Infrastructure

arcane@prod:~$ cat infra/**

How this page reaches you — the actual infrastructure, read straight from the repo at build time (no hand-copied snippets, so it can never drift).

A single-node k3s box behind a Cloudflare Tunnel, GitOps-deployed: push to main, CI builds the image, ArgoCD syncs the cluster.

name: web image

on:
  push:
    branches: [main]
    paths:
      - "apps/web/**"
      - "packages/**"
      - "package.json"
      - "package-lock.json"
      - ".github/workflows/web.yml"
  workflow_dispatch:

concurrency:
  group: web-image
  cancel-in-progress: false

env:
  IMAGE: ghcr.io/gabrielipcarvalho/gipc-web

jobs:
  build:
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: write     # to commit the GitOps tag bump
      packages: write      # to push to GHCR
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & push image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/web/Dockerfile
          platforms: linux/arm64
          push: true
          tags: |
            ${{ env.IMAGE }}:${{ github.sha }}
            ${{ env.IMAGE }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: GitOps — pin manifest to this image (deploy feed)
        id: pin
        run: |
          # rebase-retry: two workflows can race to pin on the same push; the loser fetches the
          # winner's commit, re-applies its own tag, and retries. FETCH_HEAD is fresh on a shallow clone.
          # BRANCH-AWARE (ai/core pattern): workflow_dispatch can run from a test branch — pin the
          # triggering ref, never hardcode main.
          git config user.name  "gipc-ci"
          git config user.email "ci@gipc.dev"
          for attempt in 1 2 3 4 5; do
            git fetch origin "$GITHUB_REF_NAME"
            git reset --hard FETCH_HEAD
            sed -i "s|newTag: .*|newTag: \"${GITHUB_SHA}\"|" infra/k8s/web/kustomization.yaml
            if git diff --quiet; then echo "already pinned"; exit 0; fi
            git commit -am "deploy(web): ${GITHUB_SHA:0:7} → gipc.dev [skip ci]"
            if git push origin HEAD:"$GITHUB_REF_NAME"; then echo "pinned (attempt $attempt)"; exit 0; fi
            echo "push rejected — another workflow pushed; retrying"
            [ "$attempt" -lt 5 ] && sleep $((attempt * 3))
          done
          echo "::error::failed to pin web after 5 attempts"; exit 1

      - name: Notify deploy feed
        # post whenever the image built (even if the pin retried/failed), but never on a cancelled run.
        if: ${{ !cancelled() && github.ref == 'refs/heads/main' && steps.build.outcome == 'success' }}
        env:
          DEPLOY_HOOK_KEY: ${{ secrets.DEPLOY_HOOK_KEY }}
          # released reflects the PIN outcome — a failed pin = manifest not bumped = site NOT on the new image
          RELEASED_STATUS: ${{ steps.pin.outcome == 'success' && 'success' || 'failure' }}
        run: |
          [ -z "$DEPLOY_HOOK_KEY" ] && { echo "no key"; exit 0; }
          SUBJECT=$(git log -1 --format=%s "$GITHUB_SHA"); TS=$(date -u +%FT%TZ)
          post() {   # $1 stage, $2 status — jq builds subject-safe JSON; sign the exact bytes sent
            body=$(jq -nc --arg sha "$GITHUB_SHA" --arg subject "$SUBJECT" --arg stage "$1" --arg status "$2" --arg ts "$TS" \
              '{sha:$sha,subject:$subject,stage:$stage,status:$status,ts:$ts}')
            sig=$(printf '%s' "$body" | openssl dgst -sha256 -hmac "$DEPLOY_HOOK_KEY" | awk '{print $2}')
            curl -fsS -X POST -H "X-Signature: sha256=$sig" -H 'Content-Type: application/json' --data "$body" https://gipc.dev/api/hooks/deploy || true
          }
          post build success
          post released "$RELEASED_STATUS"

apiVersion: v1
kind: ConfigMap
metadata:
  name: core-config
  namespace: gipc
data:
  PORT: "8080"
  CORS_ORIGIN: "https://gipc.dev"
  RATE_LIMIT_RPS: "10"
  RATE_LIMIT_BURST: "20"
  PROMETHEUS_URL: "http://prometheus.observability:9090"   # used from P3
  LOKI_URL: "http://loki.observability:3100"               # P6 log surface (cross-ns ClusterIP)
  WEB_URL: "http://web:80"                                  # P7 uptime probe target
  UPTIME_INTERVAL: "30s"                                    # P7 probe cadence
  SHUTDOWN_TIMEOUT: "25s"
  LAB_ENABLED: "true"                                      # M5 — chaos/lab handlers active (P2)
  LAB_NAMESPACE: "demo"                                    # the ONLY ns core's k8s client touches
  CHAOS_RPS: "0.1"                                         # chaos-kill per-IP cooldown ≈ 1 / 10s
  CHAOS_BURST: "1"                                         # single-flight per IP
  LOAD_TARGET_URL: "http://chaos-target.demo"             # FIXED load target (isolated demo echo) — no SSRF
  LOAD_MAX_CONCURRENCY: "50"                              # code-clamped ceiling
  LOAD_MAX_SECONDS: "10"                                  # code-clamped ceiling
  LOAD_MAX_RUNS: "4"                                      # global concurrent-run ceiling
  LOAD_RPS: "0.2"                                         # per-IP cooldown ≈ 1 run / 5s
  LOAD_BURST: "1"
  LAB_EVENT_HEARTBEAT: "10s"                              # /api/lab/events heartbeat cadence
  DB_RPS: "0.5"                                           # db-explorer per-IP cooldown ≈ 1 run / 2s
  DB_BURST: "2"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: core
  namespace: gipc
  labels: { app: core }
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
  selector:
    matchLabels: { app: core }
  template:
    metadata:
      labels: { app: core }
    spec:
      serviceAccountName: core-lab        # M5 — SA whose namespaced Role (ns demo) grants pods list/delete
      terminationGracePeriodSeconds: 30   # ≥ SHUTDOWN_TIMEOUT so /api/* drains on a roll
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532        # distroless:nonroot
        fsGroup: 65532
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: core
          image: ghcr.io/gabrielipcarvalho/gipc-core:latest   # tag pinned by CI via kustomization
          ports:
            - { containerPort: 8080, name: http }
          envFrom:
            - configMapRef: { name: core-config }
          env:
            - name: DEPLOY_HOOK_KEY   # HMAC key for /api/hooks/deploy — imperative Secret, never committed
              valueFrom:
                secretKeyRef: { name: deploy-hook, key: hmac }
            - name: DEMO_DB_URL       # Lab DB explorer DSN (demo-ns toy postgres) — imperative Secret;
              valueFrom:              # optional: a missing Secret must never block boot (explorer 503s)
                secretKeyRef: { name: demo-db-url, key: url, optional: true }
          readinessProbe:
            httpGet: { path: /api/readyz, port: 8080 }
            initialDelaySeconds: 3
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /api/healthz, port: 8080 }
            initialDelaySeconds: 5
            periodSeconds: 20
          resources:
            requests: { cpu: 25m, memory: 32Mi }
            limits: { cpu: 200m, memory: 128Mi }
          securityContext:               # static binary writes nothing → full lockdown
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: [ALL] }
---
apiVersion: v1
kind: Service
metadata:
  name: core
  namespace: gipc
  labels: { app: core }
spec:
  type: ClusterIP
  selector: { app: core }
  ports:
    - { port: 8080, targetPort: 8080, name: http }

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# One app manages core + caddy. Each manifest sets its own namespace: gipc (no namespace directive here).
# Caddy's image is pinned inline in ../caddy (no images: entry), so CI's tag-pin sed matches only the
# core image line below. Keep comments free of the literal tag-key token so the sed can't match them.
resources:
  - core.yaml
  - core-lab-sa.yaml
  - core-topology-rbac.yaml
  - ../caddy
images:
  - name: ghcr.io/gabrielipcarvalho/gipc-core
    newTag: "e027f2e93fdfecc01985f4f2a0557eb6f84e8227"

apiVersion: v1
kind: ConfigMap
metadata:
  name: caddy-config
  namespace: gipc
data:
  Caddyfile: |
    {
      auto_https off
      admin off
      servers {
        trusted_proxies static private_ranges   # trust cloudflared → preserve X-Forwarded-Proto/For
        metrics                                  # enable per-server Prometheus metrics
      }
    }
    :80 {
      handle /caddy-health {
        respond 200
      }
      # arc4ne.io — the company-site tenant (ns arcane). Host-scoped FIRST so gipc's /api/*
      # routes never leak onto the arc4ne hostnames.
      @arc4ne host arc4ne.io www.arc4ne.io
      handle @arc4ne {
        reverse_proxy arcane-web.arcane:80
      }
      handle /api/ai/* {
        reverse_proxy ai:8000 {
          flush_interval -1
        }
      }
      handle /api/* {
        reverse_proxy core:8080 {
          flush_interval -1
        }
      }
      handle {
        reverse_proxy web:80
      }
      header {
        -Server
        # CSP: 'unsafe-inline' is required for Next.js static (inline hydration bootstrap + inline styles;
        # no nonce middleware on prerendered pages). challenges.cloudflare.com = Turnstile (the only external
        # host). Everything else is same-origin. No eval/worker/blob in the codebase → those stay omitted.
        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "strict-origin-when-cross-origin"
        X-Frame-Options "DENY"
        # HSTS apex-only (no includeSubDomains — mail/other subdomains aren't all HTTPS-forced; no preload).
        Strict-Transport-Security "max-age=31536000"
        Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()"
      }
      # The résumé PDF is embedded by /connect in a same-origin <iframe>. The global block above
      # stamps frame-ancestors 'none' + XFO DENY on EVERY response — including the PDF itself,
      # which made the browser refuse OUR OWN embed ("gipc.dev refused to connect"). Re-set the
      # two fields for that one asset: same-origin framing only, and a bare default-src 'none'
      # CSP (a PDF document loads no subresources). Everything else keeps the deny-all.
      # `defer` is load-bearing: the Caddyfile adapter sorts same-name directives with path
      # matchers FIRST, so without it the global block runs after this one and wins back.
      @resumepdf path /Gabriel_Carvalho_Resume.pdf
      header @resumepdf {
        Content-Security-Policy "default-src 'none'; frame-ancestors 'self'"
        X-Frame-Options "SAMEORIGIN"
        defer
      }
    }
    :2019 {
      metrics /metrics                           # internal only — NOT in the Service/tunnel
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: caddy
  namespace: gipc
  labels: { app: caddy }
spec:
  replicas: 1
  selector:
    matchLabels: { app: caddy }
  template:
    metadata:
      labels: { app: caddy }
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "2019"
        prometheus.io/path: "/metrics"
    spec:
      securityContext:
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: caddy
          image: caddy:2.8-alpine   # pinned INLINE (not in kustomization images:) so CI's sed can't touch it
          ports:
            - { containerPort: 80, name: http }
            - { containerPort: 2019, name: metrics }
          readinessProbe:
            httpGet: { path: /caddy-health, port: 80 }
            initialDelaySeconds: 3
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /caddy-health, port: 80 }
            initialDelaySeconds: 10
            periodSeconds: 20
          resources:
            requests: { cpu: 25m, memory: 32Mi }
            limits: { cpu: 150m, memory: 128Mi }
          securityContext:
            allowPrivilegeEscalation: false   # runs root for :80 bind + /data,/config writes — lighter than core
          volumeMounts:
            - { name: config, mountPath: /etc/caddy }
      volumes:
        - name: config
          configMap: { name: caddy-config }
---
apiVersion: v1
kind: Service
metadata:
  name: caddy
  namespace: gipc
  labels: { app: caddy }
spec:
  type: NodePort
  selector: { app: caddy }
  ports:
    - { port: 80, targetPort: 80, nodePort: 30082, name: http }

tunnel: ‹tunnel-id›
credentials-file: /etc/cloudflared/gipc.json
originRequest:
  connectTimeout: 30s
ingress:
  - hostname: gipc.dev
    service: http://localhost:30082
  - hostname: www.gipc.dev
    service: http://localhost:30082
  - hostname: arc4ne.io
    service: http://localhost:30082
  - hostname: www.arc4ne.io
    service: http://localhost:30082
  - service: http_status:404

# The codified mirror of gipc.dev's Cloudflare provisioning: the tunnel + the full DNS zone
# (site CNAMEs + the Migadu mail set). Imported and applied in Sprint J — `plan` is clean;
# see README.md for the import notes (short names, config_src, the one reconciling apply).

# gipc.dev and www route through the tunnel: proxied CNAMEs onto cfargotunnel.com.
resource "cloudflare_record" "apex" {
  zone_id = var.zone_id
  name    = "gipc.dev"
  type    = "CNAME"
  content = "${var.tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "www" {
  zone_id = var.zone_id
  name    = "www"
  type    = "CNAME"
  content = "${var.tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# --- Migadu mail: the records that make gipc.dev email work. All DNS-only (unproxied),
# ttl 300. Authored verbatim from the live-API snapshot — never edit content to "tidy" it;
# a wrong byte here silently breaks mail. Names are the provider's SHORT form (verified at
# import: v4 stores the record's short name in state, not the FQDN). ---

resource "cloudflare_record" "autoconfig" {
  zone_id = var.zone_id
  name    = "autoconfig"
  type    = "CNAME"
  content = "autoconfig.migadu.com"
  proxied = false
  ttl     = 300
}

resource "cloudflare_record" "autodiscover" {
  zone_id = var.zone_id
  name    = "autodiscover"
  type    = "CNAME"
  content = "autodiscover.migadu.com"
  proxied = false
  ttl     = 300
}

resource "cloudflare_record" "dkim1" {
  zone_id = var.zone_id
  name    = "key1._domainkey"
  type    = "CNAME"
  content = "key1.gipc.dev._domainkey.migadu.com"
  proxied = false
  ttl     = 300
}

resource "cloudflare_record" "dkim2" {
  zone_id = var.zone_id
  name    = "key2._domainkey"
  type    = "CNAME"
  content = "key2.gipc.dev._domainkey.migadu.com"
  proxied = false
  ttl     = 300
}

resource "cloudflare_record" "dkim3" {
  zone_id = var.zone_id
  name    = "key3._domainkey"
  type    = "CNAME"
  content = "key3.gipc.dev._domainkey.migadu.com"
  proxied = false
  ttl     = 300
}

resource "cloudflare_record" "mx_primary" {
  zone_id  = var.zone_id
  name     = "gipc.dev"
  type     = "MX"
  content  = "aspmx1.migadu.com"
  priority = 10
  proxied  = false
  ttl      = 300
}

resource "cloudflare_record" "mx_secondary" {
  zone_id  = var.zone_id
  name     = "gipc.dev"
  type     = "MX"
  content  = "aspmx2.migadu.com"
  priority = 20
  proxied  = false
  ttl      = 300
}

resource "cloudflare_record" "srv_autodiscover" {
  zone_id = var.zone_id
  name    = "_autodiscover._tcp"
  type    = "SRV"
  ttl     = 300
  data {
    priority = 0
    weight   = 1
    port     = 443
    target   = "autodiscover.migadu.com"
  }
}

resource "cloudflare_record" "srv_imaps" {
  zone_id = var.zone_id
  name    = "_imaps._tcp"
  type    = "SRV"
  ttl     = 300
  data {
    priority = 0
    weight   = 1
    port     = 993
    target   = "imap.migadu.com"
  }
}

resource "cloudflare_record" "srv_pop3s" {
  zone_id = var.zone_id
  name    = "_pop3s._tcp"
  type    = "SRV"
  ttl     = 300
  data {
    priority = 0
    weight   = 1
    port     = 995
    target   = "pop.migadu.com"
  }
}

resource "cloudflare_record" "srv_submissions" {
  zone_id = var.zone_id
  name    = "_submissions._tcp"
  type    = "SRV"
  ttl     = 300
  data {
    priority = 0
    weight   = 1
    port     = 465
    target   = "smtp.migadu.com"
  }
}

resource "cloudflare_record" "txt_dmarc" {
  zone_id = var.zone_id
  name    = "_dmarc"
  type    = "TXT"
  content = "v=DMARC1; p=quarantine;"
  proxied = false
  ttl     = 300
}

resource "cloudflare_record" "txt_spf" {
  zone_id = var.zone_id
  name    = "gipc.dev"
  type    = "TXT"
  content = "v=spf1 include:spf.migadu.com -all"
  proxied = false
  ttl     = 300
}

resource "cloudflare_record" "txt_mail_verify" {
  zone_id = var.zone_id
  name    = "gipc.dev"
  type    = "TXT"
  content = "hosted-email-verify=mj2ixoiz"
  proxied = false
  ttl     = 300
}

# The tunnel itself. config_src = "local" is the truth: ingress rules live in
# /etc/cloudflared/config.yml on the box (see infra/cloudflared + infra/ansible) — a remote
# tunnel_config resource would misstate how this tunnel is actually managed.
resource "cloudflare_zero_trust_tunnel_cloudflared" "gipc" {
  account_id = var.account_id
  name       = "gipc"
  secret     = var.tunnel_secret
  config_src = "local"

  # Both secret and config_src are ForceNew, and neither survives import into state (the v4
  # provider leaves config_src null on read and never returns the real secret) — so a first
  # plan would see null→"local" and null→<dummy> and want to REPLACE the live tunnel. Ignoring
  # both suppresses that spurious replacement; the real credential + the local config both live
  # on the box, never in Terraform. (Verified at import: state carries the computed tunnel_token
  # but not `secret`; config_src imported as null → the replace was driven by config_src, not
  # the secret.)
  lifecycle {
    ignore_changes = [secret, config_src]
  }
}