feat(core): initialize project with access control and AI integration

Automates namespace creation, prerequisite checks, chart lint,
helm upgrade --install with wait, and post-deploy verification.

apps/gingress/src/controller/ingress_watcher.rs

@@ -131,7 +131,7 @@ fn process_ingress(ingress: &Ingress, store: &ConfigStore, _ingress_class: &str)
 
     // Process annotations for advanced features
     let annotations = ingress.annotations();
-    process_annotations(&annotations, &ingress_prefix, store);
+    process_annotations(&annotations, &ingress_prefix, &namespace, store);
 
     store.signal_reload();
 }
@@ -163,6 +163,7 @@ const ANN_RATE_LIMIT_BURST: &str = "gingress.io/rate-limit-burst";
 const ANN_REQUEST_HEADERS: &str = "gingress.io/request-headers";
 const ANN_WEBSOCKET: &str = "gingress.io/websocket";
 const ANN_SESSION_AFFINITY: &str = "gingress.io/session-affinity";
+const ANN_GIT_BACKEND: &str = "gingress.io/git-backend";
 
 /// Parse Ingress annotations and write corresponding ConfigStore entries.
 ///
@@ -175,6 +176,7 @@ const ANN_SESSION_AFFINITY: &str = "gingress.io/session-affinity";
 fn process_annotations(
     annotations: &BTreeMap<String, String>,
     ingress_prefix: &str,
+    namespace: &str,
     store: &ConfigStore,
 ) {
     // Collect hosts from the ingress routes that were just stored
@@ -256,6 +258,22 @@ fn process_annotations(
             );
         }
     }
+
+    // ── Git backend ──
+    // When present, requests with Git User-Agent (git/*, JGit/*) are routed to
+    // this backend instead of normal host+path matching.
+    // Value format: "namespace/service-name:port" or "service-name:port" (namespace from Ingress)
+    if let Some(val) = annotations.get(ANN_GIT_BACKEND) {
+        if let Some(backend) = parse_git_backend(val, &namespace) {
+            store.set("git_backend", &backend);
+            tracing::info!(
+                backend = format!("{}/{}:{}", backend.namespace, backend.name, backend.port),
+                "Git backend configured"
+            );
+        } else {
+            tracing::warn!(annotation = %ANN_GIT_BACKEND, value = %val, "Invalid git-backend format, expected 'namespace/name:port' or 'name:port'");
+        }
+    }
 }
 
 fn parse_rate_limit(val: &str, burst_override: Option<&String>) -> (u32, u32) {
@@ -321,6 +339,34 @@ fn parse_session_affinity(val: &str) -> (bool, String, u64) {
     }
 }
 
+/// Parse git-backend annotation value.
+///
+/// Format: "namespace/name:port" or "name:port" (namespace defaults to Ingress namespace).
+fn parse_git_backend(val: &str, default_namespace: &str) -> Option<gingress_proxy::config::Backend> {
+    let val = val.trim();
+    // Split off port: "namespace/name:port" → ("namespace/name", "port")
+    let (ns_name, port_str) = val.rsplit_once(':').unwrap_or((val, ""));
+    let port: u16 = port_str.parse().ok()?;
+
+    // Split namespace and name: "namespace/name" → ("namespace", "name")
+    let (namespace, name) = if let Some((ns, n)) = ns_name.rsplit_once('/') {
+        (ns.to_string(), n.to_string())
+    } else {
+        // No namespace specified — use the Ingress namespace
+        (default_namespace.to_string(), ns_name.to_string())
+    };
+
+    if name.is_empty() {
+        return None;
+    }
+
+    Some(gingress_proxy::config::Backend {
+        namespace,
+        name,
+        port,
+    })
+}
+
 /// Remove a set of hosts from the global websocket host list (scoped cleanup).
 fn prune_websocket_hosts(store: &ConfigStore, hosts_to_remove: &[String]) {
     if let Some(mut existing) = store.get::<Vec<String>>("websocket:hosts") {

apps/gingress/src/controller/reconciler.rs

@@ -71,6 +71,7 @@ impl Reconciler {
         let headers = self.collect_headers();
         let session_affinity = self.collect_session_affinity(&routes);
         let websocket_hosts = self.collect_websocket_hosts();
+        let git_upstream = self.collect_git_backend();
 
         // Step 5: Build the complete ProxyConfig
         let cfg = ProxyConfig {
@@ -81,6 +82,7 @@ impl Reconciler {
             headers,
             session_affinity,
             websocket_hosts,
+            git_upstream,
         };
 
         // Step 6: Validate
@@ -231,4 +233,9 @@ impl Reconciler {
             .get::<Vec<String>>("websocket:hosts")
             .unwrap_or_default()
     }
+
+    /// Collect git backend configuration from annotation.
+    fn collect_git_backend(&self) -> Option<gingress_proxy::config::Backend> {
+        self.store.get("git_backend")
+    }
 }

deploy.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ── helpers ──────────────────────────────────────────────────────────
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+log()  { echo -e "${GREEN}[OK]${NC}  $*"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+err()  { echo -e "${RED}[ERR]${NC} $*"; exit 1; }
+
+command_exists() { command -v "$1" &>/dev/null; }
+
+# ── defaults ─────────────────────────────────────────────────────────
+NAMESPACE="${NAMESPACE:-app}"
+RELEASE="${RELEASE:-deploy}"
+CHART_DIR="${CHART_DIR:-./deploy}"
+REGISTRY="${REGISTRY:-harbor.gitdata.me/gtateam}"
+TAG="${TAG:-$(git rev-parse --short HEAD)}"
+CONFIG_MAP="${CONFIG_MAP:-app-env}"
+PVC_NAME="${PVC_NAME:-shared-data}"
+
+# ── prerequisites ────────────────────────────────────────────────────
+command_exists helm   || err "helm not found — install via https://helm.sh/docs/intro/install/"
+command_exists kubectl || err "kubectl not found — install via https://kubernetes.io/docs/tasks/tools/"
+
+log "helm $(helm version --short)"
+log "kubectl $(kubectl version --client --short 2>/dev/null || kubectl version -o json 2>/dev/null | grep gitVersion)"
+
+# ── 1. Ensure namespace ──────────────────────────────────────────────
+log "Ensuring namespace $NAMESPACE exists..."
+kubectl create namespace "$NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
+
+# ── 2. Ensure prerequisites ─────────────────────────────────────────
+# ConfigMap (must exist before Helm install)
+if ! kubectl get configmap "$CONFIG_MAP" -n "$NAMESPACE" &>/dev/null; then
+    err "ConfigMap '$CONFIG_MAP' not found in namespace '$NAMESPACE' — create it first"
+fi
+
+# PVC (must exist before Helm install)
+if ! kubectl get pvc "$PVC_NAME" -n "$NAMESPACE" &>/dev/null; then
+    err "PVC '$PVC_NAME' not found in namespace '$NAMESPACE' — create it first"
+fi
+
+# cert-manager ClusterIssuer
+if ! kubectl get clusterissuer letsencrypt-prod &>/dev/null; then
+    warn "ClusterIssuer 'letsencrypt-prod' not found — TLS certificate issuance will fail"
+fi
+
+log "Prerequisites verified"
+
+# ── 3. Lint chart ────────────────────────────────────────────────────
+log "Linting Helm chart..."
+helm lint "$CHART_DIR" || err "Helm lint failed"
+
+# ── 4. Deploy ────────────────────────────────────────────────────────
+log "Deploying release $RELEASE with tag $TAG..."
+
+helm upgrade --install "$RELEASE" "$CHART_DIR" \
+    --namespace "$NAMESPACE" \
+    --set imageRegistry="$REGISTRY" \
+    --set imageTag="$TAG" \
+    --set configMapName="$CONFIG_MAP" \
+    --set pvcName="$PVC_NAME" \
+    --wait \
+    --timeout 5m
+
+log "Release $RELEASE deployed successfully"
+
+# ── 5. Verify ────────────────────────────────────────────────────────
+log "Checking deployment status..."
+kubectl get deployments -n "$NAMESPACE" -l app.kubernetes.io/instance="$RELEASE"
+kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/instance="$RELEASE"
+kubectl get services -n "$NAMESPACE" -l app.kubernetes.io/instance="$RELEASE"
+kubectl get ingress -n "$NAMESPACE"
+
+log "Deployment complete"

deploy/.helmignore

@@ -21,3 +21,5 @@
 .idea/
 *.tmproj
 .vscode/
+# Secrets
+.server.yaml

deploy/templates/gingress/deployment.yaml

@@ -2,11 +2,11 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: gingress-controller
-  namespace: gingress-system
+  namespace: {{ .Values.gingress.namespace | default "gingress-system" }}
   labels:
     app: gingress
 spec:
-  replicas: 2
+  replicas: {{ .Values.gingress.replicaCount | default 2 }}
   selector:
     matchLabels:
       app: gingress
@@ -18,28 +18,30 @@ spec:
       serviceAccountName: gingress-controller
       containers:
         - name: gingress
-          image: gingress:latest
-          imagePullPolicy: IfNotPresent
+          image: "{{ .Values.imageRegistry }}/{{ .Values.gingress.repository }}:{{ .Values.imageTag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.gingress.imagePullPolicy | default "IfNotPresent" }}
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           args:
             - "--ingress-class=gingress"
-            - "--bind-http=0.0.0.0:80"
-            - "--bind-https=0.0.0.0:443"
+            - "--bind-http=0.0.0.0:{{ .Values.gingress.httpPort | default 80 }}"
+            - "--bind-https=0.0.0.0:{{ .Values.gingress.httpsPort | default 443 }}"
             - "--metrics-bind=0.0.0.0:8080"
           ports:
             - name: http
-              containerPort: 80
+              containerPort: {{ .Values.gingress.httpPort | default 80 }}
               protocol: TCP
             - name: https
-              containerPort: 443
+              containerPort: {{ .Values.gingress.httpsPort | default 443 }}
               protocol: TCP
             - name: metrics
               containerPort: 8080
               protocol: TCP
           env:
             - name: RUST_LOG
-              value: "info"
-            - name: METRICS_PUSH_URL
-              value: ""  # Optional: push to metrics aggregator
+              value: {{ .Values.gingress.logLevel | default "info" | quote }}
           livenessProbe:
             httpGet:
               path: /healthz
@@ -52,13 +54,10 @@ spec:
               port: 8080
             initialDelaySeconds: 5
             periodSeconds: 5
+          {{- with .Values.gingress.resources }}
           resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 512Mi
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -68,26 +67,3 @@ spec:
                   matchLabels:
                     app: gingress
                 topologyKey: kubernetes.io/hostname
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: gingress
-  namespace: gingress-system
-spec:
-  type: LoadBalancer
-  selector:
-    app: gingress
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP
-    - name: https
-      port: 443
-      targetPort: 443
-      protocol: TCP
-    - name: metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP

deploy/templates/gingress/rbac.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: gingress-system
+  name: {{ .Values.gingress.namespace | default "gingress-system" }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: gingress-controller
-  namespace: gingress-system
+  namespace: {{ .Values.gingress.namespace | default "gingress-system" }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -38,7 +38,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: gingress-controller
-    namespace: gingress-system
+    namespace: {{ .Values.gingress.namespace | default "gingress-system" }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: IngressClass

deploy/templates/gingress/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gingress
+  namespace: {{ .Values.gingress.namespace | default "gingress-system" }}
+  labels:
+    app: gingress
+spec:
+  type: LoadBalancer
+  selector:
+    app: gingress
+  ports:
+    - name: http
+      port: {{ .Values.gingress.httpPort | default 80 }}
+      targetPort: http
+      protocol: TCP
+    - name: https
+      port: {{ .Values.gingress.httpsPort | default 443 }}
+      targetPort: https
+      protocol: TCP

deploy/templates/gitserver/ssh-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "deploy.serviceFullname" (dict "root" . "svcKey" "gitserver") }}-ssh
+  labels:
+    {{- include "deploy.labels" . | nindent 4 }}
+    app.kubernetes.io/component: gitserver
+spec:
+  type: LoadBalancer
+  ports:
+    - port: {{ .Values.services.gitserver.ports.ssh }}
+      targetPort: ssh
+      protocol: TCP
+      name: ssh
+  selector:
+    {{- include "deploy.serviceSelectorLabels" (dict "root" . "svcKey" "gitserver") | nindent 4 }}

deploy/values.yaml

@@ -137,25 +137,50 @@ services:
         mountPath: /data
         subPath: static
 
+# Gingress controller configuration
+gingress:
+  namespace: "app"
+  repository: gingress
+  replicaCount: 2
+  httpPort: 80
+  httpsPort: 443
+  logLevel: "info"
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
 # External PVC (managed outside Helm — not deleted on uninstall)
 pvcName: "shared-data"
 
-# Ingress — only for the main app service
+# Ingress — handled by gingress controller
 ingress:
-  enabled: false
-  className: ""
-  annotations: {}
+  enabled: true
+  className: "gingress"
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    gingress.io/git-backend: "deploy-gitserver:8021"
   hosts:
-    - host: chart-example.local
+    - host: gitdata.ai
       paths:
         - path: /
           pathType: Prefix
           serviceName: app
           servicePort: 3000
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
+    - host: static.gitdata.ai
+      paths:
+        - path: /
+          pathType: Prefix
+          serviceName: static_server
+          servicePort: 8081
+  tls:
+    - secretName: gitdata-ai-tls
+      hosts:
+        - gitdata.ai
+        - static.gitdata.ai
 
 imagePullSecrets: []
 nameOverride: ""

libs/gingress-proxy/src/config.rs

@@ -90,6 +90,8 @@ pub struct ProxyConfig {
     pub session_affinity: HashMap<String, SessionAffinityConfig>,
     /// WebSocket enabled hosts
     pub websocket_hosts: Vec<String>,
+    /// Git backend — requests with Git User-Agent are routed here
+    pub git_upstream: Option<Backend>,
 }
 
 /// The shared configuration store: read-heavy, write-light.

libs/gingress-proxy/src/server.rs

@@ -41,6 +41,23 @@ impl GIngressProxy {
     pub fn filter_chain(&self) -> &Arc<std::sync::RwLock<FilterChain>> {
         &self.filter_chain
     }
+
+    /// Match a request to a route rule based on host and path.
+    fn match_route(cfg: &crate::config::ProxyConfig, host: &str, path: &str) -> Option<String> {
+        cfg.routes.get(host).and_then(|rules| {
+            rules.iter().find(|r| match r.path_type {
+                crate::config::PathType::Prefix | crate::config::PathType::ImplementationSpecific => {
+                    path.starts_with(&r.path)
+                }
+                crate::config::PathType::Exact => path == r.path,
+            })
+        }).map(|r| {
+            format!(
+                "upstream:{}/{}:{}",
+                r.backend.namespace, r.backend.name, r.backend.port
+            )
+        })
+    }
 }
 
 #[async_trait::async_trait]
@@ -66,23 +83,29 @@ impl ProxyHttp for GIngressProxy {
 
         let cfg = self.config.assemble_proxy_config();
 
-        // Match path to a route rule
-        let path = session.req_header().uri.path();
-        let route = cfg.routes.get(&host).and_then(|rules| {
-            rules.iter().find(|r| match r.path_type {
-                crate::config::PathType::Prefix | crate::config::PathType::ImplementationSpecific => {
-                    path.starts_with(&r.path)
-                }
-                crate::config::PathType::Exact => path == r.path,
-            })
-        });
+        // Git User-Agent override: requests from git clients (git/2.x, JGit, etc.)
+        // are routed directly to the git backend regardless of host/path matching.
+        let backend_key = if let Some(ref git_backend) = cfg.git_upstream {
+            let ua = session
+                .req_header()
+                .headers
+                .get("user-agent")
+                .and_then(|v| v.to_str().ok())
+                .unwrap_or("");
 
-        let backend_key = route.map(|r| {
-            format!(
+            if ua.starts_with("git/") || ua.starts_with("JGit/") {
+                tracing::debug!(host, ua, "Git UA detected, routing to git backend");
+                Some(format!(
                     "upstream:{}/{}:{}",
-                r.backend.namespace, r.backend.name, r.backend.port
-            )
-        });
+                    git_backend.namespace, git_backend.name, git_backend.port
+                ))
+            } else {
+                // Normal route matching for non-git requests
+                Self::match_route(&cfg, &host, session.req_header().uri.path())
+            }
+        } else {
+            Self::match_route(&cfg, &host, session.req_header().uri.path())
+        };
 
         // Select endpoint via load balancer
         let endpoint = backend_key
@@ -105,7 +128,7 @@ impl ProxyHttp for GIngressProxy {
             }
             None => pingora::Error::e_explain(
                 pingora::ErrorType::InternalError,
-                format!("no upstream found for host '{}' path '{}'", host, path),
+                format!("no upstream found for host '{}' path '{}'", host, session.req_header().uri.path()),
             ),
         }
     }

src/components/layout/MemberList.tsx

@@ -19,41 +19,6 @@ const ROLE_COLORS: Record<string, string> = {
   member: 'var(--role-blue)',
 };
 
-/** Fallback mock data for non-project pages or loading states */
-const MOCK_ROLES = [
-  {
-    name: 'Admin',
-    color: 'var(--role-red)',
-    members: [
-      { name: 'ZhenYi', status: 'online' as const, activity: 'Coding' },
-    ],
-  },
-  {
-    name: 'Maintainer',
-    color: 'var(--role-orange)',
-    members: [
-      { name: 'Alex', status: 'online' as const, activity: '' },
-      { name: 'Mia', status: 'idle' as const, activity: 'Reviewing PR' },
-    ],
-  },
-  {
-    name: 'Developer',
-    color: 'var(--role-blue)',
-    members: [
-      { name: 'Tom', status: 'online' as const, activity: '' },
-      { name: 'Luna', status: 'offline' as const, activity: '' },
-      { name: 'Jake', status: 'offline' as const, activity: '' },
-    ],
-  },
-  {
-    name: 'Guest',
-    color: 'var(--role-gray)',
-    members: [
-      { name: 'Sam', status: 'offline' as const, activity: '' },
-    ],
-  },
-];
-
 function useRoomSafe() {
   try {
     return useRoom();
@@ -68,6 +33,7 @@ export function MemberList() {
 
   const [groups, setGroups] = useState<MemberGroup[]>([]);
   const [total, setTotal] = useState(0);
+  const [loading, setLoading] = useState(true);
   const [apiPresence, setApiPresence] = useState<Map<string, PresenceStatus>>(new Map());
 
   // Fetch project presence from API
@@ -127,10 +93,12 @@ export function MemberList() {
     if (!projectName) {
       setGroups([]);
       setTotal(0);
+      setLoading(false);
       return;
     }
 
     let cancelled = false;
+    setLoading(true);
 
     projectMembersGrouped(projectName)
       .then((res) => {
@@ -144,13 +112,41 @@ export function MemberList() {
         console.error('[MemberList] failed to load project members:', err);
         setGroups([]);
         setTotal(0);
+      })
+      .finally(() => {
+        if (!cancelled) setLoading(false);
       });
 
     return () => { cancelled = true; };
   }, [projectName]);
 
-  // Real project members loaded
-  if (groups.length > 0) {
+  // Loading state
+  if (loading) {
+    return (
+      <div
+        className="flex flex-col items-center justify-center h-full w-[240px]"
+        style={{ backgroundColor: 'var(--surface-sidebar)' }}
+      >
+        <div className="w-5 h-5 rounded-full border-2 border-t-transparent animate-spin" style={{ borderColor: 'var(--text-muted)', borderTopColor: 'transparent' }} />
+      </div>
+    );
+  }
+
+  // No project selected or no members
+  if (groups.length === 0) {
+    return (
+      <div
+        className="flex flex-col items-center justify-center h-full w-[240px]"
+        style={{ backgroundColor: 'var(--surface-sidebar)' }}
+      >
+        <p className="text-[12px]" style={{ color: 'var(--text-muted)' }}>
+          {projectName ? 'No members' : 'Select a project'}
+        </p>
+      </div>
+    );
+  }
+
+  // Real project members
   return (
     <div
       className="flex flex-col h-full w-[240px] pt-4 px-2 overflow-y-auto"
@@ -221,62 +217,4 @@ export function MemberList() {
       })}
     </div>
   );
-  }
-
-  // Loading / no project selected: show mock fallback
-  return (
-    <div
-      className="flex flex-col h-full w-[240px] pt-6 px-2 overflow-y-auto"
-      style={{ backgroundColor: 'var(--surface-sidebar)' }}
-    >
-      {MOCK_ROLES.map((role) => (
-        <div key={role.name} className="mb-2">
-          <div
-            className="flex items-center px-1 py-1 text-[11px] font-semibold uppercase"
-            style={{ color: 'var(--text-muted)' }}
-          >
-            <span style={{ color: role.color }}>{role.name}</span>
-            <span className="ml-1">— {role.members.length}</span>
-          </div>
-
-          {role.members.map((m) => (
-            <button
-              key={m.name}
-              className={`flex items-center gap-3 px-2 py-1.5 rounded-[4px] transition-colors cursor-pointer w-full text-left ${
-                m.status === 'offline' ? 'opacity-40' : ''
-              }`}
-              style={{ color: 'var(--text-primary)' }}
-            >
-              <div
-                className="w-8 h-8 rounded-full flex items-center justify-center relative flex-shrink-0"
-                style={{ backgroundColor: role.color }}
-              >
-                <span className="text-xs font-medium" style={{ color: 'var(--text-inverse)' }}>
-                  {m.name[0]}
-                </span>
-                <div
-                  className="absolute -bottom-0.5 -right-0.5 w-3.5 h-3.5 rounded-full border-[3px]"
-                  style={{
-                    backgroundColor: STATUS_COLORS[m.status],
-                    borderColor: 'var(--surface-sidebar)',
-                  }}
-                />
-              </div>
-
-              <div className="min-w-0">
-                <p className="text-[13px] font-medium truncate" style={{ color: role.color }}>
-                  {m.name}
-                </p>
-                {m.activity && (
-                  <p className="text-[11px] truncate" style={{ color: 'var(--text-muted)' }}>
-                    {m.activity}
-                  </p>
-                )}
-              </div>
-            </button>
-          ))}
-        </div>
-      ))}
-    </div>
-  );
 }