debugjois.dev

Static site generator and content for debugjois.dev.

Layout

• site/ - Go static site generator for the main website and daily log
• site/content/ - source content, including daily notes
• site/templates/ - HTML templates
• site/static/ - static assets copied into the build output
• site/cloudfront/ - source and deploy notes for the live CloudFront Function

Workspace

The Go workspace in go.work includes only ./site.

Common commands

Run from site/ unless noted otherwise:

• go build -o debugjois-site . - build the site binary
• ./debugjois-site build - build the static site into build/
• ./debugjois-site build --dev - include drafts and scratch content
• ./debugjois-site build --rebuild - rebuild the entire archive
• ./debugjois-site sync-notes-obsidian - sync daily notes from Google Drive shared drive
• ./debugjois-site commit-notes - commit daily note changes
• ./debugjois-site commit-notes --skip-ci - commit with [skip ci] appended to the message
• ./debugjois-site upload - upload generated files to S3
• ./debugjois-site upload --dryrun - preview upload without writing to S3
• ./debugjois-site build-newsletter - preview the weekly newsletter
• ./debugjois-site build-newsletter --post - post newsletter draft to Buttondown
• ./debugjois-site build-newsletter --post --notify - post and notify via Resend
• go test ./... - run site tests
• golangci-lint run - run the configured Go lint/format checks

Deployments

• Site deploys are handled by the site GitHub workflows and ./debugjois-site upload.
• CloudFront Function source is tracked in site/cloudfront/; see site/cloudfront/README.md for manual deploy commands.

AWS GitHub Actions OIDC setup

The site workflows use aws-actions/configure-aws-credentials with the repo secret AWS_ROLE_ARN to upload generated files to s3://debugjois-dev-site. Keep this OIDC provider and role outside any application stack so deleting app/backend infrastructure does not break site deploys.

Use these commands to recreate the provider and site deploy role if they are missing:

ACCOUNT_ID=654654546088
REPO=deepakjois/debugjois.dev
ROLE_NAME=debugjois-dev-site-github-actions-role
BUCKET=debugjois-dev-site
# IAM can retrieve the GitHub Actions OIDC thumbprint automatically. If the# provider already exists, this command fails harmlessly with EntityAlreadyExists.
aws iam create-open-id-connect-provider \
--url https://token.actions.githubusercontent.com \
--client-id-list sts.amazonaws.com
cat > /tmp/debugjois-dev-site-github-actions-trust.json <<EOF_TRUST{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com", "token.actions.githubusercontent.com:sub": "repo:${REPO}:ref:refs/heads/main" } } } ]}EOF_TRUST
aws iam create-role \
--role-name "$ROLE_NAME" \
--assume-role-policy-document file:///tmp/debugjois-dev-site-github-actions-trust.json
cat > /tmp/debugjois-dev-site-github-actions-s3-policy.json <<EOF_POLICY{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::${BUCKET}" }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::${BUCKET}/*" } ]}EOF_POLICY
aws iam put-role-policy \
--role-name "$ROLE_NAME" \
--policy-name debugjois-dev-site-s3-deploy \
--policy-document file:///tmp/debugjois-dev-site-github-actions-s3-policy.json
ROLE_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${ROLE_NAME}"
gh secret set AWS_ROLE_ARN --repo "$REPO" --body "$ROLE_ARN"

Verify the setup:

aws iam list-open-id-connect-providers
aws iam get-role --role-name debugjois-dev-site-github-actions-role \
--query 'Role.AssumeRolePolicyDocument'
gh secret list --repo deepakjois/debugjois.dev | grep AWS_ROLE_ARN