From 0d445d948c95eac010b4f3cabe1419526b447043 Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Sun, 7 Jun 2026 15:21:21 +0000 Subject: [PATCH] =?UTF-8?q?stem95su:=20host=20STEM=20platform=20for=2095.?= =?UTF-8?q?=20=D0=A1=D0=A3=20(public=20NFS-backed=20static=20site)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New public static site at stem95su.viktorbarzin.me serving the school's Bulgarian STEM platform (dashboard + lessons/games, externally authored HTML/media exported from Gemini). - Stock nginx:1.28-alpine serving /srv/nfs/stem-site read-only (nfs_volume), NOT image-baked — content updated out-of-band (Nextcloud "PVE NFS Pool" or rsync), no rebuild; auto-backed-up offsite by nfs-mirror. - ingress_factory auth="none" (open; CrowdSec + ai-bot-block at the edge), dns_type="proxied" (Cloudflare CNAME auto-created). - nginx ConfigMap sets index stem_board.html (the dashboard) for "/". - Docs: service-catalog entry + new "Static Site Hosting" pattern (NFS-backed vs image-baked) in patterns.md. Applied via scripts/tg apply; verified live end-to-end (dashboard, 20MB page, video byte-range, no Authentik redirect) through the public Cloudflare path. Co-Authored-By: Claude Opus 4.8 --- .claude/reference/patterns.md | 9 ++ .claude/reference/service-catalog.md | 3 +- stacks/stem95su/main.tf | 173 +++++++++++++++++++++++++++ stacks/stem95su/secrets | 1 + stacks/stem95su/terragrunt.hcl | 8 ++ stacks/stem95su/variables.tf | 9 ++ 6 files changed, 202 insertions(+), 1 deletion(-) create mode 100644 stacks/stem95su/main.tf create mode 120000 stacks/stem95su/secrets create mode 100644 stacks/stem95su/terragrunt.hcl create mode 100644 stacks/stem95su/variables.tf diff --git a/.claude/reference/patterns.md b/.claude/reference/patterns.md index 56ec6750..d0e167d1 100644 --- a/.claude/reference/patterns.md +++ b/.claude/reference/patterns.md @@ -23,6 +23,15 @@ module "nfs_data" { 3. Reload exports: `ssh root@192.168.1.127 "exportfs -ra"` 4. Verify: `showmount -e 192.168.1.127` +## Static Site Hosting +Two patterns for serving a folder of static files (HTML/CSS/JS/media): + +1. **Image-baked** (default for git-native content): bake files into an `nginx:*-alpine` image at build time, deploy like any owned app (CI builds + pushes, Keel/Woodpecker rolls out). Reference: `stacks/blog` (Hugo → nginx, `Website/Dockerfile`). Use when content lives in git and changes via commits. + +2. **NFS-backed** (for externally-authored / large / non-git content): a stock `nginx:1.28-alpine` Deployment mounts an `nfs_volume` PVC **read-only** at `/usr/share/nginx/html`; a tiny ConfigMap supplies `/etc/nginx/conf.d/default.conf` (just `root` + `index .html`). Files are dropped on `/srv/nfs/` out-of-band (Nextcloud "PVE NFS Pool" or rsync) — no rebuild, auto-backed-up by `nfs-mirror`. Reference: `stacks/stem95su` (established 2026-06-07). Use when content is authored outside git (e.g. exported tools), is large (avoids git/image bloat), or a non-dev updates it. **The export subdir on the PVE host must exist before the pod mounts** — the `nfs_volume` module does NOT create it (see "Adding NFS Exports"; a subdir under the already-exported `/srv/nfs` needs no new `/etc/exports` line). + +Both front with `ingress_factory` (`auth="none"` for open public content → CrowdSec + ai-bot-block still apply; or chain `anubis_instance` for a PoW gate, as `blog` does). + ## ~~iSCSI Storage~~ (REMOVED — replaced by proxmox-lvm) > iSCSI via democratic-csi and TrueNAS has been fully removed (2026-04). All database storage now uses `StorageClass: proxmox-lvm` (Proxmox CSI, LVM-thin hotplug). TrueNAS has been decommissioned. diff --git a/.claude/reference/service-catalog.md b/.claude/reference/service-catalog.md index 589316de..3b3177b4 100644 --- a/.claude/reference/service-catalog.md +++ b/.claude/reference/service-catalog.md @@ -116,6 +116,7 @@ | status-page | Status page | status-page | | plotting-book | Book plotting/world-building app | plotting-book | | tripit | Self-hosted TripIt-clone travel-itinerary PWA (FastAPI + SvelteKit SPA, same-origin). CNPG (`tripit` db, Vault static role `pg-tripit`) + RWX NFS trip-doc vault (`/srv/nfs/tripit-documents`) + RWO `proxmox-lvm-encrypted` personal-document vault `tripit-personal-documents` (passports/IDs — AES-256-GCM app-layer envelope, master key `DOCUMENT_ENCRYPTION_KEY` in `secret/tripit`). `auth=required` (Authentik forward-auth, reads `X-authentik-email`); second `auth=none` ingress on `/api/calendar` for HMAC-token-gated `.ics` feed. Email-ingest CronJob `tripit-ingest-plans` (`*/15`) is the SOLE inbound path — forward a booking to plans@viktorbarzin.me (catch-all → spam@), polled read-only and routed ONLY to a registered user / verified linked address (no default-owner fallback; strangers ignored), parsed by local LLM (`qwen3vl-4b`), and the sender is emailed the outcome (Added to trip / Couldn't import). Plus `tripit-poll-flights`, `tripit-run-reminders`, `tripit-transport-nudge`, `tripit-weather-brief`. (The old Gmail-scrape `tripit-ingest-mail` CronJob was removed 2026-06-05.) App secrets in Vault `secret/tripit`. | tripit | +| stem95su | STEM educational platform for **95. СУ „Проф. Иван Шишманов"** (Sofia school) at stem95su.viktorbarzin.me. Public **open** static site (`auth=none` — CrowdSec + ai-bot-block, no login). Stock `nginx:1.28-alpine` serving content **straight off PVE host NFS** `/srv/nfs/stem-site` (RWX `nfs_volume`, mounted read-only) — **NOT** image-baked, so the externally-authored (Gemini-exported) HTML/media is updated out-of-band (Nextcloud "PVE NFS Pool" or rsync) with no rebuild; auto-backed-up offsite by `nfs-mirror`. Dashboard `stem_board.html` served at `/` via a small nginx ConfigMap (`index`). No DB, no secrets. Reference impl for the NFS-backed static-site pattern (see patterns.md). | stem95su | | trek | **TRIAL (2026-06-05)** — self-hosted group-trip planner (upstream [TREK](https://github.com/mauriceboe/TREK), `mauriceboe/trek:3.0.22`, AGPL-3.0). Solo evaluation behind Authentik forward-auth (`auth=required`) before deciding build-vs-adopt; covers collaborative trip planning + accommodation records + activities + per-person budget splitting on free OpenStreetMap (no paid maps key). SQLite + uploads on `proxmox-lvm-encrypted` (`trek-data-encrypted` 2Gi, `trek-uploads-encrypted` 5Gi). For the trial only: `ENCRYPTION_KEY` is TREK-auto-generated onto the data PVC and the bootstrap admin (`admin@trek.local`) is printed to pod logs — NO Vault/ESO wiring (graduation TODO: move key to `secret/trek` + ESO, add an app-level SQLite backup CronJob since host file-backup can't read the LUKS PVC, wire TREK↔Authentik OIDC). Pinned image, TF-managed (no CI/Keel). Availability-poll companion (Rallly) deferred. Teardown: `tg destroy` in `stacks/trek`. | trek | ## Cloudflare Domains @@ -125,7 +126,7 @@ blog, hackmd, privatebin, url, echo, f1tv, excalidraw, send, audiobookshelf, jsoncrack, ntfy, cyberchef, homepage, linkwarden, changedetection, tandoor, n8n, stirling-pdf, dashy, city-guesser, -travel, netbox, phpipam, tripit, t3 +travel, netbox, phpipam, tripit, t3, stem95su ``` ### Non-Proxied (Direct DNS) diff --git a/stacks/stem95su/main.tf b/stacks/stem95su/main.tf new file mode 100644 index 00000000..2ac6cc05 --- /dev/null +++ b/stacks/stem95su/main.tf @@ -0,0 +1,173 @@ +# STEM educational platform for 95. СУ „Проф. Иван Шишманов" (Sofia). +# Public, open static site at stem95su.viktorbarzin.me. Self-contained HTML +# pages + media authored externally (Gemini exports), served by a stock nginx +# straight off the PVE host NFS — NOT baked into an image, so content can be +# updated out-of-band (Nextcloud "PVE NFS Pool" or rsync to /srv/nfs/stem-site) +# without a rebuild. Auto-backed-up offsite by the existing nfs-mirror job. + +resource "kubernetes_namespace" "stem95su" { + metadata { + name = "stem95su" + labels = { + "istio-injection" : "disabled" + tier = local.tiers.aux + } + } + lifecycle { + # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace + ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]] + } +} + +module "tls_secret" { + source = "../../modules/kubernetes/setup_tls_secret" + namespace = kubernetes_namespace.stem95su.metadata[0].name + tls_secret_name = var.tls_secret_name +} + +# Content lives on the PVE host NFS. NOTE: the nfs_volume module creates only +# the K8s PV+PVC — the export subdir (/srv/nfs/stem-site) must already exist on +# 192.168.1.127 or the pod fails to mount (mount.nfs exit 32). It is created +# during deploy and re-created on demand if ever lost. +module "nfs_content" { + source = "../../modules/kubernetes/nfs_volume" + name = "stem95su-content" + namespace = kubernetes_namespace.stem95su.metadata[0].name + nfs_server = var.nfs_server + nfs_path = "/srv/nfs/stem-site" + storage = "1Gi" + access_modes = ["ReadWriteMany"] +} + +# Minimal nginx server block: serve the static dir, with the dashboard +# (stem_board.html) as the directory index so "/" loads the platform home. +# All other pages/assets are reached by their exact filenames (the dashboard +# links to them by name — those must not be renamed). +resource "kubernetes_config_map" "nginx_conf" { + metadata { + name = "stem95su-nginx-conf" + namespace = kubernetes_namespace.stem95su.metadata[0].name + } + data = { + "default.conf" = <<-EOT + server { + listen 80; + server_name _; + root /usr/share/nginx/html; + index stem_board.html index.html; + } + EOT + } +} + +resource "kubernetes_deployment" "stem95su" { + metadata { + name = "stem95su" + namespace = kubernetes_namespace.stem95su.metadata[0].name + labels = { + run = "stem95su" + tier = local.tiers.aux + } + } + spec { + replicas = 1 + selector { + match_labels = { + run = "stem95su" + } + } + template { + metadata { + labels = { + run = "stem95su" + } + } + spec { + container { + image = "nginx:1.28-alpine" + name = "nginx" + resources { + limits = { + memory = "64Mi" + } + requests = { + cpu = "10m" + memory = "64Mi" + } + } + port { + container_port = 80 + } + volume_mount { + name = "content" + mount_path = "/usr/share/nginx/html" + read_only = true + } + volume_mount { + name = "nginx-conf" + mount_path = "/etc/nginx/conf.d" + read_only = true + } + readiness_probe { + http_get { + path = "/" + port = 80 + } + initial_delay_seconds = 3 + period_seconds = 10 + } + } + volume { + name = "content" + persistent_volume_claim { + claim_name = module.nfs_content.claim_name + } + } + volume { + name = "nginx-conf" + config_map { + name = kubernetes_config_map.nginx_conf.metadata[0].name + } + } + } + } + } + lifecycle { + ignore_changes = [ + spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1 + ] + } +} + +resource "kubernetes_service" "stem95su" { + metadata { + name = "stem95su" + namespace = kubernetes_namespace.stem95su.metadata[0].name + labels = { + run = "stem95su" + } + } + spec { + selector = { + run = "stem95su" + } + port { + name = "http" + port = "80" + target_port = "80" + } + } +} + +module "ingress" { + source = "../../modules/kubernetes/ingress_factory" + # auth = "none": public static educational site for 95. СУ, open to the internet by design — CrowdSec + ai-bot-block gate bots; no login. + auth = "none" + namespace = kubernetes_namespace.stem95su.metadata[0].name + name = "stem95su" + service_name = kubernetes_service.stem95su.metadata[0].name + port = "80" + host = "stem95su" + dns_type = "proxied" + tls_secret_name = var.tls_secret_name +} diff --git a/stacks/stem95su/secrets b/stacks/stem95su/secrets new file mode 120000 index 00000000..ca54a7cf --- /dev/null +++ b/stacks/stem95su/secrets @@ -0,0 +1 @@ +../../secrets \ No newline at end of file diff --git a/stacks/stem95su/terragrunt.hcl b/stacks/stem95su/terragrunt.hcl new file mode 100644 index 00000000..0d1c8e53 --- /dev/null +++ b/stacks/stem95su/terragrunt.hcl @@ -0,0 +1,8 @@ +include "root" { + path = find_in_parent_folders() +} + +dependency "platform" { + config_path = "../platform" + skip_outputs = true +} diff --git a/stacks/stem95su/variables.tf b/stacks/stem95su/variables.tf new file mode 100644 index 00000000..4e8a36b5 --- /dev/null +++ b/stacks/stem95su/variables.tf @@ -0,0 +1,9 @@ +variable "tls_secret_name" { + type = string + sensitive = true +} + +variable "nfs_server" { + type = string + default = "192.168.1.127" +}