[0kaba0hub]

GitHub Pages refuses the deployments (deployment_failed, no detail) while gh-pages itself is published fine. This serves gh-pages from the cluster that already runs yarilomail.org.

• helm/: nginx (nginx:1.28-alpine) plus a sidecar (alpine:3.24) that installs git (apk upgrade then apk add git, exiting so the container restarts if that fails), pulls gh-pages every 60 s into /site/<commit> and points /site/current at it, keeping the previous checkout until the next lands. No image to build and no rollout per merge: the workflow already rewrites gh-pages.
• nginx: dir to dir/ and an extensionless page to .html by relative 301, root 404.html with status 404, assets/ cached for a year, /healthz ready once a checkout is in place.
• Client addresses in the log: nginx takes CF-Connecting-IP only from realIp.trustedProxies (prod: the pod network 10.1.0.0/16), JSON access log.
• Ingress: doc.yarilomail.org, Cloudflare ranges only, letsencrypt-prod, secret doc-yarilomail-org-tls, label cloudflare-whitelist: "true" so the cluster's cf-whitelist CronJob keeps the ranges current; namespace yarilomail.
• argocd-app.yaml: application yarilo-docs from main, ignoreDifferences on the whitelist annotation with RespectIgnoreDifferences=true.
• README Serving section; CLAUDE.md step 5.

Checked on a scratch namespace (since removed): sync served gh-pages 31b5af1; /, /main/, /latest/, /2.4.6/..., /AUTH_OAUTH2.html, /main/relay/dkim_milter.html 200; /main and /main/relay/dkim_milter 301; missing pages 404; llms.txt utf-8; assets immutable; log shows CF-Connecting-IP from a trusted peer and the peer itself without it. helm lint, docs:build.

After merge: apply argocd-app.yaml on the cluster; the certificate is issued once doc.yarilomail.org points at the cluster in Cloudflare. The Pages deploy job stays until then and goes in a follow-up PR with site-root/CNAME (indexnow then depends on build only).

[0kaba0hub]

#281 (51b0bd5): one finding.

site is an emptyDir with sizeLimit: 256Mi. A shallow checkout of gh-pages is 70 MB today (65 MB of files plus 5 MB of .git during the clone), and sync.sh holds up to three copies at once: the previous checkout, the current one and <head>.tmp while it clones. That peak is about 210 MB now and grows by roughly 16 MB per published version, times three, so the next release pushes it past the limit, and kubelet evicts the pod for exceeding the emptyDir limit. Raise sizeLimit to 1Gi (three copies of a site that can grow to 300 MB), or drop the previous checkout before cloning so only two copies exist at the peak; either way, write the formula next to the value.

[0kaba0hub]

#281 (bad4a78): APPROVED.