bmr_bluecap
171c8c96aa
There was no way to view the rebuild in a browser: the ingress answered only on websecure for the production hostnames, which have no cert and still belong to the live WordPress site. Review meant a port-forward. Add bcs.int.7tl-homelab.com as a staging route. The *.int zone resolves to the internal traefik LB (10.66.15.30) and is not reachable from the internet, so this exposes nothing publicly and leaves the real domain untouched. It follows the same pattern as the existing argocd/lidarr/tautulli ingresses. Enable cert-manager on the ingress, but scope the tls block to the staging host only. The production hostnames stay out of it deliberately: requesting a cert for names the live site still serves is a cutover step, not a prerequisite. Fix the issuer name while here. The commented-out placeholder said "letsencrypt-production"; the ClusterIssuer is actually "letsencrypt-prod", so the old hint would have silently failed to issue. Note for cutover: letsencrypt-prod solves via DNS-01 against Cloudflare, so the production cert can be issued before DNS moves, avoiding the HTTP-01 ordering problem. Conditional on bluecapstrategies.com being reachable by the cert-manager Cloudflare token, which is not yet verified.
BlueCap Strategies Website
Static marketing site for BlueCap Strategies, built with Astro and deployed to a k3s homelab cluster via GitOps (ArgoCD).
Stack
- Astro 5 — static output (
output: "static"), no runtime JS framework. - Content Collections (Markdown) — page copy lives in
src/content/(services, focus-areas, pages, insights), validated by a Zod SEO schema at build time. - nginx (Alpine) serves the built
dist/from a multi-stage Docker image. - ArgoCD + Kustomize (
k8s/) reconcile the deployment; images are published to GHCR by CI.
Local development
npm install
npm run dev # dev server at http://localhost:4321
npm run build # astro check (typecheck) + astro build → dist/
npm run preview # serve the production build
npm run seo:lint # structural SEO checks over dist/ (run after build)
npm run test:e2e # Playwright end-to-end tests
Copy .env.example to .env and fill in values as needed (site URL, contact form endpoint,
analytics keys). Never commit .env.
Editing content
Page copy is Markdown with typed frontmatter — no code changes needed to edit words:
src/content/services/*.md— service detail pagessrc/content/focus-areas/*.md— focus-area detail pagessrc/content/pages/*.md— standalone long-form pages (e.g. About)src/content/insights/*.md— blog/insights posts
Frontmatter is enforced by the Zod schema in src/content.config.ts (e.g. description must be
120–158 chars), so the build fails fast on SEO violations. The .md files are build-time
source: Astro compiles them to static HTML in dist/. The Markdown itself is never served.
Project layout
src/ Astro pages, layouts, components, content collections, styles
public/ Static assets served as-is (images, robots.txt, healthz)
scripts/ Build tooling (seo-lint.mjs)
tests/ Playwright e2e specs
deploy/ nginx.conf for the runtime image
k8s/ Kustomize manifests (namespace, deployment, service, ingress, configmap)
docs/ Committed engineering records — ADRs, deployment, SEO/AEO, deviations
Dockerfile Multi-stage build → nginx image containing only dist/
planning/ (git-ignored) holds working docs — content inventories, parity checklists, and the
original rebuild brief. See docs/adr/ for the decision record.
Deployment
Push to main → GitHub Actions runs the quality gates, builds and pushes a <git-sha>-tagged
image to GHCR, and updates the image tag in k8s/. ArgoCD reconciles the change to k3s. GitHub
never receives cluster credentials. See docs/gitops-deployment-strategy.md.