fix: make Redis TLS configurable via REDIS_TLS env var

- Change TLS check from ENV !== 'local' to REDIS_TLS === 'true'
- Add REDIS_TLS env var to Helm deployment template
- Default to true for OCI Redis, can override for self-hosted K8s

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/helm-chart/templates/deployment.yaml

@@ -104,6 +104,8 @@ spec:
               value: {{ .Values.maestro.redis_host }}
             - name: REDIS_PORT
               value: "{{ .Values.maestro.redis_port }}"
+            - name: REDIS_TLS
+              value: "{{ .Values.maestro.redis_tls }}"
             - name: JWT_PRIVATE_KEY
               valueFrom:
                 secretKeyRef:

deploy/helm-chart/values.yaml

@@ -48,6 +48,7 @@ maestro:
   redis_host: "aaapzppmlyamkocqwstpo7zvopczyyiyuy6xzm2g6c5k4mq3a66be4a-0.redis.sa-saopaulo-1.oci.oraclecloud.com"
   redis_port: "6379"
   redis_database: "0"
+  redis_tls: "true"
   cookie_secret: "13cc5e136d3074bcc05bec8697092ec1f5f376bf"
 autoscaling:
   enabled: false

environment.d.ts

@@ -16,6 +16,7 @@ declare global {
       OPEN_CUSTOMER_ID: string;
       DEDICATED_PROXY: string;
       COOKIE_SECRET: string;
+      REDIS_TLS?: string;
     }
   }
 }

src/services/service.module.ts

@@ -14,7 +14,7 @@ import { redisStore } from 'cache-manager-ioredis-yet';
           keyPrefix: 'maestro:sso',
         }
 
-        if (process.env.ENV !== 'local') {  
+        if (process.env.REDIS_TLS === 'true') {
           baseRedisConfig['tls'] = {
             servername: process.env.REDIS_HOST,
           }