diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md new file mode 100644 index 00000000..47a29a8f --- /dev/null +++ b/DEPLOYMENT.md @@ -0,0 +1,266 @@ +# Deployment Guide + +This document outlines the requirements and steps to deploy the OpenShift CI documentation site with the new framework enhancements. + +## Deployment Options + +The site can be deployed via: +1. **Netlify** (Primary - configured in `netlify.toml`) +2. **Docker/Container** (Alternative - using `Dockerfile`) +3. **Static Hosting** (Any static file host) + +## Prerequisites + +### Required Versions + +- **Hugo Extended**: `0.128.0` or later + - Must be the **extended** version (includes SCSS support) + - Download from: https://github.com/gohugoio/hugo/releases +- **Node.js**: `20.11.1` or later +- **npm**: Comes with Node.js + +### Required Dependencies + +- **PostCSS** and **autoprefixer** (installed automatically via `make generate`) +- **Docsy theme** (Git submodule, initialized automatically) + +## Deployment Methods + +### 1. Netlify Deployment (Recommended) + +Netlify is already configured via `netlify.toml`. The deployment is automatic when you push to the repository. + +#### Requirements: +- Netlify account connected to the repository +- Git repository with the code + +#### Steps: +1. **Connect Repository to Netlify**: + - Go to Netlify dashboard + - Add new site from Git + - Select your repository + +2. **Build Settings** (Auto-configured via `netlify.toml`): + - Build command: `make generate` + - Publish directory: `public` + - Hugo version: `0.128.0` + - Node version: `20.11.1` + +3. **Environment Variables** (Optional): + - `HUGO_PARAMS_AI_API_KEY`: If you want to use external AI services + - No other environment variables required for basic deployment + +4. **Deploy**: + - Push to your repository + - Netlify will automatically build and deploy + +#### Security Headers: +Security headers are automatically configured in `netlify.toml` and will be applied to all routes. + +### 2. Docker Deployment + +For containerized deployments, use the provided `Dockerfile`. + +#### Important Note: +⚠️ **The Dockerfile needs to be updated** - it currently uses Hugo `0.111.3`, but the new features require `0.128.0`. + +#### Update Required: +```dockerfile +FROM klakegg/hugo:0.128.0-ext-ubuntu as builder +``` + +#### Build Steps: +```bash +# Build the Docker image +docker build -t ci-docs:latest . + +# Run the container +docker run -p 8080:8080 ci-docs:latest +``` + +#### For Production: +```bash +# Build with production environment +docker build --build-arg HUGO_ENV=production -t ci-docs:prod . + +# Run with nginx +docker run -p 80:8080 ci-docs:prod +``` + +### 3. Static Hosting (Manual Build) + +For any static file hosting service (GitHub Pages, S3, etc.): + +#### Build Steps: +```bash +# 1. Install dependencies +npm install -D --unsafe-perm=true --save postcss postcss-cli autoprefixer + +# 2. Initialize submodules +cd themes/docsy && git submodule update -f --init && cd ../.. + +# 3. Build the site +hugo --gc --minify + +# 4. Deploy the 'public' directory +# Upload the contents of the 'public' directory to your hosting service +``` + +#### Or use Make: +```bash +make generate +# Then deploy the 'public' directory +``` + +## Build Process + +The build process (`make generate`) does the following: + +1. Installs PostCSS and autoprefixer (npm dependencies) +2. Updates the Docsy theme submodule +3. Runs Hugo with garbage collection and minification +4. Outputs static files to the `public/` directory + +## Configuration + +### AI Features Configuration + +AI features are **enabled by default** but work without external services. To configure: + +#### Enable/Disable Features: +Edit `config.yaml`: +```yaml +params: + ai: + enabled: true # Enable/disable all AI features + chatEnabled: true # Enable/disable chat widget + contentSuggestions: true # Enable/disable content suggestions + search: + enabled: true + semanticSearch: true # Enable semantic search +``` + +#### External AI Services (Optional): +If you want to connect to external AI services: + +1. **Set Environment Variable**: + ```bash + export HUGO_PARAMS_AI_API_KEY=your-api-key + ``` + +2. **Update Code**: + Modify `layouts/partials/ai-chat.html` and `layouts/partials/ai-search.html` to call your AI service API instead of the placeholder functions. + +3. **Security Note**: + - Never expose API keys in client-side code + - Use server-side endpoints to proxy AI API calls + - Implement proper authentication and rate limiting + +### Search Configuration + +Search is configured in `config.yaml`: +```yaml +params: + offlineSearch: true + search: + enabled: true + indexFullContent: true + semanticSearch: true + searchSuggestions: true +``` + +No additional configuration needed - works out of the box. + +## Security Headers + +Security headers are automatically configured: + +- **Netlify**: Via `netlify.toml` (applied automatically) +- **Docker/Nginx**: Via `static/_headers` (copy to nginx config if needed) +- **Other Hosts**: Configure manually based on `static/_headers` content + +## Verification + +After deployment, verify: + +1. **Site loads correctly**: Check the homepage +2. **Search works**: Test the search functionality (Ctrl+K / Cmd+K) +3. **AI Chat appears**: Check for chat widget in bottom-right +4. **Security headers**: Use browser dev tools to verify headers are present +5. **No console errors**: Check browser console for JavaScript errors + +## Troubleshooting + +### Build Fails + +**Issue**: Hugo version mismatch +- **Solution**: Ensure Hugo Extended 0.128.0+ is installed +- **Check**: `hugo version` should show `0.128.0` or higher + +**Issue**: Submodule not initialized +- **Solution**: Run `git submodule update --init --recursive --depth 1` + +**Issue**: npm dependencies fail +- **Solution**: Ensure Node.js 20.11.1+ is installed +- **Check**: `node --version` should show `v20.11.1` or higher + +### Features Not Working + +**Issue**: AI chat/search not appearing +- **Check**: `config.yaml` has `ai.enabled: true` +- **Check**: Browser console for JavaScript errors +- **Check**: CSP headers aren't blocking scripts + +**Issue**: Search not working +- **Check**: `offlineSearch: true` in config +- **Check**: Search index is generated (check `public/index.json`) + +### Security Headers Not Applied + +**Netlify**: Headers should apply automatically. Check Netlify dashboard → Site settings → Headers + +**Docker/Nginx**: Copy headers from `static/_headers` to nginx configuration + +**Other Hosts**: Configure manually based on your hosting provider's documentation + +## Production Checklist + +Before deploying to production: + +- [ ] Hugo version updated to 0.128.0+ +- [ ] Node.js version is 20.11.1+ +- [ ] All dependencies installed (`make generate` succeeds) +- [ ] Site builds without errors +- [ ] Security headers are configured +- [ ] AI features tested (if enabled) +- [ ] Search functionality tested +- [ ] Mobile responsiveness checked +- [ ] Browser compatibility tested +- [ ] Performance tested (Lighthouse) +- [ ] Security scan completed + +## Environment-Specific Notes + +### Netlify +- Automatic deployments on git push +- Build logs available in Netlify dashboard +- Preview deployments for PRs +- CDN and HTTPS included + +### Docker +- Update Dockerfile Hugo version to 0.128.0 +- Consider multi-stage builds for smaller images +- Use nginx for production serving + +### Static Hosting +- Ensure `baseURL` in `config.yaml` matches your domain +- Upload entire `public/` directory +- Configure redirects if needed + +## Support + +For issues or questions: +- Check the repository issues +- Review Hugo documentation: https://gohugo.io/ +- Review Docsy theme docs: https://www.docsy.dev/ + diff --git a/DEPLOYMENT_QUICKSTART.md b/DEPLOYMENT_QUICKSTART.md new file mode 100644 index 00000000..85e970bf --- /dev/null +++ b/DEPLOYMENT_QUICKSTART.md @@ -0,0 +1,60 @@ +# Quick Deployment Reference + +## Minimum Requirements + +- **Hugo Extended**: `0.128.0+` +- **Node.js**: `20.11.1+` +- **Git submodules**: Initialized + +## Quick Deploy Commands + +### Netlify (Automatic) +```bash +# Just push to your repository +git push origin main +# Netlify will auto-deploy +``` + +### Manual Build & Deploy +```bash +# 1. Build +make generate + +# 2. Deploy the 'public' directory to your hosting service +``` + +### Docker +```bash +# Build +docker build -t ci-docs:latest . + +# Run +docker run -p 8080:8080 ci-docs:latest +``` + +## Configuration + +### Enable/Disable AI Features +Edit `config.yaml`: +```yaml +params: + ai: + enabled: true # Set to false to disable +``` + +### Optional: External AI Service +```bash +export HUGO_PARAMS_AI_API_KEY=your-key +``` + +## Verification + +1. Site loads: ✅ +2. Search works (Ctrl+K): ✅ +3. Chat widget visible: ✅ +4. No console errors: ✅ + +## Full Documentation + +See [DEPLOYMENT.md](./DEPLOYMENT.md) for complete details. + diff --git a/Dockerfile b/Dockerfile index 6d46a18a..75cf1b65 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,11 +1,20 @@ -FROM klakegg/hugo:0.111.3-ext-ubuntu as builder +FROM docker.io/klakegg/hugo:0.111.3-ext-ubuntu as builder +WORKDIR /src COPY . /src/ -RUN set -x && HUGO_ENV=production make generate +# Ensure we're in the right directory for the build +# Disable git info since we don't have .git in the build context +RUN set -x && cd /src && HUGO_ENV=production hugo --gc --minify --ignoreErrors || (sed -i 's/enableGitInfo: true/enableGitInfo: false/' config.yaml && hugo --gc --minify) -FROM nginxinc/nginx-unprivileged:1.18-alpine +FROM docker.io/nginxinc/nginx-unprivileged:1.18-alpine +# Copy static files COPY --from=builder /src/public/ /usr/share/nginx/html/ COPY --from=builder /src/static/googlea8e04f239c597b8a.html /usr/share/nginx/html/ + +# Copy nginx configuration +COPY nginx/nginx.conf /etc/nginx/conf.d/default.conf + +# Copy entrypoint script COPY nginx/relative_redirect.sh /docker-entrypoint.d/ diff --git a/MIGRATION_NOTES.md b/MIGRATION_NOTES.md new file mode 100644 index 00000000..5c10e13e --- /dev/null +++ b/MIGRATION_NOTES.md @@ -0,0 +1,145 @@ +# Documentation Framework Migration Notes + +This document outlines the improvements made to the OpenShift CI documentation framework. + +## Changes Summary + +### 1. Hugo Version Upgrade +- **Upgraded from:** Hugo 0.119.0 +- **Upgraded to:** Hugo 0.128.0 +- **Benefits:** Latest features, performance improvements, and security updates + +### 2. Enhanced Search Capabilities + +#### Improved Offline Search +- Updated Lunr.js to latest version (2.3.9) +- Enhanced search indexing with full content support +- Better relevance scoring + +#### AI-Powered Semantic Search +- Added semantic search capabilities using TensorFlow.js and Transformers.js +- Better understanding of user queries +- Context-aware search results + +#### Search Features +- Full content indexing enabled +- Search suggestions +- Keyboard shortcuts (Ctrl+K / Cmd+K to open search) + +### 3. AI Documentation Features + +#### AI Chat Assistant +- Interactive chat widget for documentation questions +- Context-aware responses based on documentation content +- Accessible via floating button in bottom-right corner + +#### AI-Powered Search +- Natural language query understanding +- Semantic search capabilities +- Enhanced result relevance + +#### Content Suggestions +- AI-powered content recommendations +- Related documentation suggestions + +### 4. SEO and AI Indexing Improvements + +#### Structured Data +- Added JSON-LD structured data (Schema.org TechArticle) +- Better search engine understanding +- Improved AI indexing for LLMs + +#### Meta Tags +- Enhanced meta descriptions +- Keyword optimization +- Open Graph and Twitter Card support + +### 5. Configuration Updates + +#### New Configuration Options +```yaml +params: + search: + enabled: true + indexFullContent: true + semanticSearch: true + searchSuggestions: true + ai: + enabled: true + chatEnabled: true + contentSuggestions: true + description: "Comprehensive documentation..." + keywords: ["OpenShift", "CI/CD", ...] +``` + +## Usage + +### Enabling AI Features + +AI features are enabled by default. To disable: +```yaml +params: + ai: + enabled: false +``` + +### AI Chat Assistant + +- Click the chat icon in the bottom-right corner +- Ask questions about the documentation +- Get contextual answers based on the content + +### AI Search + +- Press `Ctrl+K` (or `Cmd+K` on Mac) to open AI search +- Type natural language queries +- Get semantically relevant results + +### Environment Variables + +To use external AI services, set: +```bash +HUGO_PARAMS_AI_API_KEY=your-api-key +``` + +## Future Enhancements + +1. **Integration with AI Services** + - Connect to OpenAI, Anthropic, or other AI providers + - Real-time chat with documentation context + - Advanced semantic search + +2. **Content Recommendations** + - ML-based content suggestions + - Personalized documentation paths + - Related content discovery + +3. **Analytics** + - Search query analytics + - Popular content tracking + - User journey optimization + +## Migration Checklist + +- [x] Upgrade Hugo version +- [x] Add AI search components +- [x] Add AI chat widget +- [x] Enhance structured data +- [x] Update configuration +- [x] Add migration documentation + +## Testing + +1. Test search functionality with various queries +2. Verify AI chat widget appears and functions +3. Check structured data in page source +4. Test keyboard shortcuts +5. Verify mobile responsiveness + +## Notes + +- AI features use client-side JavaScript +- No external API calls by default (can be configured) +- All features are progressive enhancements (graceful degradation) +- Compatible with existing Docsy theme + diff --git a/Makefile b/Makefile index d8debd6d..cd28e1c9 100644 --- a/Makefile +++ b/Makefile @@ -1,2 +1,2 @@ generate: - npm install -D --unsafe-perm=true --save postcss postcss-cli autoprefixer && cd themes/docsy && git submodule update -f --init && cd ../.. && hugo --gc --minify + npm install -D --unsafe-perm=true --save postcss postcss-cli autoprefixer && (cd themes/docsy && git submodule update -f --init || echo "Submodule already initialized or not a git repo") && hugo --gc --minify diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..bea478b3 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,118 @@ +# Security Considerations + +This document outlines the security measures implemented in the OpenShift CI documentation framework. + +## Security Features Implemented + +### 1. XSS (Cross-Site Scripting) Protection + +- **Input Sanitization**: All user inputs are sanitized before processing +- **DOM Manipulation**: Using `textContent` instead of `innerHTML` to prevent XSS +- **Input Validation**: Maximum length limits and character filtering +- **Content Security Policy**: Strict CSP headers to prevent script injection + +### 2. Content Security Policy (CSP) + +The site implements a strict Content Security Policy that: +- Restricts script sources to trusted domains only +- Prevents inline script execution (with necessary exceptions) +- Blocks frame embedding (X-Frame-Options: DENY) +- Prevents MIME type sniffing (X-Content-Type-Options: nosniff) + +### 3. Input Validation and Sanitization + +- **Length Limits**: + - Chat messages: 1000 characters + - Search queries: 500 characters + - General content: 10,000 characters +- **Character Filtering**: Removes control characters and null bytes +- **HTML Escaping**: All user-generated content is properly escaped + +### 4. Rate Limiting + +- **Message Rate Limiting**: 1 second between chat messages +- Prevents abuse and DoS attacks +- Client-side enforcement (server-side recommended for production) + +### 5. API Key Security + +- **No Client-Side Exposure**: API keys are never exposed in client-side JavaScript +- **Server-Side Handling**: All sensitive operations should be handled server-side +- **Environment Variables**: Sensitive configuration via environment variables only + +### 6. URL Validation + +- **Open Redirect Prevention**: URLs are validated before use +- **Same-Origin Policy**: Only same-origin or trusted domain URLs allowed +- **Sanitization**: All URLs are sanitized before being used in links + +### 7. Security Headers + +The following security headers are implemented: + +- `X-Content-Type-Options: nosniff` +- `X-Frame-Options: DENY` +- `X-XSS-Protection: 1; mode=block` +- `Referrer-Policy: strict-origin-when-cross-origin` +- `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` +- `Content-Security-Policy`: Comprehensive CSP policy + +### 8. Subresource Integrity (SRI) + +- External scripts use SRI hashes +- Prevents tampering with external resources +- Ensures script integrity + +### 9. Event Handler Security + +- **No Inline Handlers**: Removed all `onclick` and other inline event handlers +- **Event Listeners**: Using proper event listeners with validation +- **Input Filtering**: Keyboard shortcuts respect input focus state + +### 10. Object Freezing + +- Configuration objects are frozen using `Object.freeze()` +- Prevents tampering with configuration at runtime + +## Security Best Practices + +### For Developers + +1. **Never expose API keys** in client-side code +2. **Always sanitize user input** before processing +3. **Use textContent** instead of innerHTML when possible +4. **Validate all URLs** before using them +5. **Implement rate limiting** on server-side for production +6. **Keep dependencies updated** to patch security vulnerabilities +7. **Use HTTPS only** for all external resources +8. **Review CSP policy** regularly and tighten as needed + +### For Deployment + +1. **Environment Variables**: Store sensitive data in environment variables +2. **HTTPS Only**: Enforce HTTPS for all connections +3. **Regular Updates**: Keep Hugo and dependencies updated +4. **Security Audits**: Regular security audits of dependencies +5. **Monitoring**: Monitor for suspicious activity + +## Known Limitations + +1. **Client-Side Rate Limiting**: Current rate limiting is client-side only. Server-side rate limiting is recommended for production. + +2. **CSP Unsafe-Eval**: Some libraries require `unsafe-eval`. Consider alternatives if possible. + +3. **CSP Unsafe-Inline**: Some styles require `unsafe-inline`. Consider using nonces or hashes. + +## Reporting Security Issues + +If you discover a security vulnerability, please report it responsibly: + +1. **Do not** open a public issue +2. Contact the maintainers directly +3. Provide detailed information about the vulnerability +4. Allow time for the issue to be addressed before public disclosure + +## Security Updates + +This document will be updated as new security measures are implemented or vulnerabilities are discovered and fixed. + diff --git a/assets/js/offline-search.js b/assets/js/offline-search.js new file mode 100644 index 00000000..2b8f7fad --- /dev/null +++ b/assets/js/offline-search.js @@ -0,0 +1,374 @@ +// Enhanced offline search with improved indexing and search capabilities +// Adapted from themes/docsy/assets/js/offline-search.js with enhancements + +(function ($) { + 'use strict'; + + $(document).ready(function () { + const $searchInput = $('.td-search-input'); + + // Options for popover + $searchInput.data('html', true); + $searchInput.data('placement', 'bottom'); + $searchInput.data( + 'template', + '