c877c61e3e
deploy: publish site on host port 1337; nginx proxies /api/contact; auto-deploy
...
CI / quality (push) Has been cancelled
CI / e2e (push) Has been cancelled
CI / lighthouse (push) Has been cancelled
CI / relay (push) Has been cancelled
Deploy / deploy (push) Has been cancelled
CI / images (push) Has been cancelled
- site nginx listens on 1337; proxies /api/contact to the relay over the internal
network (single public port; TLS terminates upstream at Cloudflare)
- trailing-slash rewrite moved inside location / so /api/contact isn't redirected
- compose: publish ${SITE_PORT:-1337}, internal bridge network, no Traefik labels
(non-destructive — does not touch the WordPress apex router)
- .gitea/workflows/deploy.yml: on push to main, runner rebuilds + restarts the stack
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-07-10 10:00:33 +02:00
bfa8cfd357
feat: homelab case study from live infra; Traefik-based deploy
...
- rewrote homelab (content + topology diagram + stack) from a live inspection of the host:
Ubuntu 24.04, ~30 Docker services behind Traefik (Cloudflare-fronted, TLS, HTTP/3),
Authentik SSO forward-auth, CrowdSec, Pi-hole, self-hosted Gitea + CI runner, socket-proxy,
per-app network isolation; WordPress framed as being decommissioned (not future arch)
- deploy: docker-compose now uses Traefik labels + traefik_proxy network (was assumed nginx
edge); .env.example adds SITE_HOST/TRAEFIK_ENTRYPOINT; colophon + ARCHITECTURE/DOCKER/
DEPLOYMENT specs corrected nginx-edge -> Traefik (site container still serves via nginx)
- PROJECT_STATUS: pre-launch checklist updated; infra section added
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-04 11:23:09 +02:00
9088dcffb9
feat: Docker images, compose stacks, nginx config, Gitea CI
...
- site image: multi-stage node build -> unprivileged nginx (non-root, read-only)
- nginx: CSP + security headers, immutable asset caching, revalidated HTML,
canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404
- externalise theme-init so CSP uses script-src 'self' (no inline hash)
- prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user)
- Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main
- verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-04 06:21:35 +02:00
cesnimda