Thrilled to have a new, production-ready CI/CD pipeline live! It automatically builds and deploys my Jekyll static WIP site (https://hofstede.it) on every push to the main branch.
The architecture is a showcase of modern Linux tools:
Server running on Red Hat Enterprise Linux 10 (RHEL)
Forgejo for Git hosting & Actions.
A rootless Forgejo Runner, running in Podman, managed by a systemd Quadlet file.
Traefik reverse proxy running as a Podman container.
An Nginx web server for the site, also in a container for easy discovery by Traefik.
The Forgejo Runner and the Nginx Webserver run in different unprivileged user contexts.
The magic is the secure bridge between the rootless CI job and the web server. The pipeline creates a build artifact, and a systemd.path watcher on the host instantly triggers a deployment script.
It's fully decoupled, secure, and works like a charm.