feature: port the entire project to k3s

2026-09-26 13:50:13 +02:00
parent c680c3558f
commit e5ade4b3ba
7 changed files with 192 additions and 1 deletions
@@ -1,3 +1,58 @@
 # website

-Simple greeter.
+Simple greeter — the landing page at [0x29a.ch](https://0x29a.ch).
+
+Previously a stock `nginx` container on the old Docker host, serving a bind-mounted
+`/mnt/docker/website/html`. It now ships as a self-contained image (content baked in)
+and runs on the k3s cluster behind the Hetzner Caddy.
+
+## Layout
+
+```
+index.html           the greeter
+_css/styles.css      styling
+_img/ft.jpg          background image
+favicon.ico          favicon
+robots.txt           disallow all
+Dockerfile           nginx:1.29-alpine + the static files
+devenv.nix           dev shell: podman
+```
+
+## Build & push the image
+
+Images live in the Gitea container registry under `git.0x29a.ch/aaron/website`.
+`podman` reads the `Dockerfile` natively — a drop-in for `docker`.
+
+```sh
+podman build -t git.0x29a.ch/aaron/website:1.0.0 .
+podman login git.0x29a.ch                 # Gitea user + a token with write:package
+podman push git.0x29a.ch/aaron/website:1.0.0
+```
+
+Run it locally to smoke-test:
+
+```sh
+podman run --rm -p 8080:80 git.0x29a.ch/aaron/website:1.0.0
+```
+
+## Deploy to k3s
+
+Deployed via the Helm chart in `helm-k3s-lab-gitops/apps/website`, synced by ArgoCD.
+The package is private, so the namespace needs a pull secret referenced by the chart's
+`image.pullSecret` (default `gitea-registry`):
+
+```sh
+kubectl create secret docker-registry gitea-registry \
+  --docker-server=git.0x29a.ch \
+  --docker-username=<user> \
+  --docker-password=<gitea-token> \
+  -n website
+```
+
+Then bump `image.tag` in the chart's `values.yaml` and commit; ArgoCD rolls it out from
+`main`. (Make the Gitea package public instead and set `image.pullSecret: ""` to drop the
+secret entirely.)
+
+Traefik holds Ingress rules for both `0x29a.ch` and `www.0x29a.ch`. TLS is terminated at
+the edge by Caddy on the Hetzner box, which reverse-proxies to the three k3s nodes over
+Tailscale — see `ansible-play-infra/inventory/host_vars/0x29a.ch.yml`.