Add FluxCD Copilot prompt for deployment instructions in README

README.md

@@ -229,6 +229,47 @@ Referenzbeispiele fuer lokale Verifikation liegen unter:
 
 Diese Manifeste sind bewusst minimal und nicht als produktive FluxCD-Quelle gedacht.
 
+## FluxCD Copilot Prompt
+
+The following prompt can be used to instruct GitHub Copilot in your FluxCD repository about this service:
+
+---
+
+> **Prompt for FluxCD repo Copilot:**
+>
+> I am deploying `gitea-mcp-auth-proxy`, a Traefik ForwardAuth service that validates `Authorization: Bearer <token>` headers for gitea-mcp access control.
+>
+> **Image:** `gitea.nehmer.net/torben/gitea-mcp-auth-proxy:<tag>`
+> Published to the Gitea container registry at `gitea.nehmer.net`. Stable releases use `vX.Y.Z` tags; `latest` is only updated for stable releases, never for pre-releases.
+>
+> **How it works:**
+> - Returns `200` for a valid bearer token, `401` otherwise.
+> - `GET /healthz` is always reachable without auth (use for readiness/liveness probes).
+> - Token validation uses SHA-256 hashes only — never plaintext tokens.
+>
+> **Required configuration (env):**
+> - `AUTH_PROXY_LISTEN_ADDR` — default `:8080`
+> - `AUTH_PROXY_TOKEN_HASHES_DIR` — path to a directory where each file contains one SHA-256 token hash; ideal for a Kubernetes Secret volume mount (e.g. `/var/run/secrets/auth-proxy`)
+> - `AUTH_PROXY_TOKEN_HASHES` — alternative: comma-separated list of SHA-256 hashes (64 hex chars each, optionally prefixed with `sha256:`)
+> - At least one of the two hash sources must be configured; the service exits on startup if no tokens are loaded.
+> - `AUTH_PROXY_LOG_LEVEL` — optional, default `info`
+>
+> **Secret:** Create a Kubernetes Secret named `gitea-mcp-auth-proxy-tokens` containing one file per allowed token, where each file contains the SHA-256 hash of the token (not the token itself). Mount it at `/var/run/secrets/auth-proxy` as a read-only volume.
+>
+> Generate a hash with: `echo -n "my-token" | sha256sum | awk '{print $1}'`
+>
+> **Deployment constraints:**
+> - Service must be `ClusterIP` only — do not expose externally.
+> - Do not create a public Ingress route for `/healthz`.
+> - The service is consumed by Traefik as a ForwardAuth middleware; only Traefik and internal probes need network access.
+> - Apply a NetworkPolicy that allows ingress only from Traefik (by namespace/pod label) and the kubelet (for probes).
+> - Image pull requires credentials for `gitea.nehmer.net`; configure an `imagePullSecret` referencing a Secret with registry credentials.
+>
+> **Reference manifests** (minimal, non-authoritative) are available at:
+> `https://gitea.nehmer.net/torben/gitea-mcp-forward-auth/src/branch/main/deploy/k3s/`
+
+---
+
 ## Annahmen
 
 - Annahme: Go-Version ist `1.26`.