Initial cursor-devbox: image, deploy manifests, and Flux SHA automation.

Owns Dockerfile/CI and node1 workload YAML; ImagePolicy elects run_number-sha tags and ImageUpdateAutomation commits them into deploy/.
2026-09-20 12:57:44 +00:00
commit 05ea40562c
8 changed files with 459 additions and 0 deletions
@@ -0,0 +1,43 @@
+# cursor-devbox
+
+Personal Cursor Remote-SSH workspace image and GitOps for **node1-k3s**.
+
+- **Image**: `dcr.trinitysan.by/infra/cursor-devbox`
+- **Deploy**: `deploy/` (Namespace, StatefulSet, ingress)
+- **Flux image automation**: `flux/` (ImageRepository / ImagePolicy / ImageUpdateAutomation)
+
+Infra on node1 only keeps thin Flux glue (`GitRepository` + Kustomizations + auth SecretAdapters) in `infrastructure/node1-k3s/130-cursor-devbox.yaml`.
+
+## Access
+
+| Endpoint | Detail |
+|----------|--------|
+| SSH | `ssh -p 2222 developer@devbox.trinitysan.by` |
+| HTTP health | `https://devbox.trinitysan.by/` |
+
+## CI
+
+Gitea Actions (`.gitea/workflows/build-and-push.yaml`) on `master` (Dockerfile / entrypoint changes) and `workflow_dispatch` pushes:
+
+| Tag | Purpose |
+|-----|---------|
+| `:latest` | Convenience |
+| `:<git-sha>` | Immutable full SHA |
+| `:<run_number>-<git-sha>` | Sortable; elected by Flux ImagePolicy |
+
+Org secrets: `DCR_USERNAME`, `DCR_PASSWORD` (infra org).
+
+## Local build
+
+```bash
+docker build -t dcr.trinitysan.by/infra/cursor-devbox:local .
+```
+
+## Flux update flow
+
+1. CI pushes `run_number-sha` to DCR
+2. ImageRepository scans; ImagePolicy picks highest `run_number`
+3. ImageUpdateAutomation commits the new tag into `deploy/020-statefulset.yaml`
+4. Kustomization applies; StatefulSet rolls (active SSH sessions drop)
+
+Requires a Gitea PAT with **read+write** on this repo (`GITEA_CURSOR_DEVBOX_GITOPS_TOKEN` on node1, see infra `060-external-secrets.yaml.template`).