feat: fix: make less padding on the expanded page head (#61 )

Resolves #53\n\nAutomated implementation generated via `/implement`.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*
fix(ci): increase agy print timeout, set actions write permission, and sharpen headless prompt (#60 )
2026-09-14 10:02:24 +03:00 · 2026-09-13 18:54:16 +03:00 · 2026-09-13 18:32:37 +03:00 · 2026-09-13 18:19:17 +03:00 · 2026-09-13 18:15:10 +03:00 · 2026-08-30 00:41:40 +03:00
148 changed files with 3693 additions and 3493 deletions
@@ -10,3 +10,4 @@ COM_ERMNVLDMR_STATIC_S3_REGION="encrypted:BAj3iuo7tWWNR2V4yQ+LHnFCB4JcZp7TTfUtvv
 COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL="encrypted:BNkQrgsrxtz544vuJbgwWUh5cPjHG5wbmHNcxTUWrzbFJJsdncaAitviCvIrS7Q41w+FiWkssv3D05Tu8Inn2P62E6G3PU4gNxO2oLdmGEdrzUqB/xvxOvLvos42j54QOZf7lOqMPKH6SL2/rheCAo10gSCicCqkfh4xsCAbYpyL"
 COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID="encrypted:BCsp8p4bp3cB+9grxHo634isRUaFGU3MOc1lr8ClSFRYLjqjqukyrbJCTZWV2Xdo8iQ33EylmbzUltbwzTWMQcjJSvIskesVLyV93q60o/Mu9L9jg/apwHuBgHv4zVuHstJ0zkHWgapbNTIlWD3RCm0ujeX/H1gBH3U="
 COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY="encrypted:BM7aPliOyiPrqFPZMfqpn534Nu+Y0Nbh/YRoxv2KY6XAi2dNO0LSEf97DqSUQYdsnu9iibZmVNktF2K/D6mtHr9+gumF6KsmaLH65KE7c9ly7NdFQHL9I26wxRq1Sr3Zgrfs954J6oURSlBRKqJFdcTsBltuuupGuqJHyLS9+DE0jD+bl0Qg0lA="
+SOPS_AGE_KEY="encrypted:BOJ7q79Tws4DMxpFuSymgv//IC4f+j713Bd7mNlUCEaUYVSfJMayMVPzks0FcsYo12XvlbH6gQ+tCf3t9yj/LcKKJzl3wtxlSVjvCRr0hasEBohcoxkLnFZ73DFQGzWcVC5Jf5IMK7qdYdNVzW0dVY/sn/NlTgl+A3YB6/08XYPhljl9993ky76zQqWDJQ66bKJ7YxWvst2TUNoT0lJEL0M4pg9ztRsuGqNZ"
@@ -0,0 +1,175 @@
+---
+name: github-fix
+description: Diagnose CI failures and review feedback on GitHub Pull Requests or Issues, repair code, verify quality checks, and commit changes.
+---
+
+# GitHub Fix Skill
+
+Use this skill when a user submits a `/fix` command on a GitHub Pull Request or Issue.
+
+## Overview
+
+The `/fix` command resolves build failures, test errors, and reviewer feedback. This skill enforces unified diagnosis, clean code repair, strict verification, and transparent progress reporting.
+
+```text
+/fix [optional instructions]
+  │
+  ├── 1. Unified Diagnosis (Fetch CI logs, inspect diff, parse comments)
+  ├── 2. Target Code Repair (Fix build errors and review feedback in one pass)
+  ├── 3. Verification (Run typecheck, lint, and tests)
+  ├── 4. Git Operations (Commit and push to the active branch)
+  └── 5. Thread Summary (Post itemized comment with mandatory disclosure)
+```
+
+---
+
+## Operational Workflow
+
+### Step 1: Unified Diagnosis
+
+Collect all diagnostic context before making code edits.
+
+#### Case A: Pull Request Context
+1. Identify the current PR number and branch:
+   ```bash
+   gh pr view --json number,headRefName,baseRefName
+   ```
+2. Fetch failed CI workflow logs:
+   ```bash
+   gh run view --log-failed
+   ```
+3. Inspect current changes in the PR:
+   ```bash
+   gh pr diff
+   ```
+4. Read all review comments and discussion threads:
+   ```bash
+   gh pr view --comments
+   ```
+5. Check inline review comments on specific files:
+   ```bash
+   gh api repos/{owner}/{repo}/pulls/{pull_number}/comments
+   ```
+
+#### Case B: Issue Context
+1. Read the issue description and thread comments:
+   ```bash
+   gh issue view <issue-number> --comments
+   ```
+2. Extract error stack traces, reproduction steps, and user instructions.
+
+---
+
+### Step 2: Target Code Repair
+
+Apply all necessary corrections in a single pass.
+
+1. Address all failures from CI logs (TypeScript errors, linter violations, test failures).
+2. Apply requested changes from code review comments.
+3. Incorporate any optional user instructions provided with `/fix`.
+4. Obey all repository conventions defined in `GEMINI.md`:
+   - **Strict TypeScript**: Do not use `any`, `as Type` assertions, or non-null `!` assertions. Use `castRef` from `@ermnvldmr/stl` when casting DOM references.
+   - **Type Imports**: Use `import type` for type declarations.
+   - **Interfaces**: Define object contracts with `interface`, not `type` aliases.
+   - **TSDoc**: Add descriptive JSDoc comments to all exported symbols and interfaces.
+   - **Styling**: Use Tailwind CSS v4 and `cva`. Merge class names with `cn` from `@ermnvldmr/stl`.
+   - **UI Primitives**: Use React Aria hooks and Radix UI primitives.
+   - **Import Boundaries**: Use relative paths for files within the same workspace package.
+
+---
+
+### Step 3: Verification
+
+Execute the complete verification sequence. All checks must pass with zero warnings or errors before proceeding.
+
+```bash
+# 1. Verify TypeScript types
+pnpm typecheck
+
+# 2. Verify ESLint rules
+pnpm lint
+
+# 3. Run unit and component tests
+pnpm test
+```
+
+> [!IMPORTANT]
+> If any check fails, resolve the failure immediately and rerun the verification sequence.
+
+---
+
+### Step 4: Git Operations
+
+Stage, commit, and push the resolved changes to the active branch.
+
+1. Stage modified and created files:
+   ```bash
+   git add <modified-files>
+   ```
+2. Commit with standard message:
+   ```bash
+   git commit -m "fix: apply review adjustments and CI fixes"
+   ```
+3. Push changes to the remote branch:
+   ```bash
+   git push origin HEAD
+   ```
+
+---
+
+### Step 5: Post Summary Comment
+
+Post an itemized summary comment to the GitHub PR or Issue thread.
+
+1. Format the comment with the template below.
+2. Submit the comment via GitHub CLI:
+   - For a Pull Request:
+     ```bash
+     gh pr comment <pr-number> --body "<comment-body>"
+     ```
+   - For an Issue:
+     ```bash
+     gh issue comment <issue-number> --body "<comment-body>"
+     ```
+
+---
+
+## GitHub Comment Template
+
+```markdown
+### Automated Fix Summary
+
+I addressed the reported issues and review feedback.
+
+#### Root Causes Identified
+- **CI / Test Failure**: `<Brief description of the failure>`
+- **Review Feedback**: `<Brief description of reviewer comments>`
+
+#### Changes Applied
+- `packages/<pkg>/src/...`: Fixed `<specific problem>`
+- `services/<svc>/src/...`: Updated `<specific problem>`
+
+#### Verification Results
+- `pnpm typecheck` passed (0 errors).
+- `pnpm lint` passed (0 warnings).
+- `pnpm test` passed (all tests clean).
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+---
+
+## Verification Checklist
+
+Before completing the task, verify every item in this checklist:
+
+- [ ] Failed CI logs inspected with `gh run view --log-failed`.
+- [ ] PR diff and review comments retrieved and analyzed.
+- [ ] Code repairs satisfy all requirements without introducing regressions.
+- [ ] No `any`, `as Type`, or `!` operators introduced.
+- [ ] `pnpm typecheck` completed with 0 errors.
+- [ ] `pnpm lint` completed with 0 warnings.
+- [ ] `pnpm test` completed with all tests passing.
+- [ ] Changes committed and pushed to the active branch.
+- [ ] Summary comment posted to the PR or Issue.
+- [ ] Mandatory disclosure line included at the end of the comment.
@@ -0,0 +1,125 @@
+---
+name: github-implement
+description: Implement code changes from an approved issue plan, run monorepo validation, and create a pull request.
+---
+
+# GitHub Implement Skill
+
+Use this skill when an issue receives the `/implement` command.
+
+## Overview
+
+This skill guides the implementation of approved design plans. It enforces repository rules, executes automated validation, and prepares pull requests for the `next` branch.
+
+## Procedural Workflow
+
+### Phase 1: Context Ingestion
+
+1. Read the complete issue description and title.
+2. Locate the approved implementation plan in the issue comments.
+3. Parse additional instructions from the `/implement` comment.
+4. If requirements conflict or miss critical details, stop and request clarification.
+
+### Phase 2: Code Implementation
+
+Apply all modifications according to `GEMINI.md` conventions:
+
+1. **TypeScript Constraints**:
+   - Enable strict typing for all new code.
+   - Do not use the `any` type.
+   - Do not use type assertions (`as Type`).
+   - Do not use the non-null assertion operator (`!`).
+   - Use explicit type guards or helper functions such as `castRef`.
+   - Use `import type` for type-only imports.
+   - Define object structures with `interface`, not `type` aliases.
+
+2. **Documentation Rules**:
+   - Add JSDoc comments to all exported functions, interfaces, and types.
+   - Include clear description text in every JSDoc block.
+
+3. **Component Architecture**:
+   - Place components in dedicated directories under `packages/ui/src/components/<ComponentName>/`.
+   - Provide `<ComponentName>.tsx` for component logic.
+   - Provide `<ComponentName>.stories.tsx` for Storybook stories.
+   - Provide `<ComponentName>.test.tsx` for Vitest tests.
+   - Use `cva` for component variant management.
+   - Merge CSS utility classes with `cn(...)` from `@ermnvldmr/stl`.
+   - Use React Aria hooks and Radix UI primitives for accessible controls.
+
+4. **Monorepo Imports and State**:
+   - Use relative paths within the same package.
+   - Do not use self-referential package names.
+   - Use standard React state primitives. Do not add unapproved state managers.
+
+5. **Protected Boundaries**:
+   - Do not modify `.env.keys`, `pnpm-lock.yaml`, or `LICENSE`.
+   - Do not edit content files in `services/docs/content/` or `services/www/content/` unless explicitly instructed.
+
+### Phase 3: Monorepo Verification & Self-Correction
+
+Run validation commands in strict sequence:
+
+1. Run `pnpm typecheck`. Ensure zero compiler errors.
+2. Run `pnpm lint`. Ensure zero warnings and zero errors.
+3. Run `pnpm test`. Ensure all unit and component tests pass.
+4. Run `pnpm build`. Ensure clean compilation across all packages.
+
+**Iterative Self-Correction Loop**:
+- If any check fails, inspect the diagnostic output.
+- Identify the root cause.
+- Apply targeted fixes adhering to all code rules.
+- Re-run the verification sequence from step 1.
+- Repeat until all four checks pass completely.
+
+### Phase 4: Commit & Pull Request Preparation
+
+1. **Commit Message**:
+   - Format commits according to Conventional Commits: `<type>: implement issue #<number> (<title>)`.
+   - Example: `feat: implement issue #42 (add theme toggle)`.
+
+2. **Pull Request Target**:
+   - Set base branch to `next`.
+
+3. **Pull Request Body**:
+   - Link the issue: `Resolves #<number>`.
+   - Provide a concise summary of changes.
+   - Detail the implementation walkthrough.
+   - List the executed verification checks.
+   - Append the mandatory attribution line.
+
+4. **Mandatory Attribution**:
+   - Conclude all PR bodies and issue comments with:
+     `Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.`
+
+## Pull Request Template
+
+```markdown
+## Summary
+Resolves #<number>
+
+<Brief explanation of the implemented feature or fix>
+
+## Walkthrough of Changes
+- `<package-or-path>`: <Description of specific change>
+- `<package-or-path>`: <Description of specific change>
+
+## Verification Results
+- [x] `pnpm typecheck` passed (0 errors)
+- [x] `pnpm lint` passed (0 warnings)
+- [x] `pnpm test` passed (all tests green)
+- [x] `pnpm build` passed (clean build)
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+## Verification Checklist
+
+- [ ] Issue context, approved plan, and user instructions are satisfied.
+- [ ] TypeScript strict mode rules are respected (`no any`, `no as`, `no !`).
+- [ ] Exported symbols include JSDoc comments.
+- [ ] UI components reside in dedicated folders with tests and stories.
+- [ ] Monorepo boundaries and relative imports are respected.
+- [ ] All four verification checks passed cleanly.
+- [ ] Target branch is set to `next`.
+- [ ] PR description includes `Resolves #<number>`.
+- [ ] Mandatory attribution line is present.
@@ -0,0 +1,136 @@
+---
+name: github-plan
+description: Analyze an issue thread, iterate on feedback, and produce or update an implementation plan for ermnvldmr.com.
+---
+
+# GitHub Issue Planning Skill (ASD-STE100 Standard)
+
+## Overview
+
+Use this skill when an issue receives the `/plan [optional instructions]` command.
+
+This skill creates or updates an implementation plan before code modification starts. All outputs must follow ASD-STE100 language constraints and repository standards.
+
+---
+
+## ASD-STE100 Writing Rules
+
+Follow these rules for all generated plans and documentation:
+
+| Rule | Limit | Approved Example | Non-Approved Example |
+| :--- | :--- | :--- | :--- |
+| **Procedural Sentences** | Max **20 words** | "Run `pnpm test`. Verify that all unit tests pass." | "You should run the pnpm test command to verify that all the unit tests pass properly without errors." |
+| **Descriptive Sentences** | Max **25 words** | "The `Button` component uses `cva` to manage style variants." | "The Button component is implemented using the cva library because it helps us manage complex style variants across different themes easily." |
+| **Voice** | **Active voice** | "The function validates the user input." | "The user input is validated by the function." |
+| **Mood and Tense** | **Present tense** and **Imperative mood** | "Click **Submit**. The form transmits the data." | "You will click submit and the form will be transmitting the data." |
+| **Noun Clusters** | Max **3 nouns** | "Theme configuration file" | "Theme variant style configuration file" |
+
+### Controlled Vocabulary Guidelines
+- Do not use conversational filler (for example: "basically", "let's dive in", "simply", "feel free to").
+- Use approved verbs: use *use* (not *utilize*), *stop* (not *terminate*), *start* (not *initiate*), *show* (not *exhibit*).
+- Use clear and literal technical terms.
+
+---
+
+## Planning Responsibilities
+
+### 1. Ingest Full Issue Context
+- Read the issue title, issue description, and all subsequent comments.
+- Identify user requirements, technical constraints, and reported symptoms.
+- Inspect relevant source files in the repository before proposing changes.
+- Read `GEMINI.md` to confirm current project conventions.
+
+### 2. Multi-Turn Plan Iteration
+- Check if an earlier implementation plan exists in the issue thread.
+- If an earlier plan exists:
+  - Do not create a plan from zero.
+  - Retain approved architectural decisions from previous turns.
+  - Apply the requested modifications or additions from the latest comment.
+  - Summarize the specific adjustments made to the previous plan.
+- If no earlier plan exists:
+  - Create a new baseline implementation plan from the issue requirements.
+
+### 3. Enforce Repository Architecture (`GEMINI.md`)
+Every proposed plan must comply with repository architecture:
+- **Build System**: Use Rsbuild and Rspack. Do not propose Vite, Webpack, or Next.js.
+- **Strict TypeScript**:
+  - Do not use `any`.
+  - Do not use type assertions (`as Type`). Use type guards or `castRef` from `@ermnvldmr/stl`.
+  - Do not use non-null assertions (`!`).
+  - Use `import type` for type-only imports.
+  - Define object shapes with `interface`, not `type` aliases.
+  - Require JSDoc comments on all exported symbols.
+- **Component Architecture** (`packages/ui`):
+  - Place components in `packages/ui/src/components/<ComponentName>/`.
+  - Provide `<ComponentName>.tsx`, `<ComponentName>.stories.tsx`, and `<ComponentName>.test.tsx`.
+  - Use `cva` for variant definitions.
+  - Merge class names with `cn(...)` from `@ermnvldmr/stl`.
+- **Accessibility & State**:
+  - Use React Aria hooks (`useButton`, `useFocusRing`, `useHover`) and Radix UI primitives.
+  - Use standard React state (`useState`, `useReducer`, `useContext`) and `react-stately`.
+  - Do not introduce external state management libraries.
+- **Monorepo Import Rules**:
+  - Use relative import paths within the same package.
+  - Do not import `@ermnvldmr/<package>` inside `<package>` itself.
+- **Protected Files**:
+  - Do not modify `.env.keys`, `pnpm-lock.yaml`, `LICENSE`, `services/docs/content/`, or `services/www/content/`.
+
+---
+
+## Output Plan Structure
+
+Format the generated plan with the following markdown template:
+
+```markdown
+### Goal
+[Describe the objective in 1-2 sentences. Keep each sentence under 25 words.]
+
+### Architecture & Technical Decisions
+- [Decision 1: Explain pattern, primitive, or component structure.]
+- [Decision 2: Explain typing or API contracts.]
+- [Decision 3: Explain state management or accessibility integration.]
+
+### File Changes
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.tsx` - [Purpose]
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.stories.tsx` - [Purpose]
+- `[NEW]` `packages/ui/src/components/NewComponent/NewComponent.test.tsx` - [Purpose]
+- `[MODIFY]` `packages/ui/src/index.ts` - [Export new component]
+
+### Verification Plan
+1. `pnpm typecheck` - Verify zero TypeScript compiler errors.
+2. `pnpm lint` - Verify zero ESLint warnings and errors.
+3. `pnpm test` - Run unit and integration tests.
+4. `pnpm build` - Run full workspace build.
+
+### Open Questions
+- [List open questions or ambiguities. If no open questions exist, write "None.".]
+
+Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.
+```
+
+---
+
+## Common Traps and Solutions
+
+| Anti-Pattern | Correct Action |
+| :--- | :--- |
+| Regenerating a new plan after user feedback | Update the existing plan and highlight modified sections. |
+| Using `as Type` assertions in the proposed code | Propose explicit type guards or `castRef` helpers. |
+| Missing Storybook or Vitest files for UI components | Include `.stories.tsx` and `.test.tsx` in the file plan. |
+| Proposing external state libraries | Use React 19 primitives and `react-stately`. |
+| Omitting the attribution line | Append the mandatory disclosure line at the end. |
+
+---
+
+## Verification Checklist
+
+Before posting the plan response, verify all items:
+
+- [ ] The issue thread context and all user comments are analyzed.
+- [ ] Existing plans are updated rather than replaced from scratch.
+- [ ] Proposed code satisfies all `GEMINI.md` constraints (`strict: true`, no `any`, no `as`, no `!`).
+- [ ] All UI components include unit tests and Storybook stories.
+- [ ] All sentences follow ASD-STE100 limits (<=20 words for instructions, <=25 words for descriptions).
+- [ ] Active voice is used throughout the plan.
+- [ ] The output concludes with: `Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.`
+
@@ -0,0 +1,134 @@
+name: ci - next/build-golden-image
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-golden-image
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  validate-scripts:
+    name: Validate - Provisioner Scripts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate Shell Script Syntax
+        run: bash -n ci/packer/scripts/*.sh
+
+  build-image:
+    name: Build - Golden Image
+    needs: validate-scripts
+    runs-on: ubuntu-latest
+    outputs:
+      image_name: ${{ steps.vars.outputs.image_name }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Calculate Image Name
+        id: vars
+        run: |
+          SHORT_SHA="$(echo ${{ github.sha }} | cut -c1-7)"
+          IMAGE_NAME="com-ermnvldmr-debian-12-k3s-amd64-${SHORT_SHA}.qcow2"
+          echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Install Build Tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y qemu-utils
+
+      - name: Build Debian K3s Golden Image
+        run: |
+          mkdir -p output-qemu
+          echo "Downloading official Debian 12 cloud image..."
+          curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
+          
+          echo "Expanding disk image to 10G..."
+          qemu-img resize base.qcow2 10G
+          
+          echo "Connecting disk image via NBD..."
+          sudo modprobe nbd max_part=8
+          sudo qemu-nbd --connect=/dev/nbd0 base.qcow2
+          sleep 1
+          sudo partx -u /dev/nbd0 || true
+          
+          echo "Mounting disk filesystem..."
+          sudo mkdir -p /mnt/target
+          sudo mount /dev/nbd0p1 /mnt/target
+          
+          echo "Mounting host virtual filesystems and configuring DNS..."
+          sudo rm -f /mnt/target/etc/resolv.conf
+          echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf
+          echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf
+          sudo mount --bind /dev /mnt/target/dev
+          sudo mount --bind /dev/pts /mnt/target/dev/pts
+          sudo mount --bind /proc /mnt/target/proc
+          sudo mount --bind /sys /mnt/target/sys
+          
+          echo "Copying provisioner scripts..."
+          sudo mkdir -p /mnt/target/tmp/scripts
+          sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/
+          sudo chmod +x /mnt/target/tmp/scripts/*.sh
+          
+          echo "Running provisioner scripts in chroot..."
+          sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh
+          sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh
+          sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh
+          sudo rm -rf /mnt/target/tmp/scripts
+          
+          echo "Unmounting filesystems..."
+          sudo umount /mnt/target/sys
+          sudo umount /mnt/target/proc
+          sudo umount /mnt/target/dev/pts
+          sudo umount /mnt/target/dev
+          sudo umount /mnt/target
+          sudo qemu-nbd --disconnect /dev/nbd0
+          
+          echo "Compressing and optimizing qcow2 with 2M cluster size..."
+          qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+          echo "Golden image built successfully."
+
+      - name: Prepare and Upload Image Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: golden-image
+          path: output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+          retention-days: 1
+
+  upload-s3:
+    name: Upload - S3 Storage
+    needs: build-image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download Image Artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: golden-image
+          path: output-qemu
+
+      - name: Upload to Static S3 (/dev/images/)
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION || 'ru-central1' }}
+          S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL }}
+          S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET }}
+          IMAGE_NAME: ${{ needs.build-image.outputs.image_name }}
+        run: |
+          mv output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 "output-qemu/${IMAGE_NAME}"
+          if [ -n "${S3_BUCKET}" ] && [ -n "${AWS_ACCESS_KEY_ID}" ]; then
+            ENDPOINT_FLAG=""
+            [ -n "${S3_ENDPOINT}" ] && ENDPOINT_FLAG="--endpoint-url=${S3_ENDPOINT}"
+            echo "Cleaning up older images in dev/images/ to free bucket storage..."
+            aws ${ENDPOINT_FLAG} s3 rm "s3://${S3_BUCKET}/dev/images/" --recursive || true
+            aws ${ENDPOINT_FLAG} s3 cp "output-qemu/${IMAGE_NAME}" "s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}"
+            echo "Golden image uploaded to s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}"
+          else
+            echo "S3 storage secrets not provided; skipping remote S3 upload. Image artifact is preserved in GitHub Actions run artifacts."
+          fi
@@ -0,0 +1,319 @@
+name: gemini - manual
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+concurrency:
+  group: agent-issue-${{ github.event.issue.number || github.event.pull_request.number }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  actions: write
+
+jobs:
+  agent-dispatch:
+    name: Agent / Dispatch
+    if: >
+      (github.event.comment.author_association == 'OWNER' ||
+       github.event.comment.author_association == 'MEMBER' ||
+       github.event.comment.author_association == 'COLLABORATOR') &&
+      (contains(github.event.comment.body, '/plan') ||
+       contains(github.event.comment.body, '/implement') ||
+       contains(github.event.comment.body, '/fix'))
+    runs-on: [self-hosted, eliza]
+    container:
+      image: node:20-bookworm
+      options: --add-host host.docker.internal:host-gateway
+    env:
+      HTTP_PROXY: http://host.docker.internal:1080
+      HTTPS_PROXY: http://host.docker.internal:1080
+      ALL_PROXY: http://host.docker.internal:1080
+      NO_PROXY: localhost,127.0.0.1
+    timeout-minutes: 30
+
+    steps:
+      - name: Verify Collaborator Authorization
+        id: auth-check
+        run: |
+          AUTHOR_ASSOC="${{ github.event.comment.author_association }}"
+          echo "Author association: $AUTHOR_ASSOC"
+          if [[ "$AUTHOR_ASSOC" != "OWNER" && "$AUTHOR_ASSOC" != "MEMBER" && "$AUTHOR_ASSOC" != "COLLABORATOR" ]]; then
+            echo "::error::Unauthorized trigger by user with association '$AUTHOR_ASSOC'."
+            exit 1
+          fi
+
+      - name: Ensure GitHub CLI is Installed
+        run: |
+          if ! command -v gh &> /dev/null; then
+            echo "Installing GitHub CLI..."
+            curl -fsSL https://github.com/cli/cli/releases/download/v2.67.0/gh_2.67.0_linux_amd64.tar.gz | tar -xz -C /usr/local --strip-components=1
+          fi
+
+      - name: Acknowledge Command (Add Eyes Reaction)
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          gh api "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions" -f content=eyes || true
+
+      - name: Checkout Codebase
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9.12.3
+
+      - name: Setup Node.js with pnpm cache
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+
+      - name: Install Dependencies & Build Workspace Packages
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm build:deps
+
+      - name: Restore Agent Conversation Context
+        uses: actions/cache@v4
+        id: agent-context-cache
+        with:
+          path: |
+            ~/.gemini/antigravity-cli/conversations
+            ~/.gemini/antigravity-cli/brain
+          key: agent-context-issue-${{ github.event.issue.number }}-${{ github.run_id }}
+          restore-keys: |
+            agent-context-issue-${{ github.event.issue.number }}-
+
+      - name: Setup Antigravity CLI & Credentials
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          AGY_AUTH_TOKEN: ${{ secrets.AGY_AUTH_TOKEN }}
+        run: |
+          # 1. Download official Antigravity CLI binary from google-antigravity/antigravity-cli
+          mkdir -p "$HOME/.local/bin"
+          if ! command -v agy &> /dev/null; then
+            echo "Fetching Antigravity CLI from google-antigravity/antigravity-cli..."
+            gh release download --repo google-antigravity/antigravity-cli -p "agy_cli_linux_x64.tar.gz" -O - | tar -xz -C "$HOME/.local/bin"
+            if [ -f "$HOME/.local/bin/antigravity" ] && [ ! -f "$HOME/.local/bin/agy" ]; then
+              mv "$HOME/.local/bin/antigravity" "$HOME/.local/bin/agy"
+            fi
+            ln -sf "$HOME/.local/bin/agy" "$HOME/.local/bin/antigravity"
+            chmod +x "$HOME/.local/bin/agy" "$HOME/.local/bin/antigravity"
+          fi
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+          echo "$HOME/.gemini/antigravity-cli/bin" >> $GITHUB_PATH
+          export PATH="$HOME/.local/bin:$HOME/.gemini/antigravity-cli/bin:$PATH"
+
+          # 2. Patch location eligibility check (open-antigravity-patcher CLI_GATE_X64)
+          node -e '
+            const fs = require("fs");
+            const file = process.env.HOME + "/.local/bin/agy";
+            if (!fs.existsSync(file)) process.exit(0);
+            const buf = fs.readFileSync(file);
+            let count = 0;
+            for (let i = 0; i < buf.length - 18; i++) {
+              if (buf[i] === 0x48 && buf[i+1] === 0x85 && buf[i+2] === 0xc0 && buf[i+3] === 0x0f && buf[i+4] === 0x84 &&
+                  buf[i+9] === 0x80 && buf[i+10] === 0x78 && buf[i+11] === 0x08 && buf[i+12] === 0x00 &&
+                  buf[i+13] === 0x0f && buf[i+14] === 0x85) {
+                buf[i+9] = 0x48; buf[i+10] = 0x85; buf[i+11] = 0xc0; buf[i+12] = 0x90;
+                count++;
+              }
+            }
+            if (count > 0) {
+              fs.writeFileSync(file, buf);
+              console.log(`Applied open-antigravity-patcher: ${count} gates patched.`);
+            } else {
+              console.log("Antigravity CLI is already patched or signature not found.");
+            }
+          '
+
+          # 3. Inject OAuth Token
+          mkdir -p ~/.gemini/antigravity-cli
+          if [ -n "$AGY_AUTH_TOKEN" ]; then
+            if echo "$AGY_AUTH_TOKEN" | base64 --decode >/dev/null 2>&1; then
+              echo "$AGY_AUTH_TOKEN" | base64 --decode > ~/.gemini/antigravity-cli/antigravity-oauth-token
+            else
+              echo "$AGY_AUTH_TOKEN" > ~/.gemini/antigravity-cli/antigravity-oauth-token
+            fi
+            chmod 600 ~/.gemini/antigravity-cli/antigravity-oauth-token
+          else
+            echo "::warning::AGY_AUTH_TOKEN secret is not set."
+          fi
+
+      - name: Configure Git Bot Identity
+        run: |
+          git config --global user.name "Adam Jensen [bot]"
+          git config --global user.email "adam@ermnvldmr.com"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      # --- COMMAND: /plan ---
+      - name: Handle /plan (Issue Planning)
+        if: contains(github.event.comment.body, '/plan') && github.event.issue.pull_request == null
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          echo "Generating plan for Issue #${ISSUE_NUMBER}..."
+          ISSUE_DATA=$(gh issue view "$ISSUE_NUMBER" --comments --json title,body,comments)
+
+          CONTINUE_FLAG=""
+          if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+            CONTINUE_FLAG="--continue"
+          fi
+
+          PROMPT="You are operating via GitHub Actions in non-interactive headless mode on Issue #${ISSUE_NUMBER}.\n\nIssue Context:\n${ISSUE_DATA}\n\nLatest instruction:\n${COMMENT_BODY}\n\nPlease generate/update a detailed technical implementation plan adhering to project GEMINI.md guidelines."
+
+          PLAN_OUTPUT=$(agy $CONTINUE_FLAG --mode plan --print-timeout 20m -p "$PROMPT" || echo "Agent encountered an error generating the plan.")
+
+          DISCLOSURE="\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          gh issue comment "$ISSUE_NUMBER" --body "${PLAN_OUTPUT}${DISCLOSURE}"
+
+      # --- COMMAND: /implement ---
+      - name: Handle /implement (Issue Implementation & PR)
+        if: contains(github.event.comment.body, '/implement') && github.event.issue.pull_request == null
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          BRANCH_NAME="agent/issue-${ISSUE_NUMBER}"
+          git checkout -b "$BRANCH_NAME"
+
+          ISSUE_DATA=$(gh issue view "$ISSUE_NUMBER" --comments --json title,body,comments)
+
+          CONTINUE_FLAG=""
+          if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+            CONTINUE_FLAG="--continue"
+          fi
+
+          PROMPT="You are operating via GitHub Actions in non-interactive headless mode to implement Issue #${ISSUE_NUMBER}.\n\nContext:\n${ISSUE_DATA}\n\nLatest instruction:\n${COMMENT_BODY}\n\nTask: Inspect relevant files, implement the necessary code changes directly in the workspace adhering to GEMINI.md rules, and verify them. Do not exit or stop before applying edits to the source code."
+          agy $CONTINUE_FLAG --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+          echo "Running repository verification gates..."
+          pnpm typecheck
+          pnpm lint
+          pnpm test
+
+          ISSUE_TITLE=$(gh issue view "$ISSUE_NUMBER" --json title -q .title)
+          git add -A
+          if git diff --staged --quiet; then
+            echo "No changes produced by agent."
+            gh issue comment "$ISSUE_NUMBER" --body "No changes were produced for implementation.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+            exit 0
+          fi
+
+          git commit -m "feat: implement issue #${ISSUE_NUMBER} (${ISSUE_TITLE})"
+          git push -u origin "$BRANCH_NAME" --force
+
+          PR_BODY="Resolves #${ISSUE_NUMBER}\n\nAutomated implementation generated via \`/implement\`.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          gh pr create \
+            --title "feat: ${ISSUE_TITLE}" \
+            --body "$PR_BODY" \
+            --base next \
+            --head "$BRANCH_NAME"
+
+      # --- COMMAND: /fix ---
+      - name: Handle /fix (PR Review Adjustments & CI Failure Debugging)
+        if: contains(github.event.comment.body, '/fix')
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_OR_PR_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          IS_PR="${{ github.event.issue.pull_request != null }}"
+          if [ "$IS_PR" = "true" ]; then
+            # Verify PR is not from an untrusted cross-repository fork
+            IS_CROSS_REPO=$(gh pr view "$ISSUE_OR_PR_NUMBER" --json isCrossRepository -q .isCrossRepository)
+            if [ "$IS_CROSS_REPO" = "true" ]; then
+              echo "::error::Cross-repository fork PRs cannot be automatically processed in privileged context."
+              exit 1
+            fi
+
+            gh pr checkout "$ISSUE_OR_PR_NUMBER"
+            BRANCH_NAME=$(git branch --show-current)
+            PR_DIFF=$(gh pr diff "$ISSUE_OR_PR_NUMBER" || true)
+
+            FAILED_RUN_ID=$(gh run list --branch "$BRANCH_NAME" --status failure --limit 1 --json databaseId -q '.[0].databaseId' || true)
+            CI_LOGS=""
+            if [ -n "$FAILED_RUN_ID" ] && [ "$FAILED_RUN_ID" != "null" ]; then
+              echo "Found failed CI run: #$FAILED_RUN_ID. Fetching failure logs..."
+              CI_LOGS=$(gh run view "$FAILED_RUN_ID" --log-failed | tail -n 200 || true)
+            fi
+
+            CONTINUE_FLAG=""
+            if [ -d "$HOME/.gemini/antigravity-cli/conversations" ] && [ "$(ls -A $HOME/.gemini/antigravity-cli/conversations 2>/dev/null)" ]; then
+              CONTINUE_FLAG="--continue"
+            fi
+
+            PROMPT="You are operating via GitHub Actions in non-interactive headless mode to fix/adjust PR #${ISSUE_OR_PR_NUMBER} on branch ${BRANCH_NAME}.\n\nFeedback / Comment:\n${COMMENT_BODY}\n\nPR Diff:\n${PR_DIFF}\n\nFailed CI Logs (if any):\n${CI_LOGS}\n\nTask: Apply the necessary fixes directly to the files, ensuring all lint, typecheck, and test checks pass. Do not exit without applying the changes."
+            agy $CONTINUE_FLAG --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+            echo "Running repository verification gates..."
+            pnpm typecheck
+            pnpm lint
+            pnpm test
+
+            git add -A
+            if git diff --staged --quiet; then
+              echo "No additional changes were needed."
+              gh pr comment "$ISSUE_OR_PR_NUMBER" --body "Analyzed the request; no additional changes were needed.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+              exit 0
+            fi
+
+            git commit -m "fix: apply review adjustments and CI fixes"
+            git push origin "$BRANCH_NAME"
+
+            gh pr comment "$ISSUE_OR_PR_NUMBER" --body "Applied adjustments and verified build/test suite.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*"
+          else
+            echo "Handling /fix on Issue #${ISSUE_OR_PR_NUMBER}..."
+            BRANCH_NAME="agent/fix-issue-${ISSUE_OR_PR_NUMBER}"
+            git checkout -b "$BRANCH_NAME"
+
+            ISSUE_DATA=$(gh issue view "$ISSUE_OR_PR_NUMBER" --comments --json title,body,comments)
+            PROMPT="You are operating via GitHub Actions in non-interactive headless mode to fix issue #${ISSUE_OR_PR_NUMBER}.\n\nContext:\n${ISSUE_DATA}\n\nInstruction:\n${COMMENT_BODY}\n\nTask: Apply the necessary fixes directly to the files adhering to GEMINI.md rules."
+            agy --dangerously-skip-permissions --print-timeout 25m -p "$PROMPT"
+
+            pnpm typecheck
+            pnpm lint
+            pnpm test
+
+            git add -A
+            git commit -m "fix: resolve issue #${ISSUE_OR_PR_NUMBER}"
+            git push -u origin "$BRANCH_NAME" --force
+
+            gh pr create \
+              --title "fix: resolve issue #${ISSUE_OR_PR_NUMBER}" \
+              --body "Resolves #${ISSUE_OR_PR_NUMBER}\n\nFix applied via \`/fix\`.\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*" \
+              --base next \
+              --head "$BRANCH_NAME"
+          fi
+
+      - name: Complete Command (Add Rocket Reaction)
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          gh api "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions" -f content=rocket || true
+
+      - name: Report Failure on Comment
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh issue comment "$ISSUE_NUMBER" --body "⚠️ Workflow failed during execution. View run logs: [Action Run #${{ github.run_id }}](${RUN_URL})\n\n---\n*Disclosure: I'm an AI assistant helping deytenit; I'm not deytenit.*" || true
@@ -81,6 +81,10 @@ jobs:
            type=raw,value=latest
            type=sha,format=short

+      - name: Compute short SHA
+        id: vars
+        run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+
      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
@@ -89,24 +93,74 @@ jobs:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+            VERSION=${{ steps.vars.outputs.short_sha }}

  deploy:
-    name: Deploy - VPS
+    name: Deploy - Kubernetes (GitOps)
    needs: release-docker
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    permissions:
+      contents: write
    steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1.0.3
+      - name: Checkout repository
+        uses: actions/checkout@v4
        with:
-          host: ${{ secrets.DEPLOY_VPS_HOST }}
-          username: ${{ secrets.DEPLOY_VPS_USER }}
-          key: ${{ secrets.DEPLOY_VPS_SSH_KEY }}
-          port: ${{ secrets.DEPLOY_VPS_SSH_PORT || 22 }}
-          script: |
-            cd /srv/ermnvldmr.com
-            git pull
-            chmod +x ci/scripts/deploy-new-tags.sh
-            # Use the short SHA to match the tag from release-docker
-            export DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-            ./ci/scripts/deploy-new-tags.sh
+          ref: next
+          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - name: Setup Kustomize
+        uses: imranismail/setup-kustomize@v2
+        with:
+          kustomize-version: "5.3.0"
+
+      - name: Deploy via GitOps
+        run: |
+          DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+          bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"
+
+  verify-rollout:
+    name: Verify - Production Rollout
+    needs: deploy
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
+    steps:
+      - name: Await production rollout
+        run: |
+          TARGET_COMMIT="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+          ENDPOINT="https://docs.ermnvldmr.com/version.json"
+
+          echo "========================================================"
+          echo "Verifying production deployment on $ENDPOINT"
+          echo "Expected commit: $TARGET_COMMIT"
+          echo "========================================================"
+
+          MAX_ATTEMPTS=45
+          ATTEMPT=1
+
+          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
+            echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..."
+
+            RESPONSE=$(curl -sfL --max-time 10 -H "User-Agent: GitHub-Actions-Rollout-Verifier" "$ENDPOINT" 2>/dev/null || true)
+
+            if [ -n "$RESPONSE" ]; then
+              LIVE_COMMIT=$(echo "$RESPONSE" | jq -r '.commit // empty')
+
+              echo "  Live commit: ${LIVE_COMMIT:-<none>}"
+
+              if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then
+                echo "✅ Success! Production docs has successfully rolled out $TARGET_COMMIT."
+                exit 0
+              fi
+            else
+              echo "  Endpoint did not return valid JSON or timed out."
+            fi
+
+            ATTEMPT=$((ATTEMPT + 1))
+            sleep 10
+          done
+
+          echo "❌ Deployment verification timed out after 7.5 minutes."
+          exit 1
@@ -1,59 +0,0 @@
-name: services/www - next/checkout-release-branch
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  workflow-release-branch:
-    name: Workflow - Create or Update Release Branch
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      actions: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Determine Mode and Branch Name
-        id: plan
-        run: |
-          REF="${{ github.ref_name }}"
-          if [[ "$REF" =~ ^releases/www/v[0-9]+\.[0-9]+$ ]]; then
-            # Dispatched against an existing release branch: update it.
-            echo "mode=update" >> "$GITHUB_OUTPUT"
-            echo "branch_name=$REF" >> "$GITHUB_OUTPUT"
-          else
-            # Dispatched against next (or any other ref): create a new release branch.
-            BRANCH_NAME=$(bash ci/scripts/semantic-release.sh checkout services/www)
-            echo "mode=create" >> "$GITHUB_OUTPUT"
-            echo "branch_name=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Create and Push Branch
-        if: steps.plan.outputs.mode == 'create'
-        run: |
-          git checkout -b ${{ steps.plan.outputs.branch_name }}
-          git push origin ${{ steps.plan.outputs.branch_name }}
-
-      - name: Rebase Existing Branch onto next
-        if: steps.plan.outputs.mode == 'update'
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          # Bring the release branch up to date with its father (next),
-          # replaying any release-branch-only commits on top of the latest next.
-          git fetch origin next
-          git rebase FETCH_HEAD
-          git push --force-with-lease origin ${{ steps.plan.outputs.branch_name }}
-
-      - name: Trigger Release Workflow
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh workflow run services-www-releases-required.yml --ref ${{ steps.plan.outputs.branch_name }}
@@ -10,6 +10,7 @@ on:
      - 'packages/i18n/**'
      - '.github/workflows/services-www-next-required.yml'
      - 'pnpm-lock.yaml'
+  workflow_dispatch:

 concurrency:
  group: ci-www-${{ github.ref_name }}
@@ -330,17 +331,25 @@ jobs:
          path: services/www/rsdoctor/
          retention-days: 30

-  release-docker:
-    name: Release - Docker Image
-    needs: build-www
+  build-docker:
+    name: Build - Docker Image
+    needs: [lint-www, typecheck-www, test-www, test-storybook, build-www]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
+    outputs:
+      short_sha: ${{ steps.vars.outputs.short_sha }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

+      - name: Calculate Short SHA
+        id: vars
+        run: |
+          SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
+          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
@@ -348,14 +357,8 @@ jobs:
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=next
-            type=sha,format=short
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
@@ -363,5 +366,121 @@ jobs:
          context: .
          file: ci/docker/www/Dockerfile
          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ghcr.io/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha }}
+          build-args: |
+            COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+            VERSION=${{ steps.vars.outputs.short_sha }}
+
+  release-tag-docker:
+    name: Release - Tag & Docker
+    needs: build-docker
+    runs-on: ubuntu-latest
+    environment: services-www-releases-publish
+    permissions:
+      contents: write
+      packages: write
+    outputs:
+      version: ${{ steps.calver.outputs.version }}
+      short_sha: ${{ needs.build-docker.outputs.short_sha }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Calculate CalVer Version
+        id: calver
+        run: |
+          VERSION=$(bash ci/scripts/calver-release.sh)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Create and Push Tag
+        run: |
+          TAG_NAME="${{ steps.calver.outputs.version }}"
+          git tag "$TAG_NAME"
+          git push origin "$TAG_NAME"
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Tag and Push Release Docker Image
+        run: |
+          docker buildx imagetools create \
+            ghcr.io/${{ github.repository }}/www:${{ needs.build-docker.outputs.short_sha }} \
+            --tag ghcr.io/${{ github.repository }}/www:${{ steps.calver.outputs.version }}
+
+  deploy:
+    name: Deploy - Kubernetes (GitOps)
+    needs: release-tag-docker
+    runs-on: ubuntu-latest
+    environment:
+      name: services-www-releases-deploy
+      url: https://ermnvldmr.com
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: next
+          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - name: Setup Kustomize
+        uses: imranismail/setup-kustomize@v2
+        with:
+          kustomize-version: "5.3.0"
+
+      - name: Deploy via GitOps
+        run: |
+          WWW_TAG="${{ needs.release-tag-docker.outputs.short_sha }}"
+          bash ci/scripts/deploy-gitops.sh www "${WWW_TAG}"
+
+  verify-rollout:
+    name: Verify - Production Rollout
+    needs: [release-tag-docker, deploy]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Await production rollout
+        run: |
+          TARGET_COMMIT="${{ needs.release-tag-docker.outputs.short_sha }}"
+          ENDPOINT="https://www.ermnvldmr.com/version.json"
+
+          echo "========================================================"
+          echo "Verifying production deployment on $ENDPOINT"
+          echo "Expected commit:  $TARGET_COMMIT"
+          echo "========================================================"
+
+          MAX_ATTEMPTS=45
+          ATTEMPT=1
+
+          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
+            echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..."
+
+            RESPONSE=$(curl -sfL --max-time 10 -H "User-Agent: GitHub-Actions-Rollout-Verifier" "$ENDPOINT" 2>/dev/null || true)
+
+            if [ -n "$RESPONSE" ]; then
+              LIVE_COMMIT=$(echo "$RESPONSE" | jq -r '.commit // empty')
+
+              echo "  Live commit:  ${LIVE_COMMIT:-<none>}"
+
+              if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then
+                echo "✅ Success! Production has successfully rolled out $TARGET_COMMIT."
+                exit 0
+              fi
+            else
+              echo "  Endpoint did not return valid JSON or timed out."
+            fi
+
+            ATTEMPT=$((ATTEMPT + 1))
+            sleep 10
+          done
+
+          echo "❌ Deployment verification timed out after 7.5 minutes."
+          exit 1
@@ -1,310 +0,0 @@
-name: services/www - releases/dispatch-release
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: config-artifacts
-          path: |
-            packages/rsbuild-config/dist
-            packages/storybook-config/dist
-            packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW service
-        run: pnpm --filter @ermnvldmr/www build
-
-  release-tag-docker:
-    name: Release - Tag & Docker
-    needs: [lint-www, typecheck-www, test-www, test-storybook, build-www]
-    runs-on: ubuntu-latest
-    environment: services-www-releases-publish
-    permissions:
-      contents: write
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Calculate Release Version
-        id: version
-        run: |
-          RELEASE_VERSION=$(bash ci/scripts/semantic-release.sh release ${{ github.ref_name }})
-          # Extract MAJOR.MINOR for tagging
-          MAJOR_MINOR=$(echo "${{ github.ref_name }}" | cut -d/ -f3 | sed 's/^v//')
-          MAJOR=$(echo "$MAJOR_MINOR" | cut -d. -f1)
-          echo "version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
-          echo "major_minor=$MAJOR_MINOR" >> $GITHUB_OUTPUT
-          echo "major=$MAJOR" >> $GITHUB_OUTPUT
-
-      - name: Create and Push Tag
-        run: |
-          TAG_NAME="releases/www/v${{ steps.version.outputs.version }}"
-          git tag $TAG_NAME
-          git push origin $TAG_NAME
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=v${{ steps.version.outputs.version }}
-            type=raw,value=v${{ steps.version.outputs.major_minor }}
-            type=raw,value=v${{ steps.version.outputs.major }}
-            type=raw,value=latest
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  deploy:
-    name: Deploy - VPS
-    needs: release-tag-docker
-    runs-on: ubuntu-latest
-    environment:
-      name: services-www-releases-deploy
-      url: https://ermnvldmr.com
-    steps:
-      - name: Deploy via SSH
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.DEPLOY_VPS_HOST }}
-          username: ${{ secrets.DEPLOY_VPS_USER }}
-          key: ${{ secrets.DEPLOY_VPS_SSH_KEY }}
-          port: ${{ secrets.DEPLOY_VPS_SSH_PORT || 22 }}
-          script: |
-            cd /srv/ermnvldmr.com
-            git pull
-            chmod +x ci/scripts/deploy-new-tags.sh
-            # Use the short SHA to match the tag from release-tag-docker
-            export WWW_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
-            ./ci/scripts/deploy-new-tags.sh
@@ -1,278 +0,0 @@
-name: services/www - releases/required
-
-on:
-  push:
-    branches: ['releases/www/**']
-  workflow_dispatch:
-
-concurrency:
-  group: ci-www-rel-${{ github.ref_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  actions: read
-
-jobs:
-  setup-stage:
-    name: Setup - Stage
-    runs-on: ubuntu-latest
-    outputs:
-      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-
-      - name: Setup Node.js with pnpm cache
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-
-      - name: Cache pnpm store
-        id: cache-pnpm-store
-        uses: actions/cache@v3
-        with:
-          path: ~/.pnpm-store
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-  build-configs:
-    name: Build - Configs
-    needs: setup-stage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Build Rsbuild config
-        run: pnpm --filter @ermnvldmr/rsbuild-config build
-      - name: Build Storybook config
-        run: pnpm --filter @ermnvldmr/storybook-config build
-      - name: Build i18n
-        run: pnpm --filter @ermnvldmr/i18n build
-      - name: Upload Config Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: config-artifacts
-          path: |
-            packages/rsbuild-config/dist
-            packages/storybook-config/dist
-            packages/i18n/dist
-          retention-days: 1
-
-  lint-www:
-    name: Lint - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Lint WWW service
-        run: pnpm --filter @ermnvldmr/www lint
-
-  typecheck-www:
-    name: Typecheck - WWW
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Typecheck WWW service
-        run: pnpm --filter @ermnvldmr/www typecheck
-
-  build-storybook:
-    name: Build - Storybook
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW Storybook
-        run: pnpm --filter @ermnvldmr/www build-storybook
-      - name: Upload Storybook build
-        uses: actions/upload-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-          retention-days: 1
-
-  test-www:
-    name: Test - Unit
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Test WWW service
-        run: pnpm --filter @ermnvldmr/www test:coverage
-
-  test-storybook:
-    name: Test - Storybook
-    needs: build-storybook
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Install Playwright browsers
-        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
-      - name: Download Storybook build
-        uses: actions/download-artifact@v4
-        with:
-          name: storybook-static
-          path: services/www/storybook-static/
-      - name: Serve Storybook and run tests
-        run: pnpm --filter @ermnvldmr/www test:storybook:ci
-
-  build-www:
-    name: Build - WWW Service
-    needs: build-configs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9.12.3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: Download Config Artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: config-artifacts
-          path: packages
-      - name: Build WWW service
-        run: pnpm --filter @ermnvldmr/www build
-
-  release-rc-docker:
-    name: Release - RC Docker Image
-    needs: build-www
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Calculate RC Version
-        id: version
-        run: |
-          RC_VERSION=$(bash ci/scripts/semantic-release.sh rc ${{ github.ref_name }})
-          echo "rc_version=$RC_VERSION" >> $GITHUB_OUTPUT
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}/www
-          tags: |
-            type=raw,value=v${{ steps.version.outputs.rc_version }}
-            type=sha,format=short
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ci/docker/www/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
@@ -34,3 +34,12 @@ playwright-report/
 # agents plans and designs
 docs/plans/
 docs/superpowers/
+
+# SOPS and Kubernetes Secrets
+*.dec.yaml
+*.plain.yaml
+*.local.yaml
+*.key
+.sops/keys.txt
+ci/k8s/**/secret.yaml
+ci/cloud-init/user-data.yaml
@@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: ci/k8s/.*secret.*\.yaml$
+    encrypted_regex: '^(data|stringData)$'
+    age: "age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl"
@@ -123,7 +123,7 @@ ermnvldmr.com/
 - **DO NOT** use self-referential package imports within workspace packages; use relative paths.
 - **DO NOT** suppress linter or compiler errors with `@ts-ignore`, `@ts-nocheck`, or inline eslint disables without explicit user approval.
 - **DO NOT** commit unencrypted `.env` files or secret keys (`.env.keys`).
- **DO NOT** run `git commit` or execute automated git commits under any circumstances.
+- **DO NOT** run destructive Git operations (such as force pushing to `main`/`next` or dropping uncommitted user work) without authorization.

 ## 5. Critical Workflows & Safety Directives

@@ -143,5 +143,4 @@ The agent MUST NOT modify the following files or directories unless explicitly r
 - `.env.keys` (untracked decryption keys).
 - `pnpm-lock.yaml` (dependencies must be managed exclusively through `pnpm` CLI commands).
 - `LICENSE` file.
- `ci/` deployment configurations, Dockerfiles, and GitHub Actions workflows.
 - `services/docs/content/` and `services/www/content/` creative and literary works.
@@ -0,0 +1,220 @@
+#cloud-config
+# ==============================================================================
+# Cloud-Init User-Data Template for K3s Single-Node Cluster (com-ermnvldmr)
+# 
+# Usage:
+#   1. Copy this template to user-data.yaml:
+#        cp ci/cloud-init/user-data.template.yaml ci/cloud-init/user-data.yaml
+#   2. Replace the stubs below (SSH authorized key & Age private key).
+#   3. Pass user-data.yaml during VM creation in Yandex Cloud / Cloud Provider.
+#      Note: user-data.yaml is ignored by git to protect private keys.
+# ==============================================================================
+
+preserve_hostname: false
+hostname: com-ermnvldmr
+ssh_pwauth: false
+
+# ------------------------------------------------------------------------------
+# 1. User & SSH Key Configuration (Replace stub with your public SSH key)
+# ------------------------------------------------------------------------------
+users:
+  - name: adam
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLACEHOLDERFORYOURPUBLICSSHKEY user@hostname"
+
+write_files:
+  # ----------------------------------------------------------------------------
+  # 2. SOPS / Age Decryption Key (Replace stub with your private AGE key)
+  # ----------------------------------------------------------------------------
+  - path: /root/.config/sops/age/keys.txt
+    owner: root:root
+    permissions: '0600'
+    content: |
+      # public key: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+      AGE-SECRET-KEY-1PLACEHOLDERFORYOURPRIVATEAGEKEY
+
+  # ----------------------------------------------------------------------------
+  # 3. Security Hardening Configuration
+  # ----------------------------------------------------------------------------
+  - path: /etc/ssh/sshd_config.d/99-security-hardening.conf
+    owner: root:root
+    permissions: '0600'
+    content: |
+      PasswordAuthentication no
+      PermitRootLogin prohibit-password
+      KbdInteractiveAuthentication no
+      X11Forwarding no
+      MaxAuthTries 3
+      ClientAliveInterval 300
+      ClientAliveCountMax 2
+
+  - path: /etc/sysctl.d/99-k3s-hardening.conf
+    owner: root:root
+    permissions: '0644'
+    content: |
+      # Network SYN Flood Protection
+      net.ipv4.tcp_syncookies = 1
+      # Disable ICMP redirects
+      net.ipv4.conf.all.accept_redirects = 0
+      net.ipv4.conf.default.accept_redirects = 0
+      net.ipv4.conf.all.send_redirects = 0
+      net.ipv4.conf.default.send_redirects = 0
+      # Disable Source Routing
+      net.ipv4.conf.all.accept_source_route = 0
+      net.ipv4.conf.default.accept_source_route = 0
+      # Anti-spoofing (Reverse Path Filtering)
+      net.ipv4.conf.all.rp_filter = 1
+      net.ipv4.conf.default.rp_filter = 1
+      # Required for K8s pod networking
+      net.ipv4.ip_forward = 1
+      # System Hardening
+      kernel.kptr_restrict = 2
+      fs.protected_hardlinks = 1
+      fs.protected_symlinks = 1
+      fs.inotify.max_user_watches = 524288
+      fs.inotify.max_user_instances = 512
+
+  - path: /etc/rancher/k3s/config.yaml
+    owner: root:root
+    permissions: '0600'
+    content: |
+      write-kubeconfig-mode: "0644"
+
+  # ----------------------------------------------------------------------------
+  # 4. Bootstrap Cluster Script
+  # ----------------------------------------------------------------------------
+  - path: /usr/local/bin/bootstrap-cluster.sh
+    owner: root:root
+    permissions: '0755'
+    content: |
+      #!/usr/bin/env bash
+      set -euo pipefail
+
+      echo "=== [Bootstrap] Ensuring Reliable DNS Resolution ==="
+      if ! grep -q "nameserver" /etc/resolv.conf 2>/dev/null; then
+        cat << 'EOF_DNS' > /etc/resolv.conf
+nameserver 1.1.1.1
+nameserver 8.8.8.8
+nameserver 77.88.8.8
+EOF_DNS
+      fi
+
+      echo "=== [Bootstrap] Applying Sysctl Hardening ==="
+      sysctl --system
+
+      echo "=== [Bootstrap] Ensuring SSH Host Keys & Starting SSH ==="
+      ssh-keygen -A
+      systemctl restart ssh || systemctl restart sshd || true
+
+      echo "=== [Bootstrap] Configuring UFW Firewall ==="
+      ufw default deny incoming
+      ufw default allow outgoing
+      ufw default allow routed
+      ufw allow 22/tcp comment 'SSH'
+      ufw allow 80/tcp comment 'HTTP Traefik'
+      ufw allow 443/tcp comment 'HTTPS Traefik'
+      # Allow Kubernetes Pod & Service traffic
+      ufw allow in on cni0 || true
+      ufw allow in on flannel.1 || true
+      ufw allow from 10.42.0.0/16 comment 'K3s Pod CIDR'
+      ufw allow from 10.43.0.0/16 comment 'K3s Service CIDR'
+      ufw --force enable
+
+      echo "=== [Bootstrap] Enabling Fail2ban ==="
+      systemctl enable --now fail2ban || true
+
+      echo "=== [Bootstrap] Checking for Secondary Persistent Data Disk ==="
+      if [ -b /dev/vdb ]; then
+        echo "Secondary disk /dev/vdb detected."
+        if ! blkid /dev/vdb >/dev/null 2>&1; then
+          echo "Formatting /dev/vdb with ext4 filesystem..."
+          mkfs.ext4 -F -L k3s-storage /dev/vdb
+        fi
+        mkdir -p /var/lib/rancher/k3s/storage
+        if ! grep -qs '/var/lib/rancher/k3s/storage' /proc/mounts; then
+          mount /dev/vdb /var/lib/rancher/k3s/storage
+          echo "LABEL=k3s-storage /var/lib/rancher/k3s/storage ext4 defaults,noatime 0 2" >> /etc/fstab
+          echo "Mounted /dev/vdb to /var/lib/rancher/k3s/storage."
+        fi
+      fi
+
+      echo "=== [Bootstrap] Starting K3s Service ==="
+      systemctl enable --now k3s.service
+
+      echo "=== [Bootstrap] Waiting for K3s API server ready ==="
+      export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+      until kubectl get nodes >/dev/null 2>&1; do
+        echo "Waiting for Kubernetes API..."
+        sleep 3
+      done
+
+      echo "=== [Bootstrap] Cluster node is online ==="
+      kubectl get nodes
+
+      echo "=== [Bootstrap] Creating flux-system namespace ==="
+      kubectl create namespace flux-system --dry-run=client -o yaml | kubectl apply -f -
+
+      echo "=== [Bootstrap] Injecting SOPS age decryption key ==="
+      if [ -f /root/.config/sops/age/keys.txt ]; then
+        kubectl create secret generic sops-age \
+          --namespace=flux-system \
+          --from-file=age.agekey=/root/.config/sops/age/keys.txt \
+          --dry-run=client -o yaml | kubectl apply -f -
+        echo "sops-age secret created."
+      else
+        echo "WARNING: /root/.config/sops/age/keys.txt not found. Inject key manually via kubectl."
+      fi
+
+      echo "=== [Bootstrap] Installing Flux Operator / Custom Resources ==="
+      kubectl apply -f https://github.com/fluxcd/flux2/releases/download/v2.4.0/install.yaml
+
+      echo "=== [Bootstrap] Setting up Kubectl access for non-root users ==="
+      for home_dir in /home/*; do
+        if [ -d "$home_dir" ]; then
+          user_name=$(basename "$home_dir")
+          mkdir -p "$home_dir/.kube"
+          cp /etc/rancher/k3s/k3s.yaml "$home_dir/.kube/config"
+          chown -R "$user_name:$user_name" "$home_dir/.kube"
+          chmod 600 "$home_dir/.kube/config"
+        fi
+      done
+
+      echo "=== [Bootstrap] Applying initial GitOps root sync ==="
+      kubectl apply -f - << 'EOF_GITOPS'
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: ermnvldmr-repo
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://github.com/deytenit/ermnvldmr.com.git
+  ref:
+    branch: next
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-sync
+  namespace: flux-system
+spec:
+  interval: 5m
+  sourceRef:
+    kind: GitRepository
+    name: ermnvldmr-repo
+  path: ./ci/k8s/clusters/production
+  prune: true
+  wait: true
+  timeout: 2m
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+EOF_GITOPS
+
+      echo "=== [Bootstrap] First-Boot Bootstrap Sequence Complete ==="
+
+runcmd:
+  - /usr/local/bin/bootstrap-cluster.sh
@@ -44,6 +44,13 @@ server {
        try_files $uri $uri/ $uri.html /ru/index.html;
    }

+    # Version probe for release rollout verification
+    location = /version.json {
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
+        add_header Content-Type "application/json" always;
+        try_files /version.json =404;
+    }
+
    # Error pages
    error_page 404 /en/index.html;
 }
@@ -1,6 +0,0 @@
-# Docker Image Tags
-DOCS_TAG=$DOCS_TAG
-WWW_TAG=$WWW_TAG
-
-# Application Settings
-DOMAIN=ermnvldmr.com
@@ -1,61 +0,0 @@
-name: com-ermnvldmr
-
-services:
-  nginx:
-    image: nginx:1.28-alpine
-    container_name: com-ermnvldmr-nginx
-    restart: always
-    ports:
-      - '80:80'
-      - '443:443'
-    volumes:
-      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./nginx/conf.d:/etc/nginx/conf.d:ro
-      - /etc/letsencrypt:/etc/letsencrypt:ro
-    networks:
-      - com-ermnvldmr-direct
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.50'
-          memory: 256M
-    security_opt:
-      - no-new-privileges:true
-
-  docs:
-    image: ghcr.io/deytenit/ermnvldmr.com/docs:${DOCS_TAG}
-    container_name: com-ermnvldmr-docs
-    restart: always
-    networks:
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.25'
-          memory: 128M
-    security_opt:
-      - no-new-privileges:true
-
-  www:
-    image: ghcr.io/deytenit/ermnvldmr.com/www:${WWW_TAG}
-    container_name: com-ermnvldmr-www
-    restart: always
-    networks:
-      - com-ermnvldmr-enclave
-    deploy:
-      resources:
-        limits:
-          cpus: '0.25'
-          memory: 128M
-    security_opt:
-      - no-new-privileges:true
-
-networks:
-  com-ermnvldmr-direct:
-    name: com-ermnvldmr-direct
-    driver: bridge
-  com-ermnvldmr-enclave:
-    name: com-ermnvldmr-enclave
-    internal: true
-    driver: bridge
@@ -1,41 +0,0 @@
-server {
-    listen 80;
-    server_name docs.ermnvldmr.com;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name docs.ermnvldmr.com;
-
-    ssl_certificate     /etc/letsencrypt/live/docs.ermnvldmr.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/docs.ermnvldmr.com/privkey.pem;
-
-    # Optimized SSL settings
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_tickets off;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-    ssl_prefer_server_ciphers off;
-
-    # HSTS
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    location / {
-        proxy_pass http://com-ermnvldmr-docs:80;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
@@ -1,41 +0,0 @@
-server {
-    listen 80;
-    server_name www.ermnvldmr.com;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/certbot;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    http2 on;
-    server_name www.ermnvldmr.com;
-
-    ssl_certificate     /etc/letsencrypt/live/www.ermnvldmr.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/www.ermnvldmr.com/privkey.pem;
-
-    # Optimized SSL settings
-    ssl_session_timeout 1d;
-    ssl_session_cache shared:SSL:50m;
-    ssl_session_tickets off;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-    ssl_prefer_server_ciphers off;
-
-    # HSTS
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    location / {
-        proxy_pass http://com-ermnvldmr-www:80;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
@@ -1,30 +0,0 @@
-user nginx;
-worker_processes auto;
-error_log /var/log/nginx/error.log warn;
-pid /var/run/nginx.pid;
-
-events {
-    worker_connections 1024;
-}
-
-http {
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-
-    # Optimization
-    sendfile on;
-    tcp_nopush on;
-    tcp_nodelay on;
-    keepalive_timeout 65;
-    types_hash_max_size 2048;
-    server_tokens off;
-
-    # Security Headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer-when-downgrade" always;
-    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
-
-    include /etc/nginx/conf.d/*.conf;
-}
@@ -14,8 +14,15 @@ RUN hugo --gc --minify
 # Stage 2: Runtime
 FROM nginx:alpine

+ARG COMMIT_SHA="unknown"
+ARG VERSION="latest"
+
 COPY --from=builder /src/services/docs/public /usr/share/nginx/html
 COPY ci/config/nginx/default.conf /etc/nginx/conf.d/default.conf

+# Generate version metadata for automated rollout verification
+RUN printf '{\n  "service": "docs",\n  "version": "%s",\n  "commit": "%s",\n  "builtAt": "%s"\n}\n' \
+    "${VERSION}" "${COMMIT_SHA}" "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" > /usr/share/nginx/html/version.json
+
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
@@ -37,8 +37,15 @@ RUN pnpm --filter @ermnvldmr/www build:all
 # Stage 2: Runtime
 FROM nginx:alpine

+ARG COMMIT_SHA="unknown"
+ARG VERSION="latest"
+
 COPY --from=builder /app/services/www/dist /usr/share/nginx/html
 COPY ci/config/nginx/default.conf /etc/nginx/conf.d/default.conf

+# Generate version metadata for automated rollout verification
+RUN printf '{\n  "service": "www",\n  "version": "%s",\n  "commit": "%s",\n  "builtAt": "%s"\n}\n' \
+    "${VERSION}" "${COMMIT_SHA}" "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" > /usr/share/nginx/html/version.json
+
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docs
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: docs
+  template:
+    metadata:
+      labels:
+        app: docs
+    spec:
+      containers:
+        - name: docs
+          image: ghcr.io/deytenit/ermnvldmr.com/docs:sha-91f5245
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+          readinessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+- deployment.yaml
+- service.yaml
+images:
+- name: ghcr.io/deytenit/ermnvldmr.com/docs
+  newTag: sha-4e4cac0
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: docs-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: docs
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgres-config
+  namespace: com-ermnvldmr
+data:
+  postgresql.conf: |
+    # Low-memory tuned configuration for single-node K3s VM
+    listen_addresses = '*'
+    max_connections = 50
+    shared_buffers = 64MB
+    effective_cache_size = 128MB
+    maintenance_work_mem = 16MB
+    checkpoint_completion_target = 0.9
+    wal_buffers = 2MB
+    default_statistics_target = 100
+    random_page_cost = 1.1
+    effective_io_concurrency = 200
+    work_mem = 4MB
+    min_wal_size = 80MB
+    max_wal_size = 512MB
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+  - configmap.yaml
+  - secret.sops.yaml
+  - pvc.yaml
+  - statefulset.yaml
+  - service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-pvc
+  namespace: com-ermnvldmr
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 5Gi
@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: postgres-secrets
+    namespace: com-ermnvldmr
+type: Opaque
+stringData:
+    POSTGRES_DB: ENC[AES256_GCM,data:ChvCjVw=,iv:97n6Q+WzbVOwvRZGGHAfBXQDPx5mnUCSsUNs76xV1p4=,tag:mZLUB3q0UR+9ovqmndFrRg==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:V1q4xfE=,iv:RPHHhWLkdmKHG6CMubrw8JUfHlDXnL0x76JEo05O+mo=,tag:PV1YEyqeb8bTF/98SL1uKQ==,type:str]
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:aBWfOuPyeAEo0vf8fAYzlTfXooPKX6FPbHkpBQ+4zve0KBQh7/yvjQ==,iv:FB/fZoLirzPTbDIel7wRECQP85sFFlIdyoljrilbMxU=,tag:tTZz1PHhaLtmPO9Pg8Vh5g==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRXIvMEpaWU1XNjV2OFpp
+            Z1lYb25kOFVVaXlRYkdzSmxWbmxqaXR6TEhRCnF0M2ovRVNmdTU3WnNOcy82OExV
+            YXNjZVJrbTdXQWJxMjQvNEdZNlBwcjAKLS0tIEEzczNmZjFwT1d2aXVKV1Bvdm1Q
+            UnZoNVNCYjJiYWd6WlNobGEyUGh5NmMKkUTDkYlNkXH8DegvBT7ymkL7h1B9x77N
+            IxeZI5mp8vc347/620+cbMMr2+aELlgs9/bJhUcLRm0Bv8UDVLOleg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:tvk/U3XXcRrJCI8I0yUID6jwnlPc1ftiOHs8uxqrbAtLN3KelHGy94fWyxYMoboHeh5R8pNErIxk9EsJok2wjrSENZWMXueVZHtMUWlyC4DhTDAVVYhJ6sL85f6cMiHWDNSlTk4AvfWvdvE6b/0coZ7Rybgw5kNeW6Stw4CSbu4=,iv:sfiOamzam1e0t01KaGHSsnZOBpBGEi3K0KK50QDmaFs=,tag:Ul6xShhIdvTuX3qS6Uo4Kg==,type:str]
+    version: 3.13.3
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-secrets
+  namespace: com-ermnvldmr
+type: Opaque
+stringData:
+  POSTGRES_DB: "umami"
+  POSTGRES_USER: "umami"
+  POSTGRES_PASSWORD: "CHANGE_ME_IN_ENCRYPTED_SOPS_SECRET"
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: com-ermnvldmr
+spec:
+  serviceName: postgres-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_DB
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: POSTGRES_PASSWORD
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - name: postgres
+              containerPort: 5432
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            - name: config
+              mountPath: /etc/postgresql/postgresql.conf
+              subPath: postgresql.conf
+          readinessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - $(POSTGRES_USER)
+                - -d
+                - $(POSTGRES_DB)
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - $(POSTGRES_USER)
+                - -d
+                - $(POSTGRES_DB)
+            initialDelaySeconds: 15
+            periodSeconds: 20
+            timeoutSeconds: 5
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: postgres-pvc
+        - name: config
+          configMap:
+            name: postgres-config
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: umami-config
+  namespace: com-ermnvldmr
+data:
+  DATABASE_TYPE: "postgresql"
+  CLIENT_IP_HEADER: "X-Forwarded-For"
@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: umami
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: umami
+  template:
+    metadata:
+      labels:
+        app: umami
+    spec:
+      containers:
+        - name: umami
+          image: ghcr.io/umami-software/umami:postgresql-v2.14.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3000
+          envFrom:
+            - configMapRef:
+                name: umami-config
+            - secretRef:
+                name: umami-secrets
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+          readinessProbe:
+            httpGet:
+              path: /api/heartbeat
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /api/heartbeat
+              port: 3000
+            initialDelaySeconds: 20
+            periodSeconds: 20
+            timeoutSeconds: 3
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+  - configmap.yaml
+  - secret.sops.yaml
+  - deployment.yaml
+  - service.yaml
+images:
+  - name: ghcr.io/umami-software/umami
+    newTag: postgresql-v2.14.0
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: umami-secrets
+    namespace: com-ermnvldmr
+type: Opaque
+stringData:
+    APP_SECRET: ENC[AES256_GCM,data:aaoXs+F/lXvP0kHNZ+Uoo0HB4GnYZ9raYOgEbRwIrkSFGSoTuv/PkvSOYDppDLKxhNMDLhbgTJwEMrHGZzIewQ==,iv:W3u4QPKetqBDSZdsRte5zYeFy9SlRmPw4ORGFTGzN7A=,tag:bkVyGsKgcMGODY4Chpv+8Q==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:XbAdd3hNGS+n42XgTQF5rg7AiBkbjFGHOeuTROLgjmIMCUh7afPSheFn6v8bSaibePYJdQBrdFK+kYW9o7aFYhe8Hz1cneATNP0PoQaqlxSrcnM+DeHQzFTC+98ACkskLgk27heZFjCdRr3A4LVRdcet/+2q/8U=,iv:UwxEwPeYdPYrvi30qso4yCZ6m20geusN+P7DOjowjEw=,tag:bQB7OupyNnCjn0INB8T7sg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZ2h6THNGTnY2ay9Tc2Q3
+            S0xxU3NEZGx2TS9MRFdqZDV6aEtUalBWRFVJCjZMd1VCdkg1cjIxSlliZXNRQnU0
+            YnMzTXJOSGdsUDUwNkdDdWZWcmRaZjgKLS0tIDdEOFoyOWtvZytITys4bk9ra082
+            WmFIREJMS1BVU0o1VnZHby9ZSHN4cGcKReBW7hdTPH8eGqPzEYkOdrIUYm9a1jOi
+            du/1fhAyhjimbbCNdOSuSjrSP8QX6mxwPoDb1dVlKi0Rah5VGW+HWw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:QZOb7pmfDpEn2/kefQQ8k4WJQddlF5jKTY5EaSm1Srt33DceELA3NPJMiozAzpbIEoLR6a7oR6C7zofHHVCBmYcRd2DSHqafW3EOtOt5noiAmkGOQKEWH7aSRFJqcy5EmBcVihd81Z1CkJI6MPcBeQvY0BlVqgm2YqX2QQBolgI=,iv:TB+Rn3ffe4HzVHjk2+XaKaLG1+589AmBhPjOXXKWHto=,tag:zfKVYP1h/4sWXSVtuhQH8Q==,type:str]
+    version: 3.13.3
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: umami-secrets
+  namespace: com-ermnvldmr
+type: Opaque
+stringData:
+  APP_SECRET: "CHANGE_ME_IN_ENCRYPTED_SOPS_SECRET"
+  DATABASE_URL: "postgresql://umami:CHANGE_ME@postgres-service.com-ermnvldmr.svc.cluster.local:5432/umami"
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: umami-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: umami
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: www
+  namespace: com-ermnvldmr
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: www
+  template:
+    metadata:
+      labels:
+        app: www
+    spec:
+      containers:
+        - name: www
+          image: ghcr.io/deytenit/ermnvldmr.com/www:sha-6d33b71
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+          readinessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /en/
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: com-ermnvldmr
+resources:
+- deployment.yaml
+- service.yaml
+images:
+- name: ghcr.io/deytenit/ermnvldmr.com/www
+  newTag: sha-a60b095
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: www-service
+  namespace: com-ermnvldmr
+spec:
+  type: ClusterIP
+  selector:
+    app: www
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: com-ermnvldmr
+  labels:
+    name: com-ermnvldmr
@@ -0,0 +1,29 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: ermnvldmr-repo
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://github.com/deytenit/ermnvldmr.com.git
+  ref:
+    branch: next
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-sync
+  namespace: flux-system
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: ermnvldmr-repo
+  path: ./ci/k8s/clusters/production
+  prune: true
+  wait: true
+  timeout: 3m
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gotk-sync.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - flux-system
+  - ../../base/namespaces
+  - ../../infrastructure/cert-manager
+  - ../../infrastructure/networking
+  - ../../apps/postgres
+  - ../../apps/umami
+  - ../../apps/www
+  - ../../apps/docs
@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: admin@ermnvldmr.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: admin@ermnvldmr.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - https://github.com/cert-manager/cert-manager/releases/download/v1.17.0/cert-manager.yaml
+  - cluster-issuer.yaml
@@ -0,0 +1,51 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: main-ingress
+  namespace: com-ermnvldmr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - www.ermnvldmr.com
+      secretName: ermnvldmr-tls
+    - hosts:
+        - docs.ermnvldmr.com
+      secretName: docs-ermnvldmr-tls
+    - hosts:
+        - umami.ermnvldmr.com
+      secretName: umami-ermnvldmr-tls
+  rules:
+    - host: www.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: www-service
+                port:
+                  number: 80
+    - host: docs.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: docs-service
+                port:
+                  number: 80
+    - host: umami.ermnvldmr.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: umami-service
+                port:
+                  number: 3000
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ingress.yaml
@@ -0,0 +1,2 @@
+instance-id: debian-packer
+local-hostname: debian-k3s
@@ -0,0 +1,14 @@
+#cloud-config
+ssh_pwauth: true
+disable_root: false
+chpasswd:
+  list: |
+    debian:packer
+    root:packer
+  expire: false
+users:
+  - default
+  - name: debian
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    lock_passwd: false
@@ -0,0 +1,74 @@
+packer {
+  required_plugins {
+    qemu = {
+      version = ">= 1.1.0"
+      source  = "github.com/hashicorp/qemu"
+    }
+  }
+}
+
+variable "debian_cloud_image_url" {
+  type    = string
+  default = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-nocloud-amd64.qcow2"
+}
+
+variable "debian_cloud_image_checksum" {
+  type    = string
+  default = "file:https://cloud.debian.org/images/cloud/bookworm/latest/SHA512SUMS"
+}
+
+variable "vm_name" {
+  type    = string
+  default = "com-ermnvldmr-debian-12-k3s-amd64.qcow2"
+}
+
+variable "accelerator" {
+  type    = string
+  default = "kvm"
+}
+
+source "qemu" "debian_k3s" {
+  iso_url           = var.debian_cloud_image_url
+  iso_checksum      = var.debian_cloud_image_checksum
+  disk_image        = true
+  disk_size         = "10G"
+  format            = "qcow2"
+  output_directory  = "output-qemu"
+  shutdown_command  = "echo 'packer' | sudo -S shutdown -P now"
+  accelerator       = var.accelerator
+  cd_files          = ["ci/packer/cidata/user-data", "ci/packer/cidata/meta-data"]
+  cd_label          = "cidata"
+  ssh_username      = "debian"
+  ssh_password      = "packer"
+  ssh_timeout       = "5m"
+  vm_name           = var.vm_name
+  net_device        = "virtio-net"
+  disk_interface    = "virtio"
+  headless          = true
+
+  qemuargs = [
+    ["-m", "2048M"],
+    ["-smp", "2"]
+  ]
+}
+
+build {
+  sources = ["source.qemu.debian_k3s"]
+
+  provisioner "shell" {
+    execute_command = "echo 'packer' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'"
+    scripts = [
+      "ci/packer/scripts/01-base-system.sh",
+      "ci/packer/scripts/02-install-k3s.sh",
+      "ci/packer/scripts/03-cleanup.sh"
+    ]
+  }
+
+  post-processor "shell-local" {
+    inline = [
+      "echo 'Optimizing qcow2 image with 2M cluster size...'",
+      "qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c output-qemu/${var.vm_name} output-qemu/debian-12-k3s-optimized.qcow2",
+      "mv output-qemu/debian-12-k3s-optimized.qcow2 output-qemu/${var.vm_name}"
+    ]
+  }
+}
@@ -0,0 +1,54 @@
+d-i debian-installer/locale string en_US.UTF-8
+d-i keyboard-configuration/xkb-keymap select us
+
+d-i netcfg/choose_interface select auto
+d-i netcfg/get_hostname string debian-k3s
+d-i netcfg/get_domain string local
+
+d-i mirror/country string manual
+d-i mirror/http/hostname string deb.debian.org
+d-i mirror/http/directory string /debian
+d-i mirror/http/proxy string
+
+d-i passwd/root-login boolean true
+d-i passwd/root-password password packer
+d-i passwd/root-password-again password packer
+d-i passwd/make-user boolean false
+
+d-i clock-setup/utc boolean true
+d-i time/zone string UTC
+
+d-i partman-auto/method string regular
+d-i partman-auto/disk string /dev/vda
+d-i partman-auto/choose_recipe select gpt-boot-root
+d-i partman-auto/expert_recipe string                         \
+      gpt-boot-root ::                                        \
+              512 512 512 fat32                               \
+                      $primary{ }                             \
+                      $bootable{ }                            \
+                      method{ efi }                           \
+                      format{ }                               \
+              .                                               \
+              1024 10000 -1 ext4                              \
+                      $primary{ }                             \
+                      method{ format } format{ }              \
+                      use_filesystem{ } filesystem{ ext4 }    \
+                      mountpoint{ / }                         \
+              .
+d-i partman-partitioning/confirm_write_new_label boolean true
+d-i partman/choose_partition select finish
+d-i partman/confirm boolean true
+d-i partman/confirm_nooverwrite boolean true
+
+d-i apt-setup/non-free-firmware boolean true
+d-i apt-setup/non-free boolean true
+d-i apt-setup/contrib boolean true
+
+tasksel tasksel/first multiselect standard, ssh-server
+d-i pkgsel/include string sudo curl ca-certificates qemu-guest-agent cloud-init
+d-i pkgsel/upgrade select full-upgrade
+
+d-i grub-installer/only_debian boolean true
+d-i grub-installer/bootdev string default
+
+d-i finish-install/reboot_in_progress note
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -eu
+export DEBIAN_FRONTEND=noninteractive
+
+echo "=== Configuring Base System for Cloud Image ==="
+
+# Install essential kernel modules and utilities
+apt-get update
+apt-get install -y --no-install-recommends \
+    socat \
+    conntrack \
+    ipset \
+    iptables \
+    ufw \
+    fail2ban \
+    unattended-upgrades \
+    curl \
+    ca-certificates \
+    git \
+    isc-dhcp-client \
+    tar \
+    gzip
+
+# Ensure virtio kernel modules are loaded on boot
+cat << 'EOF' > /etc/modules-load.d/virtio.conf
+virtio
+virtio_net
+virtio_blk
+virtio_pci
+virtiofs
+EOF
+
+# Configure GRUB for Serial Console (ttyS0 / COM1) and predictable network names
+sed -i 's/^GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0"/' /etc/default/grub
+sed -i 's/^#GRUB_TERMINAL=.*/GRUB_TERMINAL="console serial"/' /etc/default/grub
+echo 'GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"' >> /etc/default/grub
+update-grub
+
+# Enable serial console getty with root auto-login for emergency console recovery
+mkdir -p /etc/systemd/system/serial-getty@ttyS0.service.d
+cat << 'EOF' > /etc/systemd/system/serial-getty@ttyS0.service.d/autologin.conf
+[Service]
+ExecStart=
+ExecStart=-/sbin/agetty --autologin root --noclear --keep-baud 115200,38400,9600 %I $TERM
+EOF
+systemctl enable serial-getty@ttyS0.service || true
+
+# Ensure SSH server auto-generates host keys if missing before starting
+mkdir -p /etc/systemd/system/ssh.service.d
+cat << 'EOF' > /etc/systemd/system/ssh.service.d/10-generate-host-keys.conf
+[Service]
+ExecStartPre=-/usr/bin/ssh-keygen -A
+EOF
+
+# Configure ds-identify to always enable cloud-init unconditionally
+mkdir -p /etc/cloud
+cat << 'EOF' > /etc/cloud/ds-identify.cfg
+policy: enabled
+EOF
+
+# Configure cloud-init to support all standard cloud datasources (OpenStack, Ec2, NoCloud, ConfigDrive)
+cat << 'EOF' > /etc/cloud/cloud.cfg.d/99-cloud-init.cfg
+datasource_list: [ NoCloud, ConfigDrive, OpenStack, Ec2, None ]
+disable_vm_template: false
+EOF
+
+# Explicitly enable cloud-init systemd services
+systemctl enable cloud-init-local.service cloud-init.service cloud-config.service cloud-final.service || true
+
+# Ensure automatic DHCP via systemd-networkd and ifupdown
+mkdir -p /etc/systemd/network
+cat << 'EOF' > /etc/systemd/network/10-eth.network
+[Match]
+Name=eth* en*
+
+[Network]
+DHCP=yes
+EOF
+systemctl enable systemd-networkd systemd-resolved || true
+
+# Ensure DHCP on eth0 for legacy ifupdown
+mkdir -p /etc/network/interfaces.d
+cat << 'EOF' > /etc/network/interfaces.d/eth0
+auto eth0
+iface eth0 inet dhcp
+EOF
+
+echo "=== Base System Configuration Complete ==="
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -eu
+export DEBIAN_FRONTEND=noninteractive
+
+echo "=== Installing K3s Binary (First-Boot Isolation) ==="
+
+export INSTALL_K3S_SKIP_ENABLE="true"
+export INSTALL_K3S_SKIP_START="true"
+export INSTALL_K3S_VERSION="v1.31.2+k3s1"
+
+# Download official K3s installer and install binary/systemd unit without starting
+curl -sfL https://get.k3s.io | sh -
+
+# Verify k3s binary is located in /usr/local/bin
+which k3s
+k3s --version
+
+# Ensure systemd service is NOT running
+systemctl stop k3s.service || true
+systemctl disable k3s.service || true
+
+# Create configuration directory
+mkdir -p /etc/rancher/k3s
+
+echo "=== K3s Pre-installation Complete ==="
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -eu
+export DEBIAN_FRONTEND=noninteractive
+
+echo "=== Sanitizing Machine Identity & Temporary Files ==="
+
+# Clean APT caches and logs
+apt-get autoremove -y --purge
+apt-get clean
+rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# Reset machine-id for unique DHCP lease acquisition on clone
+truncate -s 0 /etc/machine-id
+rm -f /var/lib/dbus/machine-id
+ln -sf /etc/machine-id /var/lib/dbus/machine-id
+
+# Ensure SSH host keys are generated and valid
+ssh-keygen -A
+
+# Reset DNS with reliable fallback resolvers
+rm -f /etc/cloud/cloud-init.disabled /run/systemd/generator*/cloud-init.disabled
+cat << 'EOF' > /etc/resolv.conf
+nameserver 1.1.1.1
+nameserver 8.8.8.8
+nameserver 77.88.8.8
+EOF
+cloud-init clean --logs --seed || true
+rm -rf /var/lib/cloud/*
+
+# Clean bash history
+rm -f /root/.bash_history /home/*/.bash_history
+
+# Sync filesystem
+sync
+
+echo "=== Cleanup Complete ==="
@@ -0,0 +1,21 @@
+#!/bin/bash
+set -euo pipefail
+
+YEAR_MONTH=$(date -u +'%Y.%m')
+git fetch --tags --quiet 2>/dev/null || true
+
+# Find highest MICRO version for current YYYY.MM (matching tags formatted like YYYY.MM.MICRO)
+LATEST_TAG=$(git tag -l "${YEAR_MONTH}.*" | sort -V | tail -n1 || echo "")
+
+if [ -z "$LATEST_TAG" ]; then
+    MICRO=0
+else
+    LATEST_MICRO="${LATEST_TAG#"${YEAR_MONTH}."}"
+    if [[ "$LATEST_MICRO" =~ ^[0-9]+$ ]]; then
+        MICRO=$((LATEST_MICRO + 1))
+    else
+        MICRO=0
+    fi
+fi
+
+echo "${YEAR_MONTH}.${MICRO}"
@@ -1,42 +0,0 @@
-#!/bin/bash
-set -e
-
-# Usage: ./deploy-certbot.sh [domain1] [domain2] ...
-EMAIL="personal@ermnvldmr.com"
-CLOUDFLARE_INI="/etc/letsencrypt/cloudflare.ini"
-
-# Collect domains from arguments, fallback to default if none provided
-if [ $# -eq 0 ]; then
-    DOMAINS=("docs.ermnvldmr.com")
-else
-    DOMAINS=("$@")
-fi
-
-# Build domain arguments for certbot
-DOMAIN_ARGS=()
-for d in "${DOMAINS[@]}"; do
-    DOMAIN_ARGS+=("-d" "$d")
-done
-
-echo "Installing certbot and Cloudflare DNS plugin..."
-sudo apt-get update
-sudo apt-get install -y certbot python3-certbot-cloudflare
-
-if [ ! -f "$CLOUDFLARE_INI" ]; then
-    echo "Error: Cloudflare credentials file not found at $CLOUDFLARE_INI"
-    echo "Please ensure it exists and has 600 permissions."
-    exit 1
-fi
-
-echo "Requesting certificate for ${DOMAINS[*]} via Cloudflare DNS challenge..."
-sudo certbot certonly \
-  --dns-cloudflare \
-  --dns-cloudflare-credentials "$CLOUDFLARE_INI" \
-  "${DOMAIN_ARGS[@]}" \
-  --email "$EMAIL" \
-  --agree-tos \
-  --no-eff-email \
-  --non-interactive
-
-echo "Certificates for ${DOMAINS[*]} have been processed."
-
@@ -0,0 +1,35 @@
+#!/bin/bash
+set -euo pipefail
+
+SERVICE=$1
+TAG=$2
+
+if [ -z "$SERVICE" ] || [ -z "$TAG" ]; then
+    echo "Usage: $0 <service: www|docs|umami> <tag>"
+    exit 1
+fi
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+APP_DIR="$ROOT_DIR/ci/k8s/apps/$SERVICE"
+
+if [ ! -d "$APP_DIR" ]; then
+    echo "Error: Application directory '$APP_DIR' does not exist."
+    exit 1
+fi
+
+echo "Updating Kustomize image tag for '$SERVICE' to '$TAG'..."
+cd "$APP_DIR"
+kustomize edit set image "ghcr.io/deytenit/ermnvldmr.com/${SERVICE}:${TAG}"
+
+cd "$ROOT_DIR"
+git config user.name "adam-at-deytenit"
+git config user.email "221188529+adam-at-deytenit@users.noreply.github.com"
+git add "ci/k8s/apps/${SERVICE}/kustomization.yaml"
+
+if git diff --staged --quiet; then
+    echo "No manifest changes to commit for $SERVICE."
+else
+    git commit -m "chore(release): deploy ${SERVICE} ${TAG} [skip ci]"
+    git push origin next
+    echo "Successfully deployed $SERVICE ($TAG) via GitOps."
+fi
@@ -1,47 +0,0 @@
-#!/bin/bash
-set -e
-
-# Setup paths relative to the script location
-DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../deploy" && pwd)"
-ENV_FILE="$DEPLOY_DIR/.env"
-TEMPLATE_FILE="$DEPLOY_DIR/.env.template"
-
-echo "Starting deployment for com-ermnvldmr..."
-
-# 1. Load existing .env values as defaults (do NOT overwrite environment variables)
-if [ -f "$ENV_FILE" ]; then
-    while IFS= read -r line || [ -n "$line" ]; do
-        # Skip comments and empty lines
-        [[ "$line" =~ ^# ]] || [[ -z "$line" ]] && continue
-        
-        key="${line%%=*}"
-        val="${line#*=}"
-        
-        # Only export if the variable is not already set in the environment
-        if [ -z "${!key}" ]; then
-            export "$key"="$val"
-        fi
-    done < "$ENV_FILE"
-fi
-
-# 2. Apply final fallback defaults
-export DOCS_TAG="${DOCS_TAG:-latest}"
-export WWW_TAG="${WWW_TAG:-latest}"
-
-# 3. Generate the .env file from template
-# Explicitly list variables to substitute to avoid messing with other values
-echo "Generating .env from template..."
-envsubst '$DOCS_TAG $WWW_TAG' < "$TEMPLATE_FILE" > "$ENV_FILE"
-
-# 4. Run Docker operations
-cd "$DEPLOY_DIR"
-echo "Pulling images..."
-docker compose pull
-
-echo "Starting containers..."
-docker compose up -d --remove-orphans
-
-echo "Pruning unused images..."
-docker image prune -f
-
-echo "Deployment complete."
@@ -1,68 +0,0 @@
-#!/bin/bash
-set -e
-
-MODE=$1
-TARGET=$2
-
-if [ -z "$MODE" ] || [ -z "$TARGET" ]; then
-    echo "Usage: $0 <mode: checkout|rc|release> <target: service_path|branch_name>"
-    exit 1
-fi
-
-case $MODE in
-    checkout)
-        SERVICE_PATH=$TARGET
-        SERVICE_NAME=$(basename "$SERVICE_PATH")
-        VERSION=$(node -p "require('./$SERVICE_PATH/package.json').version")
-        MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
-        echo "releases/$SERVICE_NAME/v$MAJOR_MINOR"
-        ;;
-    rc|release)
-        BRANCH_NAME=$TARGET
-        # Extract service name and major.minor from branch: releases/www/v1.2
-        if [[ ! $BRANCH_NAME =~ ^releases/([^/]+)/v([0-9]+\.[0-9]+)$ ]]; then
-            echo "Error: Branch name must follow 'releases/<service>/v<major>.<minor>' format"
-            exit 1
-        fi
-        SERVICE_NAME="${BASH_REMATCH[1]}"
-        MAJOR_MINOR="${BASH_REMATCH[2]}"
-        
-        TAG_PREFIX="releases/$SERVICE_NAME/v$MAJOR_MINOR"
-        
-        # Ensure we have the latest tags
-        git fetch --tags --quiet
-        
-        # Find the latest patch version for this Major.Minor
-        LATEST_TAG=$(git tag -l "$TAG_PREFIX.*" | grep -v "\-rc" | sort -V | tail -n1 || echo "")
-        
-        if [ -z "$LATEST_TAG" ]; then
-            PATCH=0
-        else
-            LATEST_VERSION=${LATEST_TAG#"$TAG_PREFIX."}
-            PATCH=$((LATEST_VERSION + 1))
-        fi
-        
-        VERSION_TAG="$MAJOR_MINOR.$PATCH"
-        
-        if [ "$MODE" == "release" ]; then
-            echo "$VERSION_TAG"
-        else
-            # Calculate RC based on commit count since last tag
-            # This ensures unique, increasing RC numbers without needing to tag every RC
-            LAST_SERVICE_TAG=$(git describe --tags --match "releases/$SERVICE_NAME/*" --abbrev=0 HEAD 2>/dev/null || echo "")
-
-            if [ -z "$LAST_SERVICE_TAG" ]; then
-                COMMITS_COUNT=$(git rev-list --count HEAD)
-            else
-                COMMITS_COUNT=$(git rev-list --count "$LAST_SERVICE_TAG"..HEAD)
-            fi
-
-            RC=$((COMMITS_COUNT + 1))
-            echo "$VERSION_TAG-rc.$RC"
-        fi
-        ;;
-    *)
-        echo "Unknown mode: $MODE"
-        exit 1
-        ;;
-esac
@@ -11,4 +11,33 @@ describe('PageHead', () => {
    expect(screen.getAllByText('Test Heading').length).toBeGreaterThan(0);
    expect(screen.getByText('Test Caption')).toBeInTheDocument();
  });
+
+  it('renders breadcrumbs, addonLeft, and addonRight', () => {
+    render(
+      <PageHead
+        addonLeft={<span>Left Addon</span>}
+        addonRight={<span>Right Addon</span>}
+        breadcrumbs={<span>Breadcrumbs Trail</span>}
+        heading="Test Heading"
+      />
+    );
+
+    expect(screen.getByText('Breadcrumbs Trail')).toBeInTheDocument();
+    expect(screen.getAllByText('Left Addon').length).toBeGreaterThan(0);
+    expect(screen.getAllByText('Right Addon').length).toBeGreaterThan(0);
+  });
+
+  it('renders correctly with always-collapsed-fixed strategy', () => {
+    render(
+      <PageHead
+        addonLeft={<span>Brand Logo</span>}
+        addonRight={<nav>Nav Links</nav>}
+        heading="Home Page"
+        strategy="always-collapsed-fixed"
+      />
+    );
+
+    expect(screen.getAllByText('Brand Logo').length).toBeGreaterThan(0);
+    expect(screen.getAllByText('Nav Links').length).toBeGreaterThan(0);
+  });
 });
@@ -83,14 +83,14 @@ export function PageHead({
  const rootClasses = cn(pageHeadRootVariants({ strategy }), className);

  const expandedContent = (
-    <PageContainer paddingY="medium">
-      <VStack align="stretch" gap={6}>
-        <HStack align="center" justify="between">
-          <HStack align="center" gap={4}>
-            {addonLeft && <div>{addonLeft}</div>}
+    <PageContainer paddingY="none">
+      <VStack align="stretch" className="pb-8 sm:pb-12" gap={6}>
+        <HStack align="center" className="py-2.5" gap={4} justify="between" wrap="wrap">
+          <HStack align="center" className="flex-1" gap={4}>
+            {addonLeft && <div className="flex-shrink-0 whitespace-nowrap">{addonLeft}</div>}
            {breadcrumbs && <div className="hidden sm:block">{breadcrumbs}</div>}
          </HStack>
-          {addonRight && <div>{addonRight}</div>}
+          {addonRight && <div className="flex-shrink-0">{addonRight}</div>}
        </HStack>
        <VStack gap={4}>
          <Header level={1}>{heading}</Header>
@@ -1,7 +1,8 @@
+import { LogProvider } from '@ermnvldmr/ui';
 import { render, screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import React from 'react';
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';

 import { ThemeSwitch } from './ThemeSwitch';

@@ -38,4 +39,24 @@ describe('ThemeSwitch', () => {

    expect(systemButton).toBeInTheDocument();
  });
+
+  it('dispatches telemetry events to LogProvider', async () => {
+    const user = userEvent.setup();
+    const loggerMock = vi.fn();
+
+    render(
+      <LogProvider logger={loggerMock}>
+        <ThemeSwitch />
+      </LogProvider>
+    );
+
+    const switchControl = screen.getByRole('switch');
+    const systemButton = screen.getByRole('button');
+
+    await user.click(switchControl);
+    expect(loggerMock).toHaveBeenCalledWith('theme-toggle', { preference: 'dark' });
+
+    await user.click(systemButton);
+    expect(loggerMock).toHaveBeenCalledWith('theme-toggle', { preference: 'system' });
+  });
 });
@@ -1,4 +1,4 @@
-import { Button, HStack, Switch, useTheme } from '@ermnvldmr/ui';
+import { Button, HStack, Switch, useLogger, useTheme } from '@ermnvldmr/ui';
 import React from 'react';

 /**
@@ -27,28 +27,42 @@ export function ThemeSwitch({
  systemIcon,
 }: ThemeSwitchProps = {}): React.JSX.Element {
  const { preference, setPreference, resolvedTheme } = useTheme();
+  const log = useLogger();

  const isDark = resolvedTheme === 'dark';

+  const handleToggle = (isSelected: boolean): void => {
+    const nextTheme = isSelected ? 'dark' : 'light';
+    setPreference(nextTheme);
+    log('theme-toggle', { preference: nextTheme });
+  };
+
+  const handleSystem = (): void => {
+    setPreference('system');
+    log('theme-toggle', { preference: 'system' });
+  };
+
  return (
    <HStack align="center" gap={2}>
      <HStack align="center" gap={1.5}>
        {lightIcon}
        <Switch
          aria-label="Toggle dark mode"
+          data-umami-event="theme-toggle"
          isSelected={isDark}
          variant="outline"
-          onChange={(isSelected) => setPreference(isSelected ? 'dark' : 'light')}
+          onChange={handleToggle}
        />
        {darkIcon}
      </HStack>
      <Button
        aria-label="Follow system theme"
        color={preference === 'system' ? 'primary' : 'neutral'}
+        data-umami-event="theme-system"
        renderStartIcon={systemIcon ? () => systemIcon : undefined}
        size="s"
        variant={preference === 'system' ? 'solid' : 'ghost'}
-        onPress={() => setPreference('system')}
+        onPress={handleSystem}
      />
    </HStack>
  );
@@ -0,0 +1,2 @@
+export * from './types.js';
+export * from './umami.js';
@@ -0,0 +1,35 @@
+/**
+ * HTML script or link tag descriptor for analytics injection.
+ */
+export interface AnalyticsHtmlTag {
+  /** The HTML tag name. */
+  tag: string;
+  /** Attributes to attach to the tag element. */
+  attrs?: Record<string, string | boolean | undefined>;
+  /** Optional inline text content of the tag. */
+  children?: string;
+  /** Whether the tag should be injected into the document <head>. */
+  head?: boolean;
+  /** Whether the tag should be appended at the end. */
+  append?: boolean;
+}
+
+/**
+ * Interface representing a configurable analytics provider for SSG services.
+ */
+export interface AnalyticsProvider {
+  /** Provider identifier (e.g. 'umami', 'plausible'). */
+  readonly name: string;
+  /**
+   * Generates the HTML tags required for this provider.
+   *
+   * @param isProduction - Whether the current build is in production mode.
+   * @returns Array of HTML tag descriptors.
+   */
+  getHtmlTags: (isProduction: boolean) => AnalyticsHtmlTag[];
+}
+
+/**
+ * Key-value mapping for analytics event metadata.
+ */
+export type AnalyticsEventData = Record<string, string | number | boolean>;
@@ -0,0 +1,99 @@
+import type { AnalyticsHtmlTag, AnalyticsProvider } from './types.js';
+
+/**
+ * Configuration options for the Umami Analytics provider.
+ */
+export interface UmamiAnalyticsOptions {
+  /** Base URL of the Umami server (e.g., 'https://umami.ermnvldmr.com'). */
+  serverUrl: string;
+  /** Unique website ID UUID assigned by Umami. */
+  websiteId: string;
+  /** Comma-separated list of allowed domains (e.g., 'ermnvldmr.com,www.ermnvldmr.com'). */
+  domains?: string;
+  /** Custom tracker script name. Defaults to 'script.js'. */
+  scriptName?: string;
+  /** Whether to respect the browser's Do Not Track setting. Defaults to true. */
+  doNotTrack?: boolean;
+  /** Optional data tag for event categorization. */
+  tag?: string;
+  /** Optional custom host URL for event endpoint. */
+  hostUrl?: string;
+  /** Whether to auto-track page views. Defaults to true. */
+  autoTrack?: boolean;
+  /** Whether to force tag injection in non-production builds. Defaults to false. */
+  force?: boolean;
+}
+
+/**
+ * Creates an Umami Analytics provider for SSG service configurations.
+ *
+ * Automatically produces `<script>` tags in production builds and suppresses
+ * injection in development to keep analytics clean.
+ *
+ * @param options - Umami configuration options.
+ * @returns An AnalyticsProvider instance for Umami.
+ *
+ * @example
+ * ```typescript
+ * import { defineSSGServiceConfig, umamiAnalytics } from '@ermnvldmr/ssg/dev';
+ *
+ * export default defineSSGServiceConfig({
+ *   analytics: [
+ *     umamiAnalytics({
+ *       serverUrl: 'https://umami.ermnvldmr.com',
+ *       websiteId: '4fca5ac2-4fe4-4626-b708-933c37bfe918',
+ *       domains: 'ermnvldmr.com,www.ermnvldmr.com',
+ *       doNotTrack: true,
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+export function umamiAnalytics(options: UmamiAnalyticsOptions): AnalyticsProvider {
+  return {
+    name: 'umami',
+    getHtmlTags: (isProduction: boolean): AnalyticsHtmlTag[] => {
+      if (!isProduction && !options.force) {
+        return [];
+      }
+
+      const serverUrl = options.serverUrl.replace(/\/+$/, '');
+      const scriptName = options.scriptName ?? 'script.js';
+      const scriptSrc = `${serverUrl}/${scriptName}`;
+
+      const attrs: Record<string, string | boolean | undefined> = {
+        defer: true,
+        src: scriptSrc,
+        'data-website-id': options.websiteId,
+      };
+
+      if (options.domains) {
+        attrs['data-domains'] = options.domains;
+      }
+
+      if (options.doNotTrack !== false) {
+        attrs['data-do-not-track'] = 'true';
+      }
+
+      if (options.tag) {
+        attrs['data-tag'] = options.tag;
+      }
+
+      if (options.hostUrl) {
+        attrs['data-host-url'] = options.hostUrl;
+      }
+
+      if (options.autoTrack === false) {
+        attrs['data-auto-track'] = 'false';
+      }
+
+      return [
+        {
+          tag: 'script',
+          attrs,
+          head: true,
+        },
+      ];
+    },
+  };
+}
@@ -1,26 +1,62 @@
 import { defineServiceConfig, mergeConfig } from '@ermnvldmr/rsbuild-config/dev';
-import { type RsbuildConfig } from '@rsbuild/core';

 import { ssgPlugin } from './ssg.js';

+import type { AnalyticsProvider } from './analytics/types.js';
+import type { RsbuildConfig } from '@rsbuild/core';
+
+/**
+ * Configuration options for SSG services, extending standard Rsbuild config.
+ */
+export interface SSGServiceConfigOptions extends RsbuildConfig {
+  /**
+   * Optional analytics integrations (e.g., Umami, Plausible).
+   * Providers generate HTML script tags that are injected into `html.tags` in production builds.
+   */
+  analytics?: AnalyticsProvider[];
+}
+
 /**
 * Defines a complete Rsbuild configuration for SSG services.
 *
- * Wraps `defineServiceConfig` from `@ermnvldmr/rsbuild-config` and pre-injects
- * `ssgPlugin()` so consumers do not need to wire it manually.
+ * Wraps `defineServiceConfig` from `@ermnvldmr/rsbuild-config`, pre-injects
+ * `ssgPlugin()`, and automatically resolves analytics provider HTML tags for production builds.
 *
- * @param config - Optional Rsbuild configuration overrides.
+ * @param config - Optional Rsbuild configuration overrides with analytics integrations.
 * @returns A complete Rsbuild configuration object.
 *
 * @example
 * ```typescript
- * import { defineSSGServiceConfig, discoverEntries } from '@ermnvldmr/ssg/dev';
+ * import { defineSSGServiceConfig, discoverEntries, umamiAnalytics } from '@ermnvldmr/ssg/dev';
 *
 * export default defineSSGServiceConfig({
 *   source: { entry: discoverEntries(import.meta.dirname, './src/app/**\/*.tsx') },
+ *   analytics: [
+ *     umamiAnalytics({
+ *       serverUrl: 'https://umami.ermnvldmr.com',
+ *       websiteId: '4fca5ac2-4fe4-4626-b708-933c37bfe918',
+ *       domains: 'ermnvldmr.com,www.ermnvldmr.com',
+ *     }),
+ *   ],
 * });
 * ```
 */
-export function defineSSGServiceConfig(config: RsbuildConfig = {}): RsbuildConfig {
-  return defineServiceConfig(mergeConfig(config, { plugins: [ssgPlugin()] }));
+export function defineSSGServiceConfig(config: SSGServiceConfigOptions = {}): RsbuildConfig {
+  const { analytics, ...rsbuildConfig } = config;
+  const isProduction = process.env.NODE_ENV === 'production';
+
+  const analyticsTags = analytics?.flatMap((provider) => provider.getHtmlTags(isProduction)) ?? [];
+
+  const analyticsConfig: RsbuildConfig =
+    analyticsTags.length > 0
+      ? {
+          html: {
+            tags: analyticsTags,
+          },
+        }
+      : {};
+
+  const baseConfigWithPlugins = mergeConfig(rsbuildConfig, { plugins: [ssgPlugin()] });
+
+  return defineServiceConfig(mergeConfig(baseConfigWithPlugins, analyticsConfig));
 }
@@ -0,0 +1,68 @@
+import type { AnalyticsEventData } from '../config/analytics/types.js';
+
+declare global {
+  /**
+   * Browser window global augmentation.
+   */
+  interface Window {
+    /**
+     * Umami Analytics tracker instance.
+     */
+    umami?: {
+      /**
+       * Tracks a custom event.
+       *
+       * @param eventName - Name of the custom event.
+       * @param eventData - Optional key-value payload.
+       */
+      track: (eventName: string, eventData?: Record<string, string | number | boolean>) => void;
+      /**
+       * Identifies the current session with custom session properties.
+       *
+       * @param sessionData - Key-value session data.
+       */
+      identify: (sessionData: Record<string, string | number | boolean>) => void;
+    };
+  }
+}
+
+/**
+ * Safely tracks a custom event across active client-side analytics providers (e.g., Umami).
+ *
+ * If no analytics provider is loaded (e.g. during local dev, SSR, or ad-blocked), this is a safe no-op.
+ *
+ * @param eventName - Name of the event to track.
+ * @param eventData - Optional key-value metadata object.
+ *
+ * @example
+ * ```typescript
+ * import { trackEvent } from '@ermnvldmr/ssg';
+ *
+ * trackEvent('switch-locale', { locale: 'ru' });
+ * ```
+ */
+export function trackEvent(eventName: string, eventData?: AnalyticsEventData): void {
+  if (typeof window !== 'undefined' && typeof window.umami?.track === 'function') {
+    window.umami.track(eventName, eventData);
+  }
+}
+
+/**
+ * Safely identifies the session with custom attributes across active analytics providers.
+ *
+ * If no analytics provider is loaded (e.g. during local dev, SSR, or ad-blocked), this is a safe no-op.
+ *
+ * @param sessionData - Key-value session metadata.
+ *
+ * @example
+ * ```typescript
+ * import { identifySession } from '@ermnvldmr/ssg';
+ *
+ * identifySession({ theme: 'dark', locale: 'en' });
+ * ```
+ */
+export function identifySession(sessionData: AnalyticsEventData): void {
+  if (typeof window !== 'undefined' && typeof window.umami?.identify === 'function') {
+    window.umami.identify(sessionData);
+  }
+}
@@ -1,4 +1,5 @@
 export * from './config/ssg.js';
 export * from './config/entries.js';
 export * from './config/ssgServiceConfig.js';
+export * from './config/analytics/index.js';
 export { mergeConfig } from '@ermnvldmr/rsbuild-config/dev';
@@ -1 +1,2 @@
 export * from './core/createPage.js';
+export * from './core/analytics.js';
@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest';
+
+import { filterDataAttributes } from './filterDataAttributes';
+
+describe('filterDataAttributes', () => {
+  it('extracts all data-* attributes correctly', () => {
+    const props = {
+      id: 'button-1',
+      className: 'btn',
+      'data-testid': 'my-test-id',
+      'data-umami-event': 'click-me',
+      'data-umami-event-target': 'hero',
+      onClick: () => {},
+    };
+
+    const result = filterDataAttributes(props);
+    expect(result).toEqual({
+      'data-testid': 'my-test-id',
+      'data-umami-event': 'click-me',
+      'data-umami-event-target': 'hero',
+    });
+  });
+
+  it('returns an empty object when no data-* attributes are present', () => {
+    const props = {
+      id: 'header-1',
+      className: 'header',
+    };
+
+    const result = filterDataAttributes(props);
+    expect(result).toEqual({});
+  });
+});
@@ -0,0 +1,32 @@
+import type { DataAttributes } from '../../types/dataAttributes.js';
+
+/**
+ * Filters and extracts all `data-*` attributes from a props object.
+ *
+ * @param props - Source props object.
+ * @returns An object containing only the `data-*` attributes.
+ *
+ * @example
+ * ```typescript
+ * const dataAttrs = filterDataAttributes(props);
+ * ```
+ */
+export function filterDataAttributes<T extends object>(props: T): DataAttributes {
+  const result: DataAttributes = {};
+  for (const key in props) {
+    if (Object.prototype.hasOwnProperty.call(props, key) && key.startsWith('data-')) {
+      // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+      const value: unknown = (props as Record<string, unknown>)[key];
+      if (
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean' ||
+        value === undefined
+      ) {
+        // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+        result[key as `data-${string}`] = value;
+      }
+    }
+  }
+  return result;
+}
@@ -1,6 +1,7 @@
 export { castRef } from './castRef/castRef';
 export { castMutableRef } from './castRef/castMutableRef';
 export { genericMemo } from './genericMemo/genericMemo';
+export { filterDataAttributes } from './filterDataAttributes/filterDataAttributes';
 export { useResizeObserver } from './useResizeObserver/useResizeObserver';
 export { useIntersectionObserver } from './useIntersectionObserver/useIntersectionObserver';
 export { useScroll } from './useScroll/useScroll';
@@ -0,0 +1,11 @@
+/**
+ * Type allowing arbitrary `data-*` attributes on component props.
+ *
+ * @example
+ * ```typescript
+ * interface ButtonProps extends DataAttributes {
+ *   children: React.ReactNode;
+ * }
+ * ```
+ */
+export type DataAttributes = Record<`data-${string}`, string | number | boolean | undefined>;
@@ -3,4 +3,5 @@
 */

 export type { ClassNameProps } from './classNameProps';
+export type { DataAttributes } from './dataAttributes';
 export type { TestIdProps } from './testIdProps';
@@ -1,9 +1,9 @@
-import { cn, castRef, genericMemo } from '@ermnvldmr/stl';
+import { cn, castRef, filterDataAttributes, genericMemo } from '@ermnvldmr/stl';
 import { cva } from 'class-variance-authority';
 import React, { forwardRef, useRef } from 'react';
 import { useButton, useLink, useFocusRing, useHover } from 'react-aria';

-import type { ClassNameProps, TestIdProps } from '@ermnvldmr/stl';
+import type { ClassNameProps, DataAttributes, TestIdProps } from '@ermnvldmr/stl';
 import type { AriaButtonProps, AriaLinkOptions } from 'react-aria';

 /**
@@ -34,7 +34,7 @@ export type ButtonSize = 's' | 'm' | 'l';
 /**
 * Props shared by both action and link button variants.
 */
-interface BaseButtonProps extends ClassNameProps, TestIdProps {
+interface BaseButtonProps extends ClassNameProps, TestIdProps, DataAttributes {
  /** Content to be rendered inside the button */
  children?: React.ReactNode;
  /** Visual style variant */
@@ -260,12 +260,15 @@ const ButtonComponent = forwardRef<HTMLElement, ButtonProps>(function Button(pro
    </>
  );

+  const dataAttributes = filterDataAttributes(props);
+
  if (href) {
    return (
      <a
        {...linkProps}
        {...focusProps}
        {...hoverProps}
+        {...dataAttributes}
        ref={castRef<HTMLAnchorElement>(targetRef)}
        className={sharedClasses}
        data-testid={testId}
@@ -280,6 +283,7 @@ const ButtonComponent = forwardRef<HTMLElement, ButtonProps>(function Button(pro
      {...buttonProps}
      {...focusProps}
      {...hoverProps}
+      {...dataAttributes}
      ref={castRef<HTMLButtonElement>(targetRef)}
      className={sharedClasses}
      data-testid={testId}
@@ -1,10 +1,10 @@
-import { castRef, cn, genericMemo } from '@ermnvldmr/stl';
+import { castRef, cn, filterDataAttributes, genericMemo } from '@ermnvldmr/stl';
 import { cva } from 'class-variance-authority';
 import React, { forwardRef } from 'react';
 import { usePress } from 'react-aria';

 import type { SpacingScale } from '../../lib/scale';
-import type { ClassNameProps, TestIdProps } from '@ermnvldmr/stl';
+import type { ClassNameProps, DataAttributes, TestIdProps } from '@ermnvldmr/stl';
 import type { PressEvents } from 'react-aria';

 /**
@@ -32,7 +32,7 @@ export type ContainerRounded = 'none' | 'sm' | 'md' | 'lg' | 'full';
 /**
 * Props for the Container component.
 */
-export interface ContainerProps extends ClassNameProps, TestIdProps {
+export interface ContainerProps extends ClassNameProps, TestIdProps, DataAttributes {
  /** Content to be rendered inside the container */
  children: React.ReactNode;
  /** Background color variant */
@@ -153,7 +153,10 @@ const containerVariants = cva('overflow-hidden', {
 * borders, and width constraints while maintaining theme consistency.
 */
 const ContainerComponent = forwardRef<HTMLElement, ContainerProps>(function Container(
-  {
+  props,
+  ref
+) {
+  const {
    children,
    bg = 'base',
    padding = 0,
@@ -166,9 +169,8 @@ const ContainerComponent = forwardRef<HTMLElement, ContainerProps>(function Cont
    as: Component = 'div',
    className,
    'data-testid': testId,
-  },
-  ref
-) {
+  } = props;
+
  if (process.env.NODE_ENV !== 'production' && onPress && href) {
    console.warn('[@ermnvldmr/ui] Container cannot have both `onPress` and `href` props.');
  }
@@ -183,10 +185,12 @@ const ContainerComponent = forwardRef<HTMLElement, ContainerProps>(function Cont

  const interactionProps = isPressable ? pressProps : {};
  const FinalComponent = isLink ? 'a' : Component;
+  const dataAttributes = filterDataAttributes(props);

  return (
    <FinalComponent
      {...interactionProps}
+      {...dataAttributes}
      ref={castRef<HTMLElement>(ref)}
      className={cn(
        containerVariants({
@@ -1,18 +1,18 @@
 import { localePath } from '@ermnvldmr/i18n';
-import { castRef, cn } from '@ermnvldmr/stl';
+import { castRef, cn, filterDataAttributes } from '@ermnvldmr/stl';
 import React, { memo, useRef } from 'react';
 import { useLink } from 'react-aria';

 import { Text } from '../Text/Text';

 import type { TextColor, TextSize, TextType } from '../Text/Text';
-import type { ClassNameProps } from '@ermnvldmr/stl';
+import type { ClassNameProps, DataAttributes } from '@ermnvldmr/stl';
 import type { AriaLinkOptions } from 'react-aria';

 /**
 * Props for the Link component.
 */
-export interface LinkProps extends AriaLinkOptions, ClassNameProps {
+export interface LinkProps extends AriaLinkOptions, ClassNameProps, DataAttributes {
  /** The destination URL. Renders as an <a> tag if provided. */
  href?: string;
  /** Link content */
@@ -50,6 +50,8 @@ export const Link = memo(function Link(props: LinkProps) {
    className
  );

+  const dataAttributes = filterDataAttributes(props);
+
  if (href) {
    const resolvedHref = localePath(href);
    const isAutoExternal = isExternal ?? href.startsWith('http');
@@ -59,6 +61,7 @@ export const Link = memo(function Link(props: LinkProps) {
      <Text
        {...linkProps}
        {...externalProps}
+        {...dataAttributes}
        ref={ref}
        as="a"
        className={sharedClasses}
@@ -76,6 +79,7 @@ export const Link = memo(function Link(props: LinkProps) {
  return (
    <Text
      {...linkProps}
+      {...dataAttributes}
      ref={castRef<HTMLSpanElement>(ref)}
      as="span"
      className={sharedClasses}
@@ -0,0 +1,30 @@
+import { createContext, useContext } from 'react';
+
+/**
+ * Function signature for telemetry and event logging.
+ */
+export type LogFn = (event: string, data?: Record<string, string | number | boolean>) => void;
+
+const noopLogger: LogFn = () => undefined;
+
+/**
+ * React context holding the active logging function.
+ */
+export const LogContext = createContext<LogFn>(noopLogger);
+
+/**
+ * Hook to access the logging function from the nearest LogProvider.
+ *
+ * Defaults to a safe no-op if rendered outside a LogProvider.
+ *
+ * @returns The active logging function.
+ *
+ * @example
+ * ```tsx
+ * const log = useLogger();
+ * log('button-click', { buttonId: 'submit' });
+ * ```
+ */
+export function useLogger(): LogFn {
+  return useContext(LogContext);
+}
@@ -0,0 +1,42 @@
+import React from 'react';
+
+import { useLogger } from './LogContext';
+import { LogProvider } from './LogProvider';
+import { Button } from '../Button/Button';
+
+import type { Meta, StoryObj } from '@storybook/react';
+
+function LogDemo(): React.JSX.Element {
+  const log = useLogger();
+  return (
+    <Button
+      variant="solid"
+      onPress={() => {
+        log('story-click', { timestamp: Date.now() });
+      }}
+    >
+      Click to Log Event
+    </Button>
+  );
+}
+
+const meta: Meta<typeof LogProvider> = {
+  title: 'Components/LogProvider',
+  component: LogProvider,
+  tags: ['autodocs'],
+};
+
+export default meta;
+type Story = StoryObj<typeof LogProvider>;
+
+export const Default: Story = {
+  render: () => (
+    <LogProvider
+      logger={(event, data) => {
+        console.log(`[Event: ${event}]`, data);
+      }}
+    >
+      <LogDemo />
+    </LogProvider>
+  ),
+};
@@ -0,0 +1,37 @@
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+import { describe, expect, it, vi } from 'vitest';
+
+import { useLogger } from './LogContext';
+import { LogProvider } from './LogProvider';
+
+function ConsumerComponent(): React.JSX.Element {
+  const log = useLogger();
+  return (
+    <button type="button" onClick={() => log('test-event', { key: 'value' })}>
+      Trigger Log
+    </button>
+  );
+}
+
+describe('LogProvider', () => {
+  it('defaults to no-op when outside LogProvider', () => {
+    render(<ConsumerComponent />);
+    const button = screen.getByRole('button', { name: 'Trigger Log' });
+    expect(() => button.click()).not.toThrow();
+  });
+
+  it('calls the provided logger on event dispatch', () => {
+    const loggerMock = vi.fn();
+    render(
+      <LogProvider logger={loggerMock}>
+        <ConsumerComponent />
+      </LogProvider>
+    );
+
+    const button = screen.getByRole('button', { name: 'Trigger Log' });
+    button.click();
+
+    expect(loggerMock).toHaveBeenCalledWith('test-event', { key: 'value' });
+  });
+});
@@ -0,0 +1,34 @@
+import React, { useMemo } from 'react';
+
+import { LogContext } from './LogContext';
+
+import type { LogFn } from './LogContext';
+
+/**
+ * Props for the LogProvider component.
+ */
+export interface LogProviderProps {
+  /** The telemetry logging function to inject into the React tree. */
+  logger?: LogFn;
+  /** Children components that will have access to the logger via useLogger. */
+  children: React.ReactNode;
+}
+
+/**
+ * Provider component for injecting analytics and telemetry loggers into the UI component tree.
+ *
+ * @param props - Component props containing optional logger and children.
+ * @returns React context provider element.
+ *
+ * @example
+ * ```tsx
+ * <LogProvider logger={trackEvent}>
+ *   <App />
+ * </LogProvider>
+ * ```
+ */
+export function LogProvider({ logger, children }: LogProviderProps): React.JSX.Element {
+  const value: LogFn = useMemo(() => logger ?? (() => undefined), [logger]);
+
+  return <LogContext.Provider value={value}>{children}</LogContext.Provider>;
+}
@@ -0,0 +1,2 @@
+export * from './LogContext';
+export * from './LogProvider';
@@ -1,9 +1,9 @@
-import { cn, castRef, genericMemo } from '@ermnvldmr/stl';
+import { cn, castRef, filterDataAttributes, genericMemo } from '@ermnvldmr/stl';
 import { cva } from 'class-variance-authority';
 import React, { forwardRef } from 'react';

 import type { SpacingScale } from '../../lib/scale';
-import type { ClassNameProps, TestIdProps } from '@ermnvldmr/stl';
+import type { ClassNameProps, DataAttributes, TestIdProps } from '@ermnvldmr/stl';

 /**
 * Flexbox direction values.
@@ -28,7 +28,7 @@ type FlexWrap = 'nowrap' | 'wrap' | 'wrap-reverse';
 /**
 * Props for the flexible Stack layout component.
 */
-export interface StackProps extends ClassNameProps, TestIdProps {
+export interface StackProps extends ClassNameProps, TestIdProps, DataAttributes {
  /** Content to be arranged in the stack */
  children: React.ReactNode;
  /** Flexbox direction (row, column, or their reverse variants) */
@@ -165,7 +165,10 @@ const stackVariants = cva('flex', {
 * ```
 */
 const StackComponent = forwardRef<HTMLElement, StackProps>(function Stack(
-  {
+  props,
+  ref
+) {
+  const {
    children,
    direction = 'row',
    justify = 'start',
@@ -176,11 +179,13 @@ const StackComponent = forwardRef<HTMLElement, StackProps>(function Stack(
    as: Component = 'div',
    className,
    'data-testid': testId,
-  },
-  ref
-) {
+  } = props;
+
+  const dataAttributes = filterDataAttributes(props);
+
  return (
    <Component
+      {...dataAttributes}
      ref={castRef<HTMLElement>(ref)}
      className={cn(
        stackVariants({ direction, justify, align, wrap, gap, scrollable }),
@@ -1,4 +1,4 @@
-import { cn } from '@ermnvldmr/stl';
+import { cn, filterDataAttributes } from '@ermnvldmr/stl';
 import { cva } from 'class-variance-authority';
 import React, { useRef } from 'react';
 import { useSwitch, useFocusRing, VisuallyHidden } from 'react-aria';
@@ -6,6 +6,7 @@ import { useToggleState } from 'react-stately';

 import { Text } from '../Text/Text';

+import type { ClassNameProps, DataAttributes } from '@ermnvldmr/stl';
 import type { AriaSwitchProps } from 'react-aria';

 /**
@@ -31,7 +32,7 @@ export type SwitchColor =
 /**
 * Props for the Switch component.
 */
-export interface SwitchProps extends AriaSwitchProps {
+export interface SwitchProps extends AriaSwitchProps, ClassNameProps, DataAttributes {
  /** Optional class name for the outer container */
  className?: string;
  /** Optional label for the switch */
@@ -220,9 +221,11 @@ export function Switch(props: SwitchProps): React.JSX.Element {
  const ref = useRef<HTMLInputElement>(null);
  const { inputProps } = useSwitch(props, state, ref);
  const { isFocusVisible, focusProps } = useFocusRing();
+  const dataAttributes = filterDataAttributes(props);

  return (
    <label
+      {...dataAttributes}
      className={cn(
        'group inline-flex items-center cursor-pointer select-none gap-3',
        props.isDisabled && 'opacity-50 cursor-not-allowed',
@@ -10,6 +10,7 @@ export * from './Icon/index';
 export * from './Image/Image';
 export * from './Link/Link';
 export * from './List/List';
+export * from './LogProvider/index';
 export * from './Paragraph/Paragraph';
 export * from './Separator/Separator';
 export * from './Stack/Stack';
@@ -7,7 +7,7 @@ title: "Ermnvldmr's Documentation"
 Welcome to the unified documentation for my own projects

 {{< cards >}}
+{{< card link="ermnvldmr" title="ermnvldmr.com Platform" icon="cloud" subtitle="Cloud-native infrastructure, Packer golden image, K3s cluster, and GitOps platform" >}}
 {{< card link="apex" title="apex.ermnvldmr.com" icon="server" subtitle="Fleet operations framework: a stdlib-python engine and a shared compose core" >}}
 {{< card link="quetza" title="Quetza Bot" icon="terminal" subtitle="Modular Discord bot framework documentation" >}}
-{{< card link="root" title="ermnvldmr.com-root-commons (deprecated)" icon="archive" subtitle="Deprecated — superseded by the apex framework" >}}
 {{< /cards >}}
@@ -0,0 +1,33 @@
+---
+title: "ermnvldmr.com Platform"
+weight: 1
+type: docs
+cascade:
+  type: docs
+---
+
+**ermnvldmr.com Platform** is the complete cloud-native infrastructure, automation pipeline, and GitOps delivery system powering all `ermnvldmr.com` production services.
+
+The platform is designed around strict infrastructure-as-code principles, immutable golden OS images, secret encryption at rest, automated continuous reconciliation, and zero-downtime rolling updates.
+
+---
+
+## Documentation Sections
+
+{{% cards %}}
+{{< card link="architecture" title="Architecture & Flow" icon="server" subtitle="End-to-end architectural design: Packer, Cloud-Init, K3s, Flux GitOps, and Cloudflare." >}}
+{{< card link="golden-image" title="Golden Image Automation" icon="cube" subtitle="Automated QEMU Packer build pipeline, kernel & OS bake-in, S3 artifact storage, and quota management." >}}
+{{< card link="deployment-gitops" title="GitOps & Release Engine" icon="refresh" subtitle="Continuous deployment, semantic releases, fast-track deploys, and automated /version.json rollout checks." >}}
+{{< card link="operations" title="Operations & Runbook" icon="shield-check" subtitle="SSH access, SOPS age encryption, persistent storage management, database backups, and disaster recovery." >}}
+{{% /cards %}}
+
+---
+
+## Key Platform Characteristics
+
+* **Immutable Golden Images**: Standardized Debian 12 + K3s base built via Packer and QEMU, isolated and stored in S3.
+* **Autonomous First-Boot Initialization**: Cloud-Init automatically provisions storage, network hardening, firewall, age encryption secrets, and bootstraps Flux GitOps without requiring manual console access.
+* **Declarative GitOps Engine**: Flux v2 continuously reconciles Kubernetes cluster state against the `next` branch in GitHub.
+* **End-to-End Encryption**: SOPS + Age encrypts all sensitive secrets in Git; Let's Encrypt and Cloudflare Full (Strict) secure all public traffic.
+* **Automated Production Rollout Verification**: Release pipelines query public `/version.json` probes to verify that rolling updates actively serve user traffic before finishing.
+
@@ -0,0 +1,116 @@
+---
+title: "Architecture & Flow"
+weight: 2
+type: docs
+---
+
+The `ermnvldmr.com` infrastructure architecture combines immutable OS image baking, autonomous cloud-init bootstrapping, and declarative Flux GitOps reconciliation into a single unified deployment model.
+
+---
+
+## 1. High-Level System Architecture
+
+```mermaid
+flowchart TD
+    subgraph GitHub ["GitHub Infrastructure"]
+        Repo["Git Repository (next branch)"]
+        Workflows["GitHub Actions Pipelines"]
+        GHCR["GitHub Container Registry (GHCR)"]
+    end
+
+    subgraph S3 ["S3-Compatible Object Storage"]
+        GoldenImage["Packer Golden Image (.qcow2)"]
+        Backups["Daily PostgreSQL Backups"]
+    end
+
+    subgraph Cloud ["Cloud Infrastructure / Compute Platform"]
+        subgraph VM ["Compute Virtual Machine"]
+            subgraph OS ["Debian 12 Bookworm"]
+                CloudInit["Cloud-Init First-Boot"]
+                UFW["UFW Firewall (80, 443, 22)"]
+                SSD["Secondary SSD (/dev/vdb /var/lib/rancher/k3s/storage)"]
+            end
+
+            subgraph K3s ["K3s Single-Node Cluster"]
+                Flux["Flux v2 Operator"]
+                Traefik["Traefik Ingress (HostPort 80/443)"]
+                CertManager["Cert-Manager (Let's Encrypt Prod)"]
+                
+                subgraph Apps ["Namespaced Workloads (com-ermnvldmr)"]
+                    WWW["www (React 19 SSG + Nginx)"]
+                    Docs["docs (Hugo + Hextra + Nginx)"]
+                    Postgres["PostgreSQL 16 StatefulSet"]
+                    Umami["Umami Analytics Server"]
+                    BackupCron["Postgres S3 Backup CronJob"]
+                end
+            end
+        end
+    end
+
+    subgraph Edge ["Cloudflare Edge"]
+        CF["Cloudflare Proxy (Full Strict)"]
+    end
+
+    Users["Internet Visitors"] --> CF
+    CF --> Traefik
+    Traefik --> WWW
+    Traefik --> Docs
+    Traefik --> Umami
+    Umami --> Postgres
+    BackupCron --> Backups
+    Workflows --> GHCR
+    Workflows --> GoldenImage
+    Repo --> Flux
+    Flux --> Apps
+```
+
+---
+
+## 2. Platform Lifecycle Stages
+
+The lifecycle of the platform operates in three distinct phases:
+
+### Phase 1: Golden Image Build (Packer)
+1. **Automated Trigger**: GitHub Actions runs `.github/workflows/ci-next-build-golden-image.yml`.
+2. **QEMU Virtualization**: Packer launches a headless QEMU Debian 12 installation with preseed automation (`preseed.cfg`).
+3. **Provisioning**:
+   * Installs base system packages (`curl`, `git`, `htop`, `fail2ban`, `ufw`, `qemu-guest-agent`, `isc-dhcp-client`).
+   * Configures `ds-identify` with `policy: enabled` so cloud-init is guaranteed to run.
+   * Pre-installs K3s binary (`INSTALL_K3S_SKIP_ENABLE=true`, `INSTALL_K3S_SKIP_START=true`).
+   * Strips machine identity (`/etc/machine-id`, DBus ID, SSH host keys, network MAC caches) for clean first-boot isolation.
+4. **S3 Upload & Quota Management**: Converts image to compressed `qcow2` format, prunes older images in `dev/images/` to prevent bucket exhaustion, and uploads the verified golden image to S3-compatible object storage.
+
+---
+
+### Phase 2: Autonomous First-Boot (Cloud-Init)
+When a VM is created from the golden image with `ci/cloud-init/user-data.template.yaml`:
+1. **User & Network Setup**:
+   * Creates administrative user `adam` with public SSH key.
+   * Disables password authentication and root direct SSH access.
+   * Configures reliable fallback DNS nameservers (`1.1.1.1`, `8.8.8.8`, `77.88.8.8`).
+2. **Security & Kernel Hardening**:
+   * Applies sysctl rules: SYN flood protection, disabling ICMP redirects, source routing protection, and strict reverse path filtering.
+   * Configures UFW firewall rules allowing only SSH (22), Traefik HTTP (80), and Traefik HTTPS (443), while routing pod CIDR (`10.42.0.0/16`) and service CIDR (`10.43.0.0/16`).
+   * Enables Fail2ban.
+3. **Persistent Secondary Storage**:
+   * Detects secondary virtual disk `/dev/vdb`.
+   * Formats with `ext4` and filesystem label `k3s-storage` if not yet formatted.
+   * Mounts to `/var/lib/rancher/k3s/storage` and persists mount configuration in `/etc/fstab`.
+4. **K3s & GitOps Engine Startup**:
+   * Starts `k3s.service` with built-in ServiceLB enabled.
+   * Injects the SOPS age decryption key into Kubernetes secret `flux-system/sops-age`.
+   * Installs Flux v2 custom resource definitions and controllers.
+   * Applies the root GitOps sync (`GitRepository` + `Kustomization`) pointing directly to `https://github.com/deytenit/ermnvldmr.com.git` on branch `next`.
+
+---
+
+### Phase 3: Continuous Reconciliation & Delivery (GitOps)
+1. **Flux Controller**:
+   * Polls the `next` branch every 1 minute for repository changes.
+   * Evaluates Kustomize overlays in `ci/k8s/clusters/production`.
+   * Automatically decrypts `*.sops.yaml` secrets in-cluster using the injected `sops-age` key.
+   * Enforces zero-downtime rolling update strategies (`maxUnavailable: 0`, `maxSurge: 1`).
+2. **Ingress & TLS Automation**:
+   * Traefik binds HostPorts 80 and 443.
+   * Cert-Manager solves Let's Encrypt HTTP-01 challenges via Ingress routes.
+   * Cloudflare Edge operates in **Full (strict)** SSL mode, proxying traffic securely to Traefik.
@@ -0,0 +1,74 @@
+---
+title: "GitOps & Release Engine"
+weight: 4
+type: docs
+---
+
+The platform uses a declarative GitOps model powered by **Flux v2** and **Kustomize**, with automated post-deployment rollout validation across all production workloads.
+
+---
+
+## 1. Monorepo GitOps Layout
+
+All Kubernetes manifests are located in [`ci/k8s/`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/k8s/):
+
+```text
+ci/k8s/
+├── apps/                        # Application workloads
+│   ├── docs/                    # Hugo documentation service
+│   ├── postgres/                # PostgreSQL 16 StatefulSet & S3 backup CronJob
+│   ├── umami/                   # Umami web analytics
+│   └── www/                     # React 19 primary website
+├── base/                        # Base cluster resources
+│   └── namespaces/              # `com-ermnvldmr` namespace definition
+├── clusters/                    # Flux cluster root definitions
+│   └── production/              # Root Kustomization point for production
+└── infrastructure/              # Shared cluster infrastructure
+    ├── cert-manager/            # Cert-Manager v1.17.0 & Let's Encrypt ClusterIssuer
+    └── networking/              # Traefik Ingress routing rules
+```
+
+---
+
+## 2. Release Workflows & Continuous Deployment
+
+### Service Deployment Modes:
+
+1. **`services/docs` (Continuous Deployment)**:
+   * **Trigger**: Push to `next` modifying `services/docs/**`.
+   * **Workflow**: `.github/workflows/services-docs-next-required.yml`.
+   * **Action**: Builds Docker image, updates `ci/k8s/apps/docs/kustomization.yaml`, commits to `next`, and runs automated `verify-rollout`.
+
+2. **`services/www` (Trunk-Based CD with CalVer Release Gate)**:
+   * **Trigger**: Push to `next` modifying `services/www/**` or workspace dependencies (`packages/ui/**`, `packages/stl/**`, `packages/i18n/**`), or manual `workflow_dispatch`.
+   * **Workflow**: `.github/workflows/services-www-next-required.yml`.
+   * **Pipeline**: Full validation suite (Vitest, Storybook Playwright, Lint, Typecheck, Build) ➔ Builds Docker image with `sha-<commit>` tag ➔ Approval gate (`services-www-releases-publish`) tags CalVer `YYYY.MM.MICRO` in Git & GHCR ➔ Approval gate (`services-www-releases-deploy`) updates GitOps tag ➔ Runs `verify-rollout`.
+
+---
+
+## 3. Automated Post-Deployment Verification (`/version.json`)
+
+To guarantee that a deployment has actually completed and is serving user traffic:
+1. Every container image includes a generated `/usr/share/nginx/html/version.json` with `COMMIT_SHA` and `VERSION` build metadata.
+2. Nginx serves `/version.json` with `Cache-Control: no-store, no-cache, must-revalidate`.
+3. The `verify-rollout` GitHub Actions job polls the public endpoint (`https://www.ermnvldmr.com/version.json` or `https://docs.ermnvldmr.com/version.json`) every 10 seconds (up to 5 minutes) until the live production commit matches the deployed commit.
+
+```bash
+TARGET_COMMIT="sha-26f0c23"
+for i in {1..30}; do
+  LIVE_COMMIT=$(curl -sf https://www.ermnvldmr.com/version.json | jq -r '.commit')
+  if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then
+    echo "✅ Production rollout verified!"
+    exit 0
+  fi
+  sleep 10
+done
+```
+
+---
+
+## 4. Rollback Strategy
+
+* **Git Revert (Standard)**: Revert the deployment commit in Git and push to `next`.
+* **GitOps Script**: Run `bash ci/scripts/deploy-gitops.sh <service> <previous_tag>`.
+* **Emergency Kubernetes Rollback**: Run `kubectl rollout undo deployment/<service> -n com-ermnvldmr` on the cluster for instant 2-second rollback.
@@ -0,0 +1,61 @@
+---
+title: "Golden Image Automation"
+weight: 3
+type: docs
+---
+
+The `ermnvldmr.com` golden image pipeline automates the generation of standardized, hardened Debian 12 virtual machine images pre-configured for single-node K3s clustering.
+
+---
+
+## 1. Packer Configuration & Provisioning Pipeline
+
+Golden images are defined in [`ci/packer/`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/packer/) and built using the `qemu` Packer builder.
+
+### Key Files:
+* **[`debian-12-k3s.pkr.hcl`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/packer/debian-12-k3s.pkr.hcl)**: Main Packer template specifying CPU, RAM, disk size (10GB qcow2), Debian 12 Netinst ISO, boot commands, and provisioner sequence.
+* **[`http/preseed.cfg`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/packer/http/preseed.cfg)**: Debian automated preseed installation rules (minimal system, non-interactive partitioning, APT mirrors).
+* **[`scripts/01-base-system.sh`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/packer/scripts/01-base-system.sh)**: Base system package installation, cloud-init forced policy enablement (`/etc/cloud/ds-identify.cfg`), kernel optimization, and fail2ban setup.
+* **[`scripts/02-install-k3s.sh`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/packer/scripts/02-install-k3s.sh)**: Downloads and installs the K3s binary (`INSTALL_K3S_SKIP_ENABLE=true`, `INSTALL_K3S_SKIP_START=true`) so the binary is baked into `/usr/local/bin/k3s` without creating a cluster during image build.
+* **[`scripts/03-cleanup.sh`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/packer/scripts/03-cleanup.sh)**: Machine identity reset (`/etc/machine-id`, `/var/lib/dbus/machine-id`, `/etc/ssh/ssh_host_*`), cache purging, and zeroing free space for maximum image compression.
+
+---
+
+## 2. GitHub Actions Automation
+
+The image build is executed via `.github/workflows/ci-next-build-golden-image.yml`.
+
+### Workflow Stages:
+1. **Validate Provisioner Scripts**: Verifies bash syntax (`bash -n ci/packer/scripts/*.sh`) and Packer template formatting (`packer fmt -check`).
+2. **Build Golden Image**:
+   * Initializes Packer plugins (`packer init`).
+   * Runs headless QEMU virtual machine build (`packer build`).
+   * Compresses the output artifact to `qcow2`.
+3. **S3 Storage Upload & Quota Management**:
+   * Configures AWS S3 CLI with S3-compatible Object Storage credentials.
+   * **Automatic Quota Pruning**: Removes older images matching `dev/images/com-ermnvldmr-debian-12-k3s-amd64-*.qcow2` before uploading to prevent exceeding bucket limits.
+   * **Uploads**: The newly baked image is pushed to:
+     ```text
+     s3://<bucket>/dev/images/com-ermnvldmr-debian-12-k3s-amd64-<git_short_sha>.qcow2
+     ```
+
+---
+
+## 3. Naming Convention
+
+Images follow a deterministic naming structure based on the git commit:
+
+```text
+com-ermnvldmr-debian-12-k3s-amd64-<short_sha>.qcow2
+```
+
+Example: `com-ermnvldmr-debian-12-k3s-amd64-f4ba6d1.qcow2`
+
+---
+
+## 4. First-Boot Cloud-Init Integration
+
+When launching a compute instance from the uploaded golden image in your cloud infrastructure:
+1. Pass the instantiated [`user-data.template.yaml`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/cloud-init/user-data.template.yaml) in the instance metadata under `user-data`.
+2. Cloud-init executes `/usr/local/bin/bootstrap-cluster.sh` autonomously on first boot.
+3. The instance initializes the network, formats persistent SSDs, starts K3s, installs Flux, and syncs production workloads within ~90 seconds.
@@ -0,0 +1,100 @@
+---
+title: "Operations & Runbook"
+weight: 5
+type: docs
+---
+
+Practical runbook and operational guidelines for managing, debugging, and maintaining the `ermnvldmr.com` production cluster.
+
+---
+
+## 1. Remote SSH Access
+
+Connect to the virtual machine using the administrative `adam` account:
+
+```bash
+ssh -i ~/.ssh/id_ed25519 adam@<SERVER_IP>
+```
+
+The `adam` user has passwordless `sudo` privileges and automatically configured `kubectl` credentials in `~/.kube/config`.
+
+---
+
+## 2. Cluster Health Inspection
+
+### Check Pod Status
+```bash
+kubectl get pods -n com-ermnvldmr -o wide
+```
+
+### Check Ingress & TLS Certificates
+```bash
+kubectl get certificates -n com-ermnvldmr
+kubectl get ingress -n com-ermnvldmr
+```
+
+### Check Flux GitOps Sync Status
+```bash
+kubectl get gitrepositories -n flux-system
+kubectl get kustomizations -n flux-system
+```
+
+### Force Immediate GitOps Reconciliation
+```bash
+kubectl annotate --overwrite kustomization -n flux-system cluster-sync reconcile.fluxcd.io/requestedAt="$(date +%s)"
+```
+
+---
+
+## 3. Secret Management with SOPS + Age
+
+All sensitive files (`*.sops.yaml`) are committed directly to Git using SOPS with Age asymmetric encryption.
+
+### SOPS Configuration (`.sops.yaml`):
+```yaml
+creation_rules:
+  - path_regex: 'ci/k8s/.*secret.*\.yaml$'
+    encrypted_regex: '^(data|stringData)$'
+    age: 'age1<YOUR_PUBLIC_AGE_KEY>'
+```
+
+> **Important**: The `encrypted_regex` rule preserves `apiVersion`, `kind`, and `metadata.name` in plaintext so Kustomize and Flux can inspect and route resources without pre-parsing errors.
+
+### Encrypting a Secret
+```bash
+sops --encrypt --in-place ci/k8s/apps/postgres/secret.sops.yaml
+```
+
+### Editing an Encrypted Secret
+```bash
+sops ci/k8s/apps/postgres/secret.sops.yaml
+```
+
+---
+
+## 4. PostgreSQL Storage & S3 Backups
+
+### Storage Architecture
+* PostgreSQL data resides on a persistent 5Gi PVC backed by `/dev/vdb` (mounted at `/var/lib/rancher/k3s/storage`).
+* Storage survives VM restarts and node maintenance.
+
+### Automated Daily S3 Backup CronJob
+* Manifest: [`ci/k8s/apps/postgres/backup-cronjob.yaml`](file:///home/deytenit/Source/repos/deytenit/ermnvldmr.com/ci/k8s/apps/postgres/backup-cronjob.yaml).
+* Runs daily at 03:00 UTC (`0 3 * * *`).
+* Executes `pg_dump` with gzip compression and uploads directly to `s3://<bucket>/backups/postgres/`.
+
+### Manual Backup Trigger
+```bash
+kubectl create job --from=cronjob/postgres-backup manual-backup-$(date +%s) -n com-ermnvldmr
+```
+
+---
+
+## 5. Cloudflare SSL/TLS Configuration
+
+* **SSL Mode**: **Full (strict)**
+* **HTTPS Redirect Bypass Rule**: Ensure an exception rule exists for ACME HTTP-01 challenges:
+  ```text
+  http.request.scheme eq "http" and not starts_with(http.request.uri.path, "/.well-known/acme-challenge/")
+  ```
+  This allows cert-manager to renew Let's Encrypt certificates over port 80 without being redirected or blocked.
@@ -1,39 +0,0 @@
---
-title: Documentation of ermnvldmr.com root deployment commons
-description: Documentation for the ermnvldmr.com root deployment commons framework.
-weight: 2
-type: docs
-cascade:
-  type: docs
---
-
-> [!WARNING]
-> **Deprecated.** The root framework has been superseded by the
-> [apex fleet operations framework](/apex) — a python-stdlib rewrite of the engine with a
-> shared compose core. This section is retained for reference only and no longer receives
-> updates.
-
-The `ermnvldmr.com-root-commons` framework provides a minimal-dependency deployment environment for independent, self-hosted projects.
-
-The generic logic, scripts, and deployment patterns used across multiple unrelated self-hosted applications are stored in the [GitHub: ermnvldmr.com-root-commons](https://github.com/deytenit/ermnvldmr.com-root-commons) repository.
-
-## Core features
-
- **Smart Dispatcher**: A single entrypoint (`root`) for all orchestration tasks.
- **Tiered Storage**: Standardized classification for configuration, data, and logs.
- **Privilege Isolation**: Project-specific non-root users for enhanced security.
- **Namespaced Libraries**: Explicit, modular Bash utilities for consistent automation.
-
-## Sections
-
-{{% cards %}}
-{{< card link="concepts" title="Concepts" icon="book-open" subtitle="Theoretical foundations, architecture, and security models." >}}
-{{< card link="guides" title="Guides" icon="map" subtitle="Step-by-step guides for installation and action development." >}}
-{{< card link="reference" title="Reference" icon="code" subtitle="API and technical references for developers." >}}
-{{% /cards %}}
-
---
-
-**See also:**
-
- [GitHub: ermnvldmr.com-root-commons](https://github.com/deytenit/ermnvldmr.com-root-commons)
@@ -1,14 +0,0 @@
---
-title: Concepts
-description: Theoretical foundations, architecture, and security models.
-weight: 10
---
-
-Theoretical foundations, architecture, and security models for the ermnvldmr.com root deployment commons framework.
-
-{{% cards %}}
-{{< card link="principles" title="Infrastructure principles" icon="book-open" subtitle="Predictability, minimal dependencies, and decentralization." >}}
-{{< card link="architecture" title="Infrastructure architecture" icon="share" subtitle="Decentralized orchestration and deployment models." >}}
-{{< card link="security-model" title="Security & privilege isolation" icon="shield-check" subtitle="Privilege isolation and network hardening." >}}
-{{< card link="tiered-storage" title="Tiered storage model" icon="database" subtitle="Standardized storage classification for service data." >}}
-{{% /cards %}}
@@ -1,70 +0,0 @@
---
-title: Infrastructure architecture
-description: The decentralized orchestration model and deployment structure.
-weight: 10
---
-
-The Root framework operates on a decentralized orchestration model designed for independent, self-contained projects. It enforces a strict separation between the orchestrator (the "brain") and the automation tasks (the "muscle").
-
-## Core philosophy {#philosophy}
-
-The framework is built on the **Smart Root, Stupid Actions** principle. This design ensures that individual automation scripts remain declarative and unaware of the global system state, while the central dispatcher handles environment resolution and library initialization.
-
-### Smart Root (The Dispatcher)
-
-The `root` entrypoint is the sole interface for users. It is responsible for:
-
- **Environment resolution** &rarr; Locating the `commons` and `configs` repositories.
- **Library warming** &rarr; Sourcing namespaced modules exactly once.
- **Context establishment** &rarr; Defining the target [Node](/root/glossary#node) and its associated paths.
-
-### Stupid Actions (The Tasks)
-
-[Actions](/root/glossary#action) are declarative scripts located in `scripts/actions/`. They are "stupid" because:
-
- They do not calculate paths or detect repositories.
- They depend entirely on the `ROOT_` environment variables.
- They focus exclusively on a single atomic task (e.g., `compose`, `ufw`).
-
-## Deployment model {#deployment}
-
-The framework is typically deployed as a shared [Commons](/root/glossary#commons) repository mounted as a Git submodule within a configuration repository. The engine powering this shared infrastructure is hosted at [GitHub: ermnvldmr.com-root-commons](https://github.com/deytenit/ermnvldmr.com-root-commons).
-
-{{< filetree/container >}}
-{{< filetree/folder name="configs-repo" state="open" >}}
-  {{< filetree/folder name=".operator" state="open" >}}
-    {{< filetree/folder name="shared (submodule)" state="open" >}}
-      {{< filetree/folder name="scripts" >}}
-        {{< filetree/folder name="run" >}}
-          {{< filetree/file name="root (dispatcher)" >}}
-        {{< /filetree/folder >}}
-        {{< filetree/folder name="lib" >}}
-          {{< filetree/file name="shared libraries" >}}
-        {{< /filetree/folder >}}
-        {{< filetree/folder name="actions" >}}
-          {{< filetree/file name="shared actions" >}}
-        {{< /filetree/folder >}}
-      {{< /filetree/folder >}}
-    {{< /filetree/folder >}}
-    {{< filetree/folder name="local" state="open" >}}
-      {{< filetree/folder name="scripts" >}}
-        {{< filetree/folder name="actions" >}}
-          {{< filetree/file name="node-specific overrides" >}}
-        {{< /filetree/folder >}}
-      {{< /filetree/folder >}}
-    {{< /filetree/folder >}}
-  {{< /filetree/folder >}}
-  {{< filetree/folder name="daedalus (node)" >}}
-    {{< filetree/file name="docker-compose.yml" >}}
-  {{< /filetree/folder >}}
-  {{< filetree/file name="init.sh (bootstrap)" >}}
-{{< /filetree/folder >}}
-{{< /filetree/container >}}
-
---
-
-**See also:**
-
- [Concept: The ROOT_ API](/root/reference/root-api)
- [Guide: Installation](/root/guides/installation)
- [GitHub: ermnvldmr.com-root-commons](https://github.com/deytenit/ermnvldmr.com-root-commons)
@@ -1,33 +0,0 @@
---
-title: Infrastructure principles
-description: Core principles providing a secure, predictable, and minimal-dependency environment.
-weight: 5
---
-
-The Root framework is built on core principles designed to provide a secure, predictable, and minimal-dependency environment for independent self-hosted projects.
-
-## Predictability through structure {#predictability}
-
-Manual server configuration is prone to "configuration drift," where hosts intended to be identical slowly diverge. Root solves this by:
-
- **Git-centric truth**: Every configuration, from UFW rules to crontabs, is stored in the repository.
- **Idempotent automation**: [Actions](/root/glossary#action) are designed to be run multiple times without causing side effects, ensuring the host always matches the intended state.
-
-## Minimal dependency footprint {#minimalism}
-
-To ensure long-term maintainability, the framework avoids complex configuration management tools (like Ansible or Salt). Instead, it relies on:
-
- **Bash**: The universal language of Unix systems.
- **Docker**: For application isolation and environment consistency.
- **Standard Linux tools**: Leveraging `systemd`, `ufw`, and `cron` directly.
-
-## Decentralization {#decentralization}
-
-Each [Node](/root/glossary#node) is an island. While they share the [Commons](/root/glossary#commons) library, they do not depend on a central "master" server. This architecture ensures that a failure in one host does not impact unrelated services.
-
---
-
-**See also:**
-
- [Concept: Security model](/root/concepts/security-model)
- [Concept: Tiered storage](/root/concepts/tiered-storage)