# PIDOKA HF Matomo

GitOps manifests for migrating Matomo from legacy namespace hf-matomo to tenant namespace pidoka-hf-matomo.

Safety gates:

- Source namespace remains untouched during staging.
- Verified backup before migration: /home/kube-bot/backups/matomo-20260617T060849Z on DMZ control-plane.
- Live manifests backup: /home/kube-bot/backups/matomo-live-manifests-20260617T061025Z.yaml.
- Secrets are sourced from Infisical path /tenants/pidoka/matomo via External Secrets Operator.
- Production host cutover must only happen after restore verification.

Staging note:

- Initial GitOps deployment keeps matomo and matomo-db at replicas 0.
- PVCs and secrets are created first.
- Backup restore is performed into the new PVCs before enabling workloads.
- Public ingress is intentionally not included until final cutover.