Erich Blume 8d634861f6 C1: migrate cv + docs from minikube to indri-native (#342 )

## Summary

Replace the cv (`cv.eblu.me`) and docs (`docs.eblu.me`) minikube Deployments with indri-native ansible roles. Caddy serves the extracted release tarballs directly via a new `kind: static` service-block — no daemon, no nginx pod, no ProxyGroup ingress on the request path. Mirrors the rationale of the recent devpi migration; part of the broader minikube wind-down.

## What's in this commit

- `ansible/roles/{cv,docs}` — sentinel-gated tarball download + extract into `~/{cv,docs}/content/`
- `ansible/roles/caddy/` — new `kind: static` branch in the Caddyfile template (encoded gzip, immutable cache headers for fingerprinted assets, optional `try_html` for Quartz-style clean URLs, optional per-path `download_paths` for the resume PDF's `Content-Disposition`)
- `ansible/playbooks/indri.yml` — wires `cv` and `docs` roles before `caddy`
- `service-versions.yaml` — both services flip to `type: ansible`. `docs.current-version` stays at `1.28.2` for this commit so `container-version-check` keeps passing while `containers/quartz/Dockerfile` still exists; it moves to the docs release tag in the cleanup commit
- `.forgejo/workflows/{cv-deploy,build-blumeops}.yaml` — deploy step now bumps `cv_version`/`docs_version` in the role defaults and pushes; running ansible + purging the Fly cache is manual from gilbert (matches devpi)
- Docs: `docs/how-to/operations/{cv,docs}-on-indri.md`, updated `docs/reference/services/{cv,docs}.md`, changelog fragment

## What is not in this commit

The dead artifacts. After PR review and successful cutover, a follow-up commit deletes:

- `argocd/apps/{cv,docs}.yaml` and `argocd/manifests/{cv,docs}/`
- `containers/cv/`, `containers/quartz/`
- `CONTAINER_TO_SERVICE['quartz']` mapping in `mise-tasks/container-version-check`
- bumps `docs.current-version` in `service-versions.yaml` to the release tag

## Cutover plan (manual, from gilbert, after review)

1. **Take down old:**
   - Remove the cv and docs Applications: `argocd app delete cv --cascade && argocd app delete docs --cascade`
   - Verify k8s namespaces gone: `kubectl --context=minikube-indri get ns | grep -E '^(cv|docs)\\b'` (should be empty)
   - Verify tailnet MagicDNS no longer advertises the VIPs: `nslookup cv.tail8d86e.ts.net` and `nslookup docs.tail8d86e.ts.net` should both fail
2. **Bring up new:**
   - `mise run provision-indri -- --tags cv,docs,caddy --check --diff` (already validated on branch)
   - `mise run provision-indri -- --tags cv,docs,caddy`
   - `fly ssh console -a blumeops-proxy -C "sh -c 'rm -rf /tmp/cache && nginx -s reload'"`
3. **Verify:** `mise run services-check` and the curl checks listed in `docs/how-to/operations/{cv,docs}-on-indri.md`
4. **Cleanup commit + merge.**

Total expected downtime: minutes (not the few-hour budget you authorized).

## Test plan
- [ ] `mise run provision-indri -- --tags cv,docs --check --diff` clean
- [ ] `mise run provision-indri -- --tags caddy --check --diff` shows only the cv + docs blocks changing as previewed in the PR thread
- [ ] After cutover: `cv.eblu.me`, `cv.ops.eblu.me`, `docs.eblu.me`, `docs.ops.eblu.me` all return 200
- [ ] `cv.eblu.me/resume.pdf` includes `Content-Disposition: attachment`
- [ ] A clean Quartz URL (e.g. `docs.eblu.me/explanation/agent-change-process`) resolves to the right page
- [ ] `mise run services-check` clean
- [ ] `mise run service-review --type ansible` shows cv and docs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #342

2026-04-29 14:55:11 -07:00

3.2 KiB

Raw Blame History

title

modified

last-reviewed

CV on Indri

How the CV/resume static site (cv.eblu.me) is deployed on indri natively. Replaces the prior minikube Deployment; mirrors the rationale of devpi-on-indri.

Why native, not Kubernetes

CV is a tiny static site (HTML + CSS + PDF). It needs no daemon, no database, no auth. Caddy on indri can serve the extracted tarball directly via file_server. Removing the minikube Deployment shrinks the cluster's footprint and removes a network hop (Fly → indri Caddy → ProxyGroup ingress → minikube pod becomes Fly → indri Caddy → local files).

Layout

Concern	Path / detail
Content dir	`/Users/erichblume/blumeops/cv/content/`
Version sentinel	`/Users/erichblume/blumeops/cv/.installed-version`
Caddy entry	`cv` service in `ansible/roles/caddy/defaults/main.yml` (`kind: static`)
Public URL	`https://cv.eblu.me` (via flyio-proxy)
Private URL	`https://cv.ops.eblu.me` (Caddy on indri)
Tarball source	Forgejo generic package `cv` (`forge.eblu.me/eblume/-/packages`)

The role is driven by cv_version in ansible/roles/cv/defaults/main.yml. The download and extract steps only fire when the on-disk sentinel doesn't match cv_version — i.e. after a version bump.

Deploy

Two paths:

From a release workflow (most common):

Run the Release CV workflow in the cv repo → produces a new generic package
Run the blumeops Deploy CV workflow → bumps cv_version in ansible/roles/cv/defaults/main.yml and pushes to main
From gilbert: mise run provision-indri -- --tags cv
From gilbert: fly ssh console -a blumeops-proxy -C "sh -c 'rm -rf /tmp/cache && nginx -s reload'" to purge the public-edge cache

Manual (e.g., reverting): edit cv_version in the role defaults yourself, then steps 3–4.

Verify

ssh indri 'cat ~/blumeops/cv/.installed-version'
ssh indri 'ls -la ~/blumeops/cv/content/'
curl -fsSI https://cv.ops.eblu.me/                          # private
curl -fsSI https://cv.eblu.me/                              # public
curl -fsSI https://cv.eblu.me/resume.pdf | grep -i disposition

The PDF response should include content-disposition: attachment; filename="erich-blume-resume.pdf".

Bumping the cv version

Edit cv_version in ansible/roles/cv/defaults/main.yml and re-run mise run provision-indri -- --tags cv. The role recreates the content dir from the new tarball; the sentinel update triggers the next idempotent skip.

Backup

The content dir is not in borgmatic_source_directories. The tarball is re-downloadable from the Forgejo generic package store on every deploy, and the source is in the cv repo — recovery is just re-running the role.

Rollback

If a bad version is published, set cv_version back to the previous tag in ansible/roles/cv/defaults/main.yml and re-run the role. The full minikube manifest set is preserved in git history (commits prior to the migration cleanup) for the worst case.

devpi-on-indri — same shape, different upstream
restart-indri — graceful indri restart procedure
cv — service reference

3.2 KiB Raw Blame History Unescape Escape