chore: publish 25ef5af

Built from main 25ef5af63e fix: refuse to publish a build that logged a vite error
2026-09-06 09:22:05 +00:00
parent 37a1e480c6
commit 47f4de8757
96 changed files with 1616 additions and 3563 deletions
@@ -1,106 +0,0 @@
-# Namespace, image ref, and storage class confirmed against this cluster
-# (microk8s, 2026-09-04). Image is pushed to Nexus for a durable, off-node
-# copy (docker push localhost:30892/... — see README), but the Deployment
-# below pulls it from the *node's local containerd image store* instead of
-# over the network: kubelet's image pulls run in the host network namespace,
-# which uses this node's public DNS resolver, not cluster CoreDNS, so
-# `nexus-service.nexus.svc.cluster.local` is NOT resolvable for a plain pull
-# (only for in-cluster builders like Kaniko, whose *build* pod runs in pod
-# netns). The `microk8s-hostpath` PVC below also pins every pod to whichever
-# node created it (`ai-workstation`, confirmed via the PV's nodeAffinity), so
-# a single local `ctr image import` of the pushed tar is enough — see
-# vote-service/README.md for the import command. `imagePullPolicy: Never`
-# enforces that: no accidental network pull attempt, no ImagePullBackOff.
-# `ai-for-dummies` did not exist yet as a namespace, so it is created below,
-# matching the one-namespace-per-app pattern every other small app in this
-# cluster uses (judge0, minio, pragent, …). No storageClassName set:
-# microk8s's `hostpath-storage` addon is the default.
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ai-for-dummies
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ai-for-dummies-vote
-  namespace: ai-for-dummies
-  labels:
-    app: ai-for-dummies-vote
-spec:
-  replicas: 1 # single replica: the store is one JSON file on one PVC, not a shared DB
-  selector:
-    matchLabels:
-      app: ai-for-dummies-vote
-  strategy:
-    type: Recreate # avoid two pods writing the same PVC-backed file at once
-  template:
-    metadata:
-      labels:
-        app: ai-for-dummies-vote
-    spec:
-      # Pinned to `kubernets`: the image is imported straight into that node's
-      # containerd store (see README) and `microk8s-hostpath` PVs carry a
-      # nodeAffinity for whichever node first binds them, so scheduling and
-      # storage must agree on one node. `kubernets` is the control-plane node
-      # that hosts the rest of this cluster's workloads.
-      nodeSelector:
-        kubernetes.io/hostname: kubernets
-      securityContext:
-        fsGroup: 65532 # matches distroless "nonroot" uid/gid; without it the PVC mounts root-owned and the container can't write votes.json
-      containers:
-        - name: vote-service
-          image: localhost:30892/ai-for-dummies-vote-service:latest
-          imagePullPolicy: Never # image is side-loaded via `ctr image import`; never fetch over the network
-          ports:
-            - containerPort: 8080
-          env:
-            - name: PORT
-              value: "8080"
-            - name: VOTE_DB_PATH
-              value: /data/votes.json
-            - name: ALLOWED_ORIGIN
-              value: https://netcracker.pages.marcospaulo.dev.br
-          resources:
-            requests: { cpu: 10m, memory: 16Mi }
-            limits: { cpu: 100m, memory: 64Mi }
-          readinessProbe:
-            httpGet: { path: /healthz, port: 8080 }
-            initialDelaySeconds: 2
-          livenessProbe:
-            httpGet: { path: /healthz, port: 8080 }
-            initialDelaySeconds: 5
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          securityContext:
-            runAsNonRoot: true
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: ai-for-dummies-vote-data
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ai-for-dummies-vote-data
-  namespace: ai-for-dummies
-spec:
-  accessModes: ["ReadWriteOnce"]
-  resources:
-    requests:
-      storage: 100Mi
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: ai-for-dummies-vote
-  namespace: ai-for-dummies
-spec:
-  selector:
-    app: ai-for-dummies-vote
-  ports:
-    - port: 80
-      targetPort: 8080
@@ -1,31 +0,0 @@
-# Public exposure is required: the vote widget runs in each visitor's
-# browser (client-side JS on a static Pages site), so it calls this API
-# straight from the internet — it cannot reach a cluster-internal-only
-# Service. CORS (ALLOWED_ORIGIN in deployment.yaml) is the real boundary:
-# it restricts which origin's browser code may call the API, not which
-# network can reach it.
-#
-# No `tls:` block here on purpose: TLS is terminated upstream by Caddy on the
-# Oracle VPS, which reverse-proxies over Tailscale to this node's port 80
-# (the nginx ingress runs on hostNetwork and routes by Host). That is how all
-# ~21 public hosts in this account are served. Reaching this host publicly
-# needs the DNS record plus the Caddy block — see vote-service/README.md:
-#   cf-dns add ai-for-dummies-vote A 129.148.56.8
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ai-for-dummies-vote
-  namespace: ai-for-dummies
-spec:
-  ingressClassName: public
-  rules:
-    - host: ai-for-dummies-vote.marcospaulo.dev.br
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: ai-for-dummies-vote
-                port:
-                  number: 80