bmr_bluecap
c19b2b2af4
CI has been failing silently since 2026-08-03. The run for 9f1cbca did
execute (Gitea action_run #6, status=failure, 13m) but died before pushing an
image, so no package version exists for that commit and ArgoCD has been
serving the 2026-07-20 build ever since.
Cause: the "Ensure docker + kustomize are available" step ran
`apt-get install -y docker.io`. The runner's job image was node:18-bullseye
and Debian 11 went EOL, so debian-security stopped serving those package
versions. `apt-get update` still succeeds, so the failure surfaces only at
install time as 404s on docker.io, containerd, systemd and libcap2.
Fetch both tools as pinned static binaries instead. These have no distro
archive dependency, so the same rot cannot recur when bookworm ages out.
Verified in the real job environment: the static client installs and reaches
the host daemon through the mounted socket.
The runner job image has separately been moved to node:22-bookworm, which
also resolves the immediate breakage, but the static-binary approach is kept
as the durable fix.
Also refresh the prerequisites header: items 3 and 4 still described the
pre-ADR-0008 registry design (k3s now pulls over public HTTPS, and the
private package's pull auth comes from External Secrets).
BlueCap Strategies Website
Static marketing site for BlueCap Strategies, built with Astro and deployed to a k3s homelab cluster via GitOps (ArgoCD).
Stack
- Astro 5 — static output (
output: "static"), no runtime JS framework. - Content Collections (Markdown) — page copy lives in
src/content/(services, focus-areas, pages, insights), validated by a Zod SEO schema at build time. - nginx (Alpine) serves the built
dist/from a multi-stage Docker image. - ArgoCD + Kustomize (
k8s/) reconcile the deployment; images are published to GHCR by CI.
Local development
npm install
npm run dev # dev server at http://localhost:4321
npm run build # astro check (typecheck) + astro build → dist/
npm run preview # serve the production build
npm run seo:lint # structural SEO checks over dist/ (run after build)
npm run test:e2e # Playwright end-to-end tests
Copy .env.example to .env and fill in values as needed (site URL, contact form endpoint,
analytics keys). Never commit .env.
Editing content
Page copy is Markdown with typed frontmatter — no code changes needed to edit words:
src/content/services/*.md— service detail pagessrc/content/focus-areas/*.md— focus-area detail pagessrc/content/pages/*.md— standalone long-form pages (e.g. About)src/content/insights/*.md— blog/insights posts
Frontmatter is enforced by the Zod schema in src/content.config.ts (e.g. description must be
120–158 chars), so the build fails fast on SEO violations. The .md files are build-time
source: Astro compiles them to static HTML in dist/. The Markdown itself is never served.
Project layout
src/ Astro pages, layouts, components, content collections, styles
public/ Static assets served as-is (images, robots.txt, healthz)
scripts/ Build tooling (seo-lint.mjs)
tests/ Playwright e2e specs
deploy/ nginx.conf for the runtime image
k8s/ Kustomize manifests (namespace, deployment, service, ingress, configmap)
docs/ Committed engineering records — ADRs, deployment, SEO/AEO, deviations
Dockerfile Multi-stage build → nginx image containing only dist/
planning/ (git-ignored) holds working docs — content inventories, parity checklists, and the
original rebuild brief. See docs/adr/ for the decision record.
Deployment
Push to main → GitHub Actions runs the quality gates, builds and pushes a <git-sha>-tagged
image to GHCR, and updates the image tag in k8s/. ArgoCD reconciles the change to k3s. GitHub
never receives cluster credentials. See docs/gitops-deployment-strategy.md.