Fix the Android release build and tighten the Helm values

Every Android release build runs lint, which AGP 8.7 cannot run on JDK 26,
the JDK Homebrew's Gradle starts on; make android failed unless JAVA_HOME
was set by hand. gradle/gradle-daemon-jvm.properties now runs the Gradle
daemon on JDK 17 whatever launches it.

The Helm values trusted every private address range as a proxy, which let
any client on the LAN choose its own address for the sign-in rate limits.
They now name only the nginx host and the k3s pod network. The port gains
healthcheckPath, so the pod gets readiness and liveness probes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/README.md

@@ -27,8 +27,9 @@ The merge policy in `Mirror.decide` is the same table as the desktop client's
 
 ## Building
 
-Requirements: JDK 17 (lint in AGP 8.7 fails on newer JDKs; set `JAVA_HOME`
-to a 17 when Gradle defaults to something else), Gradle 8.9 or newer, and an
+Requirements: a JDK 17 installed (Gradle 8.9 or newer runs its daemon on it
+whatever JDK launches Gradle, per `gradle/gradle-daemon-jvm.properties`:
+AGP 8.7's lint, which every release build runs, fails on newer JDKs), and an
 Android SDK with
 `platforms;android-35` and `build-tools;35.0.0`.
 

android/gradle/gradle-daemon-jvm.properties

@@ -0,0 +1,5 @@
+# The Gradle daemon runs on JDK 17 whatever the launcher runs on. AGP 8.7's
+# lint, which every release build runs (lintVitalAnalyzeRelease), cannot
+# parse the version string of newer JDKs, and a Gradle installed from
+# Homebrew launches on the newest one.
+toolchainVersion=17

config/variables/server.values.yaml

@@ -5,10 +5,13 @@ environment:
   value: "/etc/keeporg/config.txt"
 - name: "KEEPORG_EXTERNAL_URL"
   value: "https://keeporg.tiredsysadmin.cc"
-# nginx reaches the pod from the cluster's private network; its
-# X-Forwarded-For is what the sign-in rate limits count by.
+# Only the hops between nginx and the pod: the nginx host itself, and the
+# k3s pod network, which kube-proxy's NodePort translation makes the source
+# of every connection. Sign-in rate limits count by the address nginx puts
+# in X-Forwarded-For; a whole private range here would let any client on it
+# claim a fresh address with a header of its own.
 - name: "KEEPORG_TRUSTED_PROXIES"
-  value: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+  value: "10.200.1.3,10.42.0.0/16"
 image:
   name: "repo.rcmd.space/keeporg"
   version: "v0.1.0"
@@ -18,6 +21,10 @@ network:
     node: 32970
     source: 8765
     destination: 8765
+    # Readiness keeps traffic away until the server has opened (and, on the
+    # first start of 0.11, imported) its database; liveness restarts it if
+    # it stops answering.
+    healthcheckPath: "/healthz"
 mounts:
   - name: "db"
     source: "/var/lib/keeporg"

docs/HANDOVER.md

@@ -846,6 +846,13 @@ key arrives as the Kubernetes secret `keeporg-encryption` mounted on
 at it. `KEEPORG_EXTERNAL_URL=https://keeporg.tiredsysadmin.cc` matches the
 nginx `server_name`; the image's command passes neither `-config` nor
 `-url`, so this variable is the only thing that sets it there.
+`KEEPORG_TRUSTED_PROXIES` names only the nginx host (10.200.1.3) and the k3s
+pod network (10.42.0.0/16, the source address after kube-proxy's NodePort
+translation); a wider range would let clients on it choose their own address
+for the rate limits. The port's `healthcheckPath: /healthz` gives the pod
+readiness and liveness probes. The `keeporg-encryption` secret's
+`config.txt` must be the master key itself — base64 of 32 bytes, or 32 raw
+bytes — since 0.11 refuses to start without one.
 `KEEPORG_ADMIN_PASSWORD` is not set there, so the first start logs a
 generated password once.