claw
4ddf27caaf
Previously nginx try_files fell back to /index.html for any unmatched path, which meant orphaned article variants (old slug directories) returned HTTP 200 with the homepage content. This caused ~1,150 orphaned pages to be crawlable. Add explicit location blocks for /articles/ and /sections/ that use =404 instead of falling back to /index.html.
signalledger.nl
Signal Ledger — an independent news publication, a subsidiary of Jopdorp.
Architecture Decision Record (ADR)
ADR-002: Ingress Controller Migration (nginx → Traefik)
Status: Accepted
Context:
The cluster uses Traefik as its ingress controller. The initial K8s manifests were written with ingressClassName: nginx and nginx-specific annotations. This caused a mismatch: the Ingress resource was never picked up by any controller, leaving the site unreachable via the configured domains.
Decision: Migrate all ingress configuration to Traefik-native resources.
- Ingress class: Changed from
nginxtotraefik. - Annotations: Replaced nginx-specific
configuration-snippetwith Traefikrouter.entrypoints,router.tls, androuter.middlewaresannotations. - Security headers: Extracted from inline nginx snippets into a dedicated
MiddlewareCRD (k8s/middleware.yaml). This keeps header policy declarative and reusable.
Migration strategy: In-place update
- The namespace
openclaw-privatealready exists. - The deployment, service, and TLS secret are unchanged.
- We apply the new Ingress and Middleware manifests; Traefik picks them up immediately.
- Rolling back is a single
kubectl applyof the previous manifest version.
Consequences:
- Positive: Aligns with cluster infrastructure. No extra ingress controller needed.
- Positive: Middleware CRD is cleaner and version-controllable than inline snippets.
- Risk: Traefik middleware syntax errors will cause 404/500 until fixed. Mitigated by validating manifests in CI before deploy.
Deployment
Prerequisites
- Kubernetes cluster with Traefik and cert-manager installed.
registry.claw.jopdorp.nlpush access.KUBECONFIG_BASE64andREGISTRY_TOKENsecrets configured in Gitea.
CI/CD Pipeline
Gitea Actions workflow (.gitea/workflows/build-and-deploy.yaml):
- Build and test on every PR/push.
- Build and push Docker image on merge to
main. - Apply K8s manifests and wait for rollout.
Manual Deploy
kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/middleware.yaml
kubectl apply -f k8s/deployment.yaml
kubectl apply -f k8s/service.yaml
kubectl apply -f k8s/ingress.yaml
kubectl rollout status deployment/news-site -n openclaw-private --timeout=120s
Domains
signalledger.nlwww.signalledger.nl
Contact
- Email: signalledger@jopdorp.nl
- Owner: Signal Ledger is a subsidiary of Jopdorp.