mirror of
https://github.com/Patiun/com.gregkilmer.www.git
synced 2026-11-07 19:58:24 +00:00
Claude
754c6482be
- Dockerfile with a check target (typecheck and tests) and one image per service on a pinned Node 22.20 Alpine base, each with only its own production dependencies and a health check. - deploy/compose.yaml: gk-content, gk-admin and gk-site on homelab_network with no host ports, read-only root filesystems, no capabilities, the vault's Site folder mounted into the content service, and backup.dump=sqlite on it. - deploy/deploy.sh builds and checks the commit, restarts the stack, and goes back to the last good tag if it doesn't come up healthy; rollback.sh swaps tags. .gitea/workflows/deploy.yml runs it on a host runner on Cosmos. - docs/deploy.md runbook (settings, runner, mirror, NPM hosts, Turnstile, Healthchecks, backups, cutover) and the stack's inventory note in vault-kit. - Site: trusts X-Forwarded-Host/Proto for gregkilmer.com hosts so form posts pass Astro's origin check behind the proxy; rate limits read CF-Connecting-IP; site URL set for absolute links. - Content service: the held-change webhook carries a Discord-ready message; .env.example lists the core settings. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx
30 lines
1.2 KiB
JavaScript
30 lines
1.2 KiB
JavaScript
// The public site. Pages render on request from the content service's
|
|
// published notes, so a saved note is live within a minute without a rebuild.
|
|
import node from "@astrojs/node";
|
|
import { defineConfig } from "astro/config";
|
|
|
|
export default defineConfig({
|
|
site: "https://gregkilmer.com",
|
|
output: "server",
|
|
adapter: node({ mode: "standalone" }),
|
|
trailingSlash: "never",
|
|
build: { format: "file", assets: "assets" },
|
|
devToolbar: { enabled: false },
|
|
// Behind Nginx Proxy Manager the request arrives over plain http. Trusting
|
|
// X-Forwarded-Host/Proto for these hosts only lets the form posts pass
|
|
// Astro's same-origin check without trusting any other host a client sends.
|
|
security: {
|
|
allowedDomains: [
|
|
{ hostname: "gregkilmer.com", protocol: "https" },
|
|
{ hostname: "*.gregkilmer.com", protocol: "https" },
|
|
],
|
|
},
|
|
server: { host: true, port: Number(process.env.PORT ?? 4330) },
|
|
vite: {
|
|
// cookie is bundled so the server never picks up express's older copy hoisted to the root.
|
|
ssr: { noExternal: ["@gk/ui", "cookie"] },
|
|
// See packages/ui/astro.config.mjs: astro needs its own cookie, not express's.
|
|
environments: { prerender: { resolve: { noExternal: ["cookie"] } } },
|
|
},
|
|
});
|