# zai-home-base — revenue projects on djg-oracle-sl

Workspace for revenue-generating projects. Cluster edge: **Traefik v2.11**
(hostNetwork 80/443) + **cert-manager** (Let's Encrypt DNS-01 via Cloudflare).
Sites are static nginx Deployments fed by hostPath docroots in `sites/`.

## Live sites

- **bestdadjokes.lol** — dad-joke content site (Track 1; ads play via user's AdX/MCM)
- **myadhd.dev** — placeholder; ADHD micro-tools product coming (Track 2, Paddle/Stripe later)

## Layout

- `bdj/` — bestdadjokes.lol project
  - `content/jokes.json` — dataset, APPEND-ONLY (joke id = array index)
  - `build.py` — stdlib-only static generator (Python 3.6! no walrus, no dict-merge `|`)
  - `static/` — css/js/favicon (`jokes-data.js` is generated, don't hand-edit)
  - `k8s/traefik.yaml` — edge DaemonSet (hostNetwork, RBAC incl. endpointslices+nodes)
  - `k8s/letsencrypt-issuer.yaml` — ClusterIssuer, DNS-01 via CF token Secret
  - `k8s/static-sites.yaml` — per-site Deployment+Service+Ingress+Certificate
  - `deploy.sh` — build + in-place rsync to docroot (no dir swap — see gotchas)
- `adhd/site/index.html` — myadhd.dev placeholder (copied to `sites/myadhd.dev/`)
- `sites/` — live docroots (generated, gitignored)

## Deploy content

    cd bdj && ./deploy.sh

New site = docroot + copy the Deployment/Service/Ingress/Certificate pattern in
`bdj/k8s/static-sites.yaml` + a DNS record (Cloudflare API, token in
`~/.cloudflare-token`, zones bestdadjokes.lol=0cd16b5205725d310366859b3352a189,
myadhd.dev=00fa64c074d7162b7616a4a3dc42ba77).

## Server facts & gotchas (hard-won)

- VM: djg-oracle-sl, Oracle Linux 8.10, **ARM** 4c/23GB, public IP 144.24.30.131
- **k3s pinned v1.34.11**: newest kubelet (1.36) refuses cgroup v1; OL8 boots cgroup v1
  and a reboot to switch would kill the agent session. Revisit only with user OK.
- kubectl: `sudo /usr/local/bin/k3s kubectl` (sudo secure_path drops /usr/local/bin)
- **firewalld is DISABLED** (it silently rejected pod-forwarded traffic → all pod
  egress dead, "No route to host"). OCI security list (22/80/443) is the perimeter.
- **coredns Corefile patched**: `forward . 1.1.1.1 8.8.8.8` because OCI's
  169.254.169.254 resolver is link-local and unreachable from pods. A k3s upgrade
  may revert this — re-patch if pods can't resolve DNS.
- **Traefik gotcha**: without `--entrypoints.websecure.http.tls=true`, TLS routers
  register but never match → every HTTPS request 404s while plaintext works.
- **hostPath gotcha**: never atomic-swap docroot dirs (mv breaks the bind by inode);
  rsync in place. If a pod serves 403/empty after content ops, rollout-restart it.
- Local test: `curl -sk --resolve bestdadjokes.lol:443:127.0.0.1 https://bestdadjokes.lol/`
- Shell rule: never `cd` into a directory a command might delete (agent shell cwd
  breaks and needs manual recovery).

## Roadmap

1. Google Search Console (user creates property; HTML-meta verification token → I add)
2. Social content pipeline (needs user accounts: X/Pinterest/Bluesky/Reddit)
3. Ads: site into user's MCM/AdX; ad slots marked `<!-- AD_SLOT_* -->` in build.py
4. Daily content growth + long-tail topic pages; then paid-traffic arb experiments
5. myadhd.dev build-out (client-side tools, Paddle/Stripe when user ready)