Skip to content

HOLD for owner read: 6 migration/ops pages (checklist; production Compose+nginx+TLS; Gradle proxy; upgrade; permission denied; Maven proxy) - #52

Closed
fosterstack-admin wants to merge 9 commits into
mainfrom
www/migration-batch
Closed

fosterstack-admin wants to merge 9 commits into
mainfrom
www/migration-batch

Conversation

@fosterstack-admin

@fosterstack-admin fosterstack-admin commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

Six search-phrase pages for people mid-migration or in their first week, each backed by a real run (Gradle 9.8.0, Maven 3.10.0 + extension 1.2.3, FosterStack Cache 0.1.0/0.2.1, macOS + Docker Desktop). Held for the owner's read; merged in a batch, not by me. One commit per page.

  1. /build-cache-node-migration-checklist/ - real before/after against the latest published Build Cache Node image (21.2, built June 2025): URL-only change gives a cold first build then FROM-CACHE; keeping /cache/ works (separate entries); rollback still hits. No claim about the vendor beyond the URL path and the 200-vs-201 upload status. Maven not part of the run.
  2. /build-cache-docker-compose-production/ - exact compose.yaml and nginx.conf that were run; self-signed cert; nginx's default 1 MB body limit gives 413 until raised; the page lists what was NOT tested.
  3. /gradle-build-cache-corporate-proxy/ - with a tiny logging proxy I wrote: loopback and nonProxyHosts bypass the proxy; HTTPS goes through a CONNECT tunnel; a refusing proxy shows as 'response status 403: Forbidden', same text as a cache-side 403 (curl -x vs --noproxy '*' tells them apart). Re-verified after fixing my proxy (see below).
  4. /upgrade-build-cache-server/ - 0.1.0 -> 0.2.1 on the same volume keeps all entries; 0.2.1 writes more; going back to 0.1.0 still reads all. 0.1.0 has no /statusz and its entry-count metric resets to 0 after ANY restart (checked on a volume only 0.1.0 ever wrote), 0.2.1 reports it correctly. Only these two releases exist; no 0.2.0 release.
  5. /build-cache-permission-denied-data-directory/ - the real failure (volume already holding root-owned data -> 'open data/.unclean-shutdown: permission denied', exit 1) and the fix (chown -R 65532:65532 via a throwaway container). A NEW empty volume does not fail even if its top folder is root-owned (Docker copies the image's ownership into it on first use): I tried it and the page says so. Linux bind mounts and Kubernetes-without-fsGroup were not tested; the page says so.
  6. /maven-build-cache-corporate-proxy/ - Maven's settings.xml proxy: ALL of the extension's cache traffic (lookups, restores, uploads) goes through it; unlike Gradle, Maven does NOT skip the proxy for 127.0.0.1; is honored; a refusing proxy gives 'HTTP Status: 403' + 'Error downloading cache item' and the build continues without the cache; proxy down gives a ConnectException and no uploads.

Mistakes caught while testing (nothing wrong was published): (a) my first proxy 'loopback' test used a server bound only to the LAN address (redone); (b) my test proxy logged only the first request on each connection, which briefly made it look as if Maven's uploads bypassed the proxy; with the proxy fixed to log every request the opposite is true (they go through it). The Gradle page's claims were re-run against the fixed proxy and still hold.
All pages carry the Open Graph tags, mobile CSS and tagline; the LAN address used in tests is replaced by in page text. Only sitemap.xml will conflict with other open PRs (trivial). Not yet linked from the home page: add after the owner has read them.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 9, 2026 •

Copy link
Copy Markdown

Deploying www with  Cloudflare Pages  Cloudflare Pages

Latest commit: bb9fc42
Status: ✅  Deploy successful!
Preview URL: https://7a7bd9a1.www-4rw.pages.dev
Branch Preview URL: https://www-migration-batch.www-4rw.pages.dev

View logs

@fosterstack-admin fosterstack-admin changed the title HOLD for owner read: 3 migration pages (checklist; production Compose + nginx + TLS; behind a corporate proxy) HOLD for owner read: 6 migration/ops pages (checklist; production Compose+nginx+TLS; Gradle proxy; upgrade; permission denied; Maven proxy) Oct 9, 2026
@fosterstack-admin

Copy link
Copy Markdown
Contributor Author

folded into #53

fosterstack-admin added a commit that referenced this pull request Oct 9, 2026
…lock, six new pages (#53)

* Page: Build Cache Node migration checklist (real before/after run)

* Migration page: describe the old node image only as what was observed

* Page: production build cache with Docker Compose, nginx and TLS (real run)

* Page: Gradle build cache behind a corporate proxy (real run)

* Page: upgrade a self-hosted build cache and keep its data (real run, 0.1.0 to 0.2.1)

* Page: build cache server exits with permission denied on its data directory (real run)

* Page: Maven build cache extension behind a corporate proxy (real run)

* Gradle proxy page: Maven proxy settings now have their own tested page

* Review fixes on the migration pages: brace artifact, over-claims, vendor wording, title scope

* Owner's copy edit: new home headline and new security heading

* Owner's copy edit: the 48-hour line, exactly as approved, on every page

* Regulated: cut the vendor price claim

* Security block: the owner's short list; auditor line held until v0.3.0 ships

* Sitemap: regenerate after folding #52

* NIST/SLSA mapping page and the home card that replaces Acceptance-tested

* NIST page: SLSA Build track runs Level 1 to 3

* FAQ: two different scanners, not independent (their databases overlap)

* Page: Gradle build cache for a monorepo (real four-module run on 0.2.1)

* Page: Move a Maven build cache to a new server (real five-build run on 0.2.1)

* Page: Enable or disable the Gradle build cache (flag, property, settings; nine real runs on 0.2.1)

* Page: Enable or disable the Maven build cache extension (seven real builds on 0.2.1)

* Page: Does the build cache survive a restart? (clean stop, kill -9, wrong folder; real run on 0.2.1)

* Page: Maven build cache extension in a multi-module project (six real builds on 0.2.1)

* Accessibility: readable button text in dark mode, visible secondary button border, keyboard-focusable scrolling code and tables, focus outline

* README: repair a garbled sentence about analytics (found by the independent review)

---------

Co-authored-by: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant