From fd207da3cc3387f6a4cab31ce2152eed3bf76e03 Mon Sep 17 00:00:00 2001
From: chemavx <chemavx@git.chemavx.xyz>
Date: Sun, 21 Jun 2026 20:11:34 +0000
Subject: [PATCH] zona-exclusion: repoint SMTP to Infisical secret + Recreate
 strategy (3b)

- mail__options__auth__user/pass secretKeyRef
    zona-exclusion-secrets -> zona-exclusion-secrets-infisical (remapped keys)
- strategy RollingUpdate -> Recreate (single-replica RWO SQLite Ghost; avoids
    two-pods-on-one-ghost.db overlap during rolls)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 zona-exclusion/deployment.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/zona-exclusion/deployment.yaml b/zona-exclusion/deployment.yaml
index f2b8b3c..b92c1dc 100644
--- a/zona-exclusion/deployment.yaml
+++ b/zona-exclusion/deployment.yaml
@@ -30,6 +30,10 @@ metadata:
     app: zona-exclusion
 spec:
   replicas: 1
+  # Single-replica Ghost on a RWO local-path SQLite DB: Recreate avoids two Ghost
+  # processes briefly sharing one ghost.db during a roll (RollingUpdate corruption risk).
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: zona-exclusion
@@ -56,12 +60,12 @@ spec:
             - name: mail__options__auth__user
               valueFrom:
                 secretKeyRef:
-                  name: zona-exclusion-secrets
+                  name: zona-exclusion-secrets-infisical
                   key: smtp-user
             - name: mail__options__auth__pass
               valueFrom:
                 secretKeyRef:
-                  name: zona-exclusion-secrets
+                  name: zona-exclusion-secrets-infisical
                   key: smtp-pass
             - name: mail__from
               value: "Zona de Exclusión <chemavx@gmail.com>"