- Consul now running on int node (joined cluster)
- provider=consul re-enabled (int has consul.version=1.22.7)
- Removed sed placeholder approach + Gitea secrets requirement
- Added template{} stanzas reading from consul kv mmd/* keys
- Cleaned up deploy.yml (removed sed substitution step)
provider=consul auto-injects attr.consul.version >= 1.8.0 constraint which
filters out int (old Consul). provider=nomad uses native Nomad service
discovery — Traefik still picks up tags via Nomad catalog.
- Remove sed substitution from pipeline (no more __PLACEHOLDER__ pattern)
- Nomad template{} reads mmd/* keys from Consul KV at allocation time
- Secrets never touch git or pipeline logs
- Remove Gitea secrets dependency for app secrets (only HARBOR_ROBOT_TOKEN needed)