feat(manifest): serve the docs with auxesia

Add a kustomization in manifest/docs that serves docs/ at
objgit.auxesia.automuse.art. An init container clones main with
git-sync once. Auxesia then serves the docs folder from that clone.

A ConfigMap volume does not work, because Kubernetes builds it from
symbolic links and Auxesia rejects them. A git-sync sidecar does not
work either: Auxesia resolves its root once at startup, so it keeps
the old files after git-sync moves its link. To publish new docs,
restart the deployment.

Assisted-by: Claude Opus 5.5 via Claude Code
Signed-off-by: Xe Iaso <xe@tigrisdata.com>

Author: Xe

manifest/docs/deployment.yaml

@@ -0,0 +1,97 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: objgit-docs
+  labels:
+    app.kubernetes.io/name: objgit-docs
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: objgit-docs
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: objgit-docs
+    spec:
+      runtimeClassName: kata
+      securityContext:
+        fsGroup: 65532
+      # Auxesia refuses symbolic links, so a ConfigMap volume cannot hold the
+      # docs. Auxesia also resolves its root once at startup, so a git-sync
+      # sidecar that swaps the root link would leave it serving stale files.
+      # Clone once, before the server starts.
+      initContainers:
+        - name: clone
+          image: registry.k8s.io/git-sync/git-sync:v4.4.0
+          args:
+            - --repo=https://github.com/tigrisdata/objgit
+            - --ref=main
+            - --depth=1
+            - --root=/git
+            - --link=objgit
+            - --one-time
+          resources:
+            limits:
+              cpu: "500m"
+              memory: "256Mi"
+            requests:
+              cpu: "100m"
+              memory: "64Mi"
+          volumeMounts:
+            - name: git
+              mountPath: /git
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            runAsUser: 65533
+            runAsGroup: 65533
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+      containers:
+        - name: main
+          image: ghcr.io/tigrisdata/auxesia:latest
+          imagePullPolicy: "Always"
+          args:
+            - /git/objgit/docs
+            - --listen
+            - 0.0.0.0:8080
+          ports:
+            - name: http
+              containerPort: 8080
+          readinessProbe:
+            httpGet:
+              path: /llms.txt
+              port: http
+          resources:
+            limits:
+              cpu: "500m"
+              memory: "256Mi"
+            requests:
+              cpu: "250m"
+              memory: "128Mi"
+          volumeMounts:
+            - name: git
+              mountPath: /git
+              readOnly: true
+          securityContext:
+            runAsUser: 65532
+            runAsGroup: 65532
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+      volumes:
+        - name: git
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}

manifest/docs/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: objgit-docs
+  labels:
+    app.kubernetes.io/name: objgit-docs
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - objgit.auxesia.automuse.art
+      secretName: objgit-docs-public-tls
+  rules:
+    - host: objgit.auxesia.automuse.art
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: objgit-docs
+                port:
+                  name: http

manifest/docs/kustomization.yaml

@@ -0,0 +1,13 @@
+# Serves the docs/ folder of this repository with Auxesia at
+# https://objgit.auxesia.automuse.art.
+#
+#   kubectl apply -k manifest/docs/
+#
+# An init container clones main from GitHub at pod start. To publish new
+# docs, restart the deployment:
+#
+#   kubectl rollout restart deployment/objgit-docs
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

manifest/docs/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: objgit-docs
+  labels:
+    app.kubernetes.io/name: objgit-docs
+spec:
+  selector:
+    app.kubernetes.io/name: objgit-docs
+  ports:
+    - port: 80
+      targetPort: 8080
+      name: http
+  type: ClusterIP