import kgva site

2026-06-29 01:37:03 +02:00
commit f7643602cb
103 changed files with 2015 additions and 0 deletions
@@ -0,0 +1,9 @@
+# Caddy site block for the website. Replace the upstream IP with the NEW
+# container's IP, reload caddy (`caddy reload` / `systemctl reload caddy`),
+# verify, then retire the old container. Keeping the domain here means the
+# cutover is a one-line upstream change — no IP recycling needed.
+
+karimgabrielevarano.xyz, www.karimgabrielevarano.xyz {
+    encode zstd gzip
+    reverse_proxy CHANGE_ME_NEW_CONTAINER_IP:8080
+}
@@ -0,0 +1,32 @@
+# Deploy
+
+The site is a static Hugo build served by nginx in one container
+(`docker compose up -d --build`). Recommended hosting: an LXC on Proxmox, with
+Caddy in front terminating TLS and reverse-proxying the domain.
+
+## Prerequisites
+
+1. The repo must be on Gitea (e.g. `git.kgva.ch/karim/kgva`). The `REPO` URL in
+   `provision-lxc.sh` and `backend.repo` in `static/admin/config.yml` point there.
+
+## Safe cutover (no downtime, with rollback)
+
+1. On the Proxmox node, run (free CTID, **new/temporary** IP):
+   ```
+   CTID=141 IP=10.0.0.50/24 GW=10.0.0.1 BRIDGE=vmbr0 STORAGE=local-lvm \
+     ./provision-lxc.sh
+   ```
+2. Test it directly:  `curl -I http://10.0.0.50:8080`
+3. Point Caddy's upstream at the new IP (`deploy/Caddyfile`), reload Caddy,
+   open the domain, click around.
+4. Only once it's verified: stop/remove the **old** container
+   (`pct stop <old> && pct destroy <old>`), or keep it a day as rollback.
+
+This never deletes the live site before the replacement is proven.
+
+## Updating later
+
+```
+pct exec <CTID> -- bash -lc 'cd /opt/kgva && git pull && docker compose up -d --build'
+```
+or wire a Gitea Action / webhook to run that on push (see ../ADMIN.md).
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Provision an LXC for the kgva website (Docker + compose). RUN ON THE PROXMOX NODE.
+#
+# SAFE CUTOVER (recommended): create this NEW container on a FREE/temporary IP,
+# test it, then point Caddy's upstream at it. Remove the OLD container only after
+# the new one is verified. Do NOT reuse the old IP up front (IP conflict + no
+# rollback). Override any value via env, e.g.:  CTID=141 IP=10.0.0.50/24 ./provision-lxc.sh
+set -euo pipefail
+
+CTID="${CTID:-141}"                       # must be free:  pct status $CTID  → should error
+HOSTNAME_="${HOSTNAME_:-kgva}"
+IP="${IP:-CHANGE_ME/24}"                   # NEW/temporary ip, NOT the old one yet
+GW="${GW:-CHANGE_ME}"
+BRIDGE="${BRIDGE:-vmbr0}"
+STORAGE="${STORAGE:-local-lvm}"
+TEMPLATE="${TEMPLATE:-local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst}"
+REPO="${REPO:-https://git.kgva.ch/karim/kgva.git}"
+DISK="${DISK:-6}"; CORES="${CORES:-2}"; RAM="${RAM:-1024}"
+
+echo "Creating LXC $CTID ($HOSTNAME_) on $IP ..."
+pct create "$CTID" "$TEMPLATE" \
+  --hostname "$HOSTNAME_" --cores "$CORES" --memory "$RAM" \
+  --rootfs "${STORAGE}:${DISK}" \
+  --net0 "name=eth0,bridge=${BRIDGE},ip=${IP},gw=${GW}" \
+  --features nesting=1 --unprivileged 1 --onboot 1
+pct start "$CTID"
+sleep 6
+
+pct exec "$CTID" -- bash -lc '
+  set -e
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update && apt-get install -y ca-certificates curl git
+  install -m 0755 -d /etc/apt/keyrings
+  curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
+  chmod a+r /etc/apt/keyrings/docker.asc
+  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release; echo $VERSION_CODENAME) stable" \
+    > /etc/apt/sources.list.d/docker.list
+  apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
+  rm -rf /opt/kgva && git clone '"$REPO"' /opt/kgva
+  cd /opt/kgva && docker compose up -d --build
+'
+
+echo
+echo "done. test the new container:   curl -I http://${IP%/*}:8080"
+echo "then point Caddy at ${IP%/*}:8080 (see deploy/Caddyfile), reload caddy,"
+echo "verify the domain, and only THEN remove the old container."