Oleks
67b07634ae
- app/: Emdash scaffold (Astro 6, node target) with cmses/plugins/pages collections - app/seed/seed.json: WordPress→Emdash parity for kotkanagrilli.fi (~30 entries) - Dockerfile + docker/entrypoint.sh: multi-stage build, single PVC at /app/state - deploy/helm/: chart mirroring emdash-kotkanagrilli (single-replica, sqlite, kotkan) - deploy/fleet-overlay/: HelmRelease/source/image-automation templates for anton-helm-workloads (staging + production) - .woodpecker/container.yaml: arm64 build, three OCI tags per push (immutable 0.1.<pipeline> + floating <branch> + <branch>-latest) - .ddev/: local dev with nginx proxy to emdash on :4321 - README/DEPLOYMENT/ARCHITECTURE/CLAUDE: docs covering the three-repo pipeline (cms-plugins + anton-helm-workloads + Gitea OCI registry)
47 lines
1.7 KiB
YAML
47 lines
1.7 KiB
YAML
# Two secrets per environment:
|
|
# 1. cms-plugins-deploy-key — Flux's SSH key for cloning the production branch
|
|
# of cms-plugins (only `read` on this Gitea repo).
|
|
# One pair is shared between production + production;
|
|
# commit it under whichever env directory is
|
|
# applied first.
|
|
# 2. cms-plugins-production-secrets — env vars consumed by the pod via the
|
|
# chart's `existingSecret`. EMDASH_ENCRYPTION_KEY
|
|
# is required; everything else is optional.
|
|
#
|
|
# These are TEMPLATES — encrypt them with sops before committing to the
|
|
# anton-helm-workloads repo:
|
|
#
|
|
# sops --encrypt --age <recipient-key> secrets.yaml > secrets.enc.yaml
|
|
# mv secrets.enc.yaml secrets.yaml
|
|
#
|
|
# Generation:
|
|
# ssh-keygen -t ed25519 -f /tmp/cms-plugins-deploy -N ""
|
|
# → upload /tmp/cms-plugins-deploy.pub to Gitea: Repo Settings → Deploy
|
|
# Keys → "cms-plugins Flux deploy", read-only.
|
|
# openssl rand -hex 32 → EMDASH_ENCRYPTION_KEY (one per env, do not reuse).
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: cms-plugins-deploy-key
|
|
namespace: flux-system
|
|
type: Opaque
|
|
stringData:
|
|
identity: |
|
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
|
REPLACE_WITH_PRIVATE_KEY
|
|
-----END OPENSSH PRIVATE KEY-----
|
|
identity.pub: |
|
|
ssh-ed25519 REPLACE_WITH_PUBLIC_KEY flux@cms-plugins
|
|
known_hosts: |
|
|
git.oleks.space REPLACE_WITH_HOST_KEY
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: cms-plugins-production-secrets
|
|
namespace: kotkan
|
|
type: Opaque
|
|
stringData:
|
|
EMDASH_ENCRYPTION_KEY: REPLACE_WITH_RANDOM_HEX_32
|