Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

helm/proxmox-api-simulator/Chart.yaml

@@ -4,7 +4,7 @@ description: Stateful Proxmox VE API simulator (PostgreSQL-backed) for labs and
 type: application
 version: 0.1.0
 appVersion: "0.1.0"
-home: https://github.com/inecs/proxmox-api-simulator
+home: https://github.com/sergeyantropoff/proxmox-api-simulator
 keywords:
   - proxmox
   - pve
@@ -12,5 +12,6 @@ keywords:
   - simulator
 maintainers:
   - name: inecs
+    url: https://hub.docker.com/r/inecs/proxmox-api-simulator
 # Bundled PostgreSQL uses the official postgres image (see templates/postgresql-*.yaml).
 # No external chart dependency is required — run helm install directly.

helm/proxmox-api-simulator/README.md

@@ -1,10 +1,18 @@
+**Language / Язык:** [English](README.md) | [Русский](README.ru.md)
+
 # Helm chart: proxmox-api-simulator
 
 Deploys the published runtime image
 [`inecs/proxmox-api-simulator`](https://hub.docker.com/r/inecs/proxmox-api-simulator)
-with optional Bitnami PostgreSQL, migrations, seed Job, Ingress, and
+with optional official PostgreSQL (`postgres:17.5-bookworm`), migrations, seed Job, Ingress, and
 cert-manager Let's Encrypt `ClusterIssuer` resources.
 
+> **Laboratory / CI only.** Chart defaults include weak placeholder secrets
+> (`change-me…`, DB password `proxmox`). Always override
+> `secret.ticketSigningKey` and `postgresql.auth.password` (as in the install
+> example below) before any networked or shared cluster. See
+> [SECURITY.md](../../SECURITY.md).
+
 Full guide: [docs/kubernetes.md](../../docs/kubernetes.md).
 
 ## Quick install

helm/proxmox-api-simulator/README.ru.md

@@ -0,0 +1,47 @@
+**Language / Язык:** [English](README.md) | [Русский](README.ru.md)
+
+# Helm-чарт: proxmox-api-simulator
+
+Развёртывает опубликованный runtime-образ
+[`inecs/proxmox-api-simulator`](https://hub.docker.com/r/inecs/proxmox-api-simulator)
+с опциональным официальным PostgreSQL (`postgres:17.5-bookworm`), миграциями, seed Job, Ingress и ресурсами
+cert-manager Let's Encrypt `ClusterIssuer`.
+
+> **Только лаборатория / CI.** В defaults чарта слабые placeholder-секреты
+> (`change-me…`, пароль БД `proxmox`). Перед сетевым или shared-кластером всегда
+> переопределяйте `secret.ticketSigningKey` и `postgresql.auth.password` (как в
+> примере установки ниже). См. [SECURITY.md](../../SECURITY.md).
+
+Полное руководство: [docs/kubernetes.md](../../docs/ru/kubernetes.md).
+
+## Быстрая установка
+
+Требования: Kubernetes, Helm 3, ingress-nginx (или совместимый), cert-manager.
+
+```bash
+helm upgrade --install pve-sim ./helm/proxmox-api-simulator \
+  -n proxmox-sim --create-namespace \
+  -f ./helm/proxmox-api-simulator/values-ingress-example.yaml \
+  --set certManager.email=you@example.com \
+  --set ingress.hosts[0].host=pve-sim.example.com \
+  --set ingress.tls[0].hosts[0]=pve-sim.example.com \
+  --set secret.ticketSigningKey="$(openssl rand -hex 32)" \
+  --set postgresql.auth.password="$(openssl rand -hex 16)"
+```
+
+Направьте DNS хоста на Ingress-контроллер, дождитесь Ready у Certificate,
+затем откройте `https://pve-sim.example.com/`.
+
+## Обзор values
+
+| Ключ | По умолчанию | Смысл |
+|---|---|---|
+| `image.repository` | `inecs/proxmox-api-simulator` | Образ Hub |
+| `image.tag` | chart `appVersion` | Тег образа |
+| `postgresql.enabled` | `true` | Встроенный PostgreSQL StatefulSet |
+| `secret.databaseUrl` / `externalDatabase.*` | | Внешняя БД при отключённом postgres |
+| `ingress.enabled` | `false` | Публикация через Ingress |
+| `certManager.enabled` | `false` | Аннотации Ingress + опциональные ClusterIssuers |
+| `seed.enabled` | `false` | Post-install seed Job |
+
+См. [`values.yaml`](values.yaml) и [`values-ingress-example.yaml`](values-ingress-example.yaml).

helm/proxmox-api-simulator/values-ingress-example.yaml

@@ -1,12 +1,18 @@
 # Example: public Ingress + Let's Encrypt (cert-manager) + Hub image.
 #
+# WARNING: Laboratory / demo template. Always override weak secrets:
+#   --set secret.ticketSigningKey="$(openssl rand -hex 32)"
+#   --set postgresql.auth.password="$(openssl rand -hex 16)"
+# Do not expose a public Ingress with the placeholder values below.
+#
 #   helm upgrade --install pve-sim ./helm/proxmox-api-simulator \
 #     -n proxmox-sim --create-namespace \
 #     -f helm/proxmox-api-simulator/values-ingress-example.yaml \
 #     --set certManager.email=you@example.com \
 #     --set ingress.hosts[0].host=pve-sim.example.com \
 #     --set ingress.tls[0].hosts[0]=pve-sim.example.com \
-#     --set secret.ticketSigningKey="$(openssl rand -hex 32)"
+#     --set secret.ticketSigningKey="$(openssl rand -hex 32)" \
+#     --set postgresql.auth.password="$(openssl rand -hex 16)"
 
 image:
   repository: inecs/proxmox-api-simulator

helm/proxmox-api-simulator/values.yaml

@@ -1,5 +1,9 @@
 ## Default values for proxmox-api-simulator.
 ## Image: https://hub.docker.com/r/inecs/proxmox-api-simulator
+##
+## Laboratory / CI defaults only. Replace secret.ticketSigningKey and
+## postgresql.auth.password before any shared or Internet-facing install.
+## See ../../SECURITY.md.
 
 replicaCount: 1