The kubelet probes the pod IP, which Django rejects with a 400 because
ALLOWED_HOSTS is netbox.jsme.be. Setting the Host header keeps
ALLOWED_HOSTS tight instead of widening it to '*'.
Five components under applications/netbox: the web pod, an rqworker,
a daily housekeeping CronJob, postgres 18 and two valkey instances.
The task queue runs appendonly on its own PVC so queued jobs survive a
restart, while the cache instance is disposable.
Worker and cronjob override args rather than command, which replaces
CMD while keeping tini as the entrypoint, so only the web pod runs
migrations. Media, reports and scripts share one RWX PVC via subPaths
because both the web pod and the worker mount them.
Exposed on the internal gateway only.
Jeffrey