ronnibaslund/dezky
1
0
Fork 0
Code Issues 37 Pull Requests Actions Packages Projects 1 Releases Wiki Activity
144 Commits 1 Branch 0 Tags
91134c94f52df0a33c4e50af76d5d43ab9e1bbd2
Commit Graph

3 Commits

Author SHA1 Message Date
Ronni Baslund 3b9b06a99b docs(runbook): app tier + push-to-deploy CI/CD flow
ci / typecheck (map[dir:apps/booking name:booking]) (push) Successful in 20s
Details
ci / typecheck (map[dir:apps/operator name:operator]) (push) Successful in 23s
Details
ci / typecheck (map[dir:apps/website name:website]) (push) Successful in 20s
Details
ci / typecheck (map[dir:apps/portal name:portal]) (push) Successful in 26s
Details
ci / typecheck (map[dir:services/platform-api name:platform-api]) (push) Successful in 22s
Details
ci / test (push) Successful in 32s
Details
ci / build (map[dir:apps/booking name:booking]) (push) Successful in 9s
Details
ci / build (map[dir:apps/operator name:operator]) (push) Successful in 9s
Details
ci / build (map[dir:apps/portal name:portal]) (push) Successful in 6s
Details
ci / build (map[dir:services/platform-api name:platform-api]) (push) Successful in 5s
Details
ci / deploy (push) Successful in 41s
Details 
Bring the runbook up to the 2026-06-10 state: app tier + CI/CD in current
state, a Deploy flow section (push to main = release, rollback, break-glass,
required Gitea secrets), reproduce steps 8-9 (app tier secrets+apply, CI
runner + ci-deployer with the runner gotchas), per-router ACME-safe redirect
instead of the old global one, platform-api key read-back for Bitwarden, and
a pruned TODO list.
 2026-06-10 12:19:47 +02:00
Ronni Baslund 406e2ca78b feat(infra): deploy Authentik (auth.dezky.eu) + global HTTP→HTTPS redirect
ci / typecheck (map[dir:apps/booking name:booking]) (push) Has been cancelled
Details
ci / typecheck (map[dir:apps/website name:website]) (push) Has been cancelled
Details
ci / typecheck (map[dir:apps/portal name:portal]) (push) Has been cancelled
Details
ci / typecheck (map[dir:services/platform-api name:platform-api]) (push) Has been cancelled
Details
ci / test (push) Has been cancelled
Details 
- Authentik on the in-cluster Postgres/Redis (mirrors the dev compose config:
  external DB/Redis, error-reporting off, update-check off, bootstrap admin),
  via the k3s Helm controller; Ingress + cert-manager letsencrypt-prod. Live at
  https://auth.dezky.eu (image 2026.5.2). Secrets generated on-box (Bitwarden).
- Traefik HelmChartConfig: global :80 -> :443 (308) redirect via
  additionalArguments (to=:443, HTTP-01-safe).
- RUNBOOK updated.

Deferred (mirror remaining dev bits): OIDC app blueprints (portal/operator with
prod URLs) + the cosmetic "Powered by Dezky" rebrand.
 2026-06-08 19:00:07 +02:00
Ronni Baslund 153d7053ca feat(infra): k3s foundation — cert-manager, Longhorn config, in-cluster data tier
ci / typecheck (map[dir:apps/website name:website]) (push) Failing after 10m58s
Details
ci / typecheck (map[dir:apps/portal name:portal]) (push) Failing after 11m56s
Details
ci / typecheck (map[dir:apps/booking name:booking]) (push) Failing after 14m0s
Details
ci / typecheck (map[dir:services/platform-api name:platform-api]) (push) Has been cancelled
Details
ci / test (push) Has been cancelled
Details 
Adds the production cluster foundation (authored + applied live on node1):
- cert-manager via the k3s HelmChart controller + letsencrypt staging/prod
  ClusterIssuers (HTTP-01 / Traefik).
- Longhorn config for single-node (values: replica=1, default StorageClass,
  Retain) + backup-to-Hetzner-Object-Storage credential template.
- In-cluster data tier (dezky-data): Postgres 16 (with Authentik+OCIS DB init),
  MongoDB 7, Redis 7 as StatefulSets on Longhorn, + secret template.
- bootstrap.sh: install open-iscsi/nfs-common + enable iscsid (Longhorn prereq).
- RUNBOOK.md: full reproducible node1 build order.

Real secrets are generated on-box and kept in Bitwarden — never in git.
 2026-06-08 18:39:31 +02:00