Portfolio¶

Principal site — rafaelgonzalezalbes.com

Repository¶

Field	Value
Forgejo	`rafael.gonzalez.albes/portfolio`
Plane prefix	`PORT`
Profile	`static-sftp`

Deploy flow¶

flowchart LR
  Push[push main] --> WP[Woodpecker]
  WP --> Build[npm build]
  Build --> SFTP[lftp mirror dist]
  SFTP --> IONOS[IONOS public_html]
  IONOS --> Live[rafaelgonzalezalbes.com]

Woodpecker SFTPs directly to IONOS — not through the VPS filesystem.

Future (not started)

Planned: leave IONOS web hosting; deploy static files to the infra VPS + Cloudflare. See Migrate VPS off IONOS.

Woodpecker secrets¶

Set via onboard-project.sh from local/projects/portfolio.env:

ftp_host, ftp_user, ftp_pass, frontend_remote_path
plane_api_key, plane_workspace, plane_project_id, plane_api_url, plane_issue_prefix

CI notify¶

Branch name must contain PORT-N for Plane CI comments (e.g. feature/PORT-12-homepage).

Template: templates/woodpecker-notify-plane.yml

Public vs private¶

Git repo: public on Forgejo — anonymous users can browse source and commits
Woodpecker: public project visibility — anonymous users can view builds and logs
Live site: public on IONOS, indexable by search engines
Other repos (bioscan/*, infra/devops): private — team only

Apply on VPS: bash scripts/open-portfolio-public.sh

See Access control.

Cloudflare TLS 1.3 + HTTP/3¶

IONOS Apache on the apex often stops at TLS 1.2 and has no HTTP/3. Put Cloudflare in front of the public site (keep SFTP deploy to IONOS as the origin).

One-time setup (Cloudflare + IONOS DNS)¶

Add rafaelgonzalezalbes.com to Cloudflare (or use the existing zone if www is already there).
In Cloudflare DNS, ensure:
@ (apex) → IONOS web host A record (same IP IONOS already uses for the site), Proxied (orange cloud)
www → same origin (A or CNAME), Proxied
In Cloudflare SSL/TLS:
Mode Full (or Full (strict) if the IONOS cert is valid for the hostname)
Edge certificates: leave defaults (TLS 1.2 + 1.3)
In Cloudflare Network / Speed: leave HTTP/3 (with QUIC) enabled (default on modern zones).
At IONOS: point apex/www DNS to Cloudflare nameservers or keep IONOS as DNS and only CNAME/proxy what Cloudflare manages — pick one DNS authority to avoid split-brain.
Wait for DNS; verify:

curl -sSI https://rafaelgonzalezalbes.com/ | grep -iE 'HTTP/|server:|alt-svc'
curl -sSI https://www.rafaelgonzalezalbes.com/ | grep -iE 'HTTP/|server:|alt-svc'

Expect Cloudflare (server: cloudflare) and alt-svc: h3=... on both.

Do not proxy platform hosts¶

Leave git, ci, pm, status, security, docs, etc. as DNS only (grey cloud) pointing at 85.215.32.166. Those use Traefik + Let's Encrypt on the VPS — see TLS and HTTP versions.

Code graph¶

Interactive Graphify view (published with platform docs):

https://docs.rafaelgonzalezalbes.com/graph/portfolio/

Hub: Code graphs.

Useful scripts¶

bash scripts/trigger-portfolio-pipeline.sh
bash scripts/check-woodpecker-status.sh   # on VPS

MCP¶

Task	Use
Create PORT ticket	`plane` MCP
Open PR / read repo	`forgejo` MCP
Check pipeline / logs	`woodpecker` MCP
Trigger deploy	`woodpecker` MCP or `infra-ops` `trigger_pipeline`