feat: deploy to Frostmoln production #243

2026-10-14T17:43:58Z

argoyle commented

2026-10-14 17:43:58 +00:00

Moves the production deploy from AWS to the Frostmoln production cluster (namespace sites).

deploy-prod (AWS) has failed since CI left AWS: the runners have no k8s.unbound.se context, so the site on AWS still runs an older image. It's replaced by deploy-prod-frostmoln, the same pattern as Shiny's deploy-frostmoln-staging: FROSTMOLN_PRODUCTION_DEPLOY_KEY + FROSTMOLN_PRODUCTION_CLUSTER_ID (org), BUILDTOOLS_FROSTMOLN_PRODUCTION (org, target prod-frostmoln), deploy prod-frostmoln -n sites.
Frostmoln enforces restricted Pod Security: the served image is nginxinc/nginx-unprivileged (uid 101, port 8080), with a matching securityContext; the Service is ClusterIP.
ingress-prod.yaml (ALB) → ingress-prod-frostmoln.yaml (Traefik, Let's Encrypt).

Checked locally: the image serves /health and / (200) as uid 101 with all capabilities dropped.

Merge after infra's feat/frostmoln-production-sites is applied (namespace + org secret). The hostnames keep pointing at AWS until the Route 53 switch, a separate step; the certificate is issued after that.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

Moves the production deploy from AWS to the Frostmoln production cluster (namespace `sites`). - `deploy-prod` (AWS) has failed since CI left AWS: the runners have no `k8s.unbound.se` context, so the site on AWS still runs an older image. It's replaced by `deploy-prod-frostmoln`, the same pattern as Shiny's `deploy-frostmoln-staging`: `FROSTMOLN_PRODUCTION_DEPLOY_KEY` + `FROSTMOLN_PRODUCTION_CLUSTER_ID` (org), `BUILDTOOLS_FROSTMOLN_PRODUCTION` (org, target `prod-frostmoln`), `deploy prod-frostmoln -n sites`. - Frostmoln enforces restricted Pod Security: the served image is `nginxinc/nginx-unprivileged` (uid 101, port 8080), with a matching securityContext; the Service is ClusterIP. - `ingress-prod.yaml` (ALB) → `ingress-prod-frostmoln.yaml` (Traefik, Let's Encrypt). Checked locally: the image serves `/health` and `/` (200) as uid 101 with all capabilities dropped. **Merge after** infra's `feat/frostmoln-production-sites` is applied (namespace + org secret). The hostnames keep pointing at AWS until the Route 53 switch, a separate step; the certificate is issued after that. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

argoyle added 1 commit 2026-10-14 17:43:59 +00:00

feat: deploy to Frostmoln production

unbound-site / build (pull_request) Successful in 1m53s

Details

unbound-site / deploy-prod-frostmoln (pull_request) Skipped

Details

a41e44367a

The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se
context on the runners). Deploys now go to the Frostmoln production
cluster (namespace sites), the way Shiny deploys to Frostmoln staging.

Frostmoln enforces restricted Pod Security, so the served image is
nginx-unprivileged (uid 101, port 8080) with a matching securityContext.
The ALB ingress becomes a Traefik one with a Let's Encrypt certificate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

argoyle referenced this issue from a commit

2026-10-14 17:51:30 +00:00

feat(frostmoln): prepare Production for the sites (#1875)

argoyle merged commit 283852c438 into main

2026-10-14 17:53:13 +00:00

argoyle deleted branch feat/frostmoln-production

2026-10-14 17:53:13 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unboundsoftware/unbound-site#243