Author SHA1 Message Date
ahmza e133b01b00 Optimize webm videos and webp images
Re-encode all webm meme clips as VP9 at CRF 38 (audio stripped; they are
muted autoplay loops). Downscale oversized images: background.webp
3394->1920 wide q80, profile.webp 1920->512 q85 (animation preserved).

Results:
- webm: 3.2MB -> 1.37MB (-56%)
- webp: 1.2MB -> 0.70MB (-42%)
- Docker image: 23.1MB -> 18.7MB (~42% smaller than the original nginx image)

All videos verified valid/playable; profile.webp animation (5 frames)
kept intact.
2026-07-25 03:20:57 +01:00
ahmza b7145e1323 Remove temporary Netbird connectivity debug step
Build Hugo / build (push) Successful in 1m32s
Build Hugo / deploy (push) Successful in 39s
The deploy pipeline works end-to-end now (Gimli deploys successfully),
so the diagnostic step used to trace the WireGuard/TUN issue is no
longer needed. RPIC continue-on-error is kept until the cluster returns.
2026-07-25 03:07:00 +01:00
ahmza 87867b9f30 Point compose.yml at Gitea registry image with :latest tag
Build Hugo / build (push) Successful in 1m27s
Build Hugo / deploy (push) Successful in 40s
CI pushes to tea.ahmza.com/ahmza/blog-ahmza-com, not ghcr.io, and a
bare reference could resolve to the non-runnable :buildcache tag. Pin
the image to tea.ahmza.com/ahmza/blog-ahmza-com:latest so docker compose
pulls the actual runnable image.
2026-07-25 03:02:39 +01:00
ahmza 8a7833e8f5 Make RPIC deploy non-blocking while cluster is out of service
Build Hugo / build (push) Successful in 1m26s
Build Hugo / deploy (push) Failing after 38s
The Raspberry Pi cluster is temporarily out of service. Mark its deploy
step continue-on-error so its failure no longer skips the Gimli deploy
or fails the whole job. Revert once the cluster is back online.
2026-07-25 02:42:15 +01:00
ahmza 4426668518 Use registry build cache instead of gha cache
Build Hugo / build (push) Successful in 3m23s
Build Hugo / deploy (push) Failing after 39s
The GitHub-hosted 'gha' cache backend is unreachable from the
self-hosted Gitea runner (dial tcp 172.18.0.2:44181 i/o timeout), which
failed the build step even though the image pushed successfully. Switch
cache-from/cache-to to a registry-backed cache stored as a :buildcache
tag in the same Gitea registry, which works on self-hosted runners.
2026-07-25 02:21:38 +01:00
ahmza eacf71d676 Debug: check runner WireGuard capability instead of UDP ports
Build Hugo / build (push) Failing after 13m45s
Build Hugo / deploy (push) Skipped
Other Netbird peers connect fine, so the server and 51820/udp are OK --
the hang is specific to the Gitea runner. Replace the UDP port probes
with runner-side checks: /dev/net/tun presence, effective capabilities
(NET_ADMIN), WireGuard tooling/module, and a definitive 'ip tuntap add'
test. A runner container lacking TUN/NET_ADMIN cannot create the
WireGuard interface, which explains 'netbird up' timing out after the
control plane connects.
2026-07-25 01:53:09 +01:00
ahmza b05814980f Update Netbird debug to probe correct data-plane ports
Build Hugo / build (push) Successful in 1m47s
Build Hugo / deploy (push) Failing after 1m15s
The Netbird server multiplexes management + signal + dashboard behind
Traefik on :443 (no separate :10000 signal port). The tunnel data plane
is WireGuard on 51820/udp and STUN on 3478/udp. Update the debug step to
probe those UDP ports plus a general outbound-UDP check (public STUN) to
determine whether the runner network blocks UDP egress -- the likely
cause of 'netbird up' timing out after the control plane connects fine.
2026-07-25 01:46:28 +01:00
ahmza eb67d6361e Add Netbird connectivity debug step to deploy job
Build Hugo / build (push) Successful in 1m44s
Build Hugo / deploy (push) Failing after 1m8s
Temporary diagnostic step before 'Netbird Connect' that checks secret
presence (masked), DNS resolution, HTTPS reachability to the management
API, and the signal server TCP port from the runner. Helps distinguish
DNS/connectivity issues from auth/registration failures behind the
recurring 'netbird up' DeadlineExceeded error. Marked continue-on-error
so it never blocks the build.
2026-07-25 01:39:09 +01:00
ahmza 8062b9d208 Read Netbird management URL from secret
Build Hugo / build (push) Successful in 1m46s
Build Hugo / deploy (push) Failing after 58s
Switch the deploy job's Netbird Connect step to read management-url from
the NETBIRD_URL secret instead of a hardcoded value, so the URL can be
managed in the Gitea UI alongside the setup key.
2026-07-25 01:33:47 +01:00
ahmza aa01def998 Merge pull request 'Optimizations: switch to static-web-server + Caddy reverse proxy docs' (#1) from optimizations into main
Build Hugo / build (push) Successful in 1m51s
Build Hugo / deploy (push) Failing after 57s
Reviewed-on: #1
2026-07-25 00:19:53 +00:00
ahmza f23fe01f3c Fix GitLab/Gitea inconsistency in README
Build Hugo / deploy (push) Canceled after 0s
Build Hugo / build (push) Canceled after 48s
Update the README to reflect the actual infrastructure: CI/CD runs on
Gitea Actions (not GitLab), images live in the Gitea container registry,
and the clone URL points to tea.ahmza.com. Also clarify the Blowfish
theme is a Hugo module, so no submodules are needed.
2026-07-25 01:19:29 +01:00
16 changed files with 19 additions and 11 deletions
+10 -3
View File
@@ -46,8 +46,11 @@ jobs:
tags: | tags: |
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }} ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
cache-from: type=gha # Registry-backed build cache. The GitHub-hosted 'gha' cache is not
cache-to: type=gha,mode=max # reachable from self-hosted Gitea runners, so store the cache as a
# dedicated tag in the same registry instead.
cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
deploy: deploy:
runs-on: ubuntu-latest runs-on: ubuntu-latest
needs: build needs: build
@@ -58,9 +61,13 @@ jobs:
with: with:
setup-key: ${{ secrets.NETBIRD_SETUP_KEY }} setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
hostname: 'gitea-actions-blog' hostname: 'gitea-actions-blog'
management-url: 'https://netbird.ahmza.com' management-url: ${{ secrets.NETBIRD_URL }}
- name: Deploy to RPIC-Cluster - name: Deploy to RPIC-Cluster
# RPIC cluster is temporarily out of service. Don't let its failure
# block the Gimli deploy or fail the whole job. Remove this line once
# the cluster is back.
continue-on-error: true
uses: appleboy/ssh-action@v1 uses: appleboy/ssh-action@v1
with: with:
host: ${{ secrets.RPIC_HOST }} host: ${{ secrets.RPIC_HOST }}
+8 -7
View File
@@ -4,10 +4,10 @@
This repository contains the source code for my personal blog hosted at [blog.ahmza.com](https://blog.ahmza.com). This repository contains the source code for my personal blog hosted at [blog.ahmza.com](https://blog.ahmza.com).
## Features ## Features
Using GitLab provides several advantages: Using Gitea provides several advantages:
- **Highly Customizable CI/CD Pipelines**: Automated processes for building and deploying the blog. - **Highly Customizable CI/CD Pipelines**: Automated processes for building and deploying the blog via Gitea Actions.
- **GitLab Container Image Repository**: Efficient management and storage of container images. - **Gitea Container Image Repository**: Efficient management and storage of container images.
- **Custom GitLab Runners**: Flexibility in managing the CI/CD environment. - **Custom Gitea Runners**: Flexibility in managing the CI/CD environment.
The CI/CD pipeline is configured to build the blog for both amd64 and arm64 The CI/CD pipeline is configured to build the blog for both amd64 and arm64
architectures, allowing me to host the site on my [Pi cluster](https://blog.ahmza.com/posts/pi-docker-swarm/) architectures, allowing me to host the site on my [Pi cluster](https://blog.ahmza.com/posts/pi-docker-swarm/)
@@ -33,7 +33,7 @@ sacrificing performance.
## Implementation ## Implementation
- **Hugo**: Converts Markdown files into static HTML/CSS/JS files. - **Hugo**: Converts Markdown files into static HTML/CSS/JS files.
- **GitLab CI/CD**: Automates the build process and creates Docker images. - **Gitea Actions**: Automates the build process and creates Docker images.
- **Kubernetes Cluster**: Serves the static files to users. - **Kubernetes Cluster**: Serves the static files to users.
## To-Do List ## To-Do List
@@ -47,7 +47,8 @@ sacrificing performance.
## Notes ## Notes
### Cloning the Repository ### Cloning the Repository
To clone this repository along with its submodules, use the following command: The Blowfish theme is managed as a Hugo module, so no submodules are required.
Clone the repository with:
```bash ```bash
git clone git@gitlab.com:ahmza/blog.git git clone ssh://gitea@tea.ahmza.com:2222/ahmza/blog-ahmza-com.git
``` ```
Binary file not shown.

Before

Width:  |  Height:  |  Size: 782 KiB

After

Width:  |  Height:  |  Size: 441 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 254 KiB

After

Width:  |  Height:  |  Size: 73 KiB

+1 -1
View File
@@ -1,6 +1,6 @@
services: services:
blog: blog:
image: ghcr.io/ahmzaa/blog-ahmza-com image: tea.ahmza.com/ahmza/blog-ahmza-com:latest
ports: ports:
- 80:80 - 80:80
restart: unless-stopped restart: unless-stopped
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.