Commit graph

54 commits

Author SHA1 Message Date
aca01579aa ci(renovate): drop in-config schedule (workflow cron already weekly), restore info log 2026-05-27 21:21:49 +02:00
54a511547b ci(renovate): temporarily run at debug log level to diagnose why PRs aren't created 2026-05-27 21:20:00 +02:00
052139b8ea ci(renovate): scope autodiscover to richardnixon.dev*, lift PR limits, drop warnings, block major bumps for stateful services 2026-05-27 21:17:25 +02:00
05d9285a04 ci(trivy): pin Trivy 0.70.0 (0.59.1 was bogus) and use curl -f to fail on 404
All checks were successful
trivy / config-scan (push) Successful in 30s
trivy / image-scan (push) Successful in 9m32s
2026-05-27 18:01:05 +02:00
64f6059a83 ci(trivy): switch to catthehacker image + binary install (aquasec image lacks Node for checkout)
Some checks failed
trivy / config-scan (push) Failing after 13s
trivy / image-scan (push) Failing after 13s
2026-05-27 17:59:10 +02:00
456e3e5614 ci: add Renovate (autodiscover) and Trivy CVE scan workflows
Some checks failed
trivy / config-scan (push) Failing after 22s
trivy / image-scan (push) Failing after 21s
- renovate.json: gitea platform, weekly schedule on Monday, pins
  ranges, manages docker-compose images + dockerfile + github-actions.
  Critical-infra packages get extra labels for review.
- .forgejo/workflows/renovate.yml: runs Mondays 04:00 UTC, autodiscover
  Richard/* so the same workflow covers both this repo and the Hugo
  companion. Requires RENOVATE_TOKEN secret (instructions in README).
- .forgejo/workflows/trivy.yml: daily 05:00 UTC + on-push. Scans both
  IaC configs in infrastructure/ and every image referenced in
  docker-compose.yml for HIGH/CRITICAL CVEs (fixable only).
- Pin Traefik (3.6.7) and traefik-crowdsec-bouncer (0.5.0) so Renovate
  has a baseline to bump.
2026-05-27 17:57:36 +02:00
a87db639eb chore: remove legacy Django app and runtime
Some checks failed
CI/CD / ci (push) Failing after 1m2s
CI/CD / deploy (push) Has been skipped
The public blog at richardnixon.dev is fully served by the Hugo
companion repo (richardnixon.dev-hugo) since the cutover. This commit
drops everything Django-related from this repo:

- Containers stopped and removed (already done on the host):
  platform-web, platform-celery, platform-celery-beat,
  platform-frontend, platform-db, platform-redis.
- Volumes dropped: platform-db-data, platform-redis-data,
  platform-static, platform-media (no backup; DB only held an empty draft).
- docker-compose.yml: removed all platform-* services, the
  platform-internal network, and the postgres-exporter / redis-exporter
  that only monitored the dropped DB/Redis pair.
- traefik/dynamic.yml: removed platform-api router and the
  platform-api / platform-frontend service definitions.
- Source tree: deleted apps/, config/, docker/, frontend/, locale/,
  templates/, media/, static/, requirements/, manage.py,
  requirements.txt, conftest.py, pytest.ini.
- docs/development.md removed (was 100% Django dev guide).
- README and docs/deployment.md rewritten as infra-only references.
2026-05-27 17:41:28 +02:00
1e8c7ccf6f infra: cutover to Hugo blog + Forgejo Actions runner
Some checks failed
CI/CD / ci (push) Failing after 3m39s
CI/CD / deploy (push) Has been skipped
- Add blog-static (nginx:alpine) service backed by bind-mount from
  /root/richardnixon.dev-hugo/public. Hugo blog now owns
  richardnixon.dev/* via Traefik dynamic.yml (priority 100).
- Narrow platform-api (Django legacy) to /api, /admin, /static, /media
  only; remove platform-frontend (Next.js) from routing.
- Add forgejo-runner service joining infrastructure_forgejo-internal
  network, with bind-mount config + entrypoint. Allowed valid_volume:
  /root/richardnixon.dev-hugo/public for CI deploys.
- Enable [actions] in Forgejo (FORGEJO__actions__ENABLED=true,
  DEFAULT_ACTIONS_URL=https://code.forgejo.org).
- Add export_hugo management command (HTML+frontmatter dump for the
  one-time content migration; left in tree for future re-runs).
- Update README and docs/deployment.md to reflect new public surface,
  CI flow, and Forgejo clone URL.
2026-05-27 17:25:02 +02:00
9f90aca614
Merge pull request #1 from richardnixondev/feat/forgejo
Add Forgejo git forge at git.richardnixon.dev
2026-05-18 09:17:15 +01:00
Richard Nixon
52b0b44eca Add Forgejo git forge at git.richardnixon.dev
Self-hosted Forgejo instance behind Traefik+CrowdSec, with public repo
browsing (LANDING_PAGE=explore) and Authentik OIDC for sign-in.

- compose: forgejo + forgejo-db (Postgres 16), forgejo-internal network,
  SSH on host port 2222, metrics enabled on monitoring network
- prometheus: forgejo scrape job on forgejo:3000/metrics
- README + deployment docs: services table, env vars, OIDC setup steps,
  ak shell snippet for provisioning the Authentik provider
2026-05-18 10:13:30 +02:00
Richard Nixon
cc483c201f Trigger deploy pipeline 2026-04-08 03:24:10 +02:00
Richard Nixon
4ce8c6b185 Add workflow_dispatch trigger to CI/CD pipeline 2026-04-08 03:03:54 +02:00
Richard Nixon
748613a109 Fix CI: make sentry_sdk import conditional on SENTRY_DSN
Avoids ModuleNotFoundError when running check --deploy in CI
where sentry-sdk is not installed (dev dependencies only).
2026-04-08 02:50:46 +02:00
Richard Nixon
cef65dafdc Add documentation, organize .env.example, fix hardcoded secret
- Add apps/README.md describing each Django app
- Add docs/deployment.md with step-by-step VPS deploy guide
- Add docs/development.md with local dev setup guide
- Reorganize .env.example by service with section comments
- Remove hardcoded fallback from EIRESCOPE_SECRET_KEY
- Pass SENTRY_DSN env var to platform-web container
2026-04-08 02:45:07 +02:00
Richard Nixon
97e59cd235 Add test suite, split requirements, Sentry, and .dockerignore
- Split requirements.txt into base/dev/production
- Update Dockerfiles to use requirements/production.txt
- Create .dockerignore to reduce build context
- Add conftest.py with user fixtures
- Add tests: accounts models (9), blog views (4), contact views (1)
- Add sentry-sdk[django] with conditional init via SENTRY_DSN
2026-04-08 02:45:02 +02:00
Richard Nixon
4c8cdba3d2 Add GitHub Actions CI/CD pipeline
- ci job: Python 3.12 + Postgres + Redis, check --deploy, pytest, compose validation
- deploy job: SSH to VPS, pull, build, migrate, smoke test /health/
- Add pytest.ini for test discovery configuration
2026-04-08 02:44:56 +02:00
Richard Nixon
9356d7163c Add /health/ endpoint and Docker healthchecks
- Create apps/core/ with health view checking DB and cache connections
- Register /health/ in config/urls.py (outside i18n_patterns)
- Add curl to Dockerfile.full for healthcheck support
- Add healthcheck blocks to platform-web and locflow-web in compose
2026-04-08 02:44:50 +02:00
Richard Nixon
6d06d2d33d Fix allauth deprecations, frontend SSR, and infra updates
- Replace deprecated allauth settings (ACCOUNT_AUTHENTICATION_METHOD,
  ACCOUNT_EMAIL_REQUIRED, etc.) with ACCOUNT_LOGIN_METHODS and
  ACCOUNT_SIGNUP_FIELDS
- Add API_URL env var and platform-internal network to platform-frontend
  so Next.js SSR can reach Django backend internally instead of via
  public domain (fixes getaddrinfo EAI_AGAIN errors)
- Add locflow-frontend service and CORS config for LocFlow
- Update traefik dynamic routing and env example
2026-04-08 02:06:22 +02:00
Richard Nixon
039857bd95 Add Next.js frontend, Django Ninja API, and modernize infrastructure
- Add Django Ninja API layer (apps/api/) with endpoints for blog, portfolio, contact, and home
- Add CORS support (django-cors-headers) for frontend-backend communication
- Create Next.js 15 frontend with App Router, compiled Tailwind CSS v4, and TypeScript
- Add frontend Docker container (Node 22 Alpine, standalone build)
- Update Traefik routing: /api, /admin, /media, /en, /pt-br -> Django; everything else -> Next.js
- Fix media file serving in production (re_path with django.views.static.serve)
- Make eirescope and locflow publicly accessible (remove Authentik middleware)
- Add API test suite (27 tests covering all endpoints)
2026-03-07 01:05:03 +01:00
Richard Nixon
5f56840d1a Replace ASCII diagram with Mermaid for better rendering 2026-03-04 23:47:42 +01:00
Richard Nixon
322e2cd9a6 Update README with LocFlow and EireScope services
- Add LocFlow and EireScope to architecture diagram and services table
- Add environment variables for LocFlow and EireScope
- Add LocFlow Django management commands
- Add rebuild commands for LocFlow and EireScope
2026-03-04 23:45:43 +01:00
Richard Nixon
b9da04a627 Add LocFlow platform to infrastructure and fix Traefik network
- Add locflow-db and locflow-web services with isolated network
- Add Traefik routing with CrowdSec bouncer for locflow.richardnixon.dev
- Fix Docker provider network name from docker-migration_web to infrastructure_web
- Add LocFlow environment variables to .env.example
2026-03-04 23:42:56 +01:00
Richard Nixon
46095e8190 add eirescope OSINT dashboard to infrastructure
- docker-compose: eirescope service with Traefik labels
- traefik/dynamic.yml: router + service with CrowdSec middleware
2026-03-04 22:38:34 +01:00
Richard Nixon
6fb326321a Add CORS middleware for Umami to support external sites 2026-01-26 01:15:23 +01:00
Richard Nixon
e88467fdd0 fix: update Django build context to parent directory 2026-01-26 00:16:10 +01:00
Richard Nixon
46abfff502 refactor: move wp-content to absolute path and add Umami config
- Use /root/data/wp-content for WordPress runtime data
- Move custom security plugin to infrastructure/wp-plugins/
- Add UMAMI_WEBSITE_ID to .env.example
2026-01-26 00:07:58 +01:00
Richard Nixon
ac9eb771ee feat: add WordPress security hardening and Umami analytics
- Add custom security plugin with comment spam protection
- Block links, Cyrillic/Chinese chars, short comments
- Add honeypot anti-bot field
- Disable REST API user enumeration
- Block author enumeration
- Add security headers and hide WP version
- Limit login attempts (5 attempts = 15min block)
- Disable XML-RPC and pingbacks
- Block sensitive files via Traefik (readme.html, license.txt)
- Add Umami analytics to Valheim status page
2026-01-26 00:01:51 +01:00
Richard Nixon
4761b338be docs: update README with complete infrastructure documentation
- Add Valheim server to architecture diagram and services
- Document all 7 Grafana dashboards
- Add Prometheus metrics table with all exporters
- Add Valheim server section (config, status page, admin commands)
- Update environment variables documentation
- Add Valheim management commands
- Update project structure with valheim-status
2026-01-25 23:36:31 +01:00
Richard Nixon
88f77e9c23 feat: enhance Valheim status page and server config
- Rename world to EmeraldRealms
- Add admin permissions for server operators
- Add uptime tracking with auto-updating endpoint
- Show online players with connection duration
- Add players section that displays when users connect
- Fix status page to parse version from API keywords
2026-01-25 23:33:40 +01:00
Richard Nixon
d15afeedf9 feat: add Valheim metrics exporter and fix HTTPS routing
- Add adaliszk/valheim-server-monitoring for Prometheus metrics
- Enable Docker provider in Traefik for container discovery
- Add valheim-status route to dynamic.yml for SSL certificate
- Update Valheim dashboard with game-specific metrics:
  - Players online, world day, world size
  - Save & backup duration
  - Player connections, random events
- Fix health check in valheim-status container
2026-01-25 22:34:06 +01:00
Richard Nixon
78f545954f feat: add Valheim server status page
- Create valheim-status nginx container with status page
- Display server status, players online, world info
- Proxy API requests to Valheim STATUS_HTTP endpoint
- Configure Traefik routing for valheim.richardnixon.dev
- Show connection address with copy button
2026-01-25 22:23:27 +01:00
Richard Nixon
62b97932ff feat: add Valheim server dashboard and enable status HTTP
- Add Grafana dashboard for Valheim server monitoring
- Enable SUPERVISOR_HTTP and STATUS_HTTP for server management
- Track container metrics (CPU, memory, network, disk I/O)
- Include server logs panel via Loki
2026-01-25 22:10:52 +01:00
Richard Nixon
4269260bb4 feat: add comprehensive Grafana dashboards and monitoring exporters
- Add Node Exporter for VPS system metrics (CPU, memory, disk, network)
- Add PostgreSQL Exporter for database metrics
- Add Redis Exporter for cache metrics
- Enable Traefik Prometheus metrics
- Add CrowdSec to monitoring network for metrics collection

New dashboards:
- VPS System: CPU, memory, disk, network, load average
- Security (CrowdSec): Active bans, alerts, events, attack types
- Traefik Proxy: Requests/s, latency, status codes, connections
- Database: PostgreSQL & Redis metrics, cache hit ratios
- Network & Firewall: Bandwidth, TCP connections, security events
2026-01-25 22:00:00 +01:00
Richard Nixon
01bb90e5c9 docs: update SSH security description 2026-01-25 20:40:58 +01:00
Richard Nixon
9c698ed0bc docs: add comprehensive README with infrastructure documentation
- Document full architecture and services
- Add security configuration (CrowdSec, Fail2ban, GeoIP)
- Document monitoring stack (Grafana, Prometheus, Loki)
- Add common commands and deployment instructions
- Fix Grafana datasource UIDs for proper provisioning
- Update logs dashboard with search functionality
2026-01-25 20:37:46 +01:00
Richard Nixon
916cba1d18 feat: add CrowdSec security/IPS with Traefik bouncer
- Add CrowdSec container for security analysis and threat detection
- Add Traefik bouncer for request filtering
- Enable Traefik access logging (JSON format)
- Configure crowdsec middleware for all routes
- Add log acquisition for Traefik and system logs
- Update .env.example with CrowdSec bouncer key placeholder
2026-01-25 20:08:11 +01:00
Richard Nixon
c651c9cc1a feat: add infrastructure configuration
- Add Docker Compose setup for all services
- Add Traefik reverse proxy configuration
- Add Grafana, Prometheus, Loki observability stack
- Add Promtail for log collection
- Include .env.example with placeholder values
2026-01-25 18:58:00 +01:00
Richard Nixon
0c63e0c9f6 feat: add reCAPTCHA v3 to contact form
- Add django-recaptcha for spam protection
- Integrate invisible reCAPTCHA v3 in contact form
- Configure via environment variables
2026-01-25 18:38:24 +01:00
Richard Nixon
b7588ea9cb feat: add i18n, 2FA, Umami analytics, and remove dashboards
- Add internationalization support (PT-BR/EN) with URL prefixes
- Implement django-modeltranslation for multilingual content
- Add django-ckeditor-5 for rich text editing
- Implement two-factor authentication for admin
- Add Umami analytics event tracking
- Remove dashboards app (to be reimplemented later)
- Fix language switcher to use Django's set_language view
2026-01-25 18:10:42 +01:00
Richard Nixon
70b4dc0b3c Add initial database migrations for all apps 2026-01-25 02:07:29 +01:00
Richard Nixon
3754625634 Final configuration and documentation updates 2026-01-24 18:00:00 +01:00
Richard Nixon
22a1041c95 Add Docker configuration for production 2026-01-17 10:15:00 +01:00
Richard Nixon
b248cb908e Add portfolio, contact, and dashboard templates 2026-01-12 16:30:00 +01:00
Richard Nixon
ff2315c491 Add base template with TailwindCSS and HTMX 2026-01-08 11:00:00 +01:00
Richard Nixon
21e002ffb9 Implement dashboard views and Celery tasks 2026-01-03 14:20:00 +01:00
Richard Nixon
79f7fbc0e5 Add dashboard and widget models 2025-12-30 09:45:00 +01:00
Richard Nixon
3cd5fd7dcb Implement contact form with spam protection 2025-12-25 15:00:00 +01:00
Richard Nixon
a2c6609490 Add portfolio app with projects and technologies 2025-12-20 10:00:00 +01:00
Richard Nixon
cc7dd1135d Implement blog views, RSS feed, and sitemap 2025-12-15 13:30:00 +01:00
Richard Nixon
ec98d11c79 Add blog models with markdown support 2025-12-10 11:20:00 +01:00