From c945fce11d4f2964257c59099ecb40ab1d6ef2bd Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Sun, 2 Aug 2026 10:03:17 +0300
Subject: shuriken: sync via rsync daemon (no SSH), gated on completed
 generation

Per feedback: the shuriken-sync CronJob now uses the rsync daemon
protocol (rsync://) instead of SSH -- no key/Secret needed. The
frontends run rsyncd via inetd with hosts allow *.wg0; k3s pods run on
r-nodes with .wg0 (WireGuard) connectivity, so they're authorized to
push over the mesh. Add writable irregular-ninja and alt-irregular-ninja
modules to frontends/etc/rsyncd.conf.tpl (deploy with rex rsync).

It only publishes when a generation has COMPLETED since the last sync:
shuriken now deletes dist/status.json at the start of a run and writes
it last on success, so status.json presence+freshness vs a .last-sync
marker on NFS is the completed/not-yet-published signal. Most ticks
skip; a publish fires once after each daily generation. hostAliases pin
the .wg0 frontend names to mesh IPs (cluster DNS doesn't resolve *.wg0).
The nfs-check initContainer stays so rsync --delete can't wipe the live
site if NFS is down. shuriken --sync over SSH stays as a manual option.
---
 frontends/etc/rsyncd.conf.tpl | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

(limited to 'frontends')

diff --git a/frontends/etc/rsyncd.conf.tpl b/frontends/etc/rsyncd.conf.tpl
index e9fe3cf..22c9942 100644
--- a/frontends/etc/rsyncd.conf.tpl
+++ b/frontends/etc/rsyncd.conf.tpl
@@ -11,6 +11,24 @@ uid = www
 gid = www
 hosts allow = <%= $allow %>
 
+[irregular-ninja]
+comment = Irregular Ninja photo album (push from k3s over wg0)
+path = /var/www/htdocs/irregular.ninja
+read only = no
+list = yes
+uid = www
+gid = www
+hosts allow = <%= $allow %>
+
+[alt-irregular-ninja]
+comment = Alternative Irregular Ninja photo album (push from k3s over wg0)
+path = /var/www/htdocs/alt.irregular.ninja
+read only = no
+list = yes
+uid = www
+gid = www
+hosts allow = <%= $allow %>
+
 # [publicgemini]
 # comment = Public Gemini capsule content
 # path = /var/gemini
-- 
cgit v1.2.3