sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Point pilot deployments and CMS preview at SloanOps

Browse Source
This commit is contained in:
Kevin
2026-09-05 19:37:11 -04:00
parent 09064da856
commit 8a7942c4c4
10 changed files with 44 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/decap-cms-gitea-setup.md
+8 -6
View File
@@ -1,6 +1,8 @@
# Decap CMS: Gitea settings
Status: applied and verified for internal use on 2026-09-04. The repository
Status: SloanOps destination configuration prepared 2026-09-05; exact-origin
CORS and OAuth replacement must accompany the protected CMS merge. Prior
source-account settings were verified for internal use on 2026-09-04. The repository
targets the permanent `cms` staging branch, the CMS application is deployed
from `main`, and `sloanops.admin` is the approved internal editor. Client or
public access remains out of scope.
@@ -13,9 +15,9 @@ The repository implementation targets these fixed public values:
| Decap write branch | `cms` |
| Gitea base URL | `https://git.sloanops.com` |
| Gitea API root | `https://git.sloanops.com/api/v1` |
| Stable CMS origin | `https://cms-3031023-xyz-www.ksloan90.workers.dev` |
| Stable CMS origin | `https://cms-3031023-xyz-www.sloanops.workers.dev` |
| Production admin origin | `https://3031023.xyz` |
| Exact OAuth redirects | `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and `https://3031023.xyz/admin/` |
| Exact OAuth redirects | `https://cms-3031023-xyz-www.sloanops.workers.dev/admin/` and `https://3031023.xyz/admin/` |
| Required status context | `CMS content validation / cms-content-validation (pull_request)` |
The pilot and permanent branch names are intentionally slash-free. Decap
@@ -60,7 +62,7 @@ to this repository are represented by these settings:
```yaml
- GITEA__cors__ENABLED=true
- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.ksloan90.workers.dev,https://3031023.xyz
- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.sloanops.workers.dev,https://3031023.xyz
- GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
- GITEA__cors__MAX_AGE=10m
- GITEA__cors__ALLOW_CREDENTIALS=false
@@ -77,7 +79,7 @@ token or cookie:
```bash
curl --request OPTIONS 'https://git.sloanops.com/api/v1/version' \
--header 'Origin: https://cms-3031023-xyz-www.ksloan90.workers.dev' \
--header 'Origin: https://cms-3031023-xyz-www.sloanops.workers.dev' \
--header 'Access-Control-Request-Method: GET' \
--header 'Access-Control-Request-Headers: authorization,content-type'
```
@@ -95,7 +97,7 @@ CORS response were verified:
- Application name: `3031023.xyz Decap CMS`.
- Confidential client: **unchecked**. The browser client must use PKCE.
- Redirect URIs: exactly
`https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and
`https://cms-3031023-xyz-www.sloanops.workers.dev/admin/` and
`https://3031023.xyz/admin/`, including trailing slashes.
- Do not add wildcards, localhost, the journal hostname, or branch-specific
Worker preview aliases as additional redirects.
docs/preview-deployment.md
+7 -5
View File
@@ -6,14 +6,16 @@ They do not deploy the version to production traffic.
| Site key | Versioned Worker | Stable `cms` alias | Production hostname |
| --- | --- | --- | --- |
| `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.ksloan90.workers.dev` | `3031023.xyz` |
| `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.ksloan90.workers.dev` | `blog.3031023.xyz` |
| `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.sloanops.workers.dev` | `3031023.xyz` |
| `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.sloanops.workers.dev` | `blog.3031023.xyz` |
The workflows derive the preview alias from the branch name, build with
preview robots rules, run output verification, and call `wrangler versions
upload`. They use the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID` repository
secrets but contain no DNS, routes, custom-domain mutations, account IDs, or
tokens in source.
upload`. They use organization secrets `CF_MIGRATION_API_TOKEN` and
`CF_MIGRATION_ACCOUNT_ID`. Wrangler pins the destination SloanOps account ID.
They contain no DNS, route, or custom-domain mutations and no token values.
The current token expires 2026-10-05; replace it in organization secrets before
that date. Changing the old shared secret pair would affect unmigrated repos.
Only the stable CMS and production admin origins are registered with Gitea
OAuth/CORS. A CMS login attempt from a temporary branch alias is expected to