From fd75003e173f31abf6bf5aed64cba8246d4f0076 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 19 Oct 2026 11:38:44 +0200 Subject: [PATCH] webpage: the four git-syncs read Gitea in-cluster; sidecars retry forever (--max-failures=-1); gate 6 keeps the --repo values identical On 2026-10-19 09:24 the public path to Gitea failed once and the sidecar exited (max-failures defaults to 0). Anonymous in-cluster fetch proven first (main and installer-v1.34.0 resolve to the public hashes). --- .claude/rules/manifests.md | 4 +++- .../architecture/01-topology-and-trust.md | 7 +++++++ manifests/webpage.yaml | 16 ++++++++++++---- scripts/CHANGELOG.md | 10 ++++++++++ scripts/hostinstall_gates.py | 9 +++++++++ 5 files changed, 41 insertions(+), 5 deletions(-) diff --git a/.claude/rules/manifests.md b/.claude/rules/manifests.md index 98fe978a..beb7db31 100644 --- a/.claude/rules/manifests.md +++ b/.claude/rules/manifests.md @@ -29,5 +29,7 @@ ArgoCD's source of truth is the **manifest in git**: `main`, and `/scripts/` from the tag `installer-v`. Changing either `--ref` changes what real machines download — the init container **and** the sidecar both carry it, and both must move together. `hostinstall_gates.py` gate 6 fails if the manifest stops naming an `installer-v…` -tag or if the website stops tracking `main`. The full publish/rollback procedure is the R-110 fence +tag or if the website stops tracking `main`. All four git-sync containers (two sidecars, two init containers) read +Gitea **in-cluster** (`http://gitea.gitea-system.svc.cluster.local:3000/…`, since 2026-10-19) and must name the same +repo — gate 6 fails if they differ; the sidecars carry `--max-failures=-1` (retry, never exit). The full publish/rollback procedure is the R-110 fence in the repo core `CLAUDE.md`. diff --git a/documentation/architecture/01-topology-and-trust.md b/documentation/architecture/01-topology-and-trust.md index 9e8dd41d..43998728 100644 --- a/documentation/architecture/01-topology-and-trust.md +++ b/documentation/architecture/01-topology-and-trust.md @@ -271,6 +271,13 @@ app. Controller down → the gated app answers an error, never the app. Measured tunnel. Since controller v0.286.0 it sits ALONE on the `felhom-tunnel` network at the fixed address `172.16.253.2` (traefik at `.3`), so traefik can believe forwarded headers from it and from nothing else (§5). Geo-restriction WAF is **hub-enforced** (the hub holds the CF API token; the controller only reports geo desired-state). +- **[DESIGN] The website's content comes from Gitea IN-CLUSTER** (2026-10-19). The `felhom-webpage` pod pulls + `website/` (from `main`) and `scripts/` (from the `installer-v…` tag, R-110) with four git-syncs that read + `http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git` — plain HTTP, safe only because it never + leaves the cluster (the hub's own Gitea client does the same). No internet hop: the pod can start, and keep its copy + fresh, during an internet outage. The two sidecars run with `--max-failures=-1`, so an unreachable Gitea is retried, + not a restart. **This ties the website to the DooPlex cluster:** moved elsewhere, it must read the public HTTPS + address again. `scripts/hostinstall_gates.py` gate 6 keeps the four `--repo` values identical. --- diff --git a/manifests/webpage.yaml b/manifests/webpage.yaml index f27c5775..8d9acc3a 100644 --- a/manifests/webpage.yaml +++ b/manifests/webpage.yaml @@ -296,14 +296,21 @@ spec: # ── The WEBSITE sync — tracks `main`, unchanged cadence ────────────────────────────── # Deliberately still a branch: the site is content, and a typo fix must reach felhom.eu in # thirty seconds without cutting a release. Only /scripts/ moved to a tag (R-110). + # + # All four git-syncs read Gitea IN-CLUSTER (plain HTTP, never leaves the cluster — the hub's own Gitea + # client does the same): no internet hop, so the pod can start during an internet outage (2026-10-19 09:24 + # the public path failed once and the sidecar restarted). If the website ever leaves the DooPlex cluster, + # this must go back to https://gitea.dooplex.hu/admin/felhom.eu.git. `hostinstall_gates.py` gate 6 fails + # if the four `--repo` values differ. - name: git-sync image: registry.k8s.io/git-sync/git-sync:v4.4.0 args: - - --repo=https://gitea.dooplex.hu/admin/felhom.eu.git + - --repo=http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git - --ref=main - --root=/git - --link=current - --period=30s + - --max-failures=-1 # an outage must not restart the sidecar (git-sync v4.4.0 main.go L922: <0 = retry forever) # Only sync the website subdirectory - --sparse-checkout-file=/etc/git-sync/sparse-checkout volumeMounts: @@ -336,11 +343,12 @@ spec: - name: git-sync-scripts image: registry.k8s.io/git-sync/git-sync:v4.4.0 args: - - --repo=https://gitea.dooplex.hu/admin/felhom.eu.git + - --repo=http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git - --ref=installer-v1.34.0 - --root=/git-scripts - --link=current - --period=30s + - --max-failures=-1 # an outage must not restart the sidecar (git-sync v4.4.0 main.go L922: <0 = retry forever) - --sparse-checkout-file=/etc/git-sync-scripts/sparse-checkout volumeMounts: - name: git-data-scripts @@ -365,7 +373,7 @@ spec: - name: git-sync-init image: registry.k8s.io/git-sync/git-sync:v4.4.0 args: - - --repo=https://gitea.dooplex.hu/admin/felhom.eu.git + - --repo=http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git - --ref=main - --root=/git - --link=current @@ -381,7 +389,7 @@ spec: - name: git-sync-scripts-init image: registry.k8s.io/git-sync/git-sync:v4.4.0 args: - - --repo=https://gitea.dooplex.hu/admin/felhom.eu.git + - --repo=http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git - --ref=installer-v1.34.0 - --root=/git-scripts - --link=current diff --git a/scripts/CHANGELOG.md b/scripts/CHANGELOG.md index 7ff8782c..ba9c9e32 100644 --- a/scripts/CHANGELOG.md +++ b/scripts/CHANGELOG.md @@ -1,3 +1,13 @@ +## 2026-10-19 — the website's git-syncs read Gitea in-cluster and retry forever (`manifests/webpage.yaml`, gate 6) + +On 2026-10-19 09:24 the public path to Gitea failed once; git-sync v4.4.0 (`--max-failures` defaults to 0) exited +(`too many failures, aborting … failCount:1`) and the sidecar restarted. Visitors saw nothing, but a pod starting +during an outage could not seed its pages at all. All four git-sync containers now read +`http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git` (anonymous fetch proven first: `main` and +`installer-v1.34.0` resolve in-cluster to the same hashes as the public address); the two sidecars carry +`--max-failures=-1`. `hostinstall_gates.py` gate 6 now also fails when the four `--repo` values differ (red-proved: +one changed → FAIL, restored → OK). Refs unchanged; `nginx-config-rev` unchanged. + ## 2026-10-18 — CI workflow: the failure mail links the public run page, by run id (R-1135) `.gitea/workflows/gates.yml`, the alarm step: the mail's run link is now `https://gitea.dooplex.hu//actions/runs/`. diff --git a/scripts/hostinstall_gates.py b/scripts/hostinstall_gates.py index 25f2f836..7118817e 100644 --- a/scripts/hostinstall_gates.py +++ b/scripts/hostinstall_gates.py @@ -216,6 +216,15 @@ if wp is not None: else: fail("manifests/webpage.yaml no longer tracks main for the website — pinning the SITE to " "the installer tag turns every copy edit into a release") + # All four git-sync containers (two sidecars, two init containers) must read the SAME repo: they moved to + # the in-cluster Gitea address together (2026-10-19), and an init container left on another URL seeds the + # pod from a different source than the sidecar that keeps it fresh. + repos = re.findall(r'--repo=(\S+)', wp) + if len(repos) == 4 and len(set(repos)) == 1: + ok("manifest: all four git-syncs read the same repo (%s)" % repos[0]) + else: + fail("manifests/webpage.yaml: the git-sync `--repo` values differ or are not four (%s) — the " + "sidecars and init containers must read one repo" % ", ".join(repos)) # ── R-185: every path that RESOLVES the backup target must also grant on it ────────────────── #