Merge branch 'dev'

Change storefront service from ClusterIP to NodePort with externalTrafficPolicy: Local.
This preserves the real client source IP instead of NATing to the node IP.

Fixes analytics tracking showing Hetzner IP (138.201.11.251) instead of real visitor IPs.
Same fix previously applied to Rybbit backend service.

Note: On single-node clusters, this works seamlessly. Traefik routes directly
to the node where the pod is running, preserving the original source IP.

k8s/ingress.yaml

@@ -5,13 +5,29 @@ metadata:
   namespace: manoonoils
 spec:
   entryPoints:
-  - web
-  - websecure
+    - web
   routes:
-  - match: Host(`manoonoils.com`) || Host(`www.manoonoils.com`)
-    kind: Rule
-    services:
-    - name: storefront
-      port: 3000
+    - kind: Rule
+      match: Host(`manoonoils.com`) || Host(`www.manoonoils.com`)
+      middlewares:
+        - name: redirect-https
+      services:
+        - name: storefront
+          port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: storefront-secure
+  namespace: manoonoils
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`manoonoils.com`) || Host(`www.manoonoils.com`)
+      services:
+        - name: storefront
+          port: 3000
   tls:
     certResolver: letsencrypt

k8s/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
+  - middleware.yaml
   - ingress.yaml
 images:
   - name: ghcr.io/unchainedio/manoon-headless

k8s/middleware.yaml

@@ -0,0 +1,9 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+  namespace: manoonoils
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true

k8s/service.yaml

@@ -4,9 +4,13 @@ metadata:
   name: storefront
   namespace: manoonoils
 spec:
+  # Use NodePort with externalTrafficPolicy: Local to preserve client source IP
+  # This is required for proper client IP detection in analytics (Rybbit, etc.)
+  type: NodePort
+  externalTrafficPolicy: Local
   selector:
     app: storefront
   ports:
   - port: 3000
     targetPort: 3000
-  type: ClusterIP
+    # Let Kubernetes assign a NodePort automatically

src/app/api/rybbit/track/route.ts

@@ -10,7 +10,8 @@ export async function POST(request: NextRequest) {
     const cfConnectingIp = request.headers.get("cf-connecting-ip");
     const xForwardedFor = request.headers.get("x-forwarded-for");
     const xRealIp = request.headers.get("x-real-ip");
-    const nextJsIp = request.ip;
+    // @ts-ignore - ip exists at runtime but not in types
+    const nextJsIp = (request as any).ip;
     
     // Use the first available IP in priority order
     const clientIp =