Apart from the fact that TLS certificate provisioning is very wonky,
it seems to be working now.
AFAICT the L7 LBs still don't support path rewriting, which means that
this is likely not the final configuration and it will move behind
nginx instead.
Newer versions of nginx apparently hard-crash if they can't write a
PID file in the current directory.
To work around this, some writeable scratch space is created for the
nginx daemon to write its PID to.
Instead of having a manually prepared secret, use Cloud KMS (as per
the previous commits) to decrypt the in-repo secrets and template them
into the Secret resource in Kubernetes.
Not all of the values are actually secret, it has thus become a bit
easier to edit the known hosts, SSH config and such now.
This configuration is no longer in use. The Gemma configuration file
has been moved over to the k8s folder from where it will be templated
into the actual configuration.
Uses Google-managed certificates and an Ingress resource to set up an
HTTPS load-balancer.
This probably won't be the final version as the GKE Ingress is very
limited and can not do things like redirect URLs, which I need to
decommission the old setup.
First deployment actually using a Nixery image and `gitHEAD`.
This does not actually serve a working blog for various reasons. The
current storage mechanism (acid-state) isn't really appropriate
anymore and I'll need to change that soon.
