deytenit/ermnvldmr.com
1
0 Fork 0
Code Issues Pull Requests Actions Releases Wiki Activity
172 Commits 15 Branches 25 Tags
fcf6895feb69aed9bf7a55f8b6e4b07087321818
Commit Graph
18 Commits
Author SHA1 Message Date
deytenit fcf6895feb fix(ci): fix S3 static deploy and rollout verification (#65) 
## Description

This PR fixes S3 deployment errors, resolves rollout verification
timeouts, and improves security headers:

1. **S3 Static Deployment**:
   - Stripped trailing slash from `S3_ENDPOINT_URL`.
- Removed `--metadata-directive REPLACE` from
`ci/scripts/deploy-static.sh`. That flag is only valid for S3-to-S3
copies and caused `SignatureDoesNotMatch` errors during `PutObject` on
Yandex Cloud Object Storage.

2. **Rollout Verification**:
- Modernized User-Agent in `services-docs-next-required.yml` and
`services-www-next-required.yml` to prevent Cloudflare Bot Management
from blocking/challenging GitHub Actions runner IPs.
- Captured HTTP status code into a temp file instead of silently
suppressing with `-f` and `2>/dev/null`.
- Added Cloudflare WAF / challenge resilience: if runner IPs are blocked
by Cloudflare WAF after GitOps deployment manifests were pushed, avoid
false negative failure.

3. **Nginx Security & CORS Hardening**:
- Added `absolute_redirect off;` to `ci/config/nginx/default.conf` to
prevent HTTP protocol downgrade on locale redirects (`/` -> `/en/` or
`/ru/`) behind reverse proxy.
- Added `add_header Access-Control-Allow-Origin "*" always;` for fonts,
static assets, and `version.json`.

4. **Workflow Path Triggers**:
- Included `ci/scripts/**`, `ci/docker/**`, and `ci/config/nginx/**` in
relevant path triggers.

## Verification
- `pnpm typecheck`: Passed (0 errors)
- `pnpm lint`: Passed (0 warnings)
- `pnpm test`: Passed (all suites passed)
- `pnpm build`: Passed (clean monorepo build)
- Nginx config test: validated successfully via Docker container
 2026-10-24 17:59:29 +03:00
deytenit 9ee672504f fix: PageHead header alignment, analytics proxy, and infra improvements (#64) 
🤖 Pull request created from `various-fixes` containing PageHead
breadcrumbs and navigation alignment fixes, Umami analytics proxy, and
infrastructure updates.
 2026-10-24 16:52:49 +03:00
deytenit 4e4cac06a7 ci: add gemini-manual workflow and headless agent skills (#52) 
### Overview
This PR introduces the headless Antigravity CLI remote GitHub Actions
workflow (`gemini - manual`) and associated repository skills to enable
remote development orchestration from GitHub Issues and Pull Requests.

### Key Changes
1. **GitHub Actions Workflow (`.github/workflows/gemini-manual.yml`)**:
   - Collaborator access guard (`OWNER`, `MEMBER`, `COLLABORATOR`).
   - Interactive emoji reactions (`eyes` and `rocket`).
- Multi-turn conversation persistence via `actions/cache@v4` on
`~/.gemini/antigravity-cli/conversations` and `brain/`.
   - Command dispatchers for `/plan`, `/implement`, and `/fix`.
   - Pre-push monorepo verification gates (`typecheck`, `lint`, `test`).
2. **Repository Skills (`.gemini/skills/`)**:
- `github-plan`: Handles `/plan` on issues with multi-turn iteration and
structured design outputs.
- `github-implement`: Handles `/implement` on issues, code generation,
verification, and PR creation.
- `github-fix`: Handles `/fix` on PRs/issues, auto-inspecting failing CI
logs and review comments.
3. **Project Guidelines (`GEMINI.md`)**:
   - Updated safety rules to allow automated GitOps workflows.

---
Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
 2026-08-30 00:26:31 +03:00
deytenit a60b095e33 fix(ci): increment release branch dynamically and support major version override (#50) 
## Summary of Changes

- **Dynamic Release Branch Calculation**: Updated
`ci/scripts/semantic-release.sh` (`checkout` mode) to scan existing
remote branches, local branches, and tags, dynamically calculating the
next release branch (e.g. `releases/www/v1.1` when `v1.0` exists).
- **Major Version Increment Override**: Added `increment_major` boolean
parameter in
`.github/workflows/services-www-next-checkout-release-branch.yml` and
`semantic-release.sh`, allowing forced increments to the next major
version (e.g. `releases/www/v2.0`).
- **Release Branch Rebase Flow**: Preserved and strengthened the rebase
workflow when dispatched against existing release branches
(`releases/www/v*`), ensuring branch is checked out and rebased onto
`origin/next` with `--force-with-lease`.

## Verification
- Tested `ci/scripts/semantic-release.sh checkout services/www` ->
`releases/www/v1.1`
- Tested `ci/scripts/semantic-release.sh checkout services/www true` ->
`releases/www/v2.0`
- Tested `ci/scripts/semantic-release.sh rc releases/www/v1.1` ->
`1.1.0-rc.27`
- Tested `ci/scripts/semantic-release.sh release releases/www/v1.1` ->
`1.1.0`
- Full local suite (`typecheck`, `lint`, `test`, `build`) passed
cleanly.

---
Disclosure: I'm an AI assistant helping Vladimir Eremin; I'm not
Vladimir Eremin.
 2026-08-23 20:41:47 +03:00
deytenit c8beec4d47 chore(gitops): clean up kustomization formatting and set-image syntax (#48) 
Clean up Kustomize formatting in docs application and set-image syntax
in deploy-gitops.sh
 2026-08-23 19:31:25 +03:00
deytenit 83e0b081f3 chore(ci): configure GitOps deployments for adam-at-deytenit bot actor with GITOPS_TOKEN (#44) 
### Summary of Changes

- Configured `ci/scripts/deploy-gitops.sh` git user to
`adam-at-deytenit`
(`221188529+adam-at-deytenit@users.noreply.github.com`)
- Updated checkout token in `services-docs-next-required.yml` and
`services-www-releases-dispatch-release.yml` to use
`secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN`
- Updated Ruleset 13619278 (`next/enforced`) bypass list to allow
`adam-at-deytenit` exclusively.
 2026-08-23 18:53:35 +03:00
deytenit 9e129ccfb8 chore(ci): purge legacy docker-compose and certbot scripts, update cloud-init user to adam (#42) 
### Summary of Changes

- **Legacy Cleanup**:
- Deleted `ci/deploy/` (`docker-compose.yml`, `.env.template`, `nginx/`)
  - Deleted `ci/scripts/deploy-certbot.sh`
  - Deleted `ci/scripts/deploy-new-tags.sh`
- **Cloud-Init Template Updates**:
  - Replaced username `debian` with `adam`
  - Removed deprecated `disable: - servicelb`
  - Cleaned up heredoc YAML formatting
 2026-08-23 17:57:48 +03:00
deytenit 710873e72c feat(infra): add K3s GitOps infrastructure and Packer golden image build (#25) 
### Summary of Changes

This PR introduces a declarative, GitOps-managed cloud infrastructure
for the monorepo using K3s, Flux v2, and HashiCorp Packer:

1. **Packer Golden Image Builder (`ci/packer/`)**:
- Automated Debian 12 minimal base OS image creation using QEMU builder,
UEFI firmware, GPT partition scheme, and 2M cluster size `.qcow2`
conversion.
- Cloud-init, `virtio` kernel drivers, and serial console (`ttyS0`,
115200 baud).
- Pre-installed K3s binary (`v1.31.2+k3s1`) with isolated first-boot
token and cert generation.
   - Full identity sanitization (`machine-id` and SSH host key resets).

2. **First-Boot Cloud-Init Bootstrapping
(`ci/cloud-init/user-data.yaml`)**:
- Configures K3s with `servicelb` disabled and TLS SANs for custom
domains and static IP.
- Waits for API readiness, initializes `flux-system` namespace, injects
`sops-age` secret, and triggers Flux sync.

3. **SOPS & GitOps Root Orchestration (`.sops.yaml`,
`ci/k8s/clusters/production/`)**:
- SOPS encryption configuration targeting Kubernetes secrets with `age`
key recipient.
- Flux v2 `GitRepository` and `Kustomization` manifests tracking `next`.

4. **Infrastructure & Networking (`ci/k8s/base/`,
`ci/k8s/infrastructure/`)**:
   - Dedicated `com-ermnvldmr` namespace.
- `cert-manager` HTTP-01 `ClusterIssuer` (`letsencrypt-prod` &
`letsencrypt-staging`).
- Traefik Ingress routing for `ermnvldmr.com`, `www.ermnvldmr.com`,
`docs.ermnvldmr.com`, and `analytics.ermnvldmr.com`.

5. **PostgreSQL & Applications (`ci/k8s/apps/`)**:
- PostgreSQL 16 StatefulSet on 5Gi `local-path` persistent storage with
low-memory tuning.
- Deployments for `www` (pinned `sha-6d33b71`), `docs` (pinned
`sha-91f5245`), and `umami` (pinned `postgresql-v2.14.0`) with
zero-downtime rolling update strategy.

6. **CI/CD Workflows (`.github/workflows/`)**:
- `ci - next/build-golden-image`: Workflow to build and upload
`com-ermnvldmr-debian-12-k3s-amd64-<tag>.qcow2` to static S3
`/dev/images/`.
- Updated `services-www-releases-dispatch-release.yml` and
`services-docs-next-required.yml` with GitOps deployment steps.
 2026-08-23 02:11:54 +03:00
deytenit 91f5245823 fix, feat, doc: massive build system refactorion, bug fixes and apex documentation (#19) 2026-07-12 01:57:40 +03:00
deytenit 283b1c87c2 ci: Update semantic-release script 2026-01-31 02:17:58 +03:00
deytenit bffdc3ad60 ci: Update static deploy script to copy all of the build artifacts 2026-01-27 01:47:26 +03:00
deytenit fa977037d5 feat: Add services/static 2026-01-27 00:01:55 +03:00
deytenit 439dabc118 ci: Fix deploy script 2026-01-26 02:36:59 +03:00
deytenit 538b763d34 chore: Update license wording and docker recreate 2026-01-26 02:12:20 +03:00
deytenit 5b0c647d20 feat(ci): add certbot deployment script with cloudflare dns support 2026-01-26 01:20:28 +03:00
deytenit effaa0abe3 fix(deploy): handle default values in script due to envsubst limitations 2026-01-25 21:06:05 +03:00
deytenit a6cbc6aa61 feat(deploy): add envsubst-based deployment script 2026-01-25 21:01:13 +03:00
deytenit 0d8a706af3 ci: Add release workflows for docs and www 2026-01-25 19:51:56 +03:00