[0kaba0hub]

develop into main for 0.1.44: one change, #84.

• The Ingress carries cloudflare-whitelist: "true", so the cluster's cf-whitelist CronJob keeps its whitelist-source-range current; both ArgoCD applications ignore that annotation.
• nginx logs the visitor's address: set_real_ip_from 10.0.0.0/8 beside real_ip_header CF-Connecting-IP.

Checked on wwwdev (see #84): 0.1.44 rolled out, the label in place, the log shows the visitor for a request through Cloudflare, and the CronJob rewrote the annotation.

After merge: yarilomail.org on 0.1.44, the label on its Ingress, one manual run of the CronJob rewrites it, the site answers, a request through Cloudflare logged with the visitor's address.

[0kaba0hub]

On production after the merge: Deploy green, yarilomail-web rolled out on ghcr.io/yarilomail/website:0.1.44, develop still exists. The Ingress carries cloudflare-whitelist: "true"; one manual run of the cluster's cf-whitelist CronJob rewrote it (with dns-web and yarilomail-web-dev), and its annotation equals the live api.cloudflare.com list. yarilomail.org answers 200, and a request sent through Cloudflare is logged with the visitor's own address.