cameleer/cameleer-server

Fork 0

Files

hsiegeln 810f493639

CI / cleanup-branch (push) Has been skipped

Details

CI / build (push) Successful in 1m23s

Details

CI / docker (push) Successful in 5m22s

Details

CI / deploy-feature (push) Has been skipped

Details

CI / deploy (push) Successful in 44s

Details

chore: track .claude/rules/ and add self-maintenance instruction

Un-ignore .claude/rules/ so path-scoped rule files are shared via git.
Add instruction in CLAUDE.md to update rule files when modifying classes,
controllers, endpoints, or metrics — keeps rules current as part of
normal workflow rather than requiring separate maintenance.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-16 09:26:53 +02:00

1.8 KiB

Raw Blame History

paths

.gitea/**

deploy/**

Dockerfile

docker-entrypoint.sh

CI/CD & Deployment

CI workflow: .gitea/workflows/ci.yml — build -> docker -> deploy on push to main or feature branches
Build step skips integration tests (-DskipITs) — Testcontainers needs Docker daemon
Docker: multi-stage build (Dockerfile), $BUILDPLATFORM for native Maven on ARM64 runner, amd64 runtime. docker-entrypoint.sh imports /certs/ca.pem into JVM truststore before starting the app (supports custom CAs for OIDC discovery without CAMELEER_SERVER_SECURITY_OIDCTLSSKIPVERIFY).
REGISTRY_TOKEN build arg required for cameleer-common dependency resolution
Registry: gitea.siegeln.net/cameleer/cameleer-server (container images)
K8s manifests in deploy/ — Kustomize base + overlays (main/feature), shared infra (PostgreSQL, ClickHouse, Logto) as top-level manifests
Deployment target: k3s at 192.168.50.86, namespace cameleer (main), cam-<slug> (feature branches)
Feature branches: isolated namespace, PG schema; Traefik Ingress at <slug>-api.cameleer.siegeln.net
Secrets managed in CI deploy step (idempotent --dry-run=client | kubectl apply): cameleer-auth, cameleer-postgres-credentials, cameleer-clickhouse-credentials
K8s probes: server uses /api/v1/health, PostgreSQL uses pg_isready -U "$POSTGRES_USER" (env var, not hardcoded)
K8s security: server and database pods run with securityContext.runAsNonRoot. UI (nginx) runs without securityContext (needs root for entrypoint setup).
Docker: server Dockerfile has no default credentials — all DB config comes from env vars at runtime
Docker build uses buildx registry cache + --provenance=false for Gitea compatibility
CI: branch slug sanitization extracted to .gitea/sanitize-branch.sh, sourced by docker and deploy-feature jobs

1.8 KiB Raw Blame History

CI/CD & Deployment

1.8 KiB

Raw Blame History