# The kb-site CONTAINER has no configuration and no secrets.
#
# The port bind (8250:80) is static and the content lives in the
# kb-site_kb-site_content Docker volume, generated from kb/ by
# scripts/kb/gen_pages.py. Nothing here is copied to a .env on PIHA.
#
# The public address is a generator argument, not an env var:
#   python3 scripts/kb/gen_pages.py --base-url https://kb-e2a24af3.okit.pl
#
# ---------------------------------------------------------------------------
# GENERATION-TIME secret — belongs on the node you generate from
# (SATURN/SOLARIA), NOT on PIHA:
#
#   /opt/homelab/config/kb-site/.env      chmod 600
#     ACCESS_TOKEN=<token bramki NPM>
#
# The site sits behind a query-parameter gate in NPM. gen_pages.py reads
# ACCESS_TOKEN from the environment and appends ?key=<token> to every internal
# link; without it every click on the published site returns 403 and only a
# hand-assembled URL works.
#
# Same value as the advanced config of the proxy host in NPM. It lives in the
# NPM database and in that file only — never in this repository. Prefer the
# environment variable over the --access-token flag: a command-line argument
# lands in shell history and is visible in `ps`.
#
# Full procedure: kb/runbooks/kb-site-deploy.md (steps 0, 2 and 7).