Repository navigation
feat: container build and k3s manifests for public hosting - #21
Merged
Merged
Conversation
Make the Astro base path and site URL configurable through ASTRO_BASE and ASTRO_SITE so the GitHub Pages build is unchanged while the container build serves from the root of the cluster hostname. Move the theme script out of the layout into public/theme.js and stop inlining small scripts so the container can send a Content-Security-Policy with no inline scripts. Add a 404 page for nginx to serve. Add a multi-stage Dockerfile on nginx-unprivileged with a hardened static config, a multi-arch image workflow that pushes to ghcr.io, and manifests under deploy/k8s that follow the pi-cluster layout: restricted namespace, two locked-down nginx replicas, NetworkPolicy isolation, disruption budgets and a per-namespace cloudflared template. The hostname is public with no Access policy on purpose; the deploy README covers the tunnel, SOPS and Cloudflare edge steps, and README.md documents both targets.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the site deployable to the k3s homelab as a container behind a public Cloudflare Tunnel, without touching the GitHub Pages deploy.
astro.config.mjsreadsASTRO_BASE(default/gitops-notes) andASTRO_SITE(defaulthttps://mrguato.github.io), so the Pages build is unchanged and the container builds with/and the cluster hostname.public/theme.js, and small hoisted scripts are no longer inlined, so the container can sendscript-src 'self'.src/pages/404.astrogives nginx a real 404 page. GitHub Pages serves it too.Dockerfile: node:20-alpine buildsdistonce on the build platform, nginxinc/nginx-unprivileged:1.31-alpine serves it on 8080 as uid 101.nginx.confis static only, GET and HEAD only, gzip, immutable cache for/_astro/,server_tokens off, nosniff, referrer policy, HSTS, frame denial and a strict CSP..github/workflows/image.ymlbuilds linux/amd64 and linux/arm64 and pushesghcr.io/mrguato/gitops-notes:sha-<short>pluslateston main withGITHUB_TOKEN. Pull requests build without pushing.deploy.ymlis untouched.deploy/k8s/mirrors the pi-cluster layout: restricted namespace, two nginx replicas with the full restricted security context and emptyDir mounts for the paths nginx writes, ClusterIP service, a NetworkPolicy that allows ingress only from cloudflared and egress only to DNS, disruption budgets, and a cloudflared template that reads the SOPS-encryptedcloudflared-tunnelSecret. The README there lists the pi-cluster and Cloudflare dashboard steps.README.mddocuments both targets and why the hostname is public.Verification
npm run buildwith defaults: links under/gitops-notes/,theme.jsand404.htmlemitted, no inline scripts.ASTRO_BASE=/ ASTRO_SITE=https://notes.deleontech.net npm run build: root-relative links, no inline scripts, no/gitops-notespaths.docker buildandkubectl apply --dry-run=client, since neither tool is installed on this machine. The image workflow runs on this pull request, so its check exercises the Dockerfile for both architectures.Assumptions
notes.deleontech.net. To use another, change it in the staging secret and set theCLUSTER_SITE_URLrepository variable.sha-0000000as a placeholder. Replace it with the tag the image workflow prints after this merges.