Deploying these docs

This documentation site (concepts/cns/docs-site/) is a static Docusaurus build — it has no server-side runtime and no dependency on a running cns-server instance. Deploy it the way you'd deploy any static site.

Build

cd docs-site
npm install
npm run build     # -> build/, a fully static site

npm run serve serves that build/ output locally for a final check before publishing.

Live deployment: S3 + CloudFront (deployed 2026-09-20)

This site is live at https://docs.cns.amphoze.com, deployed to AWS account 329599635009 (CLI profile fauzaan — the Amphoze personal account that also hosts amphoze.com, not a Katyayani account). Resources:

Resource	Value
S3 bucket	docs-cns-amphoze-com-site (ap-south-1) — private, all public access blocked, OAC-only, versioning on
CloudFront distribution	E1E5NTG0ZDVXL2 → d2rtp2wirseyet.cloudfront.net
Origin Access Control	E1I2JO86UJ0DH1
CloudFront Function	docs-cns-url-rewrite (viewer-request) — appends /index.html to extensionless URIs, since Docusaurus emits path/index.html and the S3 REST origin (required by OAC) does not resolve directory indexes
Response headers policy	23904b10-2994-4d7b-a70e-06dfcc4137a2 (amphoze-security-headers, reused from the main amphoze.com site — generic, no domain-specific CSP)
ACM certificate (us-east-1)	arn:aws:acm:us-east-1:329599635009:certificate/028f7243-f20c-434c-a9c0-b0af3871862e, DNS-validated, covers docs.cns.amphoze.com only
Custom error responses	403 and 404 both → /404.html, HTTP 404 (private-bucket OAC returns 403 for missing keys, not 404 — both must map to the same page)
DNS	dns.he.net, account login Amphoze, zone id 1314024 (amphoze.com); docs.cns.amphoze.com CNAME → d2rtp2wirseyet.cloudfront.net. Credentials: AGENTS/secrets/dns-registrars-passwords.md in the parent repo. HE.net has no REST API but accepts scripted form POSTs — see reference_henet_dns_scripted in the operator's memory.

Upload/cache tiering used:

aws s3 sync build/ s3://docs-cns-amphoze-com-site/ --delete \
  --cache-control "public,max-age=0,must-revalidate" --exclude "assets/*" --profile fauzaan
aws s3 sync build/assets/ s3://docs-cns-amphoze-com-site/assets/ \
  --cache-control "public,max-age=31536000,immutable" --profile fauzaan
aws cloudfront create-invalidation --distribution-id E1E5NTG0ZDVXL2 --paths "/*" --profile fauzaan

HTML/JSON/XML (non-hashed) get max-age=0, must-revalidate so a redeploy is visible immediately; Docusaurus's content-hashed assets/js and assets/css get a year-long immutable cache.

No CI/CD wired yet — this was a manual first deploy (S3+CloudFront+DNS only, per explicit task scope). A redeploy today means re-running the sync commands above after npm run build, then the invalidation. Wiring GitHub Actions auto-deploy is a follow-up, blocked on concepts/cns (parent repo) actually being under git — see AGENTS.md.

Cost: S3 storage (~1.6 MB, negligible) + CloudFront (PriceClass_200, free tier covers 1 TB/month and 10M requests/month at this traffic) + ACM (free). No new Route53 hosted zone was created — DNS stays on the existing he.net zone. Expect effectively $0/month at current traffic.

The subdomain (resolved 2026-09-20)

docusaurus.config.ts's url is https://docs.cns.amphoze.com — decided and live, see table above. If this ever needs to move to a different domain: update url (and baseUrl, if the site won't live at the domain's root) in docusaurus.config.ts, re-run npm run build (Docusaurus embeds url into canonical links and the sitemap), then point DNS at the new target and provision a new ACM cert for that domain (the current cert covers only docs.cns.amphoze.com, not a wildcard).

Local search works offline, no service to provision

This site's search (@easyops-cn/docusaurus-search-local) builds its index at build time and ships it as static files alongside the rest of the site — there's no external search service, API key, or additional infrastructure to run. It works identically on S3+CloudFront as it does with npm run serve locally.