feat(kb-site): serwis nginx na PIHA + manifesty (wzorzec narty27)
services/kb-site/ — nginx:alpine serwujacy wolumen kb-site_content
(:ro, /usr/share/nginx/html), pelny layout z CLAUDE.md: docker-compose.yml,
service.yaml, README-wskaznik, env.example (swiadomie pusty — brak sekretow),
healthcheck.sh. Wpis w hosts/piha/services.yaml.
Port hosta 8250, NIE 8240 z opisu zadania: 8240 jest juz zajete przez narty27
(services/narty27/docker-compose.yml). Blok statyczny PIHA to 8210 paperless,
8220 nextcloud, 8230 kb-query, 8240 narty27 -> 8250 to nastepny wolny.
Uzgodnione z operatorem.
exposure: public — w odroznieniu od narty27 ta wystawka ma byc dostepna z
internetu przez vhost npm@PIHA kb.okit.pl; bind :8250 jest upstreamem proxy,
nie punktem wejscia.
Tresc jest czystym artefaktem repo (wyjscie scripts/kb/gen_pages.py), zyje
wylacznie w wolumenie kb-site_kb-site_content — bez binda pod /opt/homelab/data
i bez zadania backupu: odtworzeniem jest regeneracja z kb/.
Sprawdzone lokalnie: docker compose config -q, bash -n healthcheck.sh,
yaml.safe_load na obu manifestach.
2026-08-04 17:59:05 +02:00
|
|
|
service:
|
|
|
|
|
name: kb-site
|
|
|
|
|
owner_node: piha
|
|
|
|
|
role: static-html-host # public slice of the KB, rendered by scripts/kb/gen_pages.py
|
2026-08-05 12:34:13 +02:00
|
|
|
exposure: public # public via npm@PIHA (kb-e2a24af3.okit.pl). The container itself binds
|
feat(kb-site): serwis nginx na PIHA + manifesty (wzorzec narty27)
services/kb-site/ — nginx:alpine serwujacy wolumen kb-site_content
(:ro, /usr/share/nginx/html), pelny layout z CLAUDE.md: docker-compose.yml,
service.yaml, README-wskaznik, env.example (swiadomie pusty — brak sekretow),
healthcheck.sh. Wpis w hosts/piha/services.yaml.
Port hosta 8250, NIE 8240 z opisu zadania: 8240 jest juz zajete przez narty27
(services/narty27/docker-compose.yml). Blok statyczny PIHA to 8210 paperless,
8220 nextcloud, 8230 kb-query, 8240 narty27 -> 8250 to nastepny wolny.
Uzgodnione z operatorem.
exposure: public — w odroznieniu od narty27 ta wystawka ma byc dostepna z
internetu przez vhost npm@PIHA kb.okit.pl; bind :8250 jest upstreamem proxy,
nie punktem wejscia.
Tresc jest czystym artefaktem repo (wyjscie scripts/kb/gen_pages.py), zyje
wylacznie w wolumenie kb-site_kb-site_content — bez binda pod /opt/homelab/data
i bez zadania backupu: odtworzeniem jest regeneracja z kb/.
Sprawdzone lokalnie: docker compose config -q, bash -n healthcheck.sh,
yaml.safe_load na obu manifestach.
2026-08-04 17:59:05 +02:00
|
|
|
# 8250 on the LAN; npm is the sole public entry point.
|
|
|
|
|
dependencies: [] # nginx serving a local volume — nothing else required at runtime
|
|
|
|
|
ports:
|
|
|
|
|
- container: 80
|
|
|
|
|
host: 8250
|
|
|
|
|
protocol: tcp
|
|
|
|
|
healthcheck:
|
|
|
|
|
type: http
|
|
|
|
|
endpoint: http://127.0.0.1:8250/index.html # content must be loaded first (see runbook)
|
|
|
|
|
interval: 30s
|
|
|
|
|
timeout: 10s
|
|
|
|
|
retries: 5
|
|
|
|
|
restart_policy: unless-stopped
|
|
|
|
|
persistence:
|
|
|
|
|
# Docker named volume kb-site_kb-site_content (compose project prefix), NOT a
|
|
|
|
|
# bind under /opt/homelab/data. The content is a pure artifact: regenerate it
|
|
|
|
|
# from the repo with scripts/kb/gen_pages.py, no backup job needed.
|
|
|
|
|
paths:
|
|
|
|
|
- kb-site_kb-site_content
|
|
|
|
|
runtime:
|
|
|
|
|
config_files: [] # no .env — the port bind is static, no secrets
|
|
|
|
|
env_vars: []
|
|
|
|
|
content:
|
|
|
|
|
# Only kb/ documents with `visibility: public` are published; the generator
|
|
|
|
|
# is fail-closed (no frontmatter / no visibility field = private).
|
|
|
|
|
generator: scripts/kb/gen_pages.py
|
|
|
|
|
leak_check: scripts/kb/gen_pages.py --check # must pass before publishing
|
|
|
|
|
source: kb/**/*.md
|