diff --git a/CLAUDE.md b/CLAUDE.md index 8083fb9..eec1e75 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -114,7 +114,7 @@ session model. See `.claude/rules/agents.md`. ## Release & docs deploy - `rake release[X.Y.Z]` bumps the version, verifies `gem build --strict`, pushes, and creates the GitHub release; CI (`release.yml`) tests, builds, signs (Sigstore), and publishes to RubyGems via trusted publishing. -- The docs site deploys on release via `.github/workflows/deploy-docs.yml`, which calls docs-kit's reusable Kamal + GHCR workflow. `image`/`service` are `mhenrixon/phlex-forms`. +- The docs site deploys on release via `.github/workflows/deploy-docs.yml`, which calls docs-kit's reusable dash + GHCR workflow. `image`/`service` are `zoolutions/phlex-forms`. ## More Documentation diff --git a/docs/.dash/secrets b/docs/.dash/secrets new file mode 100644 index 0000000..8193c1a --- /dev/null +++ b/docs/.dash/secrets @@ -0,0 +1,3 @@ +# In CI the deploy workflow sets this to the job's GITHUB_TOKEN. Locally, +# export it (e.g. DASH_REGISTRY_PASSWORD=$(gh auth token)). +DASH_REGISTRY_PASSWORD=$DASH_REGISTRY_PASSWORD diff --git a/docs/.dockerignore b/docs/.dockerignore index 86cac7a..076b4c8 100644 --- a/docs/.dockerignore +++ b/docs/.dockerignore @@ -40,6 +40,7 @@ # CI / deploy / Docker meta — not part of the runtime image. /.github/ +/.dash/ /.kamal/ /Dockerfile* /.dockerignore diff --git a/docs/.kamal/secrets b/docs/.kamal/secrets deleted file mode 100644 index e7e0892..0000000 --- a/docs/.kamal/secrets +++ /dev/null @@ -1,3 +0,0 @@ -# In CI the deploy workflow sets this to the job's GITHUB_TOKEN. Locally, -# export it (e.g. KAMAL_REGISTRY_PASSWORD=$(gh auth token)). -KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD diff --git a/docs/README.md b/docs/README.md index 35d2850..18049a4 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,6 +1,6 @@ # phlex-forms docs -The documentation site for [phlex-forms](https://github.com/mhenrixon/phlex-forms), +The documentation site for [phlex-forms](https://github.com/zoolutions/phlex-forms), built on [docs-kit](https://docs-kit.zoolutions.llc) and served at . @@ -19,5 +19,5 @@ Pages live in `app/views/docs/pages/` and register in `app/models/doc.rb` ## Deploy -`bin/deploy` (Kamal) or the `Deploy docs` GitHub workflow (runs on release). +`bin/deploy` (dash) or the `Deploy docs` GitHub workflow (runs on release). Regenerate the social cards with `bin/rails docs_kit:og` after landing changes. diff --git a/docs/config/deploy.yml b/docs/config/deploy.yml index f8026aa..52472e0 100644 --- a/docs/config/deploy.yml +++ b/docs/config/deploy.yml @@ -1,9 +1,21 @@ -# Kamal deploy → the oss-infrastructure server (Cloudflare Tunnel + kamal-proxy). +# dash deploy → the oss-infrastructure server (Cloudflare Tunnel + dash-proxy). +# `dash docs` / `dash docs proxy` is the always-current reference for every key. # service/image = the repo OWNER/REPO so the ghcr package auto-links to the # repo and GITHUB_TOKEN can push + pull it (no PAT). See docs-kit's README. service: phlex-forms image: zoolutions/phlex-forms +# dash 4 renamed the on-host proxy (kamal-proxy → dash-proxy) and migrates a +# host in place; an older CLI must not deploy this config. +minimum_version: 4.0.0 + +# A stateless docs site never rolls back far — keep the host tidy. +retain_containers: 2 + +# Status-named pages (public/502.html, 503, 504) the proxy serves in place of +# the app's during a deploy gap — paired with `proxy.intercept_errors` below. +error_pages_path: public + servers: web: hosts: @@ -15,17 +27,51 @@ ssh: proxy: host: <%= ENV["DEPLOY_DOMAIN"] %> app_port: 3000 + # TLS terminates at Cloudflare; the tunnel reaches the proxy over plain HTTP. ssl: false healthcheck: path: /up interval: 5 timeout: 30 + # --- dash-proxy per-app features ------------------------------------------ + # zstd / br / gzip negotiated at the edge; responses the app already encoded + # (Thruster) pass through untouched. + compress: true + + # RFC 9111 shared cache. Only responses the app marks `Cache-Control: public, + # max-age` are stored (Propshaft assets, /llms*.txt) — HTML carrying a session + # cookie is refused by design. `dash proxy cache stats` shows what it holds. + cache: + enabled: true + max_ttl: 300 + + # Security headers set once here instead of per app; drop server fingerprints. + headers: + response: + set: + X-Content-Type-Options: nosniff + Referrer-Policy: strict-origin-when-cross-origin + remove: + - Server + - X-Powered-By + + # Serve public/.html instead of a bare "Bad Gateway" while a + # container is swapped or unhealthy. + intercept_errors: + - 502 + - 503 + - 504 + + # Keep the health probe out of the request histograms. + exclude_metrics_paths: + - /up + registry: server: ghcr.io username: mhenrixon password: - - KAMAL_REGISTRY_PASSWORD + - DASH_REGISTRY_PASSWORD builder: arch: amd64 diff --git a/docs/public/502.html b/docs/public/502.html new file mode 100644 index 0000000..e4eb18a --- /dev/null +++ b/docs/public/502.html @@ -0,0 +1,135 @@ + + + + + + + We're sorry, but something went wrong (500 Internal Server Error) + + + + + + + + + + + + + +
+
+ +
+
+

We're sorry, but something went wrong.
If you're the application owner check the logs for more information.

+
+
+ + + + diff --git a/docs/public/503.html b/docs/public/503.html new file mode 100644 index 0000000..e4eb18a --- /dev/null +++ b/docs/public/503.html @@ -0,0 +1,135 @@ + + + + + + + We're sorry, but something went wrong (500 Internal Server Error) + + + + + + + + + + + + + +
+
+ +
+
+

We're sorry, but something went wrong.
If you're the application owner check the logs for more information.

+
+
+ + + + diff --git a/docs/public/504.html b/docs/public/504.html new file mode 100644 index 0000000..e4eb18a --- /dev/null +++ b/docs/public/504.html @@ -0,0 +1,135 @@ + + + + + + + We're sorry, but something went wrong (500 Internal Server Error) + + + + + + + + + + + + + +
+
+ +
+
+

We're sorry, but something went wrong.
If you're the application owner check the logs for more information.

+
+
+ + + +