update to argo deploy method

Reverts ea19586b04, which belonged in ahmza.com/k8s-starter-pack. Restore the blog tree without rewriting history.

.dockerignore

@@ -0,0 +1,18 @@
+# Send only files required by the Hugo build and SWS runtime stages.
+*
+
+!Dockerfile
+!go.mod
+!go.sum
+!sws.toml
+
+!assets/
+!assets/**
+!config/
+!config/**
+!content/
+!content/**
+!layouts/
+!layouts/**
+!static/
+!static/**

.gitea/scripts/update_gitops_image.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Record a built blog image digest without requiring a YAML package in CI."""
+
+import re
+import sys
+from pathlib import Path
+
+REPOSITORY = "tea.ahmza.com/ahmza/blog-ahmza-com"
+DIGEST_IMAGE = re.compile(re.escape(REPOSITORY) + r"@sha256:[0-9a-f]{64}\Z")
+IMAGE_LINE = re.compile(
+    r"(?m)^(?P<prefix> +image: )"
+    + re.escape(REPOSITORY)
+    + r"(?::[A-Za-z0-9_][A-Za-z0-9_.-]*|@sha256:[0-9a-f]{64})"
+    + r"(?P<suffix>[ \t]*(?:#[^\n]*)?)$"
+)
+
+
+def update_image(manifest: Path, image: str) -> bool:
+    """Replace exactly one blog image; reject mutable or unexpected image input."""
+    if not DIGEST_IMAGE.fullmatch(image):
+        raise ValueError("expected the blog repository with a sha256 image digest")
+
+    original = manifest.read_text()
+    matches = list(IMAGE_LINE.finditer(original))
+    if len(matches) != 1:
+        raise ValueError(f"expected exactly one blog image line, found {len(matches)}")
+
+    updated = IMAGE_LINE.sub(
+        lambda match: match["prefix"] + image + match["suffix"], original
+    )
+    if updated == original:
+        return False
+    manifest.write_text(updated)
+    return True
+
+
+def main() -> int:
+    if len(sys.argv) != 3:
+        print("usage: update_gitops_image.py MANIFEST IMAGE@sha256:DIGEST", file=sys.stderr)
+        return 2
+    try:
+        changed = update_image(Path(sys.argv[1]), sys.argv[2])
+    except (OSError, ValueError) as error:
+        print(f"Cannot update GitOps image: {error}", file=sys.stderr)
+        return 1
+    print("GitOps image updated" if changed else "GitOps image already current")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.gitea/tests/test_update_gitops_image.py

@@ -0,0 +1,83 @@
+"""Exercise the exact image update helper used by the publishing workflow."""
+
+import importlib.util
+import tempfile
+import unittest
+from pathlib import Path
+
+SCRIPT = Path(__file__).resolve().parents[1] / "scripts" / "update_gitops_image.py"
+SPEC = importlib.util.spec_from_file_location("update_gitops_image", SCRIPT)
+assert SPEC is not None and SPEC.loader is not None
+MODULE = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(MODULE)
+REPOSITORY = "tea.ahmza.com/ahmza/blog-ahmza-com"
+IMAGE = REPOSITORY + "@sha256:" + "a" * 64
+
+
+class UpdateImageTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.manifest = Path(self.directory.name) / "deployment.yaml"
+
+    def test_replaces_only_blog_image_and_preserves_other_fields(self):
+        original = (
+            "spec:\n"
+            "  containers:\n"
+            "    - name: blog\n"
+            f"      image: {REPOSITORY}:latest\n"
+            "    - name: other\n"
+            "      image: example.org/other:latest\n"
+        )
+        self.manifest.write_text(original)
+        self.assertTrue(MODULE.update_image(self.manifest, IMAGE))
+        self.assertEqual(
+            self.manifest.read_text(), original.replace(REPOSITORY + ":latest", IMAGE)
+        )
+
+    def test_existing_digest_update_preserves_comment(self):
+        self.manifest.write_text(
+            "          image: " + REPOSITORY + "@sha256:" + "b" * 64 + " # keep\n"
+        )
+        self.assertTrue(MODULE.update_image(self.manifest, IMAGE))
+        self.assertEqual(self.manifest.read_text(), "          image: " + IMAGE + " # keep\n")
+
+    def test_same_digest_is_noop(self):
+        text = "          image: " + IMAGE + "\n"
+        self.manifest.write_text(text)
+        self.assertFalse(MODULE.update_image(self.manifest, IMAGE))
+        self.assertEqual(self.manifest.read_text(), text)
+
+    def test_missing_or_duplicate_image_fails_without_modification(self):
+        for text in ["spec: {}\n", ("          image: " + IMAGE + "\n") * 2]:
+            with self.subTest(text=text):
+                self.manifest.write_text(text)
+                with self.assertRaises(ValueError):
+                    MODULE.update_image(self.manifest, IMAGE)
+                self.assertEqual(self.manifest.read_text(), text)
+
+    def test_rejects_unexpected_or_mutable_image_input(self):
+        text = "          image: " + REPOSITORY + ":latest\n"
+        self.manifest.write_text(text)
+        for image in [
+            REPOSITORY + ":latest",
+            REPOSITORY + "@sha256:short",
+            "example.org/untrusted@sha256:" + "a" * 64,
+            IMAGE + "\nimage: injected",
+            REPOSITORY + "@sha256:" + "A" * 64,
+        ]:
+            with self.subTest(image=image):
+                with self.assertRaises(ValueError):
+                    MODULE.update_image(self.manifest, image)
+                self.assertEqual(self.manifest.read_text(), text)
+
+    def test_refuses_partial_repository_match(self):
+        text = "          image: " + REPOSITORY + "-other:latest\n"
+        self.manifest.write_text(text)
+        with self.assertRaises(ValueError):
+            MODULE.update_image(self.manifest, IMAGE)
+        self.assertEqual(self.manifest.read_text(), text)
+
+
+if __name__ == "__main__":
+    unittest.main()

.gitea/workflows/build-docker-images.yml

@@ -0,0 +1,99 @@
+name: Build Hugo
+
+on:
+  push:
+    branches: ["main"]
+
+# Serialize blog publishes so builds cannot update its desired image at once.
+# Other apps may still push to GitOps, so the push step also handles that race.
+concurrency:
+  group: blog-publish
+  cancel-in-progress: false
+
+env:
+  REGISTRY: tea.ahmza.com
+  IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Check GitOps update helper
+        run: python3 -m unittest discover -s .gitea/tests -v
+
+      - name: Login to Gitea Container Registry
+        # Pin the v3 release ref so an upstream tag move cannot change CI code.
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.repository_owner }}
+          password: ${{ secrets.GITEATOKEN }}
+
+      # Hugo runs on BUILDPLATFORM; runtime stages only copy static files.
+      # Both amd64 and arm64 images therefore build without QEMU emulation.
+      - name: Set up Docker Buildx
+        # v3, pinned to an immutable commit.
+        # yamllint disable-line rule:line-length
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+
+      - name: Build and push
+        id: build
+        # v6, pinned to an immutable commit.
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+        with:
+          context: .
+          platforms: linux/arm64,linux/amd64
+          push: true
+          tags: |
+            ${{ env.IMAGE }}:latest
+            ${{ env.IMAGE }}:${{ gitea.sha }}
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
+          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max
+
+      - name: Check out cluster GitOps repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+        with:
+          repository: ahmza.com/k8s-starter-pack
+          ref: main
+          # This credential writes only GitOps, separately from registry access.
+          token: ${{ secrets.GITOPS_TOKEN }}
+          path: _gitops
+
+      - name: Record the published image in Git
+        env:
+          BUILD_DIGEST: ${{ steps.build.outputs.digest }}
+          SOURCE_SHA: ${{ gitea.sha }}
+        run: |
+          set -eu
+          deploy_image="${IMAGE}@${BUILD_DIGEST}"
+          python3 .gitea/scripts/update_gitops_image.py \
+            _gitops/apps/blog-ahmza-com/deployment.yaml "$deploy_image"
+
+          cd _gitops
+          if git diff --quiet -- apps/blog-ahmza-com/deployment.yaml; then
+            echo "GitOps already references $deploy_image"
+            exit 0
+          fi
+          git config user.name "gitea-actions[bot]"
+          git config user.email "gitea-actions[bot]@tea.ahmza.com"
+          git add apps/blog-ahmza-com/deployment.yaml
+          git commit -m "Deploy blog ${SOURCE_SHA}"
+
+          # Rebase unrelated app updates; do not force-push or ignore conflicts.
+          for attempt in 1 2 3; do
+            if git push origin HEAD:main; then
+              exit 0
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "GitOps push failed after three attempts" >&2
+              exit 1
+            fi
+            git pull --rebase origin main
+          done

.github/workflows/build-docker-images.yml

@@ -1,86 +0,0 @@
-name: Build Hugo
-
-on:
-  push:
-    branches: [ "main" ]
-
-env:
-  REGISTRY: tea.ahmza.com
-  IMAGE_NAME: ${{ gitea.repository }}
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-
-      - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ gitea.repository_owner }}
-          password: ${{ secrets.GITEATOKEN }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/arm64, linux/amd64
-          push: true
-          build-args: |
-            BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
-          tags: |
-            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
-            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
-          # Registry-backed build cache. The GitHub-hosted 'gha' cache is not
-          # reachable from self-hosted Gitea runners, so store the cache as a
-          # dedicated tag in the same registry instead.
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
-  deploy:
-    runs-on: ubuntu-latest
-    needs: build
-
-    steps:
-      - name: Netbird Connect
-        uses: Alemiz112/netbird-connect@v1
-        with:
-          setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
-          hostname: 'gitea-actions-blog'
-          management-url: ${{ secrets.NETBIRD_URL }}
-
-      - name: Deploy to RPIC-Cluster
-        # RPIC cluster is temporarily out of service. Don't let its failure
-        # block the Gimli deploy or fail the whole job. Remove this line once
-        # the cluster is back.
-        continue-on-error: true
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.RPIC_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.RPIC_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          script: 'kubectl rollout restart deployment blog -n blog-ahmza-com'
-
-      - name: Deploy to Gimli
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.GIMLI_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.GIMLI_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          script: 'docker compose down && docker compose pull && docker compose up -d'

.gitignore

@@ -5,5 +5,8 @@ styles/
 node_modules
 public/
 resources/
-go.sum
 themes/
+
+# CI's separate GitOps checkout and Python helper test artifacts are not source.
+_gitops/
+__pycache__/

Dockerfile

@@ -1,6 +1,19 @@
-FROM ghcr.io/hugomods/hugo:0.157.0 AS build
+# syntax=docker/dockerfile:1
+# Pin the build stage to the native build platform so Hugo runs once (never
+# under QEMU emulation). Hugo output is static HTML — identical across arches —
+# so there's no reason to run it per target arch. The runtime stage below stays
+# on TARGETPLATFORM, so multi-arch (amd64 + arm64) runtime images are preserved.
+FROM --platform=$BUILDPLATFORM ghcr.io/hugomods/hugo:0.165.0 AS build
 WORKDIR /tmp/hugo
-COPY . .
+
+COPY go.mod go.sum ./
+COPY config ./config
+RUN hugo mod graph
+
+COPY assets ./assets
+COPY content ./content
+COPY layouts ./layouts
+COPY static ./static
 RUN hugo --gc --minify
 
 FROM ghcr.io/static-web-server/static-web-server:2

README.md

@@ -33,9 +33,45 @@ sacrificing performance.
 
 ## Implementation
 - **Hugo**: Converts Markdown files into static HTML/CSS/JS files.
-- **Gitea Actions**: Automates the build process and creates Docker images.
+- **Gitea Actions**: Builds amd64/arm64 images and records the exact image digest
+  in the separate GitOps repository.
+- **Argo CD**: Watches that Git commit and reconciles the Kubernetes deployment.
 - **Kubernetes Cluster**: Serves the static files to users.
 
+## GitOps deployment
+
+The workflow in [`.gitea/workflows/build-docker-images.yml`](.gitea/workflows/build-docker-images.yml)
+keeps building and publishing `tea.ahmza.com/ahmza/blog-ahmza-com`. Instead of
+connecting to NetBird and invoking `kubectl`, it commits the published image's
+immutable digest to `apps/blog-ahmza-com/deployment.yaml` in
+[`ahmza.com/k8s-starter-pack`](https://tea.ahmza.com/ahmza.com/k8s-starter-pack).
+Argo CD then performs the rollout; CI success alone is not confirmation that the
+cluster has finished deploying.
+
+Configure these Gitea Actions secrets in this source repository:
+
+- `GITEATOKEN`: the existing registry-push credential.
+- `GITOPS_TOKEN`: a separate least-privilege bot PAT with read/write access to
+  `ahmza.com/k8s-starter-pack`, including permission to push to `main`.
+
+Commit/push the GitOps app manifests **before** enabling this workflow: the
+Deployment file must already exist remotely. Once the migration is verified,
+remove the old `KUBE_CONFIG`, `NETBIRD_SETUP_KEY`, and `NETBIRD_URL` secrets only
+if no other workflows use them. No Kubernetes credentials are needed by this
+workflow. The runner still needs HTTPS access to Gitea and the registry.
+
+The full first-sync, routing, certificate, and rollback checklist is in
+[`docs/13-blog-gitops.md`](https://tea.ahmza.com/ahmza.com/k8s-starter-pack/src/branch/main/docs/13-blog-gitops.md)
+in the GitOps repository. The older [Caddy examples](docs/caddy-reverse-proxy.md)
+are standalone deployment references, not extra components to deploy alongside
+the new ingress-nginx manifests.
+
+Test the standard-library-only image updater locally with:
+
+```sh
+python3 -m unittest discover -s .gitea/tests -v
+```
+
 ## To-Do List
 - [x] Migrate to Kubernetes
 - [x] Migrate to Blowfish theme
@@ -50,5 +86,5 @@ sacrificing performance.
 The Blowfish theme is managed as a Hugo module, so no submodules are required.
 Clone the repository with:
 ```bash
-git clone ssh://gitea@tea.ahmza.com:2222/ahmza/blog-ahmza-com.git
+git clone ssh://git@tea.ahmza.com/ahmza/blog-ahmza-com.git
 ```

config/_default/languages.en.toml

@@ -1,5 +1,5 @@
-languageCode = "en"
+locale = "en"
-languageName = "English"
+label = "English"
 weight = 1
 title = "ahmza's ramblings"
 

config/_default/module.toml

@@ -1,3 +1,3 @@
 [[imports]]
 disable = false
-path = "github.com/nunocoracao/blowfish/v2"
+path = "github.com/nunocoracao/blowfish/v3"

content/posts/welcome/index.md

@@ -15,7 +15,7 @@ lastmod:
 
 The mandatory hello world when you start something new.
 
-I'd like to say thank you for visiting this site.
+I'd like to say thank you for visiting this site :D
 
 ### A Bit about Me
 

go.mod

@@ -2,4 +2,4 @@ module github.com/ahmzaa/blog-ahmza-com
 
 go 1.24.3
 
-require github.com/nunocoracao/blowfish/v2 v2.86.0 // indirect
+require github.com/nunocoracao/blowfish/v3 v3.4.0

go.sum

@@ -0,0 +1,2 @@
+github.com/nunocoracao/blowfish/v3 v3.4.0 h1:Fv7mS97lagllTGzHA2V1H6+N5fuQd3DuWmOQlFFV4Aw=
+github.com/nunocoracao/blowfish/v3 v3.4.0/go.mod h1:8lJwR95VgcyWDhjKvUJMdOQXogrmhYSxkWh4ogSJfCg=

layouts/partials/extend-footer.html

@@ -1,6 +1,8 @@
 <br>
 <div class="flex items-center gap-x-5">
 	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://mastodon.social/@ahmza">Mastodon</a>
-	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://github.com/ahmzaa">Github</a>
 	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://www.linkedin.com/in/ahmza/">Linkedin</a>
+	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://github.com/ahmzaa">Github</a>
+	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://gitlab.com/ahmza">Gitlab</a>
+	<a class="text-sm text-neutral-500 dark:text-neutral-400" rel="me noopener noreferrer" target="_blank" href="https://tea.ahmza.com/ahmza">Gitea</a>
 </div>

static/admin/config.yml

@@ -1,69 +0,0 @@
-## Commit messages
-backend:
-  name: github
-  repo: ahmzaa/blog-ahmza-com
-  branch: main
-  squash_merges: true
-  base_url: https://sveltia-cms-auth.hamzaahmed12328.workers.dev
-  use_graphql: true
-  commit_messages:
-    create: Create {{collection}} "{{slug}}"
-    update: Update {{collection}} "{{slug}}"
-    delete: Delete {{collection}} "{{slug}}"
-    uploadMedia: Upload "{{path}}"
-    deleteMedia: Delete "{{path}}"
-    openAuthoring: '{{message}}'
-
-## Publish mode
-publish_mode: editorial_workflow # Allowed Values: simple, editorial_workflow
-
-## Media and Public folders
-#Media
-media_folder: "assets/uploaded/img"
-public_folder: "/uploaded/img"
-
-## SiteTitle
-site_url: https://blog.ahmza.com
-display_url: blog.ahmza.com
-logo_url: https://blog.ahmza.com/logo.webp
-
-## Collections
-collections:
-  - name: posts
-    identifier_field: name
-    label: posts
-    label_singular: post
-    icon: article
-    description: sites main content, blog posts
-    folder: "content/posts"
-    path: "{{slug}}/index"
-    media_folder: ""
-    public_folder: ""
-    create: true
-    slug: '{{slug}}'
-    fields:
-      - {label: "Title", name: "title", widget: "string"}
-      - {label: "Featured Image", name: "featureimage", widget: "image"}
-      - {label: "Featured Image Caption", name: "featureimagecaption", widget: "string"}
-      - {label: "Publish Date", name: "date", widget: "datetime", default: "{{now}}", date_format: "YYYY-MM-DD"}
-      - {label: "Last Modified", name: "lastmod", widget: "datetime", default: "{{now}}", date_format: "YYYY-MM-DD"}
-      - {label: "Author", name: "author", widget: "string", default: "ahmza"}
-      - {label: "Draft", name: "draft", widget: "boolean", default: "false"}
-      - {label: "Tags", name: "tags", widget: "list"}
-      - {label: "Description", name: "description", widget: "string"}
-      - {label: "Body", name: "body", widget: "markdown"}
-    extension: md
-    sortable_fields: ['title', 'date', 'lastmod', 'tags']
-    view_filters:
-      - label: "ahmza's posts"
-        field: author
-        pattern: 'ahmza'
-      - label: Drafts
-        field: draft
-        pattern: true
-    view_groups:
-      - label: Year
-        field: date
-        pattern: \d{4}
-      - label: Drafts
-        field: draft

static/admin/index.html

@@ -1,20 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta name="robots" content="noindex" />
-    <title>Content Manager</title>
-    <!-- Include the script that enables Netlify Identity on this page. -->
-  </head>
-  <body>
-    <!-- Sveltia CMS, pinned to a specific version with Subresource Integrity.
-         Bump the version + regenerate the integrity hash when upgrading:
-         curl -sS https://cdn.jsdelivr.net/npm/@sveltia/cms@<ver>/dist/sveltia-cms.js \
-           | openssl dgst -sha384 -binary | openssl base64 -A -->
-    <script
-      src="https://cdn.jsdelivr.net/npm/@sveltia/cms@0.172.4/dist/sveltia-cms.js"
-      integrity="sha384-Sj4Mfbg9OjjwG2ZE/YeUYu7xbZRTXGFg/wa/nszj3KzItKuRLEmGqSpV5C9YI2Ge"
-      crossorigin="anonymous"></script>
-  </body>
-</html>