deploying the blog

this week i sat down and actually deployed this blog.

i’d been building it locally with hugo for a while, but never got around to shipping it anywhere. i containerized it and set up a github actions workflow to build and push the image on every merge to main. it now runs on my home kubernetes cluster with a proper tls cert.

the interesting part was continuous deployment. github actions needs to tell the cluster to update after a push, but the cluster runs at home behind a regular internet connection, so there’s no clean api to call. i ended up going with ssh, but with a very restricted setup: a dedicated user whose key is locked down to only two specific commands. nothing else is allowed.

i also cleaned up some stale deployments from the cluster. a kde desktop i once ran in a container for fun, an old side project, an mta i experimented with. all gone.

on the infrastructure side, i spent some time tidying up the opentofu ci, moving to plan-on-pr and apply-on-merge, the obvious setup that i’d been putting off. there was also a circular dependency: when ci manages its own repo settings in tofu, you hit a bootstrapping problem if you ever need to change those settings. i separated that into a standalone stack you apply manually.

finally, i set up dns records for outbound email on a subdomain. dkim, spf, mx, the usual dance. nothing interesting to write about, but it needed doing.

it was a productive weekend.