diff options
| author | Paul Buetow <paul@buetow.org> | 2026-08-02 10:03:17 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-08-02 10:03:17 +0300 |
| commit | c945fce11d4f2964257c59099ecb40ab1d6ef2bd (patch) | |
| tree | 93ec32c794936c22abc9e28258b10dfdbf0fd03d /frontends/scripts | |
| parent | c3bda963abcf5d2bd93f1ad40a07fce715154f5f (diff) | |
shuriken: sync via rsync daemon (no SSH), gated on completed generation
Per feedback: the shuriken-sync CronJob now uses the rsync daemon
protocol (rsync://) instead of SSH -- no key/Secret needed. The
frontends run rsyncd via inetd with hosts allow *.wg0; k3s pods run on
r-nodes with .wg0 (WireGuard) connectivity, so they're authorized to
push over the mesh. Add writable irregular-ninja and alt-irregular-ninja
modules to frontends/etc/rsyncd.conf.tpl (deploy with rex rsync).
It only publishes when a generation has COMPLETED since the last sync:
shuriken now deletes dist/status.json at the start of a run and writes
it last on success, so status.json presence+freshness vs a .last-sync
marker on NFS is the completed/not-yet-published signal. Most ticks
skip; a publish fires once after each daily generation. hostAliases pin
the .wg0 frontend names to mesh IPs (cluster DNS doesn't resolve *.wg0).
The nfs-check initContainer stays so rsync --delete can't wipe the live
site if NFS is down. shuriken --sync over SSH stays as a manual option.
Diffstat (limited to 'frontends/scripts')
0 files changed, 0 insertions, 0 deletions