttpcache(chart, 'cache', {
 
 This adds a Varnish caching layer with cluster-wide cache invalidation using [kube-httpcache](https://github.com/mittwald/kube-httpcache).
 
-## Next Steps
+## Next steps
 
 Now that you have a basic Plone deployment:
 
-- **Configure resources**: See [Scale Resources](../how-to/scale-resources.md) to adjust CPU and memory
-- **Add monitoring**: Configure [Prometheus metrics](../how-to/configure-monitoring.md)
-- **Explore variants**: Learn about [Classic UI vs Volto](../explanation/plone-variants.md)
+- **Configure resources**: See {doc}`/reference/configuration-options` for CPU and memory options.
+- **Add monitoring**: Follow {doc}`/how-to/enable-prometheus-monitoring`.
+- **Explore variants**: Read about Volto and Classic UI in {doc}`/explanation/features`.
+- **Harden pods**: Apply {doc}`/how-to/configure-security-context`.
 
 ## Troubleshooting
 
@@ -150,8 +160,6 @@ Now that you have a basic Plone deployment:
 - Ensure port-forward is running
 - Check service endpoints: `kubectl get endpoints`
 
-For more help, see the [Troubleshooting guide](../how-to/troubleshooting.md).
-
 ---
 
 **Complete example**: See the [cdk8s-plone-example](https://github.com/bluedynamics/cdk8s-plone-example) repository for a full working example.

package/documentation/sources/tutorials/index.md

@@ -1,3 +1,12 @@
+---
+myst:
+  html_meta:
+    "description": "Learning-oriented tutorials that guide you through using cdk8s-plone to deploy Plone CMS on Kubernetes."
+    "property=og:description": "Learning-oriented tutorials that guide you through using cdk8s-plone to deploy Plone CMS on Kubernetes."
+    "property=og:title": "Tutorials"
+    "keywords": "Plone, cdk8s, Kubernetes, tutorials, getting started"
+---
+
 ```{image} ../_static/kup6s-icon-tutorials.svg
 :align: center
 :class: section-icon-large
@@ -18,7 +27,7 @@ These tutorials will teach you how to:
 - Customize component resources and settings
 - Test your deployment
 
-## Available Tutorials
+## Available tutorials
 
 ```{toctree}
 ---

package/lib/httpcache.js

@@ -118,5 +118,5 @@ class PloneHttpcache extends constructs_1.Construct {
 }
 exports.PloneHttpcache = PloneHttpcache;
 _a = JSII_RTTI_SYMBOL_1;
-PloneHttpcache[_a] = { fqn: "@bluedynamics/cdk8s-plone.PloneHttpcache", version: "0.1.35" };
+PloneHttpcache[_a] = { fqn: "@bluedynamics/cdk8s-plone.PloneHttpcache", version: "0.1.37" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaHR0cGNhY2hlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2h0dHBjYWNoZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLHlCQUF5QjtBQUN6Qiw2QkFBNkI7QUFDN0IsaUNBQTZCO0FBQzdCLDJDQUF1QztBQXdKdkM7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0gsTUFBYSxjQUFlLFNBQVEsc0JBQVM7SUFPM0MsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxPQUE4QjtRQUN0RSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pCLElBQUksVUFBa0IsQ0FBQztRQUN2QixJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3hCLElBQUksT0FBZSxDQUFDO1lBQ3BCLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7Z0JBQzVCLE9BQU8sR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztZQUM5RCxDQUFDO2lCQUFNLENBQUM7Z0JBQ04sT0FBTyxHQUFHLE9BQU8sQ0FBQyxjQUFjLENBQUM7WUFDbkMsQ0FBQztZQUNELFVBQVUsR0FBRyxFQUFFLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNoRCxDQUFDO2FBQU0sQ0FBQztZQUNOLFVBQVUsR0FBRyxPQUFPLENBQUMsVUFBVSxDQUFDO1FBQ2xDLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsVUFBVSxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUM7UUFDNUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxZQUFJLENBQUMsSUFBSSxFQUFFLFdBQVcsRUFBRTtZQUM1Qyx1REFBdUQ7WUFDdkQsSUFBSSxFQUFFLDBCQUEwQjtZQUNoQyxLQUFLLEVBQUUsZ0JBQWdCO1lBQ3ZCLE9BQU8sRUFBRSxPQUFPLENBQUMsWUFBWTtZQUM3QixNQUFNLEVBQUU7Z0JBQ04sWUFBWSxFQUFFLE9BQU8sQ0FBQyxRQUFRLElBQUksQ0FBQztnQkFDbkMsR0FBRyxDQUFDLFFBQVEsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDO2dCQUM3QyxLQUFLLEVBQUU7b0JBQ0wsY0FBYyxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsa0JBQWtCO29CQUNoRCxhQUFhLEVBQUUsS0FBSztvQkFDcEIsWUFBWSxFQUFFLElBQUk7b0JBQ2xCLGNBQWMsRUFBRSxPQUFPLENBQUMsY0FBYyxJQUFJLFNBQVM7aUJBQ3BEO2dCQUNELCtEQUErRDtnQkFDL0QsMERBQTBEO2dCQUMxRCxjQUFjLEVBQUUsa0NBQWtDO2dCQUNsRCxXQUFXLEVBQUUsVUFBVTtnQkFDdkIsWUFBWSxFQUFFO29CQUNaLEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLGtCQUFrQixFQUFFO29CQUN6RSxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO29CQUMvQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUU7b0JBQ3hELEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLG1CQUFtQixFQUFFO29CQUMzRSxFQUFFLElBQUksRUFBRSx1QkFBdUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO29CQUNoRCxHQUFHLENBQUMsT0FBTyxDQUFDLFlBQVksSUFBSSxFQUFFLENBQUM7aUJBQ2hDO2dCQUNELDREQUE0RDtnQkFDNUQsWUFBWSxFQUFFO29CQUNaLG9CQUFvQixFQUFFLE9BQU87aUJBQzlCO2dCQUNELEdBQUcsQ0FBQyxPQUFPLENBQUMsV0FBVyxJQUFJLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxXQUFXLEVBQUUsQ0FBQztnQkFDaEUsU0FBUyxFQUFFO29CQUNULE1BQU0sRUFBRTt3QkFDTixHQUFHLEVBQUUsT0FBTyxDQUFDLFFBQVEsSUFBSSxNQUFNO3dCQUMvQixNQUFNLEVBQUUsT0FBTyxDQUFDLFdBQVcsSUFBSSxPQUFPO3FCQUN2QztvQkFDRCxRQUFRLEVBQUU7d0JBQ1IsR0FBRyxFQUFFLE9BQU8sQ0FBQyxVQUFVLElBQUksTUFBTTt3QkFDakMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxhQUFhLElBQUksT0FBTztxQkFDekM7aUJBQ0Y7Z0JBQ0QsSUFBSSxFQUFFO29CQUNKLE9BQU8sRUFBRSxJQUFJO2lCQUNkO2dCQUNELFFBQVEsRUFBRTtvQkFDUixPQUFPLEVBQUUsT0FBTyxDQUFDLGVBQWUsSUFBSSxJQUFJO29CQUN4QyxTQUFTLEVBQUU7d0JBQ1QsTUFBTSxFQUFFOzRCQUNOLEdBQUcsRUFBRSxNQUFNOzRCQUNYLE1BQU0sRUFBRSxPQUFPO3lCQUNoQjt3QkFDRCxRQUFRLEVBQUU7NEJBQ1IsR0FBRyxFQUFFLEtBQUs7NEJBQ1YsTUFBTSxFQUFFLE1BQU07eUJBQ2Y7cUJBQ0Y7aUJBQ0Y7Z0JBQ0QsY0FBYyxFQUFFO29CQUNkLE9BQU8sRUFBRSxPQUFPLENBQUMsY0FBYyxJQUFJLEtBQUs7b0JBQ3hDLGVBQWUsRUFBRSxPQUFPLENBQUMsY0FBYyxJQUFJLEtBQUs7aUJBQ2pEO2FBQ0Y7U0FDRixDQUFDLENBQUM7UUFDSCxNQUFNLGdCQUFnQixHQUFHLFNBQVMsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUU7WUFDL0QsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQzVGLE9BQU8sU0FBUyxDQUFDLElBQUksQ0FBQztZQUN4QixDQUFDO1lBQ0QsT0FBTyxTQUFTLENBQUM7UUFDbkIsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLGdCQUFnQixLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLE1BQU0sSUFBSSxLQUFLLENBQUMsa0NBQWtDLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLG9CQUFvQixHQUFHLGdCQUFnQixDQUFDLElBQUksQ0FBQztJQUNwRCxDQUFDOztBQS9GSCx3Q0FnR0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBmcyBmcm9tICdmcyc7XG5pbXBvcnQgKiBhcyBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHsgSGVsbSB9IGZyb20gJ2NkazhzJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgUGxvbmUgfSBmcm9tICcuL3Bsb25lJztcblxuLyoqXG4gKiBBbiBlbnZpcm9ubWVudCB2YXJpYWJsZSB0byBwYXNzIHRvIHRoZSBrdWJlLWh0dHBjYWNoZSBjb250YWluZXIuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgSHR0cGNhY2hlRW52VmFyIHtcbiAgLyoqXG4gICAqIFRoZSBuYW1lIG9mIHRoZSBlbnZpcm9ubWVudCB2YXJpYWJsZS5cbiAgICovXG4gIHJlYWRvbmx5IG5hbWU6IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIHZhbHVlIG9mIHRoZSBlbnZpcm9ubWVudCB2YXJpYWJsZS5cbiAgICovXG4gIHJlYWRvbmx5IHZhbHVlOiBzdHJpbmc7XG59XG5cbi8qKlxuICogQSBLdWJlcm5ldGVzIHRvbGVyYXRpb24gZm9yIHRoZSBWYXJuaXNoIHBvZHMuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgSHR0cGNhY2hlVG9sZXJhdGlvbiB7XG4gIC8qKlxuICAgKiBUaGUgdGFpbnQga2V5IHRvIHRvbGVyYXRlLlxuICAgKi9cbiAgcmVhZG9ubHkga2V5OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBvcGVyYXRvciAoRXF1YWwgb3IgRXhpc3RzKS5cbiAgICogQGRlZmF1bHQgJ0VxdWFsJ1xuICAgKi9cbiAgcmVhZG9ubHkgb3BlcmF0b3I/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSB0YWludCB2YWx1ZSB0byBtYXRjaCAod2hlbiBvcGVyYXRvciBpcyBFcXVhbCkuXG4gICAqIEBkZWZhdWx0IC0gbm8gdmFsdWVcbiAgICovXG4gIHJlYWRvbmx5IHZhbHVlPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgdGFpbnQgZWZmZWN0IHRvIHRvbGVyYXRlIChOb1NjaGVkdWxlLCBQcmVmZXJOb1NjaGVkdWxlLCBOb0V4ZWN1dGUpLlxuICAgKiBAZGVmYXVsdCAtIHRvbGVyYXRlIGFsbCBlZmZlY3RzXG4gICAqL1xuICByZWFkb25seSBlZmZlY3Q/OiBzdHJpbmc7XG59XG5cbi8qKlxuICogQ29uZmlndXJhdGlvbiBvcHRpb25zIGZvciBQbG9uZUh0dHBjYWNoZSAoVmFybmlzaCBjYWNoaW5nIGxheWVyKS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBQbG9uZUh0dHBjYWNoZU9wdGlvbnMge1xuICAvKipcbiAgICogVGhlIFBsb25lIGNvbnN0cnVjdCB0byBhdHRhY2ggdGhlIEhUVFAgY2FjaGUgdG8uXG4gICAqIFRoZSBjYWNoZSB3aWxsIGF1dG9tYXRpY2FsbHkgY29ubmVjdCB0byB0aGUgYmFja2VuZCBhbmQgZnJvbnRlbmQgc2VydmljZXMuXG4gICAqL1xuICByZWFkb25seSBwbG9uZTogUGxvbmU7XG5cbiAgLyoqXG4gICAqIFZhcm5pc2ggVkNMIGNvbmZpZ3VyYXRpb24gYXMgYSBzdHJpbmcuXG4gICAqIElmIHByb3ZpZGVkLCB0aGlzIHRha2VzIHByZWNlZGVuY2Ugb3ZlciB2YXJuaXNoVmNsRmlsZS5cbiAgICogQGRlZmF1bHQgLSBsb2FkZWQgZnJvbSB2YXJuaXNoVmNsRmlsZSBvciBkZWZhdWx0IGNvbmZpZyBmaWxlXG4gICAqL1xuICByZWFkb25seSB2YXJuaXNoVmNsPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBQYXRoIHRvIGEgVmFybmlzaCBWQ0wgY29uZmlndXJhdGlvbiBmaWxlLlxuICAgKiBJZiBub3QgcHJvdmlkZWQsIHVzZXMgdGhlIGRlZmF1bHQgVkNMIGZpbGUgaW5jbHVkZWQgaW4gdGhlIGxpYnJhcnkuXG4gICAqIEBkZWZhdWx0IC0gdXNlcyBkZWZhdWx0IGNvbmZpZy92YXJuaXNoLnRwbC52Y2xcbiAgICovXG4gIHJlYWRvbmx5IHZhcm5pc2hWY2xGaWxlPzogc3RyaW5nIHwgdW5kZWZpbmVkO1xuXG4gIC8qKlxuICAgKiBOYW1lIG9mIGFuIGV4aXN0aW5nIEt1YmVybmV0ZXMgc2VjcmV0IGNvbnRhaW5pbmcgVmFybmlzaCBhZG1pbiBjcmVkZW50aWFscy5cbiAgICogVGhlIHNlY3JldCBzaG91bGQgYmUgY3JlYXRlZCBzZXBhcmF0ZWx5IGluIHRoZSBzYW1lIG5hbWVzcGFjZS5cbiAgICogQGRlZmF1bHQgLSB1bmRlZmluZWQgKG5vIGV4aXN0aW5nIHNlY3JldClcbiAgICovXG4gIHJlYWRvbmx5IGV4aXN0aW5nU2VjcmV0Pzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBDUFUgbGltaXQgZm9yIFZhcm5pc2ggcG9kcy5cbiAgICogQGRlZmF1bHQgJzUwMG0nXG4gICAqL1xuICByZWFkb25seSBsaW1pdENwdT86IHN0cmluZztcblxuICAvKipcbiAgICogTWVtb3J5IGxpbWl0IGZvciBWYXJuaXNoIHBvZHMuXG4gICAqIEBkZWZhdWx0ICc1MDBNaSdcbiAgICovXG4gIHJlYWRvbmx5IGxpbWl0TWVtb3J5Pzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBDUFUgcmVxdWVzdCBmb3IgVmFybmlzaCBwb2RzLlxuICAgKiBAZGVmYXVsdCAnMTAwbSdcbiAgICovXG4gIHJlYWRvbmx5IHJlcXVlc3RDcHU/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIE1lbW9yeSByZXF1ZXN0IGZvciBWYXJuaXNoIHBvZHMuXG4gICAqIEBkZWZhdWx0ICcxMDBNaSdcbiAgICovXG4gIHJlYWRvbmx5IHJlcXVlc3RNZW1vcnk/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIEVuYWJsZSBQcm9tZXRoZXVzIFNlcnZpY2VNb25pdG9yIGZvciBtZXRyaWNzIGNvbGxlY3Rpb24uXG4gICAqIFJlcXVpcmVzIFByb21ldGhldXMgT3BlcmF0b3IgdG8gYmUgaW5zdGFsbGVkIGluIHRoZSBjbHVzdGVyLlxuICAgKiBAZGVmYXVsdCBmYWxzZVxuICAgKi9cbiAgcmVhZG9ubHkgc2VydmljZW1vbml0b3I/OiBib29sZWFuO1xuXG4gIC8qKlxuICAgKiBFbmFibGUgdGhlIFByb21ldGhldXMgZXhwb3J0ZXIgZm9yIFZhcm5pc2ggbWV0cmljcy5cbiAgICogV2hlbiBlbmFibGVkLCB0aGUgZXhwb3J0ZXIgc2lkZWNhciBjb250YWluZXIgd2lsbCBiZSBkZXBsb3llZCBhbG9uZ3NpZGUgVmFybmlzaC5cbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgZXhwb3J0ZXJFbmFibGVkPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogVmVyc2lvbiBvZiB0aGUga3ViZS1odHRwY2FjaGUgSGVsbSBjaGFydCB0byB1c2UuXG4gICAqIElmIG5vdCBzcGVjaWZpZWQsIHRoZSBsYXRlc3QgdmVyc2lvbiBmcm9tIHRoZSByZXBvc2l0b3J5IHdpbGwgYmUgdXNlZC5cbiAgICogQGRlZmF1bHQgdW5kZWZpbmVkIChsYXRlc3QpXG4gICAqL1xuICByZWFkb25seSBjaGFydFZlcnNpb24/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFZlcnNpb24gb2YgdGhlIGt1YmUtaHR0cGNhY2hlIENvbnRhaW5lciBJbWFnZSB0byB1c2UuXG4gICAqIElmIG5vdCBzcGVjaWZpZWQsIHRoZSBsYXRlc3QgdmVyc2lvbiBmcm9tIHRoZSByZXBvc2l0b3J5IHdpbGwgYmUgdXNlZC5cbiAgICogQGRlZmF1bHQgdW5kZWZpbmVkIChjaGFydFZlcnNpb24gPSB3aXRoIGVhY2ggY2hhcnQgcmVsZWFzZSB0aGVyZSBpcyBhbiBpbWFnZSByZWxlYXNlIHRvbyApXG4gICAqL1xuICByZWFkb25seSBhcHBWZXJzaW9uPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBOdW1iZXIgb2YgVmFybmlzaCBwb2QgcmVwbGljYXMgdG8gcnVuLlxuICAgKiBAZGVmYXVsdCAyXG4gICAqL1xuICByZWFkb25seSByZXBsaWNhcz86IG51bWJlcjtcblxuICAvKipcbiAgICogQWRkaXRpb25hbCBlbnZpcm9ubWVudCB2YXJpYWJsZXMgdG8gcGFzcyB0byB0aGUga3ViZS1odHRwY2FjaGUgY29udGFpbmVyLlxuICAgKiBUaGVzZSBhcmUgYXBwZW5kZWQgdG8gdGhlIGJ1aWx0LWluIGVudiB2YXJzIChCQUNLRU5EX1NFUlZJQ0VfTkFNRSwgZXRjLilcbiAgICogYW5kIGNhbiBiZSByZWZlcmVuY2VkIGluIFZDTCB0ZW1wbGF0ZXMgdXNpbmcgR28gdGVtcGxhdGUgc3ludGF4OiB7eyAuRW52LlZBUl9OQU1FIH19XG4gICAqIEBkZWZhdWx0IC0gbm8gYWRkaXRpb25hbCBlbnYgdmFyc1xuICAgKi9cbiAgcmVhZG9ubHkgZXh0cmFFbnZWYXJzPzogSHR0cGNhY2hlRW52VmFyW107XG5cbiAgLyoqXG4gICAqIFRvbGVyYXRpb25zIGZvciB0aGUgVmFybmlzaCBwb2RzLlxuICAgKiBVc2UgdGhpcyB0byBhbGxvdyBzY2hlZHVsaW5nIG9uIG5vZGVzIHdpdGggc3BlY2lmaWMgdGFpbnRzLFxuICAgKiBlLmcuIG5vZGVzIHRhaW50ZWQgd2l0aCBrdWJlcm5ldGVzLmlvL2FyY2g9YW1kNjQ6Tm9TY2hlZHVsZS5cbiAgICogQGRlZmF1bHQgLSBubyB0b2xlcmF0aW9uc1xuICAgKi9cbiAgcmVhZG9ubHkgdG9sZXJhdGlvbnM/OiBIdHRwY2FjaGVUb2xlcmF0aW9uW107XG59XG5cbi8qKlxuICogUGxvbmVIdHRwY2FjaGUgY29uc3RydWN0IGZvciBkZXBsb3lpbmcgVmFybmlzaCBIVFRQIGNhY2hpbmcgbGF5ZXIuXG4gKlxuICogVXNlcyB0aGUgbWl0dHdhbGQva3ViZS1odHRwY2FjaGUgSGVsbSBjaGFydCB0byBkZXBsb3kgVmFybmlzaCBhcyBhXG4gKiBjYWNoaW5nIHByb3h5IGluIGZyb250IG9mIFBsb25lIGJhY2tlbmQgYW5kL29yIGZyb250ZW5kIHNlcnZpY2VzLlxuICpcbiAqIFRoZSBjYWNoZSBhdXRvbWF0aWNhbGx5IGNvbm5lY3RzIHRvIHRoZSBQbG9uZSBzZXJ2aWNlcyBhbmQgcHJvdmlkZXNcbiAqIEhUVFAgY2FjaGUgaW52YWxpZGF0aW9uIGNhcGFiaWxpdGllcy5cbiAqXG4gKiBAZXhhbXBsZVxuICogY29uc3QgcGxvbmUgPSBuZXcgUGxvbmUoY2hhcnQsICdwbG9uZScpO1xuICogY29uc3QgY2FjaGUgPSBuZXcgUGxvbmVIdHRwY2FjaGUoY2hhcnQsICdjYWNoZScsIHtcbiAqICAgcGxvbmU6IHBsb25lLFxuICogICBleGlzdGluZ1NlY3JldDogJ3Zhcm5pc2gtc2VjcmV0JyxcbiAqIH0pO1xuICovXG5leHBvcnQgY2xhc3MgUGxvbmVIdHRwY2FjaGUgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICAvKipcbiAgICogTmFtZSBvZiB0aGUgVmFybmlzaCBzZXJ2aWNlIGNyZWF0ZWQgYnkgdGhlIEhlbG0gY2hhcnQuXG4gICAqIFVzZSB0aGlzIHRvIHJlZmVyZW5jZSB0aGUgY2FjaGUgc2VydmljZSBmcm9tIGluZ3Jlc3Mgb3Igb3RoZXIgY29uc3RydWN0cy5cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBodHRwY2FjaGVTZXJ2aWNlTmFtZTogc3RyaW5nO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIG9wdGlvbnM6IFBsb25lSHR0cGNhY2hlT3B0aW9ucykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgbGV0IHZhcm5pc2hWY2w6IHN0cmluZztcbiAgICBpZiAoIW9wdGlvbnMudmFybmlzaFZjbCkge1xuICAgICAgbGV0IHZjbFBhdGg6IHN0cmluZztcbiAgICAgIGlmICghb3B0aW9ucy52YXJuaXNoVmNsRmlsZSkge1xuICAgICAgICB2Y2xQYXRoID0gcGF0aC5qb2luKF9fZGlybmFtZSwgJ2NvbmZpZycsICd2YXJuaXNoLnRwbC52Y2wnKTtcbiAgICAgIH0gZWxzZSB7XG4gICAgICAgIHZjbFBhdGggPSBvcHRpb25zLnZhcm5pc2hWY2xGaWxlO1xuICAgICAgfVxuICAgICAgdmFybmlzaFZjbCA9IGZzLnJlYWRGaWxlU3luYyh2Y2xQYXRoLCAndXRmOCcpO1xuICAgIH0gZWxzZSB7XG4gICAgICB2YXJuaXNoVmNsID0gb3B0aW9ucy52YXJuaXNoVmNsO1xuICAgIH1cbiAgICBjb25zdCBpbWFnZVRhZyA9IG9wdGlvbnMuYXBwVmVyc2lvbiA/PyBvcHRpb25zLmNoYXJ0VmVyc2lvbjtcbiAgICBjb25zdCBodHRwY2FjaGUgPSBuZXcgSGVsbSh0aGlzLCAnaHR0cGNhY2hlJywge1xuICAgICAgLy8gc2VlIGh0dHBzOi8vZ2l0aHViLmNvbS9taXR0d2FsZC9rdWJlLWh0dHBjYWNoZS9jaGFydFxuICAgICAgcmVwbzogJ2h0dHBzOi8vaGVsbS5taXR0d2FsZC5kZScsXG4gICAgICBjaGFydDogJ2t1YmUtaHR0cGNhY2hlJyxcbiAgICAgIHZlcnNpb246IG9wdGlvbnMuY2hhcnRWZXJzaW9uLFxuICAgICAgdmFsdWVzOiB7XG4gICAgICAgIHJlcGxpY2FDb3VudDogb3B0aW9ucy5yZXBsaWNhcyA/PyAyLFxuICAgICAgICAuLi4oaW1hZ2VUYWcgJiYgeyBpbWFnZTogeyB0YWc6IGltYWdlVGFnIH0gfSksXG4gICAgICAgIGNhY2hlOiB7XG4gICAgICAgICAgYmFja2VuZFNlcnZpY2U6IG9wdGlvbnMucGxvbmUuYmFja2VuZFNlcnZpY2VOYW1lLFxuICAgICAgICAgIGZyb250ZW5kV2F0Y2g6IGZhbHNlLFxuICAgICAgICAgIGJhY2tlbmRXYXRjaDogdHJ1ZSxcbiAgICAgICAgICBleGlzdGluZ1NlY3JldDogb3B0aW9ucy5leGlzdGluZ1NlY3JldCA/PyB1bmRlZmluZWQsXG4gICAgICAgIH0sXG4gICAgICAgIC8vIFdvcmthcm91bmQ6IHVwc3RyZWFtIGNoYXJ0IGFjY2VwdHMgYmFja2VuZFBvcnROYW1lIGJ1dCBuZXZlclxuICAgICAgICAvLyByZW5kZXJzIGl0IGFzIENMSSBhcmcuIFBhc3MgdmlhIGNhY2hlRXh0cmFBcmdzIGluc3RlYWQuXG4gICAgICAgIGNhY2hlRXh0cmFBcmdzOiAnLSAtYmFja2VuZC1wb3J0bmFtZT1iYWNrZW5kLWh0dHAnLFxuICAgICAgICB2Y2xUZW1wbGF0ZTogdmFybmlzaFZjbCxcbiAgICAgICAgZXh0cmFFbnZWYXJzOiBbXG4gICAgICAgICAgeyBuYW1lOiAnQkFDS0VORF9TRVJWSUNFX05BTUUnLCB2YWx1ZTogb3B0aW9ucy5wbG9uZS5iYWNrZW5kU2VydmljZU5hbWUgfSxcbiAgICAgICAgICB7IG5hbWU6ICdCQUNLRU5EX1NFUlZJQ0VfUE9SVCcsIHZhbHVlOiAnODA4MCcgfSxcbiAgICAgICAgICB7IG5hbWU6ICdCQUNLRU5EX1NJVEVfSUQnLCB2YWx1ZTogb3B0aW9ucy5wbG9uZS5zaXRlSWQgfSxcbiAgICAgICAgICB7IG5hbWU6ICdGUk9OVEVORF9TRVJWSUNFX05BTUUnLCB2YWx1ZTogb3B0aW9ucy5wbG9uZS5mcm9udGVuZFNlcnZpY2VOYW1lIH0sXG4gICAgICAgICAgeyBuYW1lOiAnRlJPTlRFTkRfU0VSVklDRV9QT1JUJywgdmFsdWU6ICczMDAwJyB9LFxuICAgICAgICAgIC4uLihvcHRpb25zLmV4dHJhRW52VmFycyA/PyBbXSksXG4gICAgICAgIF0sXG4gICAgICAgIC8vIHNlZSBodHRwczovL2dpdGh1Yi5jb20vbWl0dHdhbGQva3ViZS1odHRwY2FjaGUvaXNzdWVzLzI1M1xuICAgICAgICBub2RlU2VsZWN0b3I6IHtcbiAgICAgICAgICAna3ViZXJuZXRlcy5pby9hcmNoJzogJ2FtZDY0JyxcbiAgICAgICAgfSxcbiAgICAgICAgLi4uKG9wdGlvbnMudG9sZXJhdGlvbnMgJiYgeyB0b2xlcmF0aW9uczogb3B0aW9ucy50b2xlcmF0aW9ucyB9KSxcbiAgICAgICAgcmVzb3VyY2VzOiB7XG4gICAgICAgICAgbGltaXRzOiB7XG4gICAgICAgICAgICBjcHU6IG9wdGlvbnMubGltaXRDcHUgfHwgJzUwMG0nLFxuICAgICAgICAgICAgbWVtb3J5OiBvcHRpb25zLmxpbWl0TWVtb3J5IHx8ICc1MDBNaScsXG4gICAgICAgICAgfSxcbiAgICAgICAgICByZXF1ZXN0czoge1xuICAgICAgICAgICAgY3B1OiBvcHRpb25zLnJlcXVlc3RDcHUgfHwgJzEwMG0nLFxuICAgICAgICAgICAgbWVtb3J5OiBvcHRpb25zLnJlcXVlc3RNZW1vcnkgfHwgJzEwME1pJyxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgICByYmFjOiB7XG4gICAgICAgICAgZW5hYmxlZDogdHJ1ZSxcbiAgICAgICAgfSxcbiAgICAgICAgZXhwb3J0ZXI6IHtcbiAgICAgICAgICBlbmFibGVkOiBvcHRpb25zLmV4cG9ydGVyRW5hYmxlZCA/PyB0cnVlLFxuICAgICAgICAgIHJlc291cmNlczoge1xuICAgICAgICAgICAgbGltaXRzOiB7XG4gICAgICAgICAgICAgIGNwdTogJzEwMG0nLFxuICAgICAgICAgICAgICBtZW1vcnk6ICcxMDBNaScsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgICAgcmVxdWVzdHM6IHtcbiAgICAgICAgICAgICAgY3B1OiAnMTBtJyxcbiAgICAgICAgICAgICAgbWVtb3J5OiAnNTBNaScsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHNlcnZpY2VNb25pdG9yOiB7XG4gICAgICAgICAgZW5hYmxlZDogb3B0aW9ucy5zZXJ2aWNlbW9uaXRvciB8fCBmYWxzZSxcbiAgICAgICAgICBzY3JhcGVTaWduYWxsZXI6IG9wdGlvbnMuc2VydmljZW1vbml0b3IgfHwgZmFsc2UsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH0pO1xuICAgIGNvbnN0IGh0dHBjYWNoZVNlcnZpY2UgPSBodHRwY2FjaGUuYXBpT2JqZWN0cy5maW5kKChjb25zdHJ1Y3QpID0+IHtcbiAgICAgIGlmICgoY29uc3RydWN0LmtpbmQgPT09ICdTZXJ2aWNlJykgJiYgKGNvbnN0cnVjdC5tZXRhZGF0YS5uYW1lPy5lbmRzV2l0aCgna3ViZS1odHRwY2FjaGUnKSkpIHtcbiAgICAgICAgcmV0dXJuIGNvbnN0cnVjdC5uYW1lO1xuICAgICAgfVxuICAgICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgICB9KTtcbiAgICBpZiAoaHR0cGNhY2hlU2VydmljZSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ0NvdWxkIG5vdCBmaW5kIGh0dHBjYWNoZSBzZXJ2aWNlJyk7XG4gICAgfVxuICAgIHRoaXMuaHR0cGNhY2hlU2VydmljZU5hbWUgPSBodHRwY2FjaGVTZXJ2aWNlLm5hbWU7XG4gIH1cbn0iXX0=