admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ddbcabebb4e380e4c8c679efd92a3aa10d5f2dbe
felhom.eu/.claude/rules/manifests.md
T
adminandClaude Opus 5.5 c28ce7ce2f
gates / gates (push) Successful in 3m25s
Details
R-1228: retire DooPlex's copy of the website (operator yes); the installer pin moves to INSTALLER-TAG 
- INSTALLER-TAG (one line) is the only installer pin; publish-site-cloudflare.sh reads it.
- hostinstall gate 6c: pin file holds one tag, no manifest pins one, publish script takes
  the site from origin/main and scripts/ from the tag. Red seen on five mutants.
- manifests: webpage.yaml keeps only FileBrowser; contact-mailer.yaml loses the old
  felhom.eu/api Ingress (an orphan: glued to the next doc by a `80---` typo).
- R-110 fence text, manifests/website rules, build skill, runbooks, poster facts updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-11-07 23:10:21 +01:00

1.4 KiB
Raw Blame History

paths
paths
manifests/**
**/*.yaml

Manifests — ArgoCD, deliberate sync, secrets

One app, and auto-sync is OFF

The whole cluster is GitOps via a single ArgoCD app felhom syncing this repo's manifests/ to the felhom-system namespace. Auto-sync is OFF — a deploy is a deliberate manual sync.

ArgoCD's source of truth is the manifest in git:

  • Committing a manifest change deploys nothing until the app is synced.
  • Pin explicit image versions, never :latest.
  • Never bare kubectl set image / kubectl apply — the next sync reverts it, so the fix looks like it worked and then silently disappears.
  • Sync method (hard-refresh + sync, local sudo kubectl): the felhom-build-deploy skill.

Secrets

  • Out-of-band secretKeyRef only — never inline stringData (REUSE.md §3).
  • manifest_bearer_gate.py fails on any bearer-shaped literal anywhere under manifests/. It runs from python3 scripts/repo_gates.py.

The installer is no longer served from a manifest

Until 2026-11-07 manifests/webpage.yaml ran DooPlex's copy of the website and pinned the installer tag in two --ref lines. That copy is retired (R-1228); webpage.yaml now holds only FileBrowser. The installer tag lives in INSTALLER-TAG at the repo root, and hostinstall_gates.py gate 6 fails if any manifest pins one again. The full publish/rollback procedure is the R-110 fence in the repo core CLAUDE.md.

Reference in new issue View Git Blame Copy Permalink