docs(onprem): fix self-hosted install and upgrade pages from a clean 3.4.0 install

[Maffooch]

We ran a clean, docs-only install of DefectDojo Pro 3.4.0 and kept a list of everything in the self-hosted pages that was wrong, stale or failed as written. This PR fixes each item still present on dev. Each one was checked against the page first, then against the current chart, compose files and CLI.

Fixed

• Registry key in the license. The license-inspection jq command printed the whole payload, container_token included. It now drops that field. The page explains that container_token is the registry key (a base64 Google Cloud service-account key), and shows how to pipe it into docker login / helm registry login with --password-stdin without printing it.
• gcloud "Option A" switched the active account. It now logs Helm in with the license key or a JSON key file through --password-stdin, without touching gcloud. Option B (gcloud auth login) now warns that it changes the active account and shows how to switch back.
• Admin Secret name. With inline secrets, the chart-managed Secret is named after the release (dojopro), not dojopro-defectdojo. Checked with helm template against chart 3.4.0.
• Commands that failed as written.
  • The log-verbosity helm upgrade left out the ddorch certificates, so it failed with ddorch.tls.rootCa is required. It now uses --reuse-values, checked against a 3.4.0 release on a local cluster.
  • The pre-upgrade helm template was missing the same three --set-file flags, and mixed $CHART_REF with $CHART.
  • The Compose upload-size command used a KEY=VALUE form that the CLI rejects. It now uses --key / --value.
• Stale lists and counts.
  • Compose: the container list now matches 3.4.0.
  • Compose ports: 9142 and 9871 are bound to 127.0.0.1 from 3.3.300 on. The page used to say they were published on every interface.
  • Helm: the expected pod lists match chart 3.4.0.
  • The external Secret needs 10 keys, not 12.
  • The air-gapped step that captured the generated keys used head -n 9 on output that is not in a fixed order. It now filters for the two keys by name.
• Connectors secret. The three different instructions are now one: DD_CONNECTORS_SHARED_SECRET takes the same value as CLOUD_PORTAL_SECRET_KEY. With inline values, leave it empty and the chart fills in that value.
• Health probe. /login/ returns 404. The upgrade check now uses /api/v2/health_check/light/, which needs no login and returns 200.
• Version examples (2.53 through 2.57) are now 3.4.0 or placeholders. The Known Issues heading is no longer pinned to 2.57.1; its intro says which chart the issues were confirmed on.
• Bundle name and signatures. The install page used helm-chart-<version>.zip and the upgrade page used dojo-pro-helm-bundled-<version>.zip; both now use the second name. Each release does publish a detached GPG signature and the public key, plus a cosign signature for the chart package, so the install guide gains a short "Verify the Bundle Signature" section. The bundle carries its own copy of the signing key, so the section first checks the key's fingerprint (69D5 A6D7 01E6 6415 03F2 8E9B 2227 78D8 18CC 8FAB) and says to get the key from support or from a bundle already verified. It explains gpg's "not certified" warning, and notes that cosign's transparency-log lookup needs internet access. The migration runbook's cosign command pointed at a .zip.sig that is not published; it now verifies the chart .tgz.
• Bootstrap script paths now point to bootstrap/bootstrap-aws-eks.sh and bootstrap/bootstrap-gcp-gke.sh in the extracted bundle, which is where operators have them.
• Release notes link. The upgrade guide sent readers to a release page they cannot open. It now links the public Pro changelog and upgrade notes.
• Provider-neutral prerequisites. The tool list was brew install awscli ... eksctl plus an AWS identity check. It is now a platform-neutral list, with per-platform extras. The pre-install checklist no longer assumes RDS and ElastiCache.
• sudo. Root commands on the Compose install, upgrade, sizing, FIPS, storage and upload-size pages now use sudo or sudo -E. The air-gapped install page is unchanged on purpose: it adds the operator to the docker and dojosrv groups during setup, says the remaining CLI commands then run without sudo, and uses sudo only for file operations under /opt and /etc. That page is consistent with itself.
• Backup tool. dojo-db-backup is not the tool's name. The standalone utility is dojo-backup, and dojo-compose-cli 2.1.5 has no backup command of its own.
• Sandbox Mode shared a sidebar weight with the Kubernetes section, so it showed up as a Kubernetes page. It now sits with the general pages, and the self-hosting overview links it.
• Relabel and copy slips.
  • "the Asset" for "the product" (sizing), "separate Assets" (FIPS), "the Asset documentation" (Helm install).
  • The Compose sizing tab described an "Application nodes" column that its table does not have.
  • The Helm FIPS note told readers to email for image access, which the FIPS page says is not needed.
  • About: "We regularly on LinkedIn".
• Minors.
  • The certificate steps need OpenSSL 3: macOS LibreSSL rejects -copy_extensions (reproduced).
  • The psql pre-flight now sets and creates $NAMESPACE before using it.
  • Removed the "connectors crashloops during init" known issue, which did not happen on 3.4.0.
  • The "list available chart versions" command could not list anything. The page now says Helm cannot list OCI tags, and shows how to confirm one version exists.
  • Compose "update it fully" now gives the commands and the reboot check.
  • The Compose wizard table gives the defaults (* and http://localhost) and says to replace them.
  • The About page links the self-hosted install.
  • The changelog intro covered "Cloud Version" only and now covers self-hosted releases as well.
  • The pre-upgrade render now shows how to copy the three ddorch certificates out of the release's <release>-orch-certs-configmap if you no longer have the files.
  • The inline-secrets Secret is dojopro for this guide's release name, or <release>-dojopro for a release name that does not contain dojopro.
  • The upgrade guide links the on-premise upgrade page, not the open-source upgrade notes.
  • The database pre-flight says "your database server", not "your RDS instance".
  • Mailto links rendered with the next word glued on ("support@defectdojo.comif you..."). The theme wraps them in a <script>/<noscript> pair, and the minifier dropped the space after it. A project-level render-link.html now renders mailto links as plain anchors, the way the site footer already does. This turns off the theme's script-based address obfuscation for every mailto link on the site, roughly 280 links. That is acceptable because they all point to role addresses (support@, hello@ and info@defectdojo.com), and support@ already appears as a plain link in every page's footer.

Already fixed on dev

• None. Every item was still present.

Left alone

• No GKE or generic-cluster deploy section. That comes with the chart work.
• Translated pages are not updated.
• installing_on_kubernetes.md and upgrading_on_kubernetes.md are generated from the Helm chart's own guides. Their header comment now says this copy carries hand edits pending a sync. The same fixes are open against the chart's source guides in chart repository PR 244.
• No changes to the sections that docs(onprem): recover a Compose first install that gives up during initialization #16298 (first-install recovery, first-start duration) or the CLI-pages PR (air-gapped upgrade section) are editing.

Checks

• npm ci && npm run build -- --environment development in docs/: exit 0, no warnings or errors.
• hugo --minify --gc --config config/production/hugo.toml in docs/: exit 0, no warnings or errors.
• Every internal link and anchor on the changed pages resolves against the built site. That check also turned up three pre-existing broken anchors on the Helm install page, which are fixed.

🤖 Generated with Claude Code