Previews

Any branch named pr-<something> deploys to pr-<something>.<HOST> with its own certificate — an exact replica of the future site. Open a merge request to master to discuss it; merge to publish. The environment is removed by the manual undeploy job in the branch’s pipeline, or when the branch is deleted.

The dev branch deploys to dev.<HOST> the same way; it is the branch the site editor works on.

Protect these branches (Settings → Repository → Protected branches, wildcard pr-*) so the protected variables are visible to them — an unprotected branch sees empty HOST and K8S_CLUSTER and deploys an ingress with no host, reporting success.

A preview host needs a DNS record like the main one: pr-*.<HOST> as a wildcard, or one record per preview. Sites under *.n2.lite.network need none.