Build app images for amd64 and arm64

README.md

@@ -178,9 +178,10 @@ the VM disk on the selected non-local Pimox storage. It leaves the VM stopped
 and not enabled for host boot by default. It does not use the Debian Kubernetes
 golden-node template for OpenWrt.
 
-The website and demos images default to `linux/arm64` because both deployments
-are pinned to the Raspberry Pi worker. Override with `WEBSITE_IMAGE_PLATFORMS`
-or `DEMOS_IMAGE_PLATFORMS` only if node placement changes.
+The website and demos images default to `linux/amd64,linux/arm64` because both
+deployments can schedule on either the Debian host or ARM workers. Override with
+`WEBSITE_IMAGE_PLATFORMS` or `DEMOS_IMAGE_PLATFORMS` only when intentionally
+restricting node placement.
 
 Build metadata is written under `.lab/` so repeat runs can skip the website
 or demos image build when the source hash, platform, image reference, and
@@ -515,11 +516,12 @@ exposed at `https://n8n.lab2025.duckdns.org`. It receives
 `OLLAMA_BASE_URL=http://192.168.100.73:11434` so workflows can call the existing
 Debian-host Ollama API for translation prewarming and batch jobs.
 
-The `arr-stack` app runs Prowlarr, Sonarr, Radarr, qBittorrent, Kapowarr,
-Suwayomi, Maintainerr, and FlareSolverr as native Kubernetes Deployments in the
-`arr-stack` namespace. It uses retained OpenEBS PVCs for shared `/data` media
-paths and per-service config directories, and exposes the user interfaces
-through dedicated Traefik hostnames instead of a Tailscale sidecar.
+The ARR/media stack is intentionally not deployed by the Kubernetes app
+pipeline. It is better suited to a Docker Compose stack on the Debian host with
+persistent volumes under `/data`, where large media paths, qBittorrent writes,
+and service config directories can survive cluster rebuilds without OpenEBS
+node-affinity or PVC migration concerns. The legacy `apps/arr-stack` manifests
+are retained only as migration reference.
 
 ## Storage
 
@@ -758,10 +760,10 @@ to WebAssembly with a TypeScript UI so the codec work stays fast and still
 avoids backend uploads.
 
 The demos are designed to be local-first so the current cluster can serve them
-from the Raspberry Pi worker without turning either pod into an application
-server. The website pod serves the portfolio shell and the `demos-static` pod
-serves static demo bundles; CPU-heavy work runs in the visitor's browser. With
-the current deployments pinned to the Raspberry Pi, avoid bundling large ML
+from any Linux app node without turning either pod into an application server.
+The website pod serves the portfolio shell and the `demos-static` pod serves
+static demo bundles; CPU-heavy work runs in the visitor's browser. Because the
+deployments can run on either Debian or ARM workers, avoid bundling large ML
 models, server-side WebSocket probes, or backend video transcoders into either
 image. If those demos become production-grade, lazy load model assets in the
 browser or move backend workers to a larger node, such as VMs on the Orange Pi 5

apps/website/blog.php

@@ -363,7 +363,7 @@ function renderStackSourceLinks(string $stackKey, array $sourceLinks, string $so
         <g class="diagram-node node-accent-green" transform="translate(54 542)">
           <rect width="240" height="70" rx="8"></rect>
           <text x="18" y="27">Buildx image build</text>
-          <text class="diagram-small" x="18" y="50">linux/arm64 website + demos</text>
+          <text class="diagram-small" x="18" y="50">amd64 + arm64 website and demos</text>
         </g>
 
         <g class="diagram-node node-accent-purple" transform="translate(412 92)">

apps/website/lang/en.php

@@ -116,7 +116,7 @@ return [
     'blog_q2'                => 'Why kubeadm? Were managed clusters too emotionally stable?',
     'blog_a2'                => 'Pretty much. kubeadm keeps the cluster close to the metal, which is a polite way of saying I get to see every sharp edge. The Debian node runs the control plane, the Raspberry Pi joins as an arm64 worker, and Pimox on an Orange Pi 5 Plus now gives me a repeatable way to add Debian 13 arm64 VM workers. Suddenly networking, storage, container runtimes, certs, and node recovery are not mysterious cloud magic. They are my problem.',
     'blog_q3'                => 'So where is the CI/CD part hiding?',
-    'blog_a3'                => 'It is small, but it is real. OpenTofu brings up the cluster, platform, apps, and edge layers. Argo CD watches Git from the app workers, Kyverno keeps policy pressure on the workloads, Docker Buildx builds linux/arm64 images, and the local registry feeds the cluster. No enterprise dashboard fireworks, just a clean loop: Git changed, image built, cluster updated, nobody had to kubectl-edit anything at 2 AM.',
+    'blog_a3'                => 'It is small, but it is real. OpenTofu brings up the cluster, platform, apps, and edge layers. Argo CD watches Git from the app workers, Kyverno keeps policy pressure on the workloads, Docker Buildx builds amd64 and arm64 images, and the local registry feeds the cluster. No enterprise dashboard fireworks, just a clean loop: Git changed, image built, cluster updated, nobody had to kubectl-edit anything at 2 AM.',
     'blog_q4'                => 'Why run your own registry and Gitea? Was the simple option unavailable?',
     'blog_a4'                => 'The simple option was very available, which is why I heroically ignored it. The registry means experiments do not need to go to a public image repo, and external Gitea gives the lab its own Git service without making Kubernetes responsible for its own source of truth. Together they make the setup feel less like "some containers under the stairs" and more like a tiny platform with opinions, responsibilities, and occasionally dramatic storage needs.',
     'blog_q5'                => 'What actually hurt the most?',

apps/website/lang/nah.php

@@ -116,7 +116,7 @@ return [
     'blog_q2'                => 'Tleica kubeadm? Managed clusters catca too emotionally stable?',
     'blog_a2'                => 'Quena. kubeadm quicahua cluster nechca metal; in polite way quitosnequi niquita nochi sharp edge. Debian node quipia control plane, Raspberry Pi joins quen arm64 worker, ihuan Pimox ipan Orange Pi 5 Plus quimaca repeatable Debian 13 arm64 VM workers. Suddenly networking, storage, container runtimes, certs, ihuan node recovery amo cloud magic: no problema.',
     'blog_q3'                => 'Canin motlatia CI/CD part?',
-    'blog_a3'                => 'Tepiton, zan real. OpenTofu quichihua cluster, platform, apps, ihuan edge layers. Argo CD quitta Git ipan app workers, Kyverno quimaca policy pressure, Docker Buildx quichihua linux/arm64 images, ihuan local registry quimaca cluster. Clean loop: Git mopatla, image omochiuh, cluster updated, ahmo aca monequi kubectl-edit 2 AM.',
+    'blog_a3'                => 'Tepiton, zan real. OpenTofu quichihua cluster, platform, apps, ihuan edge layers. Argo CD quitta Git ipan app workers, Kyverno quimaca policy pressure, Docker Buildx quichihua amd64 ihuan arm64 images, ihuan local registry quimaca cluster. Clean loop: Git mopatla, image omochiuh, cluster updated, ahmo aca monequi kubectl-edit 2 AM.',
     'blog_q4'                => 'Tleica own registry ihuan Gitea? Simple option amo oncatca?',
     'blog_a4'                => 'Simple option huel oncatca, ic heroic oniquignore. Registry quitosnequi experiments amo monequi yasque public image repo, ihuan external Gitea quimaca lab own Git service ahmo quichihua Kubernetes responsible para source of truth. In ome quichihua setup ma nesi quen tepiton platform ika opinions, responsibilities, ihuan storage drama.',
     'blog_q5'                => 'Tlein achi cualani?',

bootstrap/apps/variables.tf

@@ -75,15 +75,6 @@ variable "applications" {
       self_heal        = true
       create_namespace = true
     }
-    arr-stack = {
-      project          = "default"
-      path             = "apps/arr-stack"
-      namespace        = "arr-stack"
-      target_revision  = "main"
-      prune            = true
-      self_heal        = true
-      create_namespace = true
-    }
     supply-chain-policy = {
       project          = "default"
       path             = "apps/supply-chain-policy"

lab.sh

@@ -2991,10 +2991,10 @@ apps() {
     demos_registry_endpoint="$(demos_registry_endpoint)"
     demos_image_ref="${registry_endpoint}/demos-static:latest"
     demos_image_state_file="${REPO_ROOT}/.lab/demos-static-image.state"
-    demos_platforms="${DEMOS_IMAGE_PLATFORMS:-linux/arm64}"
+    demos_platforms="${DEMOS_IMAGE_PLATFORMS:-linux/amd64,linux/arm64}"
     demos_source_hash="$(demos_source_hash)"
     website_image_state_file="${REPO_ROOT}/.lab/php-website-image.state"
-    website_platforms="${WEBSITE_IMAGE_PLATFORMS:-linux/arm64}"
+    website_platforms="${WEBSITE_IMAGE_PLATFORMS:-linux/amd64,linux/arm64}"
     website_source_hash="$(website_source_hash)"
     website_image_ref="${registry_endpoint}/php-website:${WEBSITE_IMAGE_TAG:-$(website_image_tag "${website_source_hash}")}"
     export TF_VAR_registry_endpoint="${TF_VAR_registry_endpoint:-${registry_endpoint}}"
@@ -3124,18 +3124,6 @@ apps() {
     wait_for_namespaced_resource n8n deployment n8n n8n 300
     wait_for_deployment_ready n8n n8n n8n 300
 
-    refresh_argocd_application arr-stack
-    wait_for_namespace arr-stack arr-stack 300
-    wait_for_namespaced_resource arr-stack deployment prowlarr arr-stack 300
-    wait_for_deployment_ready arr-stack flaresolverr arr-stack 300
-    wait_for_deployment_ready arr-stack prowlarr arr-stack 300
-    wait_for_deployment_ready arr-stack radarr arr-stack 300
-    wait_for_deployment_ready arr-stack sonarr arr-stack 300
-    wait_for_deployment_ready arr-stack qbittorrent arr-stack 300
-    wait_for_deployment_ready arr-stack kapowarr arr-stack 300
-    wait_for_deployment_ready arr-stack suwayomi arr-stack 300
-    wait_for_deployment_ready arr-stack maintainerr arr-stack 300
-
     echo "Application deployment successfully completed."
 }