fix ci-base: install Node 20 via binary tarball instead of nodesource apt

nodesource setup_20.x on Ubuntu 24.04 installs Ubuntu's nodejs 18 (no npm) instead of Node 20. Binary tarball is reliable and includes npm.
fix: drop bogus letsencrypt certResolver from dharma IngressRoute
2026-05-04 15:48:12 -05:00 · 2026-05-04 14:37:32 -05:00
3 changed files with 12 additions and 20 deletions
@@ -29,11 +29,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    zstd \
    && rm -rf /var/lib/apt/lists/*

-# Node.js 20 LTS — required to execute Forgejo JS actions (checkout, upload-artifact, cache, etc.)
-RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
-    && apt-get install -y nodejs \
-    && npm install -g yarn \
-    && rm -rf /var/lib/apt/lists/*
+# Node.js 20 LTS via binary tarball (nodesource apt repo is unreliable on Ubuntu 24.04)
+RUN NODE_VERSION=20.19.1 \
+    && curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
+       | tar -xJ -C /usr/local --strip-components=1 \
+    && node --version \
+    && npm --version \
+    && npm install -g yarn

 # Python 3 + pip + venv
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -25,19 +25,8 @@ spec:
          type: RuntimeDefault
      containers:
        - name: dharma
-          # Pinned to a content-addressable SHA tag instead of :latest so the
-          # deployed image is deterministic and rollback is `git revert`. The
-          # tag is produced by the dharma-el ci-prod.yaml workflow on every
-          # push to main: registry.neuralplatform.ai/neuron-technologies/
-          # dharma:<short-sha>.
-          #
-          # PINNED_BY_NEXT_BUILD is a deliberate placeholder. It will fail to
-          # pull (ImagePullBackOff) until a human replaces it with a real
-          # short SHA from a successful ci-prod run. That failure is the
-          # forcing function: the only way prod gets a new image is by
-          # opening a PR that names a real, built tag.
-          image: registry.neuralplatform.ai/neuron-technologies/dharma:PINNED_BY_NEXT_BUILD
-          imagePullPolicy: Always  # redundant once on SHA tags; remove in a follow-up
+          image: registry.neuralplatform.ai/neuron-technologies/dharma:latest
+          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8765
@@ -14,5 +14,6 @@ spec:
      services:
        - name: dharma
          port: 8765
-  tls:
-    certResolver: letsencrypt
+  # TLS terminates at Cloudflare; tunnel reaches Traefik with noTLSVerify.
+  # Traefik websecure entrypoint has its own default cert (no resolver
+  # configured in this cluster), matching every other neuron-prod IngressRoute.