Larvitz :fedora: :redhat:<p>Thrilled to have a new, production-ready CI/CD pipeline live! It automatically builds and deploys my Jekyll static WIP site (<a href="https://hofstede.it" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">hofstede.it</span><span class="invisible"></span></a>) on every push to the main branch.</p><p>The architecture is a showcase of modern Linux tools:</p><p>🔹 Server running on Red Hat Enterprise Linux 10 (RHEL) <br>🔹 Forgejo for Git hosting & Actions.<br>🔹 A rootless Forgejo Runner, running in Podman, managed by a systemd Quadlet file.<br>🔹 Traefik reverse proxy running as a Podman container.<br>🔹 An Nginx web server for the site, also in a container for easy discovery by Traefik.</p><p>The Forgejo Runner and the Nginx Webserver run in different unprivileged user contexts. </p><p>The magic is the secure bridge between the rootless CI job and the web server. The pipeline creates a build artifact, and a systemd.path watcher on the host instantly triggers a deployment script. <br>It's fully decoupled, secure, and works like a charm.</p><p><a href="https://burningboard.net/tags/devops" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>devops</span></a> <a href="https://burningboard.net/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> <a href="https://burningboard.net/tags/forgejo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>forgejo</span></a> <a href="https://burningboard.net/tags/podman" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>podman</span></a> <a href="https://burningboard.net/tags/rhel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rhel</span></a> <a href="https://burningboard.net/tags/cicd" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cicd</span></a> <a href="https://burningboard.net/tags/traefik" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>traefik</span></a> <a href="https://burningboard.net/tags/systemd" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>systemd</span></a> <a href="https://burningboard.net/tags/redhat" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>redhat</span></a></p>