adminandClaude Opus 5.5
c28ce7ce2f
gates / gates (push) Successful in 3m25s
- INSTALLER-TAG (one line) is the only installer pin; publish-site-cloudflare.sh reads it. - hostinstall gate 6c: pin file holds one tag, no manifest pins one, publish script takes the site from origin/main and scripts/ from the tag. Red seen on five mutants. - manifests: webpage.yaml keeps only FileBrowser; contact-mailer.yaml loses the old felhom.eu/api Ingress (an orphan: glued to the next doc by a `80---` typo). - R-110 fence text, manifests/website rules, build skill, runbooks, poster facts updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
32 lines
1.4 KiB
Markdown
32 lines
1.4 KiB
Markdown
---
|
|
paths: ["manifests/**", "**/*.yaml"]
|
|
---
|
|
|
|
# Manifests — ArgoCD, deliberate sync, secrets
|
|
|
|
## One app, and auto-sync is OFF
|
|
|
|
The whole cluster is GitOps via a **single ArgoCD app `felhom`** syncing this repo's `manifests/` to
|
|
the `felhom-system` namespace. **Auto-sync is OFF — a deploy is a deliberate manual sync.**
|
|
|
|
ArgoCD's source of truth is the **manifest in git**:
|
|
|
|
- Committing a manifest change deploys nothing until the app is synced.
|
|
- **Pin explicit image versions, never `:latest`.**
|
|
- **Never bare `kubectl set image` / `kubectl apply`** — the next sync reverts it, so the fix looks
|
|
like it worked and then silently disappears.
|
|
- Sync method (hard-refresh + sync, local `sudo kubectl`): the **`felhom-build-deploy`** skill.
|
|
|
|
## Secrets
|
|
|
|
- **Out-of-band `secretKeyRef` only — never inline `stringData`** (`REUSE.md` §3).
|
|
- `manifest_bearer_gate.py` fails on any bearer-shaped literal anywhere under `manifests/`. It runs
|
|
from `python3 scripts/repo_gates.py`.
|
|
|
|
## The installer is no longer served from a manifest
|
|
|
|
Until 2026-11-07 `manifests/webpage.yaml` ran DooPlex's copy of the website and pinned the installer tag in two
|
|
`--ref` lines. That copy is retired (R-1228); `webpage.yaml` now holds only FileBrowser. The installer tag lives in
|
|
`INSTALLER-TAG` at the repo root, and `hostinstall_gates.py` gate 6 fails if any manifest pins one again. The full
|
|
publish/rollback procedure is the R-110 fence in the repo core `CLAUDE.md`.
|