bmr_bluecap/bcs-website
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
22 Commits 1 Branch 0 Tags
4e354d2721fb8cf616b384556aa33084365cd470
Commit Graph
8 Commits
Author SHA1 Message Date
bmr_bluecap 171c8c96aa k8s: add LAN-only staging host bcs.int.7tl-homelab.com with TLS 
There was no way to view the rebuild in a browser: the ingress answered only
on websecure for the production hostnames, which have no cert and still
belong to the live WordPress site. Review meant a port-forward.

Add bcs.int.7tl-homelab.com as a staging route. The *.int zone resolves to
the internal traefik LB (10.66.15.30) and is not reachable from the internet,
so this exposes nothing publicly and leaves the real domain untouched. It
follows the same pattern as the existing argocd/lidarr/tautulli ingresses.

Enable cert-manager on the ingress, but scope the tls block to the staging
host only. The production hostnames stay out of it deliberately: requesting a
cert for names the live site still serves is a cutover step, not a
prerequisite.

Fix the issuer name while here. The commented-out placeholder said
"letsencrypt-production"; the ClusterIssuer is actually "letsencrypt-prod",
so the old hint would have silently failed to issue.

Note for cutover: letsencrypt-prod solves via DNS-01 against Cloudflare, so
the production cert can be issued before DNS moves, avoiding the HTTP-01
ordering problem. Conditional on bluecapstrategies.com being reachable by the
cert-manager Cloudflare token, which is not yet verified.
 2026-09-22 15:57:09 -04:00
gitea-actions[bot] 5331e7d717 ci: deploy c19b2b2af4 [skip ci] 2026-09-22 19:49:14 +00:00
gitea-actions[bot] 042e80ac2c ci: deploy fc64909f3d [skip ci] 2026-07-20 12:30:05 +00:00
gitea-actions[bot] 99d4a3bea9 ci: deploy b9f2c72bd4 [skip ci] 2026-07-17 11:38:52 +00:00
gitea_admin b9f2c72bd4 deploy: private package pull via External Secrets; pull over public HTTPS (no k3s restart)
CI / ci (push) Successful in 1m55s
Details 
- k3s pulls git.7tl-homelab.com/... over valid TLS (no registries.yaml/node config)
- CI still pushes internally to 10.66.15.22:3000 (fast, insecure-trusted)
- ExternalSecret materializes gitea-registry dockerconfigjson from OpenBao
- deployment uses imagePullSecrets: gitea-registry
- .env added to .dockerignore
 2026-07-17 07:36:22 -04:00
gitea-actions[bot] 504b517409 ci: deploy 79f2e8a78b [skip ci] 2026-07-16 21:53:40 +00:00
gitea_adminandClaude Opus 4.8 3dab3bc9fb Add Gitea Actions CI, ArgoCD Application, and Gitea Packages wiring 
- .gitea/workflows/ci.yml: build → seo:lint → e2e → image build/push →
  bump k8s image tag and commit back (paths-ignore + [skip ci] guard)
- argocd/bcs-website-application.yaml: ArgoCD App (internal Gitea repoURL, k8s path)
- k8s: image → Gitea Packages path; kustomization images newTag stanza
- ADR-0007 (Gitea Actions + Packages), supersedes GHCR/GitHub bits of ADR-0001
- Reconcile gitops-deployment-strategy.md to Gitea

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-16 06:29:01 -04:00
gitea_adminandClaude Opus 4.8 cd91c4b97c Initial commit: BlueCap Strategies Astro site 
Static Astro 5 site for BlueCap Strategies with exact live-site content
parity, deployed to k3s via GitOps (ArgoCD).

- Page copy in Markdown content collections (services, focus-areas, pages,
  insights) with a Zod SEO schema enforced at build time
- Homepage + About restored to exact live copy; real live-site imagery
- Build-time SEO linter (scripts/seo-lint.mjs) and Playwright e2e suite
- Multi-stage Dockerfile (nginx serves dist/) and Kustomize manifests (k8s/)
- Per-agent robots.txt; config-driven PostHog + Umami analytics scaffold
- ADRs and engineering docs under docs/

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-15 17:40:46 -04:00