S0: Forgejo Actions → Cloudflare Pages deploy for infraternal.com

kayg commented

2026-10-05 14:17:08 +00:00

Owner

Deploy infraternal.com from Forgejo. Cloudflare Pages Git integration does not support Forgejo. Thus, a Forgejo Actions job builds the site and runs wrangler pages deploy (direct upload). This is the same pattern as ttyinv. Decision 44.

Done:

Runner infraternal-dev (forgejo-runner v13.2.0, SHA-256 verified), label docker → node:22-bookworm. It runs as the unprivileged user ci with rootless podman, linger and a systemd --user service.
Cloudflare token at ~/.cf-token on infraternal-dev: Pages Edit, D1 Edit, and DNS Edit for the zone infraternal.com only.

To do:

Create the Pages project infraternal for direct upload only. Do not connect Git: a Git-connected project blocks direct upload.
Create the D1 database infraternal-waitlist and apply migrations/0001_waitlist.sql
Add the repository secret CLOUDFLARE_API_TOKEN (a token scoped to Pages and D1, not the DNS token)
.forgejo/workflows/site.yml: on a push to main that touches the site paths, and on manual trigger, run scripts/verify fast and then deploy
Custom domains infraternal.com and www → Pages; check TLS

Deploy infraternal.com from Forgejo. Cloudflare Pages Git integration does not support Forgejo. Thus, a Forgejo Actions job builds the site and runs `wrangler pages deploy` (direct upload). This is the same pattern as ttyinv. Decision 44. Done: - [x] Runner `infraternal-dev` (forgejo-runner v13.2.0, SHA-256 verified), label `docker` → `node:22-bookworm`. It runs as the unprivileged user `ci` with rootless podman, linger and a `systemd --user` service. - [x] Cloudflare token at `~/.cf-token` on infraternal-dev: Pages Edit, D1 Edit, and DNS Edit for the zone infraternal.com only. To do: - [ ] Create the Pages project `infraternal` for direct upload only. Do not connect Git: a Git-connected project blocks direct upload. - [ ] Create the D1 database `infraternal-waitlist` and apply `migrations/0001_waitlist.sql` - [ ] Add the repository secret `CLOUDFLARE_API_TOKEN` (a token scoped to Pages and D1, not the DNS token) - [ ] `.forgejo/workflows/site.yml`: on a push to `main` that touches the site paths, and on manual trigger, run `scripts/verify fast` and then deploy - [ ] Custom domains `infraternal.com` and `www` → Pages; check TLS

kayg commented

2026-10-05 14:17:46 +00:00

Author

Owner

Progress 2026-10-05:

Created the Pages project infraternal (direct upload, no Git connection) → infraternal.pages.dev.
Created the D1 database infraternal-waitlist, id d47e8eef-1a78-4c52-8c5b-e86566a6070c. This id is not secret. It goes in apps/website/wrangler.toml.
The account id is in ~/.cf-account-id on infraternal-dev (mode 600). The token cannot list accounts, so I read the id from the infraternal.com zone.

The owner must do these steps (the Forgejo token cannot manage Actions secrets):

Add the repository secret CLOUDFLARE_API_TOKEN. Best: a separate token with only Pages Edit and D1 Edit, so that CI never has DNS rights. Also add the secret CLOUDFLARE_ACCOUNT_ID.

Progress 2026-10-05: - Created the Pages project `infraternal` (direct upload, no Git connection) → `infraternal.pages.dev`. - Created the D1 database `infraternal-waitlist`, id `d47e8eef-1a78-4c52-8c5b-e86566a6070c`. This id is not secret. It goes in `apps/website/wrangler.toml`. - The account id is in `~/.cf-account-id` on infraternal-dev (mode 600). The token cannot list accounts, so I read the id from the infraternal.com zone. The owner must do these steps (the Forgejo token cannot manage Actions secrets): - [x] Add the repository secret `CLOUDFLARE_API_TOKEN`. Best: a separate token with only Pages Edit and D1 Edit, so that CI never has DNS rights. Also add the secret `CLOUDFLARE_ACCOUNT_ID`.

kayg commented

2026-10-05 14:26:44 +00:00

Author

Owner

Completed by Aside: repository Actions secrets CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID are now saved in kayg/infraternal. The CI API token is a separate Cloudflare token named "infraternal / CI Pages + D1", scoped to Cloudflare Pages: Edit and D1: Edit for the account only, with no DNS rights. The existing ~/.cf-token on infraternal-dev was left unchanged. Forgejo confirmed both secrets were added. No secret values are included here. Deployment/workflow/TLS checks remain pending.

kayg commented

2026-10-05 14:27:23 +00:00

Author

Owner

Progress: applied apps/website/migrations/0001_waitlist.sql (from branch s0-website, commit 7253a00) to the D1 database infraternal-waitlist. Result: success. What remains: the workflow .forgejo/workflows/site.yml (added when S0 merges), the first deploy, and the custom domains and TLS.

Progress: applied `apps/website/migrations/0001_waitlist.sql` (from branch `s0-website`, commit `7253a00`) to the D1 database `infraternal-waitlist`. Result: success. What remains: the workflow `.forgejo/workflows/site.yml` (added when S0 merges), the first deploy, and the custom domains and TLS.

kayg referenced this issue

2026-10-10 01:52:45 +00:00

Per-account canvas document: server storage and live sync by operations (D178, D180) #98

kayg referenced this issue

2026-10-10 02:11:21 +00:00

Per-account canvas document: server storage and live sync by operations (D178, D180) #98

kayg referenced this issue

2026-10-10 02:49:14 +00:00

Per-account canvas document: server storage and live sync by operations (D178, D180) #98

kayg referenced this issue

2026-10-20 22:57:31 +00:00

Canvas layout is not the same on every device (D248) #243