From 43edfa44b89a908cdd3a018a3cd1653be3875f3c Mon Sep 17 00:00:00 2001
From: djg <djg@ch4t.buzz>
Date: Mon, 21 Sep 2026 22:25:40 +0000
Subject: [PATCH] ci: switch to Docker image build and kubectl rollout

---
 .forgejo/workflows/deploy.yml | 23 +++++++++++++++++------
 Dockerfile                    |  9 +++++++++
 nginx.conf                    | 28 ++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+), 6 deletions(-)
 create mode 100644 Dockerfile
 create mode 100644 nginx.conf

diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 0edd6cc..5d40fcc 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -10,10 +10,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build site
-        run: python3 build.py
-
-      - name: Deploy to nginx docroot
+      - name: Build image
         run: |
-          rsync -av --delete site/ /home/opc/zai-home-base/sites/helpme-tips/
-          echo "Deployed at $(date)"
+          docker build \
+            -t git.ch4t.buzz/djg/helpme-tips:${{ github.sha }} \
+            -t git.ch4t.buzz/djg/helpme-tips:latest \
+            .
+
+      - name: Push to registry
+        run: |
+          docker push git.ch4t.buzz/djg/helpme-tips:${{ github.sha }}
+          docker push git.ch4t.buzz/djg/helpme-tips:latest
+
+      - name: Roll out to k8s
+        run: |
+          kubectl set image deployment/static-hts \
+            nginx=git.ch4t.buzz/djg/helpme-tips:${{ github.sha }} \
+            -n default
+          kubectl rollout status deployment/static-hts -n default --timeout=120s
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..4c8afc9
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,9 @@
+FROM python:3.11-slim AS builder
+WORKDIR /app
+COPY . .
+RUN python3 build.py
+
+FROM nginx:alpine
+COPY --from=builder /app/site/ /usr/share/nginx/html/
+COPY nginx.conf /etc/nginx/nginx.conf
+EXPOSE 80
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..22f3212
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,28 @@
+worker_processes 1;
+error_log /dev/stderr warn;
+pid /tmp/nginx.pid;
+events { worker_connections 1024; }
+http {
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+  access_log /dev/stdout;
+  sendfile on;
+  gzip on;
+  gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;
+  gzip_min_length 1024;
+  server {
+    listen 80;
+    root /usr/share/nginx/html;
+    index index.html;
+    error_page 404 /404.html;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+    location ~* \.(css|js|svg|png|jpg|ico|woff2?)$ {
+      expires 7d;
+      add_header Cache-Control "public";
+    }
+    location / {
+      try_files $uri $uri/ $uri/index.html =404;
+    }
+  }
+}