### Summary of Changes
- **Version Metadata Generation**:
- `ci/docker/www/Dockerfile` & `ci/docker/docs/Dockerfile` accept
`COMMIT_SHA` and `VERSION` build args and write
`/usr/share/nginx/html/version.json`.
- `ci/config/nginx/default.conf` configures `location = /version.json`
with `Cache-Control: no-store, no-cache, must-revalidate` so
verification is never stale.
- **Automated Rollout Verification**:
- `.github/workflows/services-www-releases-dispatch-release.yml`
- `.github/workflows/services-docs-next-required.yml`
- `.github/workflows/services-www-next-required.yml`
- Added `verify-rollout` job that polls
`https://www.ermnvldmr.com/version.json` and
`https://docs.ermnvldmr.com/version.json` with 10s intervals (up to 5
minutes) to ensure the commit actively rolls out to users.
### Summary of Changes
- Streamlined Ingress TLS and routing rules to focus on
`www.ermnvldmr.com`, `docs.ermnvldmr.com`, and `umami.ermnvldmr.com`
since apex domain is redirected to `www` at the edge.
### Summary of Changes
- Removed `traefik.ingress.kubernetes.io/router.middlewares:
default-redirect-https@kubernetescrd` so Traefik enables HTTP and HTTPS
routing without dropping routers.
### Summary of Changes
- Removed `targetNamespace` from root `cluster-sync` Kustomization so
each application and infrastructure component preserves its own declared
namespace (`com-ermnvldmr`, `cert-manager`, etc.).
### Summary of Changes
- Set `targetNamespace: com-ermnvldmr` in `gotk-sync.yaml` and
`user-data.template.yaml` so application workloads deploy into the
dedicated `com-ermnvldmr` namespace.
### Summary of Changes
1. **SOPS Secret Encryption Scope**:
- Configured `encrypted_regex: '^(data|stringData)$'` in `.sops.yaml`.
- Re-encrypted PostgreSQL and Umami secrets so `apiVersion`, `kind`, and
`metadata.name` remain in clean plaintext.
- Prevents Kustomize controller panic on encrypted metadata during Flux
GitOps reconciliation.
2. **Reliable DNS Fallback**:
- Added standard fallback DNS resolvers (`1.1.1.1`, `8.8.8.8`,
`77.88.8.8`) to `03-cleanup.sh` and `bootstrap-cluster.sh`.
### Summary of Changes
- Configured `/etc/cloud/ds-identify.cfg` with `policy: enabled` so
Debian's `ds-identify` generator never disables cloud-init.
- Installed `isc-dhcp-client` package.
- Explicitly enabled all 4 cloud-init systemd services in base system.
- Cleaned cloud-init seed and removed any disable flags in image
cleanup.
### Summary of Changes
1. **Systemd-Networkd DHCP & Base System**:
- Added `/etc/systemd/network/10-eth.network` with `Name=eth* en*` and
`DHCP=yes`.
- Enabled `systemd-networkd` and `systemd-resolved` so all ethernet
interfaces get DHCP automatically on first boot.
- Added `git` package to base image.
2. **Flux v2 Standalone Installation**:
- Replaced `kubectl apply -k` with standalone `kubectl apply -f
https://github.com/fluxcd/flux2/releases/download/v2.4.0/install.yaml`
so Flux installs in 2 seconds without git dependencies.
3. **Kubectl Access for Non-Root Users**:
- Copies `/etc/rancher/k3s/k3s.yaml` into `/home/<user>/.kube/config`
with `0600` permissions and proper user ownership.
4. **Cluster Kustomization Cleanliness**:
- Removed self-referential `- flux-system` from
`ci/k8s/clusters/production/kustomization.yaml`.
### Summary of Changes
- Added `OpenStack` and `Ec2` to cloud-init `datasource_list` so
cloud-init properly receives Yandex Cloud `user-data` metadata on
instance boot.
- Added serial console autologin drop-in
(`/etc/systemd/system/serial-getty@ttyS0.service.d/autologin.conf`) so
the Serial Console in the Cloud Web Console provides passwordless root
access for emergency recovery.
### Summary of Changes
- Added systemd drop-in override
`/etc/systemd/system/ssh.service.d/10-generate-host-keys.conf` with
`ExecStartPre=-/usr/bin/ssh-keygen -A` so `ssh.service` auto-generates
host keys if missing on startup.
- Added `ssh-keygen -A` to `03-cleanup.sh` and `bootstrap-cluster.sh` in
`user-data.template.yaml`.
### Summary of Changes
This PR incorporates the final infrastructure optimizations following
the initial merge of PR #25:
1. **SOPS & Secrets Management**:
- Generated dedicated Age keypair
(`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and
updated `.sops.yaml`.
- Added SOPS-encrypted production secrets for PostgreSQL
(`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics
(`ci/k8s/apps/umami/secret.sops.yaml`).
- Verified 100% clean round-trip decryption.
2. **Cloud-Init Template & Git Safety**:
- Converted `user-data.yaml` into `user-data.template.yaml` with clear
stubs for public SSH keys and private Age keys.
- Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent
accidental secret leaks.
3. **Persistent Secondary Storage**:
- Added automated detection, ext4 formatting, and mounting of secondary
persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with
`noatime` in `user-data.template.yaml`.
4. **Golden Image Naming & Workflows**:
- Updated image naming convention to include hyphenated UTC timestamps:
`com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`.
- Verified successful CI golden image build and S3 upload.
…tic assets
Regex locations (~* .js|css|woff2 etc) have higher priority than prefix
locations (/en/, /ru/) in nginx. Without an explicit root in the server
block, the caching location had no root to serve files from, causing
404s for all /en/static/... and /ru/static/... assets.
- Add root /usr/share/nginx/html to server block so all locations
inherit it
- Remove alias from /en/ and /ru/ locations (redundant with explicit
root)
- Reorder: caching regex locations before locale prefix locations
(documents intent)
Made-with: Cursor
This PR extends the build pipeline of the www service to support
locale-prefixed static builds (EN/RU) with build-time SSG output
injection, while also refactoring UI typography to a tokenized Tailwind
v4 @theme-driven approach.
Changes:
- Add build-time SSG plugin to @ermnvldmr/rsbuild-config and wire
multi-locale builds (/en/, /ru/) into services/www.
- Introduce new @ermnvldmr/i18n package (locale constants, path helpers,
keysets, pluralization) and apply it to www navigation/text.
- Refactor ui typography to a shared getTypographyClassNames utility +
Tailwind token definitions, with stl/cn updated for correct
Tailwind-merge behavior.
deytenit