chore(deps): update dependency @babel/core to v8.0.9 (#250)

Moves the production deploy from AWS to the Frostmoln production cluster (namespace `sites`).

- `deploy-prod` (AWS) has failed since CI left AWS: the runners have no `k8s.unbound.se` context, so the site on AWS still runs an older image. It's replaced by `deploy-prod-frostmoln`, the same pattern as Shiny's `deploy-frostmoln-staging`: `FROSTMOLN_PRODUCTION_DEPLOY_KEY` + `FROSTMOLN_PRODUCTION_CLUSTER_ID` (org), `BUILDTOOLS_FROSTMOLN_PRODUCTION` (org, target `prod-frostmoln`), `deploy prod-frostmoln -n sites`.
- Frostmoln enforces restricted Pod Security: the served image is `nginxinc/nginx-unprivileged` (uid 101, port 8080), with a matching securityContext; the Service is ClusterIP.
- `ingress-prod.yaml` (ALB) → `ingress-prod-frostmoln.yaml` (Traefik, Let's Encrypt).

Checked locally: the image serves `/health` and `/` (200) as uid 101 with all capabilities dropped.

**Merge after** infra's `feat/frostmoln-production-sites` is applied (namespace + org secret). The hostnames keep pointing at AWS until the Route 53 switch, a separate step; the certificate is issued after that.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
Reviewed-on: #243

.gitea/workflows/ci.yaml

@@ -13,21 +13,35 @@ jobs:
       BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod:
+  deploy-prod-frostmoln:
     needs: build
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
+      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Deploy to production
+      - name: Install fm
-        run: deploy prod
+        run: |
+          sudo install -d -m 0755 /etc/apt/keyrings
+          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
+          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
+          sudo apt-get update && sudo apt-get install -y fm
+      - name: Deploy to Frostmoln production
+        env:
+          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
+        # The cluster API is private: the kubeconfig's exec plugin opens an fm
+        # tunnel on demand. fm reads the key from its config file, not the env.
+        run: |
+          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
+          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
+          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n sites

Dockerfile

@@ -1,4 +1,4 @@
-FROM amd64/nginx:1.29.5-alpine@sha256:251df7d28ed7958c0e810b3c4cc380d0382336fcc34e361bfb60fb73b2ec19dc as build
+FROM amd64/nginx:1.31.8-alpine@sha256:74fe162437217d0f87b296bd786ff2c9bbe77e1edc15421da420ffa31a5016f1 as build
 
 RUN apk add --update \
     wget
@@ -13,7 +13,8 @@ COPY ./ /site
 WORKDIR /site
 RUN hugo
 
-FROM amd64/nginx:1.29.5-alpine@sha256:251df7d28ed7958c0e810b3c4cc380d0382336fcc34e361bfb60fb73b2ec19dc
+# Unprivileged (uid 101, port 8080): Frostmoln enforces restricted Pod Security.
+FROM nginxinc/nginx-unprivileged:1.31.7-alpine@sha256:b5047b9b76845eac124358373c6852377c52e4b05834a47647e955dd91cb8f1e
 ADD default.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /site/public /usr/share/nginx/html
 

default.conf

@@ -1,5 +1,5 @@
 server {
-    listen       80;
+    listen       8080;
     server_name  localhost;
 
     access_log /dev/stdout combined;

k8s/deploy.yaml

@@ -22,6 +22,11 @@ spec:
       labels:
         app.kubernetes.io/name: unbound-site
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -39,20 +44,23 @@ spec:
         readinessProbe:
           httpGet:
             path: /health
-            port: 80
+            port: 8080
           initialDelaySeconds: 5
           periodSeconds: 5
           timeoutSeconds: 5
         imagePullPolicy: Always
-        image: oci.unbound.se/unboundsoftware/unbound-site:${COMMIT}
+        image: ${IMAGE}
         ports:
-        - containerPort: 80
+        - containerPort: 8080
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         resources:
           requests:
             cpu: 5m
             memory: 5Mi
           limits:
-            cpu: 300m
             memory: 300Mi
 
 ---
@@ -64,9 +72,8 @@ metadata:
   labels:
     app.kubernetes.io/name: unbound-site
 spec:
-  type: NodePort
   selector:
     app.kubernetes.io/name: unbound-site
   ports:
   - port: 80
-    targetPort: 80
+    targetPort: 8080

k8s/ingress-prod-frostmoln.yaml

@@ -1,15 +1,12 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: unbound-site-ingress
+  name: unbound-site
   annotations:
-    kubernetes.io/ingress.class: "alb"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    alb.ingress.kubernetes.io/group.name: default
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: "443"
 spec:
+  ingressClassName: traefik
   rules:
     - host: "unbound.se"
       http:

themes/LoveIt/.circleci/config.yml

@@ -2,7 +2,7 @@ version: 2.1
 jobs:
   build-check:
     docker:
-      - image: cibuilds/hugo:0.156@sha256:729fd6dcc7ba3aee517e058baac2fd54a02e4143dbc176e2d2a324f6c5a29a9f
+      - image: cibuilds/hugo:0.168@sha256:4aed25bd442a26734b2af49a05a182fa63ee31324ccc2bf196dfe4709a048550
     working_directory: ~/LoveIt
     steps:
       - checkout

themes/LoveIt/package.json

@@ -5,13 +5,13 @@
   "private": true,
   "dependencies": {},
   "devDependencies": {
-    "@babel/cli": "7.28.6",
+    "@babel/cli": "8.0.6",
-    "@babel/core": "7.29.0",
+    "@babel/core": "8.0.9",
-    "@babel/preset-env": "7.29.0",
+    "@babel/preset-env": "8.0.7",
     "babel-preset-minify": "0.5.2",
     "babelify": "10.0.0",
     "browserify": "17.0.1",
-    "core-js": "3.48.0",
+    "core-js": "3.51.0",
     "husky": "9.1.7",
     "minimist": "1.2.8",
     "segmentit": "2.0.3"