From dfa1a370ac6c7bbf18e247113f1c1a400620ab9b Mon Sep 17 00:00:00 2001 From: Niek Otten Date: Fri, 18 Sep 2026 16:31:47 +0200 Subject: [PATCH] ci(deploy): publish the stack over TLS when PUBLIC_DOMAIN is set (refs #175) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The in-cluster edge (#178) is off unless the chart is given a domain, so pass one through from a repository variable. Unset, the deploy is exactly what it was — NodePorts, and the portals reachable only over the SSH forwards. Co-Authored-By: Claude Opus 5 (1M context) --- .gitea/workflows/deploy.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml index 818830c..d1b49b2 100644 --- a/.gitea/workflows/deploy.yaml +++ b/.gitea/workflows/deploy.yaml @@ -27,6 +27,10 @@ jobs: # `kubectl port-forward` — runbook §5. Override with repo variables. TALOS_VM_IP: ${{ vars.TALOS_VM_IP }} TALOS_HOST: ${{ vars.TALOS_HOST }} + # Set it and the stack is published over TLS on . by the + # in-cluster edge (ADR-0035, runbook §10). Empty = NodePorts, as before. + PUBLIC_DOMAIN: ${{ vars.PUBLIC_DOMAIN }} + PUBLIC_EMAIL: ${{ vars.PUBLIC_EMAIL }} steps: - uses: https://github.com/actions/checkout@v4 @@ -89,7 +93,13 @@ jobs: # The jobs are idempotent, and deleting them first is what keeps a changed # Job template from wedging the upgrade (`cannot patch … with kind Job`). - name: Deploy the chart - run: make k8s-reseed TALOS_HOST=${TALOS_HOST:-localhost} K8S_REGISTRY=${TALOS_VM_IP:-192.168.122.173}:30500 + run: | + set -euo pipefail + publish="${PUBLIC_DOMAIN:+--set public.domain=$PUBLIC_DOMAIN --set public.email=${PUBLIC_EMAIL:-}}" + make k8s-reseed \ + TALOS_HOST=${TALOS_HOST:-localhost} \ + K8S_REGISTRY=${TALOS_VM_IP:-192.168.122.173}:30500 \ + K8S_SET="$publish" # `dev` is a mutable tag and helm sees an unchanged pod template, so the # new images only land on a restart (pullPolicy is already Always).