Service sign-up buttons link to /members, which 404'd because only /members/ is proxied. Use an absolute https target since TLS ends at the ingress. Add an opt-in task that creates any missing tier/service group from the role's config (with the placeholder member) in the OpenLDAP pod, leaving existing groups untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>