-
🌻
-
FlowerCore
-
Blue Jay Lab
-
- Multi-tenant service management platform built on .NET 10,
- Kubernetes, and GitOps. Digital signage, telephony IVR,
- MySQL/PHP hosting, and infrastructure automation.
-
+
Skip to content
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
+
+
+ FlowerCore
+ More to come.
+
+
+
+
+
+
+ Update Center
+
+
+ Software updates & releases
+
+
+
---
diff --git a/apps/fc-landing/preview.html b/apps/fc-landing/preview.html
new file mode 100644
index 0000000..e1dea4d
--- /dev/null
+++ b/apps/fc-landing/preview.html
@@ -0,0 +1,356 @@
+
+
+
+
+
+
FlowerCore
+
+
+
+
+
Skip to content
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ FlowerCore
+ More to come.
+
+
+
+
+
+
+ Update Center
+
+
+ Software updates & releases
+
+
+
+
+
\ No newline at end of file
diff --git a/apps/github-runner/Dockerfile.arm64 b/apps/github-runner/Dockerfile.arm64
new file mode 100644
index 0000000..5fb0ab3
--- /dev/null
+++ b/apps/github-runner/Dockerfile.arm64
@@ -0,0 +1,63 @@
+FROM myoung34/github-runner:latest
+
+# arm64 variant of the FlowerCore self-hosted runner image.
+# Built/maintained alongside the amd64 Dockerfile. The ONLY substantive
+# difference from the amd64 image is that the Actions/Ruby tool-cache arch
+# label is "arm64" instead of the amd64 "x64". Ruby itself is still compiled
+# from source via ruby-build, so it is naturally arm64 on an aarch64 host.
+
+ARG RUBY_VERSION=3.3.11
+ARG RUBY_MINOR=3.3
+ARG RUBY_BUILD_VERSION=v20260326
+ARG RUNNER_UID=1001
+ARG RUNNER_GID=1001
+# arm64 tool-cache arch label (was x64 on amd64). ruby/setup-ruby@v1 on a
+# self-hosted aarch64 Linux runner discovers Ruby under _tool/Ruby/
/arm64.
+ARG TOOLCACHE_ARCH=arm64
+
+ENV RUNNER_TOOL_CACHE=/home/runner/_tool
+ENV RUNNER_RUBY_TOOLCACHE=/opt/runner-toolcache
+ENV PATH="/home/runner/_tool/Ruby/${RUBY_MINOR}/${TOOLCACHE_ARCH}/bin:/opt/runner-toolcache/Ruby/${RUBY_MINOR}/${TOOLCACHE_ARCH}/bin:${PATH}"
+
+USER root
+
+# Bake the IAmWorkin step-ca root CA into the system trust store. Without
+# this, .NET HttpClient calls from CI tests against *.iamworkin.lan
+# (e.g. https://selenium.iamworkin.lan/session) fail with `PartialChain`
+# because the runner image's default Ubuntu trust bundle doesn't include
+# our internal Root CA. update-ca-certificates regenerates
+# /etc/ssl/certs/ca-certificates.crt, which OpenSSL + .NET on Linux read
+# automatically — no SSL_CERT_FILE env var needed.
+COPY step-ca-root.crt /usr/local/share/ca-certificates/iamworkin-step-ca-root.crt
+
+RUN apt-get update \
+ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+ autoconf \
+ bison \
+ build-essential \
+ ca-certificates \
+ curl \
+ libdb-dev \
+ libffi-dev \
+ libgdbm-dev \
+ libgmp-dev \
+ libncurses-dev \
+ libreadline-dev \
+ libssl-dev \
+ libyaml-dev \
+ patch \
+ pkg-config \
+ uuid-dev \
+ zlib1g-dev \
+ && update-ca-certificates \
+ && curl -fsSL "https://github.com/rbenv/ruby-build/archive/refs/tags/${RUBY_BUILD_VERSION}.tar.gz" -o /tmp/ruby-build.tar.gz \
+ && mkdir -p /tmp/ruby-build \
+ && tar -xzf /tmp/ruby-build.tar.gz --strip-components=1 -C /tmp/ruby-build \
+ && /tmp/ruby-build/install.sh \
+ && rm -rf /tmp/ruby-build /tmp/ruby-build.tar.gz /var/lib/apt/lists/*
+
+COPY install-ruby-toolcache.sh /usr/local/bin/install-ruby-toolcache.sh
+
+RUN chmod +x /usr/local/bin/install-ruby-toolcache.sh \
+ && RUBY_VERSION="${RUBY_VERSION}" RUBY_MINOR="${RUBY_MINOR}" TOOLCACHE_ARCH="${TOOLCACHE_ARCH}" TOOLCACHE_ROOT="${RUNNER_RUBY_TOOLCACHE}" RUNNER_UID="${RUNNER_UID}" RUNNER_GID="${RUNNER_GID}" /usr/local/bin/install-ruby-toolcache.sh \
+ && ruby -v
diff --git a/apps/github-runner/install-ruby-toolcache.sh b/apps/github-runner/install-ruby-toolcache.sh
index 544b25a..d753d54 100644
--- a/apps/github-runner/install-ruby-toolcache.sh
+++ b/apps/github-runner/install-ruby-toolcache.sh
@@ -6,12 +6,16 @@ RUBY_MINOR="${RUBY_MINOR:-3.3}"
TOOLCACHE_ROOT="${TOOLCACHE_ROOT:-/opt/runner-toolcache}"
RUNNER_UID="${RUNNER_UID:-1001}"
RUNNER_GID="${RUNNER_GID:-1001}"
-RUBY_PREFIX="${TOOLCACHE_ROOT}/Ruby/${RUBY_VERSION}/x64"
+# Tool-cache arch label. Defaults to x64 (amd64 image, unchanged). The arm64
+# Dockerfile passes TOOLCACHE_ARCH=arm64 so ruby/setup-ruby@v1 finds Ruby on
+# aarch64 self-hosted runners.
+TOOLCACHE_ARCH="${TOOLCACHE_ARCH:-x64}"
+RUBY_PREFIX="${TOOLCACHE_ROOT}/Ruby/${RUBY_VERSION}/${TOOLCACHE_ARCH}"
mkdir -p "${TOOLCACHE_ROOT}/Ruby"
RUBY_CONFIGURE_OPTS="${RUBY_CONFIGURE_OPTS:---disable-install-doc --disable-yjit}" ruby-build "${RUBY_VERSION}" "${RUBY_PREFIX}"
-touch "${TOOLCACHE_ROOT}/Ruby/${RUBY_VERSION}/x64.complete"
+touch "${TOOLCACHE_ROOT}/Ruby/${RUBY_VERSION}/${TOOLCACHE_ARCH}.complete"
ln -sfn "${RUBY_VERSION}" "${TOOLCACHE_ROOT}/Ruby/${RUBY_MINOR}"
"${RUBY_PREFIX}/bin/ruby" -v
diff --git a/docs/gx10-tenant-landing/CUTOVER-RUNBOOK.md b/docs/gx10-tenant-landing/CUTOVER-RUNBOOK.md
new file mode 100644
index 0000000..5c82b16
--- /dev/null
+++ b/docs/gx10-tenant-landing/CUTOVER-RUNBOOK.md
@@ -0,0 +1,83 @@
+# GX10 Tenant Landing-Site Migration — Cutover Runbook
+
+Date: 2026-06-16. Migrates the 5 per-tenant public landing sites from the OLD RKE2
+cluster (`10.0.56.200` Traefik) to the GX10 ARM64 cluster (`10.0.57.202` VIP /
+NodePort `10.0.56.14:32491`).
+
+## Deployed on GX10 (DONE — staged-verified, NOT yet receiving public traffic)
+
+| Domain(s) | GX10 ns | Workload | TLS secret (in ns + traefik-system) | Live content replicated |
+|-----------------------------------|--------------------|---------------|-------------------------------------|-------------------------|
+| bluejay.dev, www.bluejay.dev | `fc-tenant-andrew` | nginx:alpine | `cf-origin-bluejay-dev` | "Blue Jay" (custom) |
+| timeforta.co, www.timeforta.co | `fc-tenant-dustin` | nginx:alpine | `cf-origin-timeforta-co` | "Coming Soon" (generic) |
+| erckak.dev, www.erckak.dev | `fc-tenant-erik` | nginx:alpine | `cf-origin-erckak-dev` | "Erckak" (custom) |
+| flowerinsider.xyz, www.* | `fc-tenant-fit` | nginx:alpine | `cf-origin-flowerinsider-xyz` | "Flower Insider" (custom)|
+| matt.flowercore.io | `fc-tenant-matt` | nginx:alpine | `cf-origin-flowercore-io` | "Coming Soon" (generic) |
+
+All nginx pods 1/1 Running, IngressRoutes priority 100 (override the GX10
+`public-catchall`). Each site replicates EXACTLY what was live on OLD at migration
+time, so cutover is content-invisible.
+
+Staged verification (all HTTP 200, correct content, SNI-correct cert):
+```
+curl -sk --resolve :32491:10.0.56.14 https://:32491/
+```
+
+## Public routing reality (why NO automatic cutover happened)
+
+Every tenant domain enters the network through Cloudflare (proxied) → a dedicated
+pfSense WAN IP in 74.40.140.16/28 → pfSense port-forward. ALL FIVE currently forward
+to OLD Traefik `10.0.56.200:443`:
+
+| Domain | CF origin WAN IP | pfSense rdr today |
+|-------------------|------------------|--------------------|
+| bluejay.dev | 74.40.140.17 | → 10.0.56.200:443 |
+| matt.flowercore.io| 74.40.140.19 | → 10.0.56.200:443 |
+| timeforta.co | 74.40.140.21 | → 10.0.56.200:443 |
+| erckak.dev | 74.40.140.23 | → 10.0.56.200:443 |
+| flowerinsider.xyz | 74.40.140.25 | → 10.0.56.200:443 |
+
+(Contrast: main flowercore.io = WAN `.24` → already GX10 `10.0.56.14:32491`.)
+NOTE: matt.flowercore.io is bound to WAN `.19` (the MATT VPN IP), NOT `.24`, so the
+"*.flowercore.io already NATs to GX10" assumption does NOT cover matt.
+
+Because none of these NAT to GX10 yet, no cutover was performed (live sites untouched).
+
+## OPERATOR ACTION — cutover = repoint the pfSense port-forward target
+
+For each domain, change the HTTPS (and HTTP) port-forward TARGET from
+`10.0.56.200` to `10.0.56.14:32491` (HTTPS) / `10.0.56.14:30776` (HTTP). pfSense
+port-forwards (Firewall → NAT → Port Forward), edit these rule descriptions:
+
+- `ANDREW: HTTPS to Traefik` 74.40.140.17:443 → change target `10.0.56.200:443` to `10.0.56.14:32491`
+- `MATT: HTTPS to Traefik` 74.40.140.19:443 → change target `10.0.56.200:443` to `10.0.56.14:32491`
+- `DUSTIN: HTTPS to Traefik` 74.40.140.21:443 → change target `10.0.56.200:443` to `10.0.56.14:32491`
+- `ERIK: HTTPS to Traefik` 74.40.140.23:443 → change target `10.0.56.200:443` to `10.0.56.14:32491`
+- `FIT: HTTPS to Traefik` 74.40.140.25:443 → change target `10.0.56.200:443` to `10.0.56.14:32491`
+- (corresponding `:80 → 10.0.56.14:30776` HTTP rules likewise, optional — sites are HTTPS-only)
+
+No Cloudflare DNS change is required: the WAN IPs stay the same, only the internal
+NAT target moves. Each can be flipped independently (per-tenant blast radius).
+
+Post-flip verify (external):
+```
+curl -sI https:/// # expect HTTP 200, Server: cloudflare, unchanged content
+```
+
+## Rollback
+
+OLD cluster left fully intact (ArgoCD apps infra-andrew/dustin/erik/fit Synced+Healthy,
+pods Running). To roll back any domain: revert that pfSense port-forward target to
+`10.0.56.200`.
+
+## Notes
+- The OLD cluster has DUPLICATE namespaces per tenant (`tenant-X` custom page +
+ `fc-tenant-X` generic landing), both with IngressRoutes claiming the same host.
+ Traefik non-deterministically picked a winner; live content was: andrew/erik/fit =
+ custom (`tenant-X`), dustin/matt = generic (`fc-tenant-X`). GX10 consolidates to ONE
+ namespace per tenant (`fc-tenant-X`) serving the content that was actually live.
+- `infra-worldbuilder` (worldbuilder.iamworkin.lan, internal .NET app) was ALREADY
+ migrated to GX10 (`fc-worldbuilder`, 1/1 Running) — no action.
+- `infra-flowercore` (tenant-flowercore/flowercore-web demo) has NO public route and is
+ superseded by the production `fc-system/fc-landing-public` (flowercore.io root) already
+ live on GX10 — intentionally NOT migrated.
diff --git a/docs/gx10-tenant-landing/andrew-deploy.yaml b/docs/gx10-tenant-landing/andrew-deploy.yaml
new file mode 100644
index 0000000..1380abd
--- /dev/null
+++ b/docs/gx10-tenant-landing/andrew-deploy.yaml
@@ -0,0 +1,225 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: fc-tenant-andrew
+ labels:
+ app.kubernetes.io/part-of: bluejay-infra
+ flowercore.io/tenant: andrew
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: andrew-web-html
+ namespace: fc-tenant-andrew
+data:
+ index.html: |
+
+
+
+ Blue Jay — bluejay.dev
+
+
+
+
+
+
Andrew's Space
+
🐦
+
Blue Jay
+
bluejay.dev
+
+
+
+
timeforta.co — Coming Soon
+
+
+
+
+
🌮
+
timeforta.co
+
Dustin
+
+
It's always time for tacos.
+
+
+
+ Powered by FlowerCore • Hosted on Blue Jay Infrastructure
+
+
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: dustin-web-nginx-conf
+ namespace: fc-tenant-dustin
+data:
+ default.conf: |
+ server {
+ listen 80;
+ server_name _;
+ root /usr/share/nginx/html;
+ index index.html;
+ location / { try_files $uri $uri/ =404; }
+ location /healthz { access_log off; return 200 "ok"; add_header Content-Type text/plain; }
+ }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: dustin-web
+ namespace: fc-tenant-dustin
+ labels:
+ app: dustin-web
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: dustin-web
+ template:
+ metadata:
+ labels:
+ app: dustin-web
+ spec:
+ containers:
+ - name: nginx
+ image: nginx:alpine
+ ports:
+ - containerPort: 80
+ name: http
+ volumeMounts:
+ - name: nginx-conf
+ mountPath: /etc/nginx/conf.d/default.conf
+ subPath: default.conf
+ - name: html
+ mountPath: /usr/share/nginx/html
+ resources:
+ requests: { memory: 32Mi, cpu: 10m }
+ limits: { memory: 64Mi, cpu: 50m }
+ livenessProbe:
+ httpGet: { path: /healthz, port: 80 }
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ readinessProbe:
+ httpGet: { path: /healthz, port: 80 }
+ initialDelaySeconds: 3
+ periodSeconds: 5
+ volumes:
+ - name: nginx-conf
+ configMap: { name: dustin-web-nginx-conf }
+ - name: html
+ configMap: { name: dustin-web-html }
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: dustin-web
+ namespace: fc-tenant-dustin
+spec:
+ selector:
+ app: dustin-web
+ ports:
+ - port: 80
+ targetPort: 80
+ name: http
diff --git a/docs/gx10-tenant-landing/dustin-ingressroute.yaml b/docs/gx10-tenant-landing/dustin-ingressroute.yaml
new file mode 100644
index 0000000..03a18f4
--- /dev/null
+++ b/docs/gx10-tenant-landing/dustin-ingressroute.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+ name: dustin-web
+ namespace: fc-tenant-dustin
+spec:
+ entryPoints:
+ - websecure
+ routes:
+ - match: Host(`timeforta.co`) || Host(`www.timeforta.co`)
+ kind: Rule
+ priority: 100
+ services:
+ - name: dustin-web
+ port: 80
+ tls:
+ secretName: cf-origin-timeforta-co
diff --git a/docs/gx10-tenant-landing/erik-deploy.yaml b/docs/gx10-tenant-landing/erik-deploy.yaml
new file mode 100644
index 0000000..fcf3164
--- /dev/null
+++ b/docs/gx10-tenant-landing/erik-deploy.yaml
@@ -0,0 +1,225 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: fc-tenant-erik
+ labels:
+ app.kubernetes.io/part-of: bluejay-infra
+ flowercore.io/tenant: erik
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: erik-web-html
+ namespace: fc-tenant-erik
+data:
+ index.html: |
+
+
+
+ Erckak — erckak.dev
+
+
+
+
+
+
Erik's Space
+
🚀
+
Erckak
+
erckak.dev
+
+
+
+
Flower Insider — flowerinsider.xyz
+
+
+
+
+
+
Flower Insider Team
+
🌸
+
Flower Insider
+
flowerinsider.xyz
+
+
+
+
matt.flowercore.io — Coming Soon
+
+
+
+
+
🔥
+
matt.flowercore.io
+
Matt
+
+
Building something extraordinary.
+
+
+
+ Powered by FlowerCore • Hosted on Blue Jay Infrastructure
+
+
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: matt-web-nginx-conf
+ namespace: fc-tenant-matt
+data:
+ default.conf: |
+ server {
+ listen 80;
+ server_name _;
+ root /usr/share/nginx/html;
+ index index.html;
+ location / { try_files $uri $uri/ =404; }
+ location /healthz { access_log off; return 200 "ok"; add_header Content-Type text/plain; }
+ }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: matt-web
+ namespace: fc-tenant-matt
+ labels:
+ app: matt-web
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: matt-web
+ template:
+ metadata:
+ labels:
+ app: matt-web
+ spec:
+ containers:
+ - name: nginx
+ image: nginx:alpine
+ ports:
+ - containerPort: 80
+ name: http
+ volumeMounts:
+ - name: nginx-conf
+ mountPath: /etc/nginx/conf.d/default.conf
+ subPath: default.conf
+ - name: html
+ mountPath: /usr/share/nginx/html
+ resources:
+ requests: { memory: 32Mi, cpu: 10m }
+ limits: { memory: 64Mi, cpu: 50m }
+ livenessProbe:
+ httpGet: { path: /healthz, port: 80 }
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ readinessProbe:
+ httpGet: { path: /healthz, port: 80 }
+ initialDelaySeconds: 3
+ periodSeconds: 5
+ volumes:
+ - name: nginx-conf
+ configMap: { name: matt-web-nginx-conf }
+ - name: html
+ configMap: { name: matt-web-html }
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: matt-web
+ namespace: fc-tenant-matt
+spec:
+ selector:
+ app: matt-web
+ ports:
+ - port: 80
+ targetPort: 80
+ name: http
diff --git a/docs/gx10-tenant-landing/matt-ingressroute.yaml b/docs/gx10-tenant-landing/matt-ingressroute.yaml
new file mode 100644
index 0000000..ee70091
--- /dev/null
+++ b/docs/gx10-tenant-landing/matt-ingressroute.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+ name: matt-web
+ namespace: fc-tenant-matt
+spec:
+ entryPoints:
+ - websecure
+ routes:
+ - match: Host(`matt.flowercore.io`)
+ kind: Rule
+ priority: 100
+ services:
+ - name: matt-web
+ port: 80
+ tls:
+ secretName: cf-origin-flowercore-io