From 8076f89dfbf012cc02bd8b057f14b368b0657439 Mon Sep 17 00:00:00 2001
From: Security Audit <admin@nodecrew.me>
Date: Wed, 5 Aug 2026 11:32:06 +0000
Subject: [PATCH] security: change storefront from NodePort to ClusterIP
 (routed through Traefik)

---
 k8s/service.yaml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/k8s/service.yaml b/k8s/service.yaml
index b470681..5c2b62c 100644
--- a/k8s/service.yaml
+++ b/k8s/service.yaml
@@ -4,13 +4,9 @@ metadata:
   name: storefront
   namespace: manoonoils
 spec:
-  # Use NodePort with externalTrafficPolicy: Local to preserve client source IP
-  # This is required for proper client IP detection in analytics (Rybbit, etc.)
-  type: NodePort
-  externalTrafficPolicy: Local
+  type: ClusterIP
   selector:
     app: storefront
   ports:
   - port: 3000
     targetPort: 3000
-    # Let Kubernetes assign a NodePort automatically