docs(helm): internal networking, IPv6/dual-stack and container registry guides [DEP-371]

[pmdroid]

Adds three use-case guides under Self-host with Helm (Sterling's split from #1237), as child pages of /operate/deploy/helm:

Page	Covers
/operate/deploy/helm/internal-networking	No public ingress; internal Gateway (gateway.parentRefs, per-service gateway.<service>.parentRefs) or private Ingress class; engine.ssrfAllowlist / authSsrfAllowlist / pluginSsrfAllowlist; coordinator.proxyHeaders.forwardedAllowIps
/operate/deploy/helm/ipv6-dual-stack	global.bindAddress, global.ipFamilyPolicy, global.ipFamilies, and which components and Services each covers; explicit list of what is still IPv4-only (Arcade Deploy default egress, external DNS nameservers, deployed-server Services). IPv6-only is not supported.
/operate/deploy/helm/container-registry	Mirrors and air-gapped installs; per-image repositories, supportImages.*, dockerRegistry.* (and that bundled PostgreSQL/Redis get no pull Secret), Arcade Deploy runner image (deployments.image, deployments.registry.server, deployments.registry.imagePullSecrets)

Each page has: when you need it, a values overlay, how to verify, common failures, and what you own vs what the chart handles. Every value name was checked against deploy/charts/arcade/values.yaml on monorepo main.

Follow-up: once this merges, #1237 replaces its IPv6/use-case TODO with links to these pages (it can't link earlier: the broken-link test rejects links to unmerged pages).

Open items (waiting on Pascal's call)

• Codex P3: the IPv6 page's ownership table says "every chart-rendered Service", which contradicts the PostgreSQL/Redis exception and misses the headless worker-peers Services. Not P0, because the body text states the exceptions correctly. Suggested fix: one line.

Proof @ 4946083

• Codex autoreview: gpt-6.1-sol, 0 findings at P2+ (1 total)
• Closeout: not run (ENV GAP: closeout CLI not available)
• CI: pending (PR just opened)

---

Note

Low Risk
Documentation-only changes with no runtime or deployment code; risk is limited to doc accuracy and navigation.

Overview
Adds three Self-host with Helm operator guides as child pages under /operate/deploy/helm, wired in via new _meta.tsx navigation entries.

Internal networking documents private-only exposure (Gateway API HTTPRoutes with gateway.parentRefs / per-service overrides, or legacy private Ingress), engine.ssrfAllowlist / related allowlists, coordinator.proxyHeaders.forwardedAllowIps, and optional networkPolicy.egressCIDRs, with verify steps and a troubleshooting table.

IPv6 and dual-stack covers global.bindAddress, global.ipFamilyPolicy, and global.ipFamilies, and explicitly calls out IPv4-only gaps (especially Arcade Deploy egress, external DNS nameservers, and deployed-server Services).

Use a different container registry explains per-component image overrides, dockerRegistry pull secrets (including PostgreSQL/Redis limitations), supportImages, Arcade Deploy runner/registry settings, and air-gapped install flow.

public/llms.txt is regenerated so the new pages appear in the LLM index.

^{Reviewed by Cursor Bugbot for commit b2851a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 12, 2026 6:11pm UTC