| Age | Commit message (Collapse) | Author |
|---|
|
The nav is hand-copied into each page, so adding Research only to the pages
that were being edited left readers losing the link as soon as they entered an
article (6 of 9 pages lacked it). All nine now carry an identical line.
Home page: RESEARCH: had one space more than its neighbours and sat a column
out of the curl block.
Note: /research itself is still uncommitted (research/ is untracked), so
deploying this alone would publish nine links to a 404. Ship the research page
in the same push.
|
|
Dropping the .txt location made the curl/wget suffix map apply to every
request, so /robots.txt was looked up as /robots.txt.txt and 404'd. Keep the
location, but without add_header, so mime.types and charset cover the type
and the server-level security headers are still inherited.
|
|
The single-file mount pins the inode present when the container started. A
rename-based write leaves the container serving stale bytes while nginx -t
validates them, which is exactly how the previous deploy reported success
with an unchanged config. Compare the host and in-container checksums after
the reload and restart the container to re-resolve the path on mismatch.
|
|
nginx.conf is mounted as a single file. rsync renames a temp over the
destination, which replaces the inode, so the container kept reading the old
inode: nginx -t validated the old bytes, reload was a no-op, and the deploy
reported success while the live config was unchanged. Stage to
nginx.conf.new, copy in place with cat so the mounted inode keeps its
identity, then test and reload. Rollback copies in place too, for the same
reason.
|
|
`curl https://jayrup.me/public_key` is the documented way to get this key
onto a VPS, so both the file and the config serving it need to be exact.
Key file: drop the trailing space, one trailing newline. A key with no
trailing newline makes `curl ... >> ~/.ssh/authorized_keys` glue itself onto
the previous line and silently break every later key in the file.
nginx:
- `/assets/public_key` ignored $final_suffix, so curl got 404 while browsers
got 200. Route both through the suffix-aware try_files.
- add_header does not merge across levels: the asset, PDF and .txt locations
each declared one, so they inherited none of the security headers. The
asset location now repeats them; the PDF and .txt locations no longer
declare any (default_type / mime.types + charset do the job), so they
inherit again.
- `add_header Content-Type application/pdf` appended a second Content-Type
instead of setting it. Use default_type.
- `expires 30d` plus an explicit Cache-Control emitted two Cache-Control
headers. Use one explicit header.
- add `charset utf-8` so text/plain (what curl gets) is not served
charset-less while the content contains non-ASCII.
deploy: ship nginx.conf alongside public/. It is bind-mounted into the
container, so it never travelled with the rsync'd tree — the live config was
from May and predated the hardening committed in 0ee667a. Test with
`nginx -t` before reloading and restore the previous config on failure.
|
|
deploy.sh cd'd into the mktemp build dir before calling git, so
`git archive HEAD` failed with 'not a git repository' and the whole
deploy aborted. Resolve REPO from the script location and pass -C to
every git call, and write the archive to an absolute path since -C also
makes --output relative to the repo.
The deploy marker also ran `git rev-parse` from the temp dir; because it
sat inside a command substitution, set -e did not catch it and
last-deploy.txt silently recorded an empty commit. Capture SHA up front.
Also drop `mkdir -p public/cv`, left over from when the CV was copied
into a directory that nothing reads.
|
|
|
|
header + dissertation entry, PDF link annotations)
|
|
|
|
and styles
|
|
deploy)
|
|
newest-first ordering
|
|
cross-links
|
|
|
|
|
|
|
|
script
|
|
|
|
afford
|
|
|
|
|
|
|
|
|
|
philosophy-focused
|
|
|
|
|
|
|
|
fixed /tmp paths
|
|
|
|
steps
|
|
exist on Docker Hub)
|
|
|
|
|
|
|
|
project entry
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
