argoyleandClaude Opus 5.5
a41e44367a
The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se context on the runners). Deploys now go to the Frostmoln production cluster (namespace sites), the way Shiny deploys to Frostmoln staging. Frostmoln enforces restricted Pod Security, so the served image is nginx-unprivileged (uid 101, port 8080) with a matching securityContext. The ALB ingress becomes a Traefik one with a Let's Encrypt certificate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
22 lines
808 B
Docker
22 lines
808 B
Docker
FROM amd64/nginx:1.31.6-alpine@sha256:5f4b1cbc2fac6baad5fd73efa91aef5f40ee315cacc5af719402ae21bb573776 as build
|
|
|
|
RUN apk add --update \
|
|
wget
|
|
|
|
ARG HUGO_VERSION="0.89.4"
|
|
RUN wget --quiet "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_Linux-64bit.tar.gz" && \
|
|
tar xzf hugo_${HUGO_VERSION}_Linux-64bit.tar.gz && \
|
|
rm -r hugo_${HUGO_VERSION}_Linux-64bit.tar.gz && \
|
|
mv hugo /usr/bin
|
|
|
|
COPY ./ /site
|
|
WORKDIR /site
|
|
RUN hugo
|
|
|
|
# Unprivileged (uid 101, port 8080): Frostmoln enforces restricted Pod Security.
|
|
FROM nginxinc/nginx-unprivileged:1.31.6-alpine@sha256:884e0b7f42f303641b0f4e78755aea647521dca0b89ca3be7992ad78b5c07434
|
|
ADD default.conf /etc/nginx/conf.d/default.conf
|
|
COPY --from=build /site/public /usr/share/nginx/html
|
|
|
|
WORKDIR /usr/share/nginx/html
|