harden Hugo build and remove unused CMS

.dockerignore

@@ -0,0 +1,18 @@
+# Send only files required by the Hugo build and SWS runtime stages.
+*
+
+!Dockerfile
+!go.mod
+!go.sum
+!sws.toml
+
+!assets/
+!assets/**
+!config/
+!config/**
+!content/
+!content/**
+!layouts/
+!layouts/**
+!static/
+!static/**

.gitea/workflows/build-docker-images.yml

@@ -43,8 +43,6 @@ jobs:
           context: .
           platforms: linux/arm64, linux/amd64
           push: true
-          build-args: |
-            BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
           tags: |
             ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
             ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
@@ -97,12 +95,34 @@ jobs:
             && echo "NetBird management connected." \
             || { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }
 
-      - name: Deploy to talos-prod
+      - name: Deploy image to talos-prod
         uses: actions-hub/kubectl@v1.36.2
         env:
           KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
         with:
-          args: get pods
+          args: >-
+            -n blog-ahmza-com
+            set image deployment/blog
+            blog=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
+
+      - name: Wait for rollout
+        uses: actions-hub/kubectl@v1.36.2
+        env:
+          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+        with:
+          args: >-
+            -n blog-ahmza-com
+            rollout status deployment/blog
+            --timeout=5m
+
+      - name: Show deployed pods
+        uses: actions-hub/kubectl@v1.36.2
+        env:
+          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+        with:
+          args: >-
+            -n blog-ahmza-com
+            get pods -o wide
 
       - name: NetBird diagnostics & disconnect
         # Runs even on failure: captures final state for debugging and tears the

.gitignore

@@ -5,5 +5,4 @@ styles/
 node_modules
 public/
 resources/
-go.sum
 themes/

Dockerfile

@@ -3,9 +3,17 @@
 # under QEMU emulation). Hugo output is static HTML — identical across arches —
 # so there's no reason to run it per target arch. The runtime stage below stays
 # on TARGETPLATFORM, so multi-arch (amd64 + arm64) runtime images are preserved.
-FROM --platform=$BUILDPLATFORM ghcr.io/hugomods/hugo:0.157.0 AS build
+FROM --platform=$BUILDPLATFORM ghcr.io/hugomods/hugo:0.165.0 AS build
 WORKDIR /tmp/hugo
-COPY . .
+
+COPY go.mod go.sum ./
+COPY config ./config
+RUN hugo mod graph
+
+COPY assets ./assets
+COPY content ./content
+COPY layouts ./layouts
+COPY static ./static
 RUN hugo --gc --minify
 
 FROM ghcr.io/static-web-server/static-web-server:2

config/_default/languages.en.toml

@@ -1,5 +1,5 @@
-languageCode = "en"
+locale = "en"
-languageName = "English"
+label = "English"
 weight = 1
 title = "ahmza's ramblings"
 

config/_default/module.toml

@@ -1,3 +1,3 @@
 [[imports]]
 disable = false
-path = "github.com/nunocoracao/blowfish/v2"
+path = "github.com/nunocoracao/blowfish/v3"

go.mod

@@ -2,4 +2,4 @@ module github.com/ahmzaa/blog-ahmza-com
 
 go 1.24.3
 
-require github.com/nunocoracao/blowfish/v2 v2.86.0 // indirect
+require github.com/nunocoracao/blowfish/v3 v3.4.0

go.sum

@@ -0,0 +1,2 @@
+github.com/nunocoracao/blowfish/v3 v3.4.0 h1:Fv7mS97lagllTGzHA2V1H6+N5fuQd3DuWmOQlFFV4Aw=
+github.com/nunocoracao/blowfish/v3 v3.4.0/go.mod h1:8lJwR95VgcyWDhjKvUJMdOQXogrmhYSxkWh4ogSJfCg=

static/admin/config.yml

@@ -1,69 +0,0 @@
-## Commit messages
-backend:
-  name: github
-  repo: ahmzaa/blog-ahmza-com
-  branch: main
-  squash_merges: true
-  base_url: https://sveltia-cms-auth.hamzaahmed12328.workers.dev
-  use_graphql: true
-  commit_messages:
-    create: Create {{collection}} "{{slug}}"
-    update: Update {{collection}} "{{slug}}"
-    delete: Delete {{collection}} "{{slug}}"
-    uploadMedia: Upload "{{path}}"
-    deleteMedia: Delete "{{path}}"
-    openAuthoring: '{{message}}'
-
-## Publish mode
-publish_mode: editorial_workflow # Allowed Values: simple, editorial_workflow
-
-## Media and Public folders
-#Media
-media_folder: "assets/uploaded/img"
-public_folder: "/uploaded/img"
-
-## SiteTitle
-site_url: https://blog.ahmza.com
-display_url: blog.ahmza.com
-logo_url: https://blog.ahmza.com/logo.webp
-
-## Collections
-collections:
-  - name: posts
-    identifier_field: name
-    label: posts
-    label_singular: post
-    icon: article
-    description: sites main content, blog posts
-    folder: "content/posts"
-    path: "{{slug}}/index"
-    media_folder: ""
-    public_folder: ""
-    create: true
-    slug: '{{slug}}'
-    fields:
-      - {label: "Title", name: "title", widget: "string"}
-      - {label: "Featured Image", name: "featureimage", widget: "image"}
-      - {label: "Featured Image Caption", name: "featureimagecaption", widget: "string"}
-      - {label: "Publish Date", name: "date", widget: "datetime", default: "{{now}}", date_format: "YYYY-MM-DD"}
-      - {label: "Last Modified", name: "lastmod", widget: "datetime", default: "{{now}}", date_format: "YYYY-MM-DD"}
-      - {label: "Author", name: "author", widget: "string", default: "ahmza"}
-      - {label: "Draft", name: "draft", widget: "boolean", default: "false"}
-      - {label: "Tags", name: "tags", widget: "list"}
-      - {label: "Description", name: "description", widget: "string"}
-      - {label: "Body", name: "body", widget: "markdown"}
-    extension: md
-    sortable_fields: ['title', 'date', 'lastmod', 'tags']
-    view_filters:
-      - label: "ahmza's posts"
-        field: author
-        pattern: 'ahmza'
-      - label: Drafts
-        field: draft
-        pattern: true
-    view_groups:
-      - label: Year
-        field: date
-        pattern: \d{4}
-      - label: Drafts
-        field: draft

static/admin/index.html

@@ -1,20 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta name="robots" content="noindex" />
-    <title>Content Manager</title>
-    <!-- Include the script that enables Netlify Identity on this page. -->
-  </head>
-  <body>
-    <!-- Sveltia CMS, pinned to a specific version with Subresource Integrity.
-         Bump the version + regenerate the integrity hash when upgrading:
-         curl -sS https://cdn.jsdelivr.net/npm/@sveltia/cms@<ver>/dist/sveltia-cms.js \
-           | openssl dgst -sha384 -binary | openssl base64 -A -->
-    <script
-      src="https://cdn.jsdelivr.net/npm/@sveltia/cms@0.172.4/dist/sveltia-cms.js"
-      integrity="sha384-Sj4Mfbg9OjjwG2ZE/YeUYu7xbZRTXGFg/wa/nszj3KzItKuRLEmGqSpV5C9YI2Ge"
-      crossorigin="anonymous"></script>
-  </body>
-</html>