feat: deploy to Frostmoln production #391

2026-10-14T20:26:33Z

argoyle commented

2026-10-14 20:26:33 +00:00

Moves the production deploy from AWS to the Frostmoln production cluster (namespace schemas), with unboundsoftware/schemas.

deploy-prod (AWS, failing since CI left AWS) → deploy-prod-frostmoln: deploy prod-frostmoln -n schemas.
Restricted Pod Security: nginxinc/nginx-unprivileged (uid 101, port 8080; 1.31.7 isn't published for it yet, so 1.31.6). nginx.conf: no user, pid and temp paths under /tmp, listen 8080. Configs copied with --chmod=644. Service is ClusterIP.
autoscale-prod/pdb-prod → -prod-frostmoln; the ALB ingress → a Traefik one for / on schemas.unbound.se (the API's /query ingress wins on the longer path).

Checked locally (amd64): as uid 101 with all capabilities dropped, /health, / and SPA routes 200, security headers present.

Merge with the schemas PR, after infra#1878 is applied.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

Moves the production deploy from AWS to the Frostmoln production cluster (namespace `schemas`), with unboundsoftware/schemas. - `deploy-prod` (AWS, failing since CI left AWS) → `deploy-prod-frostmoln`: `deploy prod-frostmoln -n schemas`. - Restricted Pod Security: `nginxinc/nginx-unprivileged` (uid 101, port 8080; 1.31.7 isn't published for it yet, so 1.31.6). `nginx.conf`: no `user`, pid and temp paths under `/tmp`, `listen 8080`. Configs copied with `--chmod=644`. Service is ClusterIP. - `autoscale-prod`/`pdb-prod` → `-prod-frostmoln`; the ALB ingress → a Traefik one for `/` on `schemas.unbound.se` (the API's `/query` ingress wins on the longer path). Checked locally (amd64): as uid 101 with all capabilities dropped, `/health`, `/` and SPA routes 200, security headers present. **Merge with** the schemas PR, after infra#1878 is applied. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

argoyle added 2 commits 2026-10-14 20:26:34 +00:00

feat: deploy to Frostmoln production 1646ee1bc3

The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se
context on the runners). Deploys now go to the Frostmoln production
cluster (namespace schemas), the way the sites do.

Frostmoln enforces restricted Pod Security: the pod runs as the image's
non-root user with a matching securityContext. The prod-only manifests
move to the prod-frostmoln target; the ALB ingress becomes a Traefik one
with a Let's Encrypt certificate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

fix: make the nginx config readable by the unprivileged user

schemas-app / build (pull_request) Successful in 4m9s

Details

schemas-app / deploy-prod-frostmoln (pull_request) Skipped

Details

0f7610d03f

COPY keeps the source file's mode; a 600 file (local checkouts) left
uid 101 unable to read it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

All checks were successful

schemas-app / build (pull_request) Successful in 4m9s

Required

Details

schemas-app / deploy-prod-frostmoln (pull_request) Skipped

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/frostmoln-production:feat/frostmoln-production

git checkout feat/frostmoln-production

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unboundsoftware/schemas-app#391