From 815b2bc494d91c3340a2a8d1c6dac2235555b832 Mon Sep 17 00:00:00 2001
From: Elliot Silver <elliot.silver@resmed.com>
Date: Thu, 4 Dec 2025 10:00:02 -0800
Subject: [PATCH 1/7] remove unused files

---
 images/ig-publisher/Gemfile             |   8 -
 images/ig-publisher/Gemfile.lock        |  81 -----
 images/ig-publisher/ci-files/Dockerfile |  40 ---
 images/ig-publisher/flake.lock          |  73 -----
 images/ig-publisher/flake.nix           |  93 ------
 images/ig-publisher/gemset.nix          | 416 ------------------------
 6 files changed, 711 deletions(-)
 delete mode 100644 images/ig-publisher/Gemfile
 delete mode 100644 images/ig-publisher/Gemfile.lock
 delete mode 100644 images/ig-publisher/ci-files/Dockerfile
 delete mode 100644 images/ig-publisher/flake.lock
 delete mode 100644 images/ig-publisher/flake.nix
 delete mode 100644 images/ig-publisher/gemset.nix

diff --git a/images/ig-publisher/Gemfile b/images/ig-publisher/Gemfile
deleted file mode 100644
index 8a561d78..00000000
--- a/images/ig-publisher/Gemfile
+++ /dev/null
@@ -1,8 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'jekyll'
-gem 'kramdown'
-
-group :jekyll_plugins do
-  gem 'jekyll-asciidoc'
-end
diff --git a/images/ig-publisher/Gemfile.lock b/images/ig-publisher/Gemfile.lock
deleted file mode 100644
index a52bd151..00000000
--- a/images/ig-publisher/Gemfile.lock
+++ /dev/null
@@ -1,81 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    addressable (2.8.6)
-      public_suffix (>= 2.0.2, < 6.0)
-    asciidoctor (2.0.22)
-    colorator (1.1.0)
-    concurrent-ruby (1.2.3)
-    em-websocket (0.5.3)
-      eventmachine (>= 0.12.9)
-      http_parser.rb (~> 0)
-    eventmachine (1.2.7)
-    ffi (1.16.3)
-    forwardable-extended (2.6.0)
-    google-protobuf (4.26.1-x86_64-linux)
-      rake (>= 13)
-    http_parser.rb (0.8.0)
-    i18n (1.14.5)
-      concurrent-ruby (~> 1.0)
-    jekyll (4.3.3)
-      addressable (~> 2.4)
-      colorator (~> 1.0)
-      em-websocket (~> 0.5)
-      i18n (~> 1.0)
-      jekyll-sass-converter (>= 2.0, < 4.0)
-      jekyll-watch (~> 2.0)
-      kramdown (~> 2.3, >= 2.3.1)
-      kramdown-parser-gfm (~> 1.0)
-      liquid (~> 4.0)
-      mercenary (>= 0.3.6, < 0.5)
-      pathutil (~> 0.9)
-      rouge (>= 3.0, < 5.0)
-      safe_yaml (~> 1.0)
-      terminal-table (>= 1.8, < 4.0)
-      webrick (~> 1.7)
-    jekyll-asciidoc (3.0.1)
-      asciidoctor (>= 1.5.0, < 3.0.0)
-      jekyll (>= 3.0.0)
-    jekyll-sass-converter (3.0.0)
-      sass-embedded (~> 1.54)
-    jekyll-watch (2.2.1)
-      listen (~> 3.0)
-    kramdown (2.4.0)
-      rexml
-    kramdown-parser-gfm (1.1.0)
-      kramdown (~> 2.0)
-    liquid (4.0.4)
-    listen (3.9.0)
-      rb-fsevent (~> 0.10, >= 0.10.3)
-      rb-inotify (~> 0.9, >= 0.9.10)
-    mercenary (0.4.0)
-    pathutil (0.16.2)
-      forwardable-extended (~> 2.6)
-    public_suffix (5.0.5)
-    rake (13.2.1)
-    rb-fsevent (0.11.2)
-    rb-inotify (0.10.1)
-      ffi (~> 1.0)
-    rexml (3.2.8)
-      strscan (>= 3.0.9)
-    rouge (4.2.1)
-    safe_yaml (1.0.5)
-    sass-embedded (1.77.2)
-      google-protobuf (>= 3.25, < 5.0)
-      rake (>= 13.0.0)
-    strscan (3.1.0)
-    terminal-table (3.0.2)
-      unicode-display_width (>= 1.1.1, < 3)
-    unicode-display_width (2.5.0)
-    webrick (1.8.1)
-
-PLATFORMS
-  x86_64-linux
-
-DEPENDENCIES
-  jekyll
-  jekyll-asciidoc
-  kramdown
-
-BUNDLED WITH
-   2.3.27
diff --git a/images/ig-publisher/ci-files/Dockerfile b/images/ig-publisher/ci-files/Dockerfile
deleted file mode 100644
index 10302514..00000000
--- a/images/ig-publisher/ci-files/Dockerfile
+++ /dev/null
@@ -1,40 +0,0 @@
-FROM ghcr.io/fhir/ig-publisher-base:latest
-LABEL maintainer="Josh Mandel"
-
-RUN apt-get update && apt-get -y install python3 python3-pip python3-venv python3-requests openssl && \
-    apt-get clean
-
-ADD watch-and-publish /usr/local/bin/watch-and-publish
-ADD publish /usr/local/bin/publish
-
-RUN groupadd -r fhirgroup -g 2000 && \
-    useradd -r -u 1000 -g fhirgroup -m -d /home/fhiruser -s /sbin/nologin fhiruser && \
-    mkdir /app /var/lib/.fhir  && \
-    chown fhiruser.fhirgroup /app && \
-    chown fhiruser.fhirgroup /var/lib/.fhir && \
-    ln -s /var/lib/.fhir /home/fhiruser/.fhir
-
-USER fhiruser
-
-# Configure SSH for non-root user
-RUN mkdir -p /home/fhiruser/.ssh && \
-    printf "Host ci-build\n\
-    HostName ci-build-service.fhir.svc.cluster.local\n\
-    User fhir_upload\n\
-    StrictHostKeyChecking no\n\
-    Port 2222\n\
-    IdentityFile /etc/ci_build_keys/id\n\
-    IdentitiesOnly yes" > /home/fhiruser/.ssh/config && \
-    chmod go-wrx /home/fhiruser/.ssh/config
-
-RUN mkdir -p /app/builder
-ADD builder /app/builder
-WORKDIR /app
-
-RUN python3 -m venv venv
-
-# Activate the virtual environment and install the zulip library
-RUN /app/venv/bin/pip install --upgrade pip && \
-    /app/venv/bin/pip install zulip
-
-ENTRYPOINT python3 -m builder.builder || touch /scratch/done
diff --git a/images/ig-publisher/flake.lock b/images/ig-publisher/flake.lock
deleted file mode 100644
index 82581fdd..00000000
--- a/images/ig-publisher/flake.lock
+++ /dev/null
@@ -1,73 +0,0 @@
-{
-  "nodes": {
-    "fhirPublisherJarFile": {
-      "flake": false,
-      "locked": {
-        "narHash": "sha256-YBhem06I/xG+CqN85Qmh2bY4i3ijRI5JV3Y7IeqcPxY=",
-        "type": "file",
-        "url": "https://github.com/HL7/fhir-ig-publisher/releases/download/1.6.7/publisher.jar"
-      },
-      "original": {
-        "type": "file",
-        "url": "https://github.com/HL7/fhir-ig-publisher/releases/download/1.6.7/publisher.jar"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1715787315,
-        "narHash": "sha256-cYApT0NXJfqBkKcci7D9Kr4CBYZKOQKDYA23q8XNuWg=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "33d1e753c82ffc557b4a585c77de43d4c922ebb5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1678875422,
-        "narHash": "sha256-T3o6NcQPwXjxJMn2shz86Chch4ljXgZn746c2caGxd8=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "126f49a01de5b7e35a43fd43f891ecf6d3a51459",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
-      }
-    },
-    "root": {
-      "inputs": {
-        "fhirPublisherJarFile": "fhirPublisherJarFile",
-        "nixpkgs": "nixpkgs",
-        "ruby-nix": "ruby-nix"
-      }
-    },
-    "ruby-nix": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1714484206,
-        "narHash": "sha256-oZc9WkCeqfgrwqDAxrUPMi+E88rBSGoGOcho9QI279Q=",
-        "owner": "inscapist",
-        "repo": "ruby-nix",
-        "rev": "7a8ec4a1d67a777c7280362ad88e72048c258962",
-        "type": "github"
-      },
-      "original": {
-        "owner": "inscapist",
-        "repo": "ruby-nix",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/images/ig-publisher/flake.nix b/images/ig-publisher/flake.nix
deleted file mode 100644
index 3ce8608d..00000000
--- a/images/ig-publisher/flake.nix
+++ /dev/null
@@ -1,93 +0,0 @@
-{
-  description = "Docker image with Java, Ruby, Jekyll, Node, and npm";
-
-  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    ruby-nix.url = "github:inscapist/ruby-nix";
-    fhirPublisherJarFile = {
-      url = "https://github.com/HL7/fhir-ig-publisher/releases/download/1.6.7/publisher.jar";
-      flake = false;
-    };
-  };
-
-  outputs = { self, nixpkgs, ruby-nix, fhirPublisherJarFile }:
-    let
-      pkgs = import nixpkgs {
-        system =  "x86_64-linux";
-      };
-      alpine = pkgs.dockerTools.pullImage {
-        imageName = "alpine";
-        imageDigest = "sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b";
-        sha256 = "1sqv78kskab3f9cby9njlr67g1pnm748msza2nf61wbnnf98dyjz";
-        finalImageName = "alpine";
-        finalImageTag = "latest";
-      };
-      rubyNix = ruby-nix.lib pkgs;
-    in
-    rec {
-      inherit
-          (rubyNix {
-            gemset = import ./gemset.nix;
-            ruby = pkgs.ruby;
-            name = "jekyll-with-asciidoc";
-            gemConfig = pkgs.defaultGemConfig;
-          })
-          env
-          ;
-      packages.x86_64-linux.default = pkgs.dockerTools.buildImage {
-        name = "ghcr.io/fhir/ig-publisher-localdev-nix";
-        tag = "latest";
-        fromImage = alpine;
-        copyToRoot = pkgs.buildEnv {
-          name = "image-root";
-          paths = [ env ] ++ (with pkgs; [
-            shadow
-            curl
-            wget
-            jq
-            bash
-            bashInteractive
-            jdk
-            readline
-            ncurses
-            nodejs
-            nodePackages.npm
-            git
-            graphviz
-            openssl
-            (pkgs.runCommand "copy-files" {} ''
-              mkdir -p $out/usr/local/bin
-              cp ${./localdev-files/docker-entrypoint.sh} $out/usr/local/bin/docker-entrypoint.sh
-              mkdir -p $out/app/lib
-              cp ${fhirPublisherJarFile} $out/app/lib/publisher.jar
-            '')
-          ]);
-        };
-        config = {
-          Entrypoint = [ "/usr/local/bin/docker-entrypoint.sh" ];
-          Cmd = [ "bash" ];
-          WorkingDir = "/home/publisher/ig";
-          Env = [
-            "PATH=/usr/local/bin:/usr/bin:/bin:/home/publisher/bin:/home/publisher/bin/ig-publisher-scripts:/home/publisher/.node/bin"
-          ];
-          User = "publisher";
-          ExposedPorts = {
-            "4000/tcp" = {};
-          };
-        };
-
-        runAsRoot = ''
-          useradd -d /home/publisher -m publisher
-          chown -R publisher:publisher /home/publisher
-          su - publisher -c '
-            mkdir /home/publisher/ig
-            mkdir /home/publisher/.node
-            echo "prefix = /home/publisher/.node" > /home/publisher/.npmrc
-            mkdir /home/publisher/bin
-            git config --global pull.ff only
-          '
-        '';
-
-      };
-    };
-}
diff --git a/images/ig-publisher/gemset.nix b/images/ig-publisher/gemset.nix
deleted file mode 100644
index f5b7fa08..00000000
--- a/images/ig-publisher/gemset.nix
+++ /dev/null
@@ -1,416 +0,0 @@
-{
-  addressable = {
-    dependencies = ["public_suffix"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0irbdwkkjwzajq1ip6ba46q49sxnrl2cw7ddkdhsfhb6aprnm3vr";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "2.8.6";
-  };
-  asciidoctor = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1mnan6dxw4aqii9kcmp1s3sc91jiwaqkdpsg6g01fdisb6xz3n56";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "2.0.22";
-  };
-  colorator = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0f7wvpam948cglrciyqd798gdc6z3cfijciavd0dfixgaypmvy72";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.1.0";
-  };
-  concurrent-ruby = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1qh1b14jwbbj242klkyz5fc7npd4j0mvndz62gajhvl1l3wd7zc2";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.2.3";
-  };
-  em-websocket = {
-    dependencies = ["eventmachine" "http_parser.rb"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1a66b0kjk6jx7pai9gc7i27zd0a128gy73nmas98gjz6wjyr4spm";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "0.5.3";
-  };
-  eventmachine = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0wh9aqb0skz80fhfn66lbpr4f86ya2z5rx6gm5xlfhd05bj1ch4r";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.2.7";
-  };
-  ffi = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1yvii03hcgqj30maavddqamqy50h7y6xcn2wcyq72wn823zl4ckd";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.16.3";
-  };
-  forwardable-extended = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "15zcqfxfvsnprwm8agia85x64vjzr2w0xn9vxfnxzgcv8s699v0v";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "2.6.0";
-  };
-  google-protobuf = {
-    dependencies = ["rake"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = null;
-    targets = [{
-      remotes = ["https://rubygems.org"];
-      sha256 = "1pfnr2n0s9dzrsq4ii4mrrbka58llwqj0bd00fhizixvnlbzs6fh";
-      target = "x86_64-linux";
-      targetCPU = "x86_64";
-      targetOS = "linux";
-      type = "gem";
-    }];
-    version = "4.26.1";
-  };
-  "http_parser.rb" = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1gj4fmls0mf52dlr928gaq0c0cb0m3aqa9kaa6l0ikl2zbqk42as";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "0.8.0";
-  };
-  i18n = {
-    dependencies = ["concurrent-ruby"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ffix518y7976qih9k1lgnc17i3v6yrlh0a3mckpxdb4wc2vrp16";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.14.5";
-  };
-  jekyll = {
-    dependencies = ["addressable" "colorator" "em-websocket" "i18n" "jekyll-sass-converter" "jekyll-watch" "kramdown" "kramdown-parser-gfm" "liquid" "mercenary" "pathutil" "rouge" "safe_yaml" "terminal-table" "webrick"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0638cvpmk3py1w2dxpav6l0c854y6l94b6gyc2aa16i7r897z64a";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "4.3.3";
-  };
-  jekyll-asciidoc = {
-    dependencies = ["asciidoctor" "jekyll"];
-    groups = ["jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mpjgwswyxlxqazv3nsafajxhn6b5mqa2kfnzjr6r1hqg7dgn0mh";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "3.0.1";
-  };
-  jekyll-sass-converter = {
-    dependencies = ["sass-embedded"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "00n9v19h0qgjijygfdkdh2gwpmdlz49nw1mqk6fnp43f317ngrz2";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "3.0.0";
-  };
-  jekyll-watch = {
-    dependencies = ["listen"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1qd7hy1kl87fl7l0frw5qbn22x7ayfzlv9a5ca1m59g0ym1ysi5w";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "2.2.1";
-  };
-  kramdown = {
-    dependencies = ["rexml"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ic14hdcqxn821dvzki99zhmcy130yhv5fqfffkcf87asv5mnbmn";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "2.4.0";
-  };
-  kramdown-parser-gfm = {
-    dependencies = ["kramdown"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0a8pb3v951f4x7h968rqfsa19c8arz21zw1vaj42jza22rap8fgv";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.1.0";
-  };
-  liquid = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1czxv2i1gv3k7hxnrgfjb0z8khz74l4pmfwd70c7kr25l2qypksg";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "4.0.4";
-  };
-  listen = {
-    dependencies = ["rb-fsevent" "rb-inotify"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rwwsmvq79qwzl6324yc53py02kbrcww35si720490z5w0j497nv";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "3.9.0";
-  };
-  mercenary = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0f2i827w4lmsizrxixsrv2ssa3gk1b7lmqh8brk8ijmdb551wnmj";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "0.4.0";
-  };
-  pathutil = {
-    dependencies = ["forwardable-extended"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "12fm93ljw9fbxmv2krki5k5wkvr7560qy8p4spvb9jiiaqv78fz4";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "0.16.2";
-  };
-  public_suffix = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "14y4vzjwf5gp0mqgs880kis0k7n2biq8i6ci6q2n315kichl1hvj";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "5.0.5";
-  };
-  rake = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "13.2.1";
-  };
-  rb-fsevent = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1zmf31rnpm8553lqwibvv3kkx0v7majm1f341xbxc0bk5sbhp423";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "0.11.2";
-  };
-  rb-inotify = {
-    dependencies = ["ffi"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1jm76h8f8hji38z3ggf4bzi8vps6p7sagxn3ab57qc0xyga64005";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "0.10.1";
-  };
-  rexml = {
-    dependencies = ["strscan"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0d8ivcirrrxpkpjc1c835wknc9s2fl54xpw08s177yfrh5ish209";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "3.2.8";
-  };
-  rouge = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1zd1pdldi6h8x27dqim7cy8m69xr01aw5c8k1zhkz497n4np6wgk";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "4.2.1";
-  };
-  safe_yaml = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0j7qv63p0vqcd838i2iy2f76c3dgwzkiz1d1xkg7n0pbnxj2vb56";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.0.5";
-  };
-  sass-embedded = {
-    dependencies = ["google-protobuf" "rake"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0h96x0z11hrdqg8hjbgr5sy17nga3dv98jqycwp1s02xlpw23r2z";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.77.2";
-  };
-  strscan = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0mamrl7pxacbc79ny5hzmakc9grbjysm3yy6119ppgsg44fsif01";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "3.1.0";
-  };
-  terminal-table = {
-    dependencies = ["unicode-display_width"];
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "14dfmfjppmng5hwj7c5ka6qdapawm3h6k9lhn8zj001ybypvclgr";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "3.0.2";
-  };
-  unicode-display_width = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1d0azx233nags5jx3fqyr23qa2rhgzbhv8pxp46dgbg1mpf82xky";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "2.5.0";
-  };
-  webrick = {
-    groups = ["default" "jekyll_plugins"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "13qm7s0gr2pmfcl7dxrmq38asaza4w0i2n9my4yzs499j731wh8r";
-      target = "ruby";
-      type = "gem";
-    };
-    targets = [];
-    version = "1.8.1";
-  };
-}
\ No newline at end of file

From 06b856668c823804bf414fd2d49dca1f481f0433 Mon Sep 17 00:00:00 2001
From: Elliot Silver <elliot.silver@resmed.com>
Date: Thu, 4 Dec 2025 10:01:38 -0800
Subject: [PATCH 2/7] handle empty build history, remove hostname dependencies

---
 dashboard/builds.html         | 41 ++++++++++++++++++++++++-----------
 images/ig-publisher/README.md |  3 +--
 k8s/Caddyfile                 |  5 +++--
 3 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/dashboard/builds.html b/dashboard/builds.html
index 0e3e1544..09200183 100644
--- a/dashboard/builds.html
+++ b/dashboard/builds.html
@@ -21,7 +21,7 @@ <h2>FHIR IG Builds</h2>
   </div>
   </body>
   <script>
-	  
+
     function quoteattr(s) { // from https://stackoverflow.com/a/9756789/318206
       return ('' + s) /* Forces the conversion to string. */
         .replace(/&/g, '&amp;') /* This MUST be the 1st replacement. */
@@ -40,14 +40,16 @@ <h2>FHIR IG Builds</h2>
     timeFormatter = timeago(),
     buildsTable = document.getElementById("builds");
 
-    fetch("https://build.fhir.org/ig/builds.json")
-      .then(r => r.json())
+    fetch("/ig/builds.json")
+      .then(r => r.ok ? r.json() : [])
+      .catch(() => [])
       .then(renderBranches)
       .then(fetchBuilds)
       .then(renderBuilds);
 
-    fetch("https://build.fhir.org/ig/qas.json")
-      .then(r => r.json())
+    fetch("/ig/qas.json")
+      .then(r => r.ok ? r.json() : [])
+      .catch(() => [])
       .then(r => r.map(qa => {
         qa.date = new Date(qa.date)
         qa.master = /\/master\//.test(qa.repo)
@@ -58,6 +60,9 @@ <h2>FHIR IG Builds</h2>
       .then(renderQas);
 
     function renderBranches(builds) {
+      if (!builds || !Array.isArray(builds)) {
+        builds = [];
+      }
       state.branches = parseBranches(builds);
       render(state);
       return builds;
@@ -65,6 +70,9 @@ <h2>FHIR IG Builds</h2>
 
 
     function renderBuilds(builds) {
+      if (!builds || !Array.isArray(builds)) {
+        builds = [];
+      }
       state.builds = builds;
       render(state);
     }
@@ -94,10 +102,13 @@ <h2>FHIR IG Builds</h2>
 
 
     function parseBranches(builds) {
+      if (!builds || !Array.isArray(builds)) {
+        return {};
+      }
       const grouped = _.groupBy(builds.map(entry =>{
         const splitEntry = entry.split('/');
         const failure = splitEntry.includes('failure');
-        
+
         return {
           org: splitEntry[0],
           repo: splitEntry[1],
@@ -131,7 +142,9 @@ <h2>FHIR IG Builds</h2>
        return Promise.all(builds
        .filter(repo => /\/master|main\//.test(repo))
        .map(repo =>
-        fetchPool("https://build.fhir.org/ig/"+repo.replace("#", "%23")).then(b => b.text())
+        fetchPool("/ig/"+repo.replace("#", "%23"))
+        .then(b => b.ok ? b.text() : "")
+        .catch(() => "")
         .then(b => {
           var date = b.match(/Coordinated Universal Time \((.*?)\)/),
               version = b.match(/Definitions (\S+)/);
@@ -153,8 +166,10 @@ <h2>FHIR IG Builds</h2>
     }
 
     function renderQas(qas) {
-      state.qas = qas
-;
+      if (!qas || !Array.isArray(qas)) {
+        qas = [];
+      }
+      state.qas = qas;
       render(state);
     }
 
@@ -176,7 +191,7 @@ <h2>FHIR IG Builds</h2>
       })
     }
 
- 
+
   function render({builds, qas}){
     const sorter = (a, b) => {
       if (a.repo < b.repo) {
@@ -245,7 +260,7 @@ <h2>FHIR IG Builds</h2>
         <th>links</th>
       </thead><tr>` + rows.map(({org, repo, date, version, success, debug, choices}) =>
         `<td>
-        <a target="_blank" href="https://build.fhir.org/ig/${org}/${repo}" data-toggle="tooltip" title='${quoteattr(JSON.stringify(debug, null, 2))}'>
+        <a target="_blank" href="/ig/${org}/${repo}" data-toggle="tooltip" title='${quoteattr(JSON.stringify(debug, null, 2))}'>
         ${org} / <strong>${repo}</strong></a>
         </td>
         <td>${version}</td>
@@ -261,9 +276,9 @@ <h2>FHIR IG Builds</h2>
         ${choices.map(branch => `<a id="branch-${branchnum}" class="dropdown-item" onClick="rebuild(${branchnum++}, '${org}', '${repo}', '${branch.name}')">${branch.name + (branch.failing ? " [failing]" : "")}</a>`).join(`\n`)}
         </div>
       </div>
-        <a target="_blank" class="btn btn-primary btn-sm" href="https://build.fhir.org/ig/${org}/${repo}/branches/__default/${success ? "" : "failure/"}build.log">log</a>
+        <a target="_blank" class="btn btn-primary btn-sm" href="/ig/${org}/${repo}/branches/__default/${success ? "" : "failure/"}build.log">log</a>
         <a target="_blank" class="btn btn-primary btn-sm" href="https://github.com/${org}/${repo}">gh</a>
-        <a target="_blank" class="btn btn-primary btn-sm" href="https://build.fhir.org/ig/${org}/${repo}/branches/__default/${success ? "" : "failure/output/"}qa.html">qa</a>
+        <a target="_blank" class="btn btn-primary btn-sm" href="/ig/${org}/${repo}/branches/__default/${success ? "" : "failure/output/"}qa.html">qa</a>
         </td>`
     ).join(`</tr><tr>`)
 
diff --git a/images/ig-publisher/README.md b/images/ig-publisher/README.md
index cf1ede87..eb716077 100644
--- a/images/ig-publisher/README.md
+++ b/images/ig-publisher/README.md
@@ -49,10 +49,9 @@ docker build --target ci -t ghcr.io/fhir/ig-publisher-ci .
 ### Multiplatform build
 
 ```sh
-docker buildx build   --platform linux/arm64,linux/amd64 .
+docker buildx build --platform linux/arm64,linux/amd64 .
 ```
 
-
 ### Usage
 
 #### Local Development
diff --git a/k8s/Caddyfile b/k8s/Caddyfile
index f8e71bef..ee098cb3 100644
--- a/k8s/Caddyfile
+++ b/k8s/Caddyfile
@@ -3,10 +3,11 @@
 	order rate_limit before file_server
 }
 (tryall) {
-	try_files {args.0} {args.0}{fextension} {args.0}index.html
+	try_files {args[0]} {args[0]}{fextension} {args[0]}index.html
 }
 
-build.fhir.org:80, build.fhir.org {
+# Listen on all interfaces and domains with HTTPS
+:80, :443 {
 	log {
 		output stdout
 		level info

From c25fe42f1ea259f434de029b824d641ef3deb05e Mon Sep 17 00:00:00 2001
From: Elliot Silver <elliot@argentixinfo.com>
Date: Fri, 5 Dec 2025 15:20:50 -0800
Subject: [PATCH 3/7] support branch names with "/' in them (may be incomplete;
 e.g. check dashboard)

---
 images/ci-build/publish-ig                    | 21 +++++++++++++------
 .../ig-publisher/ci-files/builder/builder.py  | 13 ++++++++----
 2 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/images/ci-build/publish-ig b/images/ci-build/publish-ig
index 32844d42..23bb4fd7 100755
--- a/images/ci-build/publish-ig
+++ b/images/ci-build/publish-ig
@@ -7,6 +7,10 @@ function finish_upload_keepalive {
 }
 trap finish_upload_keepalive EXIT
 
+# Replace forward slashes with underscores for safe use in file paths
+function encode_branch_name {
+    echo "$1" | sed 's/\//\_/g'
+}
 
 IG_ORG=$1
 IG_REPO=$2
@@ -14,6 +18,11 @@ DEPLOY_TO_BRANCH=${3:-master}
 FAILURE_FLAG=${4:-success}
 IS_DEFAUT_BRANCH=${5:-nondefault}
 
+# Encode the branch name for safe file path usage
+DEPLOY_TO_BRANCH_ENCODED=$(encode_branch_name "$DEPLOY_TO_BRANCH")
+
+echo "DEBUG: Received arguments: ORG=$IG_ORG REPO=$IG_REPO BRANCH=$DEPLOY_TO_BRANCH BRANCH_ENCODED=$DEPLOY_TO_BRANCH_ENCODED FAILURE=$FAILURE_FLAG DEFAULT=$IS_DEFAUT_BRANCH" >&2
+
 TARGET="${RANDOM}_${IG_ORG}_${IG_REPO}"
 
 mkdir -p ~/uploading/$TARGET
@@ -24,19 +33,19 @@ KEEPALIVE_PID=$!
 tar xzf - && date --iso-8601 > ~/uploading/$TARGET/done.txt || false
 
 if [ "$FAILURE_FLAG" == "failure" ]; then
-    mkdir -p ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH
-    rm -rf ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH/failure || true
-    mv ~/uploading/$TARGET/ ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH/failure
+    mkdir -p ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH_ENCODED
+    rm -rf ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH_ENCODED/failure || true
+    mv ~/uploading/$TARGET/ ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH_ENCODED/failure
 else
-    mv ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH ~/uploading/branch.$TARGET.old  || true
+    mv ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH_ENCODED ~/uploading/branch.$TARGET.old  || true
     mkdir -p ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/
-    mv ~/uploading/$TARGET/ ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH
+    mv ~/uploading/$TARGET/ ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/$DEPLOY_TO_BRANCH_ENCODED
     rm -rf ~/uploading/branch.$TARGET.old || true
 fi
 
 if [ "$IS_DEFAUT_BRANCH" == "default" ]; then
     rm -f ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/__default
-    ln -s ./$DEPLOY_TO_BRANCH ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/__default
+    ln -s ./$DEPLOY_TO_BRANCH_ENCODED ~/uploading/www/ig/$IG_ORG/$IG_REPO/branches/__default
 fi
 
 set +e
diff --git a/images/ig-publisher/ci-files/builder/builder.py b/images/ig-publisher/ci-files/builder/builder.py
index 08a483f4..abb029be 100644
--- a/images/ig-publisher/ci-files/builder/builder.py
+++ b/images/ig-publisher/ci-files/builder/builder.py
@@ -12,6 +12,10 @@
 PUBLISHER_JAR_URL = os.environ.get('PUBLISHER_JAR_URL', 'https://github.com/HL7/fhir-ig-publisher/releases/latest/download/publisher.jar')
 TX_SERVER_URL = os.environ.get('TX_SERVER_URL', 'http://tx.fhir.org')
 
+def encode_branch_name(branch):
+    """Replace forward slashes with underscores for safe use in file paths"""
+    return branch.replace('/', '_')
+
 temp_dir = SCRATCH_SPACE
 clone_dir = os.path.join(temp_dir, 'repo')
 build_dir = os.path.join(clone_dir, 'output')
@@ -89,6 +93,7 @@ def early_failure(msg):
     'org': config['org'],
     'repo': config['repo'],
     'branch': config['branch'],
+    'branch_encoded': encode_branch_name(config['branch']),
     'default': 'default' if is_default_branch() else 'nondefault',
     'commit': run_git_cmd(['git', 'log', '-1', '--pretty=%B (%an)'])
   }
@@ -110,13 +115,13 @@ def early_failure(msg):
 
   message = [message_header + "rebuilt\n",
              "Commit: {commit} :{emoji}:\n",
-             "Details: [build logs]({root}/{org}/{repo}/branches/{branch}/{buildlog})"]
+             "Details: [build logs]({root}/{org}/{repo}/branches/{branch_encoded}/{buildlog})"]
   print("finalizing")
   if not built:
     print("Build error occurred")
     details['emoji'] = 'thumbs_down'
     details['buildlog'] = 'failure/build.log'
-    message += [" | [debug]({root}/{org}/{repo}/branches/{branch}/failure)"]
+    message += [" | [debug]({root}/{org}/{repo}/branches/{branch_encoded}/failure)"]
     return {
       "result_dir": clone_dir,
       "message":"".join(message).format(**details),
@@ -128,8 +133,8 @@ def early_failure(msg):
     print("Build succeeded")
     details['emoji'] = 'thumbs_up'
     details['buildlog'] = 'build.log'
-    message += [" | [published]({root}/{org}/{repo}/branches/{branch}/index.html)"]
-    message += [f" | [qa: {get_qa_score(build_dir)}]", "({root}/{org}/{repo}/branches/{branch}/qa.html)"]
+    message += [" | [published]({root}/{org}/{repo}/branches/{branch_encoded}/index.html)"]
+    message += [f" | [qa: {get_qa_score(build_dir)}]", "({root}/{org}/{repo}/branches/{branch_encoded}/qa.html)"]
     return {
       "result_dir": build_dir,
       "message":"".join(message).format(**details),

From a81dd701a0c16ed44021765b0410ecb019b9050f Mon Sep 17 00:00:00 2001
From: Elliot Silver <elliot@argentixinfo.com>
Date: Fri, 5 Dec 2025 15:26:28 -0800
Subject: [PATCH 4/7] get ci site from configuration

---
 images/ig-publisher/ci-files/builder/builder.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/images/ig-publisher/ci-files/builder/builder.py b/images/ig-publisher/ci-files/builder/builder.py
index abb029be..49e29615 100644
--- a/images/ig-publisher/ci-files/builder/builder.py
+++ b/images/ig-publisher/ci-files/builder/builder.py
@@ -66,7 +66,7 @@ def is_default_branch():
   cloned_exit = do(['git', 'clone', '--recursive', GITHUB%config, '--branch', config['branch'], 'repo'], temp_dir, deadline=True)
   os.makedirs(clone_dir, exist_ok=True)
 
-  message_header = "**[{org}/{repo}: {branch}](https://github.com/{org}/{repo}/tree/{branch})** ".format(**config)
+  message_header = "**[{org}/{repo}: {branch}]({root}/{org}/{repo}/tree/{branch})** ".format(**config)
 
   def early_failure(msg):
     config["msg"] = msg
@@ -108,7 +108,7 @@ def early_failure(msg):
          '-fhir-settings', '/etc/fhir-settings.json',
          '-auto-ig-build',
          '-tx', TX_SERVER_URL,
-         '-target', 'https://build.fhir.org/ig/{org}/{repo}/'.format(**details),
+         '-target', '{root}/{org}/{repo}/'.format(**details),
          '-out', clone_dir], clone_dir, deadline=True)
 
   built = (0 == built_exit)
@@ -146,6 +146,7 @@ def early_failure(msg):
     'org': os.environ.get('IG_ORG', 'test-igs'),
     'repo': os.environ.get('IG_REPO', 'simple'),
     'branch': os.environ.get('IG_BRANCH', 'master'),
+    'root': os.environ.get('HOSTED_ROOT', 'https://build.fhir.org/ig')
   })
   print("results")
   print(results)

From 4bddc966b49d70ba025217fdf23dd1fa2615ea92 Mon Sep 17 00:00:00 2001
From: Elliot Silver <elliot@argentixinfo.com>
Date: Fri, 5 Dec 2025 15:29:25 -0800
Subject: [PATCH 5/7] support repo needing authentication, additional tracing
 messages

---
 .../ig-publisher/ci-files/builder/builder.py  | 34 +++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/images/ig-publisher/ci-files/builder/builder.py b/images/ig-publisher/ci-files/builder/builder.py
index 49e29615..1ce28433 100644
--- a/images/ig-publisher/ci-files/builder/builder.py
+++ b/images/ig-publisher/ci-files/builder/builder.py
@@ -3,6 +3,7 @@
 import shutil
 import string
 import subprocess
+import urllib.parse
 
 from .util  import do, SCRATCH_SPACE
 from os.path import normpath
@@ -12,6 +13,20 @@
 PUBLISHER_JAR_URL = os.environ.get('PUBLISHER_JAR_URL', 'https://github.com/HL7/fhir-ig-publisher/releases/latest/download/publisher.jar')
 TX_SERVER_URL = os.environ.get('TX_SERVER_URL', 'http://tx.fhir.org')
 
+# Get Git credentials from environment
+GIT_USERNAME = os.environ.get('GIT_USERNAME')
+GIT_PASSWORD = os.environ.get('GIT_PASSWORD')
+
+def get_authenticated_url(config):
+    """Build authenticated Git URL if credentials are available"""
+    if GIT_USERNAME and GIT_PASSWORD:
+        # URL encode the credentials to handle special characters
+        username = urllib.parse.quote(GIT_USERNAME, safe='')
+        password = urllib.parse.quote(GIT_PASSWORD, safe='')
+        return f'https://{username}:{password}@github.com/{config["org"]}/{config["repo"]}'
+    else:
+        return GITHUB % config
+
 def encode_branch_name(branch):
     """Replace forward slashes with underscores for safe use in file paths"""
     return branch.replace('/', '_')
@@ -55,6 +70,8 @@ def build(config):
   logging.basicConfig(filename=logfile, level=logging.DEBUG)
   logging.info('about to clone!')
 
+  print(f"Starting build for {config['org']}/{config['repo']}:{config['branch']}")
+
   def run_git_cmd(cmds):
     return subprocess.check_output(cmds, cwd=clone_dir, universal_newlines=True).strip()
 
@@ -63,21 +80,34 @@ def is_default_branch():
     default_branch = default_branch_full.split('/')[-1]
     return bool(default_branch == config['branch'])
 
-  cloned_exit = do(['git', 'clone', '--recursive', GITHUB%config, '--branch', config['branch'], 'repo'], temp_dir, deadline=True)
+  print("Executing git clone...")
+  cloned_exit = do(['git', 'clone', '--recursive', get_authenticated_url(config), '--branch', config['branch'], 'repo'], temp_dir, deadline=True)
+  print(f"Git clone completed with exit code: {cloned_exit}")
   os.makedirs(clone_dir, exist_ok=True)
 
   message_header = "**[{org}/{repo}: {branch}]({root}/{org}/{repo}/tree/{branch})** ".format(**config)
 
   def early_failure(msg):
     config["msg"] = msg
+    print(f"Early failure: {msg}")
     return {
       "result_dir": clone_dir,
       "message": message_header + msg,
       "pubargs": ['failure', 'nondefault']
     }
 
-  if cloned_exit != 0:
+  # Check if clone actually succeeded by looking for repository content
+  repo_has_content = os.path.exists(clone_dir) and os.path.exists(os.path.join(clone_dir, '.git'))
+  print(f"Repository directory exists: {os.path.exists(clone_dir)}")
+  print(f"Repository has .git directory: {repo_has_content}")
+
+  if cloned_exit != 0 and not repo_has_content:
+    print(f"Clone failed - exit code {cloned_exit} and no repository content found")
     return early_failure("Failed to clone git repository")
+  elif cloned_exit != 0 and repo_has_content:
+    print(f"Clone succeeded despite non-zero exit code {cloned_exit} - continuing...")
+  else:
+    print("Clone succeeded normally")
 
   dl_publisher_exit = do(['wget', '-q', PUBLISHER_JAR_URL, '-O', 'publisher.jar'], temp_dir, deadline=True)
   if dl_publisher_exit != 0:

From f2e1b3c20916024ccfb2890c46704ed05aef6f60 Mon Sep 17 00:00:00 2001
From: Elliot Silver <elliot@argentixinfo.com>
Date: Fri, 5 Dec 2025 15:31:07 -0800
Subject: [PATCH 6/7] quote publication parameters in case they include a
 space; additional logging

---
 images/ig-publisher/ci-files/publish | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/images/ig-publisher/ci-files/publish b/images/ig-publisher/ci-files/publish
index c55375ec..6bca5b75 100755
--- a/images/ig-publisher/ci-files/publish
+++ b/images/ig-publisher/ci-files/publish
@@ -1,3 +1,4 @@
 #!/bin/bash
-echo "Publish $@ to CI build from $(pwd)"
-tar czf - * | ssh ci-build ./publish-ig $@
+echo "Publish $@ to CI build from $(pwd)" >&2
+echo "Publish args: ORG=$1 REPO=$2 BRANCH=$3 ARGS=$4 $5" >&2
+tar czf - * | ssh ci-build ./publish-ig "$@"

From 76d8971f3ffafd065b5323fdf79920897ab5d360 Mon Sep 17 00:00:00 2001
From: Elliot Silver <elliot@argentixinfo.com>
Date: Fri, 5 Dec 2025 16:19:23 -0800
Subject: [PATCH 7/7] support building for different environments

---
 k8s/README.md                         | 556 ++++++++++++++++++++++++++
 k8s/build-images.sh                   | 212 ++++++++++
 k8s/ci-build.deployment.template.yaml |  65 +++
 k8s/ci-build.deployment.yaml          |   8 +
 k8s/create.sh                         |  32 +-
 k8s/dev-setup.md                      | 369 +++++++++++++++--
 k8s/docker-desktop-volumes.yaml       |  62 +++
 k8s/kind-config.yaml                  |  28 ++
 k8s/kubeadm-examples.yaml             |  74 ++++
 k8s/kubeadm-persistent-volumes.yaml   |  72 ++++
 k8s/persistent-volumes.template.yaml  |  23 ++
 k8s/setup-k3s.sh                      | 175 ++++++++
 k8s/setup-kind.sh                     | 140 +++++++
 k8s/setup-kubeadm.sh                  | 258 ++++++++++++
 k8s/setup-minikube.sh                 | 146 +++++++
 k8s/setup.sh                          | 325 +++++++++++++++
 16 files changed, 2486 insertions(+), 59 deletions(-)
 create mode 100644 k8s/README.md
 create mode 100755 k8s/build-images.sh
 create mode 100644 k8s/ci-build.deployment.template.yaml
 mode change 100644 => 100755 k8s/create.sh
 create mode 100644 k8s/docker-desktop-volumes.yaml
 create mode 100644 k8s/kind-config.yaml
 create mode 100644 k8s/kubeadm-examples.yaml
 create mode 100644 k8s/kubeadm-persistent-volumes.yaml
 create mode 100644 k8s/persistent-volumes.template.yaml
 create mode 100755 k8s/setup-k3s.sh
 create mode 100755 k8s/setup-kind.sh
 create mode 100755 k8s/setup-kubeadm.sh
 create mode 100755 k8s/setup-minikube.sh
 create mode 100755 k8s/setup.sh

diff --git a/k8s/README.md b/k8s/README.md
new file mode 100644
index 00000000..a4138306
--- /dev/null
+++ b/k8s/README.md
@@ -0,0 +1,556 @@
+# FHIR IG Builder - Unified Kubernetes Setup
+
+This setup supports both local development and production GCloud deployments with a single set of configuration files and scripts.
+
+## Quick Start
+
+### GCloud Production (Default)
+```bash
+cd k8s
+./setup.sh
+./build-images.sh
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+```
+
+### Local Development (Recommended - Choose Your Cluster Type)
+
+```bash
+cd k8s
+
+# Choose one cluster setup method:
+./setup-minikube.sh    # minikube
+# OR
+./setup-kind.sh        # KIND
+# OR  
+./setup-k3s.sh         # k3s
+# OR
+./setup-kubeadm.sh     # existing kubeadm cluster
+
+# Then follow unified setup process (same for all):
+./setup.sh --type [minikube|kind|k3s|kubeadm]
+./build-images.sh --type [minikube|kind|k3s|kubeadm]
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+```
+
+### Local Development (Manual)
+
+```bash
+cd k8s
+./setup.sh --type local
+./build-images.sh --type local --push false
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+```
+
+## Scripts Overview
+
+| Script | Purpose | Status |
+|--------|---------|---------|
+| `setup.sh` | **PRIMARY** - Unified setup for all deployment types (local, minikube, kind, k3s, kubeadm, gcloud) - **Run BEFORE build-images.sh** | ✅ Active |
+| `build-images.sh` | **PRIMARY** - Build and push Docker images with deployment-specific configurations - **Run AFTER setup.sh** | ✅ Active |
+| `setup-minikube.sh` | **minikube** - Start minikube cluster for unified setup process | ✅ Active |
+| `setup-kind.sh` | **KIND** - Create KIND cluster for unified setup process | ✅ Active |
+| `setup-k3s.sh` | **k3s** - Start k3s cluster for unified setup process | ✅ Active |
+| `setup-kubeadm.sh` | **kubeadm** - Prepare existing kubeadm cluster for unified setup process | ✅ Active |
+| `create.sh` | Redirect to `setup.sh --type gcloud` | ⚠️ Deprecated |
+
+## Configuration Files
+
+| File | Purpose |
+|------|---------|
+| `ci-build.deployment.template.yaml` | Template for deployment generation |
+| `../mount/ci-build.deployment.generated.yaml` | Generated deployment (created by setup.sh) |
+| `persistent-volumes.template.yaml` | Template for local persistent volumes |
+| `../mount/kubeadm-persistent-volumes.yaml` | kubeadm-specific persistent volumes (generated by setup-kubeadm.sh) |
+| `../mount/kubeadm-node-selector.yaml` | kubeadm node selector configuration (generated by setup-kubeadm.sh) |
+| `kubeadm-examples.yaml` | Example configurations for kubeadm storage provisioners and ingress |
+| `ci-build.configmap.yaml` | ConfigMap for CI build configuration |
+| `ci-build.service.yaml` | Service definition |
+| `kind-config.yaml` | Configuration for kind clusters |
+
+## Migration from Old Setup
+
+The setup has been unified into two primary scripts. The old scripts now redirect to the new ones:
+
+```bash
+# Old way → New way (still works)
+./create.sh          →  ./setup.sh --type gcloud
+```
+
+**Recommendation**: Update your scripts to use `./setup.sh` directly as the deprecated scripts will be removed in a future release.
+
+**Important**: Always run `./setup.sh` before `./build-images.sh` - the build script depends on configuration files created by setup.
+
+## Environment Variables
+
+Both scripts support these environment variables:
+
+- `DEPLOYMENT_TYPE`: `minikube`, `kind`, `k3s`, `kubeadm`, `local`, or `gcloud` (default: `gcloud`)
+- `REGISTRY_PREFIX`: Container registry prefix (default: `gcr.io/fhir-org-starter-project` for gcloud, `localhost:5000` for local types)
+- `NAMESPACE`: Kubernetes namespace (default: `fhir`)
+- `ZULIP_EMAIL`: Email for notifications
+- `ZULIP_API_KEY`: API key for notifications
+
+## Examples
+
+### Complete Local Setup with Minikube
+
+```bash
+# Start minikube cluster
+./setup-minikube.sh
+
+# Follow unified setup process
+./setup.sh --type minikube
+./build-images.sh --type minikube
+
+# Deploy
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Test
+kubectl apply -f example-job-for-minikube.yaml
+```
+
+### Complete Local Setup with KIND
+
+```bash
+# Create KIND cluster
+./setup-kind.sh
+
+# Follow unified setup process
+./setup.sh --type kind
+./build-images.sh --type kind
+
+# Deploy
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Test
+kubectl apply -f example-job-for-minikube.yaml
+```
+
+### Complete Local Setup with k3s
+
+```bash
+# Start k3s cluster
+./setup-k3s.sh
+
+# Follow unified setup process
+./setup.sh --type k3s
+./build-images.sh --type k3s
+
+# Deploy
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Test
+kubectl apply -f example-job-for-minikube.yaml
+```
+
+### Complete kubeadm Setup
+
+```bash
+# Prepare existing kubeadm cluster
+./setup-kubeadm.sh
+
+# Follow unified setup process
+./setup.sh --type kubeadm
+./build-images.sh --type kubeadm
+
+# Deploy
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Test
+kubectl apply -f example-job-for-minikube.yaml
+```
+
+### Generic Local Setup (Legacy)
+
+```bash
+# For any local cluster (manual setup)
+./setup.sh --type local
+./build-images.sh --type local --push false
+
+# Deploy
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Test
+kubectl apply -f example-job-for-minikube.yaml
+```
+
+**Note**: All four local deployment types (minikube, KIND, k3s, kubeadm) follow the same unified 3-step setup process after initial cluster preparation. The `local` type is a generic fallback for manual setups.
+
+### Complete GCloud Setup
+
+```bash
+# Connect to GCloud
+gcloud container clusters get-credentials fhir-k8s --zone us-east1-d
+
+# Setup with production credentials
+export ZULIP_EMAIL="production-bot@example.com"
+export ZULIP_API_KEY="real-api-key"
+
+cd k8s
+./setup.sh --type gcloud
+./build-images.sh --type gcloud
+
+# Deploy
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+```
+
+### Local with Custom Registry
+
+```bash
+# Start local registry
+docker run -d -p 5000:5000 --name registry registry:2
+
+# Setup and build
+cd k8s
+./setup.sh --type local --registry localhost:5000
+./build-images.sh --type local --registry localhost:5000
+
+# Deploy
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+```
+
+## Troubleshooting
+
+### Minikube-Specific Issues
+
+**Image Pull Errors:**
+```bash
+# Ensure Docker environment is set
+eval $(minikube docker-env)
+
+# Verify images exist
+docker images | grep -E "(ig-publisher|ci-build|caddy-ratelimit)"
+
+# Rebuild if missing
+./build-images.sh --type minikube
+```
+
+**Resource Issues:**
+```bash
+# Check minikube resources
+minikube status
+kubectl top nodes
+
+# Increase memory if needed
+minikube stop
+minikube start --memory=8192 --cpus=4
+```
+
+### KIND-Specific Issues
+
+**Image Loading Failures:**
+```bash
+# Manually load images if automatic loading fails
+kind load docker-image ig-publisher:latest --name fhir-ig-builder
+kind load docker-image ci-build:latest --name fhir-ig-builder
+kind load docker-image caddy-ratelimit:latest --name fhir-ig-builder
+```
+
+**Port Conflicts:**
+```bash
+# Check for port conflicts
+lsof -i :8080
+netstat -tulpn | grep 8080
+
+# Delete and recreate cluster if needed
+kind delete cluster --name fhir-ig-builder
+./setup-kind.sh
+```
+
+### k3s-Specific Issues
+
+**Service Startup Failures:**
+```bash
+# Check k3s service status
+sudo systemctl status k3s
+sudo journalctl -u k3s --no-pager -l
+
+# Restart if needed
+sudo systemctl restart k3s
+```
+
+**KUBECONFIG Issues:**
+```bash
+# Verify KUBECONFIG is set correctly
+echo $KUBECONFIG
+kubectl cluster-info
+
+# Reset if needed
+export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+sudo chmod 644 $KUBECONFIG
+```
+
+**Data Directory Permissions:**
+```bash
+# Fix k3s data directory permissions
+sudo chown -R $(whoami):$(whoami) /var/lib/rancher/k3s
+sudo chmod -R 755 /var/lib/rancher/k3s
+```
+
+### kubeadm-Specific Issues
+
+**Storage Provisioner Problems:**
+```bash
+# Check storage classes
+kubectl get storageclass
+
+# Install local-path provisioner if missing
+kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.24/deploy/local-path-storage.yaml
+
+# Or use our examples
+kubectl apply -f kubeadm-examples.yaml
+```
+
+**Node Selector Issues:**
+```bash
+# Check node labels
+kubectl get nodes --show-labels
+
+# Apply node selector if needed
+kubectl apply -f kubeadm-node-selector.yaml
+```
+
+**CNI/Networking Issues:**
+```bash
+# Check pod network
+kubectl get pods -n kube-system
+kubectl describe pod <cni-pod-name> -n kube-system
+
+# Test connectivity
+kubectl run test-pod --image=busybox --rm -it -- ping 8.8.8.8
+```
+
+### Cross-Platform Issues
+
+**Persistent Volume Mounting Failures:**
+```bash
+# Check PV status
+kubectl get pv
+kubectl get pvc -n fhir
+kubectl describe pvc <pvc-name> -n fhir
+
+# Check node storage
+df -h
+sudo du -sh /tmp/fhir-*
+```
+
+**Registry Connectivity Problems:**
+```bash
+# Test registry access
+docker pull localhost:5000/ig-publisher:latest
+curl -v http://localhost:5000/v2/_catalog
+
+# Start local registry if missing
+docker run -d -p 5000:5000 --name registry registry:2
+```
+
+**Resource Quota Issues:**
+```bash
+# Check resource usage
+kubectl top pods -n fhir
+kubectl describe limitrange -n fhir
+kubectl describe quota -n fhir
+
+# Check node capacity
+kubectl describe nodes
+```
+
+**Service Discovery Problems:**
+```bash
+# Check services and endpoints
+kubectl get svc -n fhir
+kubectl get endpoints -n fhir
+kubectl describe svc ci-build-service -n fhir
+
+# Test internal connectivity
+kubectl run debug-pod --image=busybox --rm -it -n fhir -- nslookup ci-build-service
+```
+
+### GCloud-Specific Issues
+
+**Permission Errors:**
+```bash
+# Verify GCloud authentication
+gcloud auth list
+gcloud auth application-default login
+
+# Check cluster access
+kubectl get nodes
+gcloud container clusters get-credentials fhir-k8s --zone us-east1-d
+```
+
+**Missing Secrets:**
+```bash
+# Verify secrets exist
+kubectl get secrets -n fhir
+kubectl describe secret fhir-settings -n fhir
+
+# Check environment variables
+echo $ZULIP_EMAIL
+echo $ZULIP_API_KEY
+```
+
+## Cleanup Procedures
+
+### Universal Cleanup (All Types)
+
+```bash
+# Remove Kubernetes resources
+kubectl delete namespace fhir
+
+# Remove generated files
+rm -f ../mount/ci-build.deployment.generated.yaml
+rm -f ../mount/kubeadm-persistent-volumes.yaml
+rm -f ../mount/kubeadm-node-selector.yaml
+rm -f ../mount/id
+rm -f ../mount/id.pub
+```
+
+### Minikube Cleanup
+
+```bash
+# Stop cluster
+minikube stop
+
+# Delete cluster (complete removal)
+minikube delete
+
+# Clean Docker environment
+unset DOCKER_TLS_VERIFY DOCKER_HOST DOCKER_CERT_PATH MINIKUBE_ACTIVE_DOCKERD
+
+# Remove minikube cache (optional)
+rm -rf ~/.minikube
+```
+
+### KIND Cleanup
+
+```bash
+# Delete cluster
+kind delete cluster --name fhir-ig-builder
+
+# Remove KIND images (optional)
+docker rmi $(docker images --format "table {{.Repository}}:{{.Tag}}" | grep -E "(kindest|kind)")
+
+# Clean up KIND networks
+docker network prune
+```
+
+### k3s Cleanup
+
+```bash
+# Stop k3s service
+sudo systemctl stop k3s
+sudo systemctl disable k3s
+
+# Remove k3s data directory
+sudo rm -rf /var/lib/rancher/k3s
+sudo rm -rf /etc/rancher/k3s
+
+# Uninstall k3s (if needed)
+sudo /usr/local/bin/k3s-uninstall.sh
+
+# Clean environment
+unset KUBECONFIG
+```
+
+### kubeadm Cleanup
+
+```bash
+# Remove namespace and resources
+kubectl delete namespace fhir
+
+# Remove persistent volumes
+kubectl delete pv --selector=app=fhir-ig-builder
+
+# Clean up storage directories
+sudo rm -rf /tmp/fhir-*
+
+# Remove storage classes (if you created them)
+kubectl delete storageclass local-path
+
+# Reset kubeadm (complete cluster reset)
+# WARNING: This removes the entire cluster
+# sudo kubeadm reset
+# sudo rm -rf /etc/kubernetes/
+# sudo rm -rf /var/lib/etcd/
+```
+
+### Local Registry Cleanup
+
+```bash
+# Stop and remove local registry
+docker stop registry
+docker rm registry
+
+# Remove registry images
+docker rmi localhost:5000/ig-publisher:latest
+docker rmi localhost:5000/ci-build:latest
+docker rmi localhost:5000/caddy-ratelimit:latest
+
+# Clean registry data
+docker volume prune
+```
+
+### GCloud Cleanup
+
+```bash
+# Remove namespace (keeps cluster)
+kubectl delete namespace fhir
+
+# Clean up Cloud Build images (optional)
+gcloud container images list --repository=gcr.io/fhir-org-starter-project
+gcloud container images delete gcr.io/fhir-org-starter-project/ig-publisher:latest
+```
+
+## Diagnostic Commands
+
+### General Cluster Health
+
+```bash
+# Cluster info
+kubectl cluster-info
+kubectl get nodes
+kubectl get pods --all-namespaces
+
+# Resource usage
+kubectl top nodes
+kubectl top pods -n fhir
+
+# Events
+kubectl get events -n fhir --sort-by='.lastTimestamp'
+```
+
+### Application-Specific Debugging
+
+```bash
+# Check deployment status
+kubectl get deployments -n fhir
+kubectl describe deployment ci-build-deployment -n fhir
+
+# Pod logs
+kubectl logs -l app=ci-build -n fhir
+kubectl logs deployment/ci-build-deployment -n fhir --follow
+
+# Pod shell access
+kubectl exec -it deployment/ci-build-deployment -n fhir -- /bin/bash
+
+# Network testing
+kubectl port-forward service/ci-build-service 8080:80 -n fhir
+curl http://localhost:8080/
+```
+
+### Storage Debugging
+
+```bash
+# Check storage
+kubectl get pv,pvc -n fhir
+kubectl describe pvc fhir-volume-claim -n fhir
+
+# Check storage classes
+kubectl get storageclass
+kubectl describe storageclass local-path
+
+# Node storage
+df -h
+lsblk
+```
diff --git a/k8s/build-images.sh b/k8s/build-images.sh
new file mode 100755
index 00000000..7fc36449
--- /dev/null
+++ b/k8s/build-images.sh
@@ -0,0 +1,212 @@
+#!/bin/bash
+
+# Unified image building script for both local and GCloud deployments
+
+set -e
+
+# Configuration
+DEPLOYMENT_TYPE="${DEPLOYMENT_TYPE:-gcloud}"
+REGISTRY_PREFIX="${REGISTRY_PREFIX:-gcr.io/fhir-org-starter-project}"
+PUSH_IMAGES="${PUSH_IMAGES:-true}"
+
+usage() {
+    cat << EOF
+Usage: $0 [OPTIONS]
+
+Build Docker images for FHIR IG Builder deployment.
+
+OPTIONS:
+    -t, --type TYPE         Deployment type: 'local', 'minikube', 'kind', 'k3s', 'kubeadm', or 'gcloud' (default: gcloud)
+    -r, --registry PREFIX   Registry prefix (default: gcr.io/fhir-org-starter-project for gcloud, localhost:5000 for local)
+    -p, --push BOOL         Push images to registry: 'true' or 'false' (default: true)
+    -h, --help             Show this help message
+
+ENVIRONMENT VARIABLES:
+    DEPLOYMENT_TYPE         Same as --type
+    REGISTRY_PREFIX         Same as --registry
+    PUSH_IMAGES            Same as --push
+
+EXAMPLES:
+    # Build and push for GCloud (default)
+    $0
+
+    # Build and push with explicit registry
+    $0 --type gcloud --registry gcr.io/fhir-org-starter-project
+
+    # Build for local deployment (no push)
+    $0 --type local --registry localhost:5000 --push false
+
+    # Build for kubeadm deployment
+    $0 --type kubeadm --registry localhost:5000 --push false
+
+EOF
+}
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -t|--type)
+            DEPLOYMENT_TYPE="$2"
+            shift 2
+            ;;
+        -r|--registry)
+            REGISTRY_PREFIX="$2"
+            shift 2
+            ;;
+        -p|--push)
+            PUSH_IMAGES="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+# Validate deployment type
+if [[ "$DEPLOYMENT_TYPE" != "local" && "$DEPLOYMENT_TYPE" != "gcloud" && "$DEPLOYMENT_TYPE" != "kubeadm" && "$DEPLOYMENT_TYPE" != "minikube" && "$DEPLOYMENT_TYPE" != "kind" && "$DEPLOYMENT_TYPE" != "k3s" ]]; then
+    echo "Error: DEPLOYMENT_TYPE must be 'local', 'minikube', 'kind', 'k3s', 'kubeadm', or 'gcloud'"
+    exit 1
+fi
+
+# Set defaults based on deployment type
+if [[ ("$DEPLOYMENT_TYPE" == "local" || "$DEPLOYMENT_TYPE" == "minikube" || "$DEPLOYMENT_TYPE" == "kind" || "$DEPLOYMENT_TYPE" == "k3s" || "$DEPLOYMENT_TYPE" == "kubeadm") && "$REGISTRY_PREFIX" == "gcr.io/fhir-org-starter-project" ]]; then
+    REGISTRY_PREFIX="localhost:5000"
+elif [[ "$DEPLOYMENT_TYPE" == "gcloud" && "$REGISTRY_PREFIX" == "localhost:5000" ]]; then
+    REGISTRY_PREFIX="gcr.io/fhir-org-starter-project"
+fi
+
+# Set push defaults based on deployment type
+if [[ ("$DEPLOYMENT_TYPE" == "local" || "$DEPLOYMENT_TYPE" == "minikube" || "$DEPLOYMENT_TYPE" == "kind" || "$DEPLOYMENT_TYPE" == "k3s" || "$DEPLOYMENT_TYPE" == "kubeadm") && "$PUSH_IMAGES" == "true" ]]; then
+    echo "Note: Setting PUSH_IMAGES=false for $DEPLOYMENT_TYPE deployment (no local registry assumed)"
+    PUSH_IMAGES="false"
+fi
+
+# For local builds without registry, don't push and use simple tags
+if [[ ("$DEPLOYMENT_TYPE" == "local" || "$DEPLOYMENT_TYPE" == "minikube" || "$DEPLOYMENT_TYPE" == "kind" || "$DEPLOYMENT_TYPE" == "k3s" || "$DEPLOYMENT_TYPE" == "kubeadm") && "$REGISTRY_PREFIX" == "localhost:5000" && "$PUSH_IMAGES" == "false" ]]; then
+    REGISTRY_PREFIX=""
+    TAG_SUFFIX=":latest"
+else
+    TAG_SUFFIX=":latest"
+fi
+
+echo "Building Docker images..."
+echo "Deployment Type: $DEPLOYMENT_TYPE"
+echo "Registry: $REGISTRY_PREFIX"
+echo "Push Images: $PUSH_IMAGES"
+echo
+
+# Function to build and optionally push an image
+build_image() {
+    local image_dir="$1"
+    local image_name="$2"
+    local dockerfile="${3:-Dockerfile}"
+    local target="${4:-}"
+
+    echo "Building $image_name..."
+    cd "../images/$image_dir"
+
+    # Build command
+    local build_cmd="docker build"
+    if [[ -n "$target" ]]; then
+        build_cmd="$build_cmd --target $target"
+    fi
+
+    # Set tag based on registry prefix
+    local full_tag
+    if [[ -n "$REGISTRY_PREFIX" ]]; then
+        full_tag="$REGISTRY_PREFIX/$image_name$TAG_SUFFIX"
+    else
+        full_tag="$image_name$TAG_SUFFIX"
+    fi
+
+    build_cmd="$build_cmd -t $full_tag ."
+
+    echo "Running: $build_cmd"
+    eval "$build_cmd"
+
+    # Push if required and registry is specified
+    if [[ "$PUSH_IMAGES" == "true" && -n "$REGISTRY_PREFIX" ]]; then
+        echo "Pushing $full_tag..."
+        if [[ "$DEPLOYMENT_TYPE" == "gcloud" ]]; then
+            gcloud docker -- push "$full_tag"
+        else
+            docker push "$full_tag"
+        fi
+    fi
+
+    cd - > /dev/null
+    echo
+}
+
+# Build images
+echo "Starting image builds..."
+echo
+
+# Build ig-publisher (CI target)
+build_image "ig-publisher" "ig-publisher" "Dockerfile" "ci"
+
+# Build ci-build
+build_image "ci-build" "ci-build"
+
+# Build caddy-ratelimit
+build_image "caddy-ratelimit" "caddy-ratelimit"
+
+echo "All images built successfully!"
+
+if [[ ("$DEPLOYMENT_TYPE" == "local" || "$DEPLOYMENT_TYPE" == "minikube" || "$DEPLOYMENT_TYPE" == "kind" || "$DEPLOYMENT_TYPE" == "k3s" || "$DEPLOYMENT_TYPE" == "kubeadm") && "$PUSH_IMAGES" == "false" ]]; then
+    echo ""
+    echo "Images are available locally with tags:"
+    echo "  - ig-publisher:latest"
+    echo "  - ci-build:latest"
+    echo "  - caddy-ratelimit:latest"
+    echo ""
+
+    # Check if we're using kind and offer to load images
+    if command -v kind >/dev/null 2>&1; then
+        # Get the cluster name - default to fhir-ig-builder or detect running cluster
+        CLUSTER_NAME="${KIND_CLUSTER_NAME:-fhir-ig-builder}"
+        if kind get clusters 2>/dev/null | grep -q "^${CLUSTER_NAME}$"; then
+            echo "Detected KIND cluster '${CLUSTER_NAME}'. Loading images..."
+            kind load docker-image ig-publisher:latest --name "${CLUSTER_NAME}"
+            kind load docker-image ci-build:latest --name "${CLUSTER_NAME}"
+            kind load docker-image caddy-ratelimit:latest --name "${CLUSTER_NAME}"
+            echo "Images loaded into KIND cluster."
+            echo ""
+        fi
+    fi
+
+    # Automatically regenerate deployment configuration to match built images
+    echo "Updating deployment configuration to match built image tags..."
+    ORIGINAL_REGISTRY_PREFIX="$REGISTRY_PREFIX"
+
+    # Get the namespace from existing config or use fhir as default
+    NAMESPACE=$(kubectl config view --minify --output 'jsonpath={..namespace}' 2>/dev/null || echo "fhir")
+    if [[ -z "$NAMESPACE" ]]; then
+        NAMESPACE="fhir"
+    fi
+
+    # Regenerate setup with empty registry to match local image tags
+    if ./setup.sh --type "$DEPLOYMENT_TYPE" --registry "" --namespace "$NAMESPACE" >/dev/null 2>&1; then
+        echo "✅ Deployment configuration updated successfully"
+        echo ""
+        echo "To deploy, run:"
+        echo "  kubectl apply -f ../mount/ci-build.deployment.generated.yaml"
+    else
+        echo "⚠️  Failed to auto-update deployment configuration"
+        echo ""
+        echo "To deploy, manually run:"
+        echo "  ./setup.sh --type $DEPLOYMENT_TYPE --registry \"\" --namespace $NAMESPACE"
+        echo "  kubectl apply -f ../mount/ci-build.deployment.generated.yaml"
+    fi
+else
+    echo ""
+    echo "To deploy, run:"
+    echo "  kubectl apply -f ../mount/ci-build.deployment.generated.yaml"
+fi
\ No newline at end of file
diff --git a/k8s/ci-build.deployment.template.yaml b/k8s/ci-build.deployment.template.yaml
new file mode 100644
index 00000000..1f43f9fb
--- /dev/null
+++ b/k8s/ci-build.deployment.template.yaml
@@ -0,0 +1,65 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ci-build-deployment
+  namespace: ${NAMESPACE}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: ci-build
+  template:
+    metadata:
+      labels:
+        run: ci-build
+      namespace: ${NAMESPACE}
+    spec:
+      containers:
+      - env:
+        - name: BUILD_NUMBER
+          value: "1"
+        - name: AUTOCLEAN_EXEMPTION_REGEX
+          value: ./\(HL7\|FHIR\|IHE\|argonautproject\)/[^/]*/branches/\(main\|master\)
+        - name: SSH_AUTHORIZED_KEY
+          valueFrom:
+            configMapKeyRef:
+              key: ssh_authorized_key
+              name: ci-build-config
+        image: ${CI_BUILD_IMAGE}
+        imagePullPolicy: ${IMAGE_PULL_POLICY}
+        name: ci-build
+        volumeMounts:
+        - mountPath: /home/fhir_upload/uploading
+          name: fhir-ci-build-disk
+      - image: ${CADDY_IMAGE}
+        imagePullPolicy: ${IMAGE_PULL_POLICY}
+        name: caddy
+        volumeMounts:
+        - name: fhir-ci-build-disk
+          mountPath: /var/www
+          subPath: www
+        - name: caddy-cert-disk
+          mountPath: /data
+        - name: caddy-conf-volume
+          mountPath: /etc/caddy/Caddyfile
+          subPath: Caddyfile
+      initContainers:
+      - command:
+        - sh
+        - -c
+        - mkdir -p /disk/www && chmod a+rwx /disk /disk/www
+        image: ubuntu:16.04
+        imagePullPolicy: IfNotPresent
+        name: permissions
+        volumeMounts:
+        - mountPath: /disk
+          name: fhir-ci-build-disk
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 10
+${NODE_SELECTOR_CONFIG}
+      volumes:
+${VOLUMES_CONFIG}
+      - configMap:
+          defaultMode: 420
+          name: caddy-conf-volume
+        name: caddy-conf-volume
\ No newline at end of file
diff --git a/k8s/ci-build.deployment.yaml b/k8s/ci-build.deployment.yaml
index aaa8ae16..0e09a43f 100644
--- a/k8s/ci-build.deployment.yaml
+++ b/k8s/ci-build.deployment.yaml
@@ -1,3 +1,11 @@
+# DEPRECATED: This file is preserved for reference only.
+#
+# Use the unified setup instead:
+#   ./setup.sh --type gcloud
+#   kubectl apply -f ci-build.deployment.generated.yaml
+#
+# The generated file will have the correct configuration for your deployment type.
+
 apiVersion: apps/v1
 kind: Deployment
 metadata:
diff --git a/k8s/create.sh b/k8s/create.sh
old mode 100644
new mode 100755
index 25f64599..ee4147a1
--- a/k8s/create.sh
+++ b/k8s/create.sh
@@ -1,21 +1,17 @@
-gcloud compute disks create fhir-ci-build-disk --size 100GB
+#!/bin/bash
 
-kubectl  -n fhir create secret generic zulip-secrets --from-literal=email=$ZULIP_EMAIL --from-literal=api_key=$ZULIP_API_KEY
+# DEPRECATED: This script is deprecated and will be removed in a future release.
+# 
+# Please use the unified setup script instead:
+#   ./setup.sh --type gcloud
+#
+# This script is preserved temporarily for backward compatibility.
 
-ssh-keygen -t rsa -f id
-kubectl  -n fhir create secret generic ci-build-keys --from-file=id --from-file=id.pub
+echo "⚠️  DEPRECATION WARNING: create.sh is deprecated"
+echo "   Please use: ./setup.sh --type gcloud"
+echo "   This script will be removed in a future release."
+echo ""
+echo "Redirecting to unified setup script..."
+echo ""
 
-# get these from Grahame ;-)
-kubectl  -n fhir create secret generic fhir-settings --from-file=keyfile.ini --from-file=fhir-settings.json
-
-gcloud compute disks create caddy-cert-disk --size=10GB --zone=us-east1-d
-kubectl  -n fhir create configmap caddy-conf-volume --from-file Caddyfile
-
-kubectl apply -f ci-build.configmap.yaml
-kubectl apply -f ci-build.deployment.yaml
-kubectl apply -f ci-build.service.yaml
-
-kubectl create serviceaccount igbuild --namespace fhir
-
-# Now create a secret for it (needed for k8s > 1.23)
-https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-long-lived-api-token-for-a-serviceaccount
+exec ./setup.sh --type gcloud "$@"
diff --git a/k8s/dev-setup.md b/k8s/dev-setup.md
index 7dfe823d..cab22252 100644
--- a/k8s/dev-setup.md
+++ b/k8s/dev-setup.md
@@ -1,93 +1,380 @@
-# New Dev Setup
+# FHIR IG Builder Development Setup
 
-Current deployment process requires access to `fhir-org-startr-project` in the HL7 GCP org.
+Comprehensive setup guide for developing and deploying the FHIR IG Builder on Kubernetes, supporting both local development clusters and Google Cloud Platform production deployments.
+
+## Architecture Overview
+
+The FHIR IG Builder consists of several components:
+
+- **ci-build**: Main service that builds FHIR Implementation Guides
+- **ig-publisher**: Container with the FHIR IG Publisher tool
+- **caddy-ratelimit**: Rate-limiting reverse proxy
+- **webhook triggers**: GitHub/GitLab integration for automated builds
+
+### Workflow
+
+1. **Trigger**: GitHub webhook or manual job submission
+2. **Queue**: Kubernetes Job created for IG build
+3. **Build**: ci-build container processes the IG using ig-publisher
+4. **Publish**: Results uploaded to build.fhir.org
+5. **Notify**: Optional Zulip notifications sent
+
+## Prerequisites
+
+## Choose Your Deployment Method
+
+### Production/GCloud Deployment (Default)
 
 1. Install `kubectl`
 2. Install `gcloud`
 3. Configure access to cluster
 
-```
+**Requirements:**
+
+* GCloud CLI configured
+* Access to `fhir-org-starter-project` GCP project
+* `keyfile.ini` file (obtain from project maintainer)
+* `fhir-settings.json` file (obtain from project maintainer)
+
+**Setup:**
+
+```bash
 gcloud container clusters get-credentials fhir-k8s --zone us-east1-d
 ```
 
-4. Set up `auto-ig-builder` repo
+### Local Development
+
+1. Install `kubectl`
+
+**Requirements:**
+
+- Local Kubernetes (minikube, kind, k3s, or kubeadm cluster)
+- Docker
+
+**Setup:**
+
+```bash
+# Start/prepare local cluster (choose one)
+
+# minikube
+./setup-minikube.sh  # Start minikube
+
+# OR
+
+# KIND 
+./setup-kind.sh  # Create KIND cluster
+
+# OR
+
+# k3s
+./setup-k3s.sh  # Start k3s
+
+# OR
+
+# kubeadm
+./setup-kubeadm.sh  # Prepare existing kubeadm cluster
 
 ```
+
+## Unified Setup Process
+
+### 1. Clone and Setup Repository
+
+```bash
 git clone https://github.com/FHIR/auto-ig-builder/
-cd auto-ig-builder/triggers/ig-commit-trigger
-./setup-secret.sh
+cd auto-ig-builder/k8s
+```
+
+### 2. Run Setup Script
+
+```bash
+# For local development (all local types use same setup)
+./setup.sh --type minikube     # for minikube
+./setup.sh --type kind         # for KIND
+./setup.sh --type k3s          # for k3s
+./setup.sh --type kubeadm      # for kubeadm
+./setup.sh --type local        # generic local (works with any)
+
+# For local with custom registry
+./setup.sh --type local --registry my-registry:5000
+```
+
+### 3. Build Images
+
+```bash
+# Build and push for GCloud (default)
+./build-images.sh
+
+# Build images for specific local deployment types
+./build-images.sh --type minikube
+./build-images.sh --type kind 
+./build-images.sh --type k3s
+./build-images.sh --type kubeadm
+./build-images.sh --type local --push false  # Generic local
+
+# Build and push to custom registry
+./build-images.sh --type local --registry my-registry:5000
+```
+
+### 4. Deploy Application
+
+```bash
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+```
+
+### 5. Verify Deployment
+
+```bash
+kubectl get pods -n fhir
+kubectl get svc -n fhir
 ```
 
 ## Rate Limiting
 
 The build service uses Caddy with the `caddy-ratelimit` plugin to limit requests to `qas.json` files:
+
 - **Limit**: 100 requests per minute per IP address
 - **Scope**: Only applies to external IPs; internal IPs (10.0.0.0/8) are exempt
 - **Implementation**: Custom Caddy image with rate limiting configured in `k8s/Caddyfile`
 
 This prevents abuse while allowing internal monitoring systems unlimited access.
 
-## Recurring tasks
-5. Deploy updates to the `ig-build` image
+## Recurring Tasks
+
+### 1. Rebuild and Redeploy Images
+
+```bash
+# Use the build script for your deployment type
+./build-images.sh --type minikube    # for minikube
+./build-images.sh --type kind        # for KIND
+./build-images.sh --type k3s         # for k3s
+./build-images.sh --type kubeadm     # for kubeadm
+./build-images.sh --type gcloud      # for GCloud production
+
+# Restart deployments to use new images
+kubectl rollout restart deployment/ci-build-deployment -n fhir
+kubectl rollout status deployment/ci-build-deployment -n fhir
+```
+
+### 2. Local Webhook Testing
+
+```bash
+# Run webhook service locally (for development)
+cd triggers/ig-commit-trigger
+npm install
+npm start
 
+# Or deploy webhook to cluster
+kubectl apply -f ig-commit-trigger-service.yaml
 ```
-cd images/ig-build
-docker build -t gcr.io/fhir-org-starter-project/ig-build  -f Dockerfile .
-gcloud docker -- push gcr.io/fhir-org-starter-project/ig-build
+
+### 3. Monitor Build Jobs
+
+```bash
+# Watch running jobs
+kubectl get jobs -n fhir -w
+
+# Check job logs
+kubectl logs job/<job-name> -n fhir
+
+# Test with example job
+kubectl apply -f example-job-for-minikube.yaml
+kubectl logs job/test-ig-build -n fhir --follow
 ```
 
-6. Deploy updates to `ci-build` image
+## Complete Local Setup Examples
+
+### minikube Setup
+
+```bash
+# Step 1: Cluster Preparation
+./setup-minikube.sh
 
+# Step 2: Build and Deploy
+./setup.sh --type minikube
+./build-images.sh --type minikube
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Step 3: Test
+kubectl get pods -n fhir
+kubectl apply -f example-job-for-minikube.yaml
 ```
-cd images/ci-build
-docker build -t gcr.io/fhir-org-starter-project/ci-build  -f Dockerfile .
-gcloud docker -- push gcr.io/fhir-org-starter-project/ci-build
+
+### KIND Setup (Recommended)
+
+```bash
+# Step 1: Cluster Preparation
+./setup-kind.sh
+
+# Step 2: Build and Deploy
+./setup.sh --type kind
+./build-images.sh --type kind
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Step 3: Test
+kubectl get pods -n fhir
+kubectl apply -f example-job-for-minikube.yaml
 ```
 
-7. Deploy updates to `caddy-ratelimit` image (custom Caddy with rate limiting plugin)
+### k3s Setup
+
+```bash
+# Step 1: Cluster Preparation
+./setup-k3s.sh
 
+# Step 2: Build and Deploy
+./setup.sh --type k3s
+./build-images.sh --type k3s
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Step 3: Test
+kubectl get pods -n fhir
+kubectl apply -f example-job-for-minikube.yaml
 ```
-cd images/caddy-ratelimit
-docker build -t gcr.io/fhir-org-starter-project/caddy-ratelimit:latest -f Dockerfile .
-docker push gcr.io/fhir-org-starter-project/caddy-ratelimit:latest
 
-# After pushing, restart the deployment to use the new image
-kubectl rollout restart deployment/ci-build-deployment -n fhir
-kubectl rollout status deployment/ci-build-deployment -n fhir
+### kubeadm Setup
+
+```bash
+# Step 1: Cluster Preparation (manual - see prerequisites below)
+./setup-kubeadm.sh
+
+# Step 2: Build and Deploy
+./setup.sh --type kubeadm
+./build-images.sh --type kubeadm
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Step 3: Test
+kubectl get pods -n fhir
+kubectl apply -f example-job-for-minikube.yaml
 ```
 
-8. Deploy updates to IG commit trigger
+### Generic Local Setup
 
+```bash
+# For any existing Kubernetes cluster
+./setup.sh --type local
+./build-images.sh --type local --push false
+kubectl apply -f ../mount/ci-build.deployment.generated.yaml
+
+# Test
+kubectl get pods -n fhir
+kubectl apply -f example-job-for-minikube.yaml
 ```
-cd triggers/ig-commit-trigger
-gcloud functions deploy ig-commit-trigger --runtime nodejs22 --trigger-http
+
+## Troubleshooting
+
+### Common Issues
+
+**Pod Not Starting:**
+```bash
+# Check pod status
+kubectl describe pod -l app=ci-build -n fhir
+kubectl logs -l app=ci-build -n fhir
+```
+
+**Image Pull Failures:**
+```bash
+# For minikube - ensure Docker environment is set
+eval $(minikube docker-env)
+docker images | grep -E "(ig-publisher|ci-build|caddy-ratelimit)"
+
+# For KIND - check image loading
+kind load docker-image ig-publisher:latest --name fhir-ig-builder
+```
+
+**Storage Issues:**
+```bash
+# Check persistent volumes
+kubectl get pv,pvc -n fhir
+kubectl describe pvc fhir-volume-claim -n fhir
+
+# Check node storage
+df -h /tmp/fhir-*
+```
+
+**Networking Problems:**
+```bash
+# Test service connectivity
+kubectl port-forward service/ci-build-service 8080:80 -n fhir
+curl http://localhost:8080/
+
+# Check endpoints
+kubectl get endpoints -n fhir
 ```
 
-Note: Node.js 22 is GA and recommended.
+### Deployment-Specific Troubleshooting
+
+Refer to the comprehensive troubleshooting section in [README.md](README.md) for detailed deployment-specific issues and solutions.
 
+## Cleanup
 
----
+### Quick Cleanup (Preserve Cluster)
 
-## Testing locally with minikube
+```bash
+# Remove namespace and all resources
+kubectl delete namespace fhir
 
-```sh
-minikube config set memory 20000
-minikube start
-eval $(minikube -p minikube docker-env)
+# Remove generated files
+rm -f ../mount/ci-build.deployment.generated.yaml
+rm -f ../mount/kubeadm-persistent-volumes.yaml
+rm -f ../mount/kubeadm-node-selector.yaml
+rm -f ../mount/id
+rm -f ../mount/id.pub
+```
+
+### Complete Cleanup (Remove Cluster)
 
-kubectl  create ns fhir
+```bash
+# For minikube
+minikube stop && minikube delete
 
-ssh-keygen -t rsa -f id
-kubectl  -n fhir create secret generic ci-build-keys --from-file=id --from-file=id.pub
+# For KIND
+kind delete cluster --name fhir-ig-builder
 
-echo "" > keyfile.ini
-echo "{}" > fhir-settings.json
-kubectl  -n fhir create secret generic fhir-settings --from-file=keyfile.ini --from-file=fhir-settings.json
+# For k3s
+sudo systemctl stop k3s
+sudo rm -rf /var/lib/rancher/k3s
 
-kubectl  -n fhir create secret generic zulip-secrets --from-literal=email=bot@hsot --from-literal=api_key=zapi
+# For kubeadm (careful - removes entire cluster)
+# kubectl delete namespace fhir
+# sudo kubeadm reset
 ```
 
-Build the igbuild image as `igbuild` in minikube docker
+For comprehensive cleanup procedures, see [README.md](README.md#cleanup-procedures).
+
+## kubeadm Prerequisites
+
+* Functioning kubeadm cluster with kubectl access
+* Sufficient resources (20GB+ memory, 100GB+ storage per node)  
+* Storage provisioner (local-path, OpenEBS, Longhorn, etc.)
+* Container runtime (Docker, containerd, or CRI-O)
+* Optional: Local container registry or pull access to gcr.io
+
+## Development Workflow
+
+### Making Changes
+
+1. **Code Changes**: Modify files in `images/` directories
+2. **Rebuild**: Run `./build-images.sh --type <your-type>`
+3. **Redeploy**: `kubectl rollout restart deployment/ci-build-deployment -n fhir`
+4. **Test**: Submit test job with `kubectl apply -f example-job-for-minikube.yaml`
+
+### Debugging Builds
+
+```bash
+# Watch build logs in real-time
+kubectl logs job/<job-name> -n fhir --follow
+
+# Get shell access to running pod
+kubectl exec -it deployment/ci-build-deployment -n fhir -- /bin/bash
+
+# Check build artifacts
+kubectl exec deployment/ci-build-deployment -n fhir -- ls -la /tmp/
+```
 
-    kubectl apply -f example-job-for-minikube.yaml
+## Additional Resources
 
+- [Main README](../README.md) - Project overview and usage
+- [Architecture Slides](https://docs.google.com/presentation/d/12JykZwSdQ1pwSuzP2fGZSXr3jYMmvEcwVgNAy3dWr_U/present)
+- [Video Walkthrough](https://youtu.be/VVbF1O4pgQA)
+- [FHIR IG Publisher Documentation](https://confluence.hl7.org/display/FHIR/IG+Publisher+Documentation)
diff --git a/k8s/docker-desktop-volumes.yaml b/k8s/docker-desktop-volumes.yaml
new file mode 100644
index 00000000..54acf2e8
--- /dev/null
+++ b/k8s/docker-desktop-volumes.yaml
@@ -0,0 +1,62 @@
+---
+# PersistentVolume using Docker volume for FHIR CI Build
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: fhir-ci-build-pv
+spec:
+  capacity:
+    storage: 100Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: docker-hostpath
+  hostPath:
+    path: /var/lib/docker/volumes/fhir-ci-build/_data
+    type: DirectoryOrCreate
+---
+# PersistentVolumeClaim for FHIR CI Build
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fhir-ci-build
+  namespace: fhir
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Gi
+  storageClassName: docker-hostpath
+  volumeName: fhir-ci-build-pv
+---
+# PersistentVolume using Docker volume for Caddy Certificates
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: caddy-cert-pv
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: docker-hostpath
+  hostPath:
+    path: /var/lib/docker/volumes/caddy-certs/_data
+    type: DirectoryOrCreate
+---
+# PersistentVolumeClaim for Caddy Certificates
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: caddy-cert
+  namespace: fhir
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: docker-hostpath
+  volumeName: caddy-cert-pv
\ No newline at end of file
diff --git a/k8s/kind-config.yaml b/k8s/kind-config.yaml
new file mode 100644
index 00000000..9e3020ca
--- /dev/null
+++ b/k8s/kind-config.yaml
@@ -0,0 +1,28 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+name: fhir-ig-builder
+nodes:
+- role: control-plane
+  kubeadmConfigPatches:
+  - |
+    kind: InitConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+        node-labels: "ingress-ready=true"
+  extraPortMappings:
+  - containerPort: 80
+    hostPort: 80
+    protocol: TCP
+  - containerPort: 443
+    hostPort: 443
+    protocol: TCP
+  - containerPort: 5000
+    hostPort: 5000
+    protocol: TCP
+  extraMounts:
+  - hostPath: /tmp/fhir-data
+    containerPath: /mnt/data
+- role: worker
+  extraMounts:
+  - hostPath: /tmp/fhir-data
+    containerPath: /mnt/data
\ No newline at end of file
diff --git a/k8s/kubeadm-examples.yaml b/k8s/kubeadm-examples.yaml
new file mode 100644
index 00000000..54d243ee
--- /dev/null
+++ b/k8s/kubeadm-examples.yaml
@@ -0,0 +1,74 @@
+# kubeadm cluster configuration examples for FHIR IG Builder
+# Choose one of the following storage provisioner setups
+
+# Option 1: Local Path Provisioner (simple, single-node or testing)
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: local-path-config
+  namespace: local-path-storage
+data:
+  config.json: |-
+    {
+      "nodePathMap": [
+        {
+          "node": "DEFAULT_PATH_FOR_NON_LISTED_NODES",
+          "paths": ["/opt/local-path-provisioner"]
+        }
+      ]
+    }
+---
+# Apply with: kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml
+
+# Option 2: OpenEBS Local PV (production-ready, multi-node)
+# Apply with: kubectl apply -f https://openebs.github.io/charts/openebs-operator.yaml
+# Then create storage class:
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: openebs-hostpath
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+provisioner: openebs.io/local
+parameters:
+  cas-type: local
+  basePath: "/opt/fhir-data"
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: Delete
+
+---
+# Option 3: Longhorn (distributed storage, production-ready)
+# Apply with: kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/master/deploy/longhorn.yaml
+# Access UI: kubectl port-forward -n longhorn-system svc/longhorn-frontend 8080:80
+
+---
+# Node labeling examples for FHIR workloads
+apiVersion: v1
+kind: Node
+metadata:
+  name: worker-node-1
+  labels:
+    workload: fhir
+    storage: fast-ssd
+
+---
+# Ingress configuration example (optional)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: fhir-ig-builder-ingress
+  namespace: fhir
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+spec:
+  rules:
+  - host: fhir-ig.local
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: ci-build-service
+            port:
+              number: 80
\ No newline at end of file
diff --git a/k8s/kubeadm-persistent-volumes.yaml b/k8s/kubeadm-persistent-volumes.yaml
new file mode 100644
index 00000000..366d4ce7
--- /dev/null
+++ b/k8s/kubeadm-persistent-volumes.yaml
@@ -0,0 +1,72 @@
+# Docker Desktop accessible persistent volume configuration
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: fhir-ci-build-pv
+spec:
+  capacity:
+    storage: 100Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual
+  local:
+    path: /var/lib/docker/volumes/fhir-ci-build/_data
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: kubernetes.io/hostname
+          operator: In
+          values:
+          - docker-desktop
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fhir-ci-build
+  namespace: fhir
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Gi
+  storageClassName: manual
+  volumeName: fhir-ci-build-pv
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: caddy-cert-pv
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual
+  local:
+    path: /var/lib/docker/volumes/caddy-cert/_data
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: kubernetes.io/hostname
+          operator: In
+          values:
+          - docker-desktop
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: caddy-cert
+  namespace: fhir
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: manual
+  volumeName: caddy-cert-pv
diff --git a/k8s/persistent-volumes.template.yaml b/k8s/persistent-volumes.template.yaml
new file mode 100644
index 00000000..b28e84e1
--- /dev/null
+++ b/k8s/persistent-volumes.template.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fhir-ci-build-pvc
+  namespace: ${NAMESPACE}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: caddy-cert-pvc
+  namespace: ${NAMESPACE}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
\ No newline at end of file
diff --git a/k8s/setup-k3s.sh b/k8s/setup-k3s.sh
new file mode 100755
index 00000000..94578f7a
--- /dev/null
+++ b/k8s/setup-k3s.sh
@@ -0,0 +1,175 @@
+#!/bin/bash
+
+# k3s cluster setup and initialization script for FHIR IG Builder
+# This script starts k3s and prepares it for the unified setup process
+
+set -e
+
+NAMESPACE="${NAMESPACE:-fhir}"
+DATA_DIR="${DATA_DIR:-/var/lib/rancher/k3s/storage}"
+
+usage() {
+    cat << EOF
+Usage: $0 [OPTIONS]
+
+Start and prepare k3s cluster for FHIR IG Builder development.
+After this script, use the unified setup process like minikube, KIND, and kubeadm.
+
+OPTIONS:
+    -n, --namespace NS      Kubernetes namespace (default: fhir)
+    -d, --data-dir DIR      Data directory for local storage (default: /var/lib/rancher/k3s/storage)
+    -h, --help             Show this help message
+
+ENVIRONMENT VARIABLES:
+    NAMESPACE              Same as --namespace
+    DATA_DIR              Same as --data-dir
+
+EXAMPLES:
+    # Default k3s setup
+    $0
+
+    # Custom data directory
+    $0 --data-dir /opt/k3s-data
+
+    # Complete setup workflow:
+    $0                                    # Start k3s
+    ./setup.sh --type k3s               # Run unified setup
+    ./build-images.sh --type k3s        # Build images
+    kubectl apply -f ci-build.deployment.generated.yaml  # Deploy
+
+PREREQUISITES:
+    - k3s installed (https://k3s.io/)
+    - sudo access (k3s typically runs as root)
+    - kubectl configured to use k3s
+    - Sufficient disk space for container images and data
+
+EOF
+}
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -n|--namespace)
+            NAMESPACE="$2"
+            shift 2
+            ;;
+        -d|--data-dir)
+            DATA_DIR="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+echo "Setting up FHIR IG Builder with k3s..."
+echo "Namespace: $NAMESPACE"
+echo "Data Directory: $DATA_DIR"
+echo
+
+# Check if k3s is installed
+if ! command -v k3s >/dev/null 2>&1; then
+    echo "Error: k3s is not installed."
+    echo "Install k3s: curl -sfL https://get.k3s.io | sh -"
+    exit 1
+fi
+
+# Check if kubectl is available (k3s provides it)
+if ! command -v kubectl >/dev/null 2>&1; then
+    echo "Setting up kubectl access to k3s..."
+    # k3s installs kubectl as k3s kubectl, so we need to ensure access
+    if command -v k3s >/dev/null 2>&1; then
+        echo "You can use: k3s kubectl [command]"
+        echo "Or configure kubectl to use k3s config:"
+        echo "export KUBECONFIG=/etc/rancher/k3s/k3s.yaml"
+    else
+        echo "Error: kubectl access not available."
+        exit 1
+    fi
+fi
+
+# Check if k3s is running
+if sudo systemctl is-active --quiet k3s; then
+    echo "k3s is already running."
+    read -p "Do you want to restart it? (y/N): " -n 1 -r
+    echo
+    if [[ $REPLY =~ ^[Yy]$ ]]; then
+        echo "Restarting k3s..."
+        sudo systemctl restart k3s
+    else
+        echo "Using existing k3s cluster."
+    fi
+else
+    echo "Starting k3s..."
+    sudo systemctl start k3s
+    sudo systemctl enable k3s
+fi
+
+# Create data directory if it doesn't exist
+if [[ ! -d "$DATA_DIR" ]]; then
+    echo "Creating data directory: $DATA_DIR"
+    sudo mkdir -p "$DATA_DIR"
+    sudo chmod 755 "$DATA_DIR"
+fi
+
+# Wait a moment for k3s to fully start
+echo "Waiting for k3s to be ready..."
+sleep 10
+
+# Set up kubectl access if not already configured
+if [[ -z "${KUBECONFIG}" && -f "/etc/rancher/k3s/k3s.yaml" ]]; then
+    echo "Configuring kubectl access..."
+    export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+    echo "export KUBECONFIG=/etc/rancher/k3s/k3s.yaml" >> ~/.bashrc
+fi
+
+# Verify cluster is ready (using k3s kubectl if regular kubectl fails)
+echo "Verifying cluster access..."
+if kubectl cluster-info >/dev/null 2>&1; then
+    kubectl wait --for=condition=Ready nodes --all --timeout=300s
+elif k3s kubectl cluster-info >/dev/null 2>&1; then
+    k3s kubectl wait --for=condition=Ready nodes --all --timeout=300s
+    echo "Note: Use 'k3s kubectl' for kubectl commands, or set KUBECONFIG=/etc/rancher/k3s/k3s.yaml"
+else
+    echo "Warning: Could not verify cluster readiness. You may need to configure kubectl access."
+fi
+
+echo ""
+echo "✅ k3s cluster started successfully!"
+echo ""
+echo "The cluster is now ready for the unified setup process."
+echo ""
+echo "Configuration summary:"
+echo "  - Namespace: $NAMESPACE"
+echo "  - Data Directory: $DATA_DIR"
+echo "  - Kubectl config: ${KUBECONFIG:-/etc/rancher/k3s/k3s.yaml}"
+echo ""
+echo "Next steps (follow the same process as minikube, KIND, and kubeadm):"
+echo "1. Run unified setup:"
+echo "   ./setup.sh --type k3s --namespace $NAMESPACE"
+echo ""
+echo "2. Build Docker images:"
+echo "   ./build-images.sh --type k3s"
+echo ""
+echo "3. Deploy the application:"
+echo "   kubectl apply -f ci-build.deployment.generated.yaml"
+echo ""
+echo "4. Test with example job:"
+echo "   kubectl apply -f example-job-for-minikube.yaml"
+echo ""
+echo "5. Monitor deployment:"
+echo "   kubectl get pods -n $NAMESPACE"
+echo ""
+echo "6. Access services (if needed):"
+echo "   kubectl port-forward -n $NAMESPACE svc/ci-build-service 8080:80"
+echo ""
+echo "Cleanup when done:"
+echo "   sudo systemctl stop k3s"
+echo ""
\ No newline at end of file
diff --git a/k8s/setup-kind.sh b/k8s/setup-kind.sh
new file mode 100755
index 00000000..aa8a5f9b
--- /dev/null
+++ b/k8s/setup-kind.sh
@@ -0,0 +1,140 @@
+#!/bin/bash
+
+# KIND cluster creation and initialization script for FHIR IG Builder
+# This script creates a KIND cluster and prepares it for the unified setup process
+
+set -e
+
+CLUSTER_NAME="${KIND_CLUSTER_NAME:-fhir-ig-builder}"
+NAMESPACE="${NAMESPACE:-fhir}"
+
+usage() {
+    cat << EOF
+Usage: $0 [OPTIONS]
+
+Create and initialize KIND cluster for FHIR IG Builder development.
+After this script, use the unified setup process like minikube.
+
+OPTIONS:
+    -c, --cluster NAME      KIND cluster name (default: fhir-ig-builder)
+    -n, --namespace NS      Kubernetes namespace (default: fhir)
+    -h, --help             Show this help message
+
+ENVIRONMENT VARIABLES:
+    KIND_CLUSTER_NAME      Same as --cluster
+    NAMESPACE             Same as --namespace
+
+EXAMPLES:
+    # Default cluster creation
+    $0
+
+    # Custom cluster name
+    $0 --cluster my-fhir-cluster
+
+    # Complete setup workflow:
+    $0                                    # Create cluster
+    ./setup.sh --type local              # Run unified setup
+    ./build-images.sh --type local --push false  # Build images
+    kubectl apply -f ci-build.deployment.generated.yaml  # Deploy
+
+EOF
+}
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -c|--cluster)
+            CLUSTER_NAME="$2"
+            shift 2
+            ;;
+        -n|--namespace)
+            NAMESPACE="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+echo "Setting up FHIR IG Builder with KIND..."
+echo "Cluster Name: $CLUSTER_NAME"
+echo "Namespace: $NAMESPACE"
+echo
+
+# Check if kind is installed
+if ! command -v kind >/dev/null 2>&1; then
+    echo "Error: kind is not installed."
+    echo "Install kind: https://kind.sigs.k8s.io/docs/user/quick-start/#installation"
+    exit 1
+fi
+
+# Check if kubectl is installed
+if ! command -v kubectl >/dev/null 2>&1; then
+    echo "Error: kubectl is not installed."
+    echo "Install kubectl: https://kubernetes.io/docs/tasks/tools/"
+    exit 1
+fi
+
+# Create host directory for data persistence
+echo "Creating host directories for persistent volumes..."
+sudo mkdir -p /tmp/fhir-data
+sudo chmod 777 /tmp/fhir-data
+
+# Check if cluster already exists
+if kind get clusters 2>/dev/null | grep -q "^${CLUSTER_NAME}$"; then
+    echo "KIND cluster '${CLUSTER_NAME}' already exists."
+    read -p "Do you want to delete and recreate it? (y/N): " -n 1 -r
+    echo
+    if [[ $REPLY =~ ^[Yy]$ ]]; then
+        echo "Deleting existing cluster..."
+        kind delete cluster --name "${CLUSTER_NAME}"
+    else
+        echo "Using existing cluster. Make sure it has the correct configuration."
+    fi
+fi
+
+# Create KIND cluster if it doesn't exist
+if ! kind get clusters 2>/dev/null | grep -q "^${CLUSTER_NAME}$"; then
+    echo "Creating KIND cluster '${CLUSTER_NAME}'..."
+    KIND_CLUSTER_NAME="${CLUSTER_NAME}" kind create cluster --config=kind-config.yaml
+fi
+
+# Set kubectl context
+echo "Setting kubectl context..."
+kubectl config use-context "kind-${CLUSTER_NAME}"
+
+# Verify cluster is ready
+echo "Waiting for cluster to be ready..."
+kubectl wait --for=condition=Ready nodes --all --timeout=300s
+
+echo ""
+echo "✅ KIND cluster '${CLUSTER_NAME}' created successfully!"
+echo ""
+echo "The cluster is now ready for the unified setup process."
+echo ""
+echo "Next steps (follow the same process as minikube):"
+echo "1. Run unified setup:"
+echo "   ./setup.sh --type local --namespace ${NAMESPACE}"
+echo ""
+echo "2. Build Docker images:"
+echo "   ./build-images.sh --type local --push false"
+echo ""
+echo "3. Deploy the application:"
+echo "   kubectl apply -f ci-build.deployment.generated.yaml"
+echo ""
+echo "4. Test with example job:"
+echo "   kubectl apply -f example-job-for-minikube.yaml"
+echo ""
+echo "5. Access services (if needed):"
+echo "   kubectl port-forward -n ${NAMESPACE} svc/ci-build-service 8080:80"
+echo ""
+echo "6. Clean up when done:"
+echo "   kind delete cluster --name ${CLUSTER_NAME}"
+echo ""
\ No newline at end of file
diff --git a/k8s/setup-kubeadm.sh b/k8s/setup-kubeadm.sh
new file mode 100755
index 00000000..a24e5405
--- /dev/null
+++ b/k8s/setup-kubeadm.sh
@@ -0,0 +1,258 @@
+#!/bin/bash
+
+# kubeadm cluster preparation script for FHIR IG Builder
+# This script prepares an existing kubeadm cluster for the unified setup process
+
+set -e
+
+NAMESPACE="${NAMESPACE:-fhir}"
+STORAGE_CLASS="${STORAGE_CLASS:-}"
+NODE_SELECTOR="${NODE_SELECTOR:-}"
+DATA_DIR="${DATA_DIR:-/opt/fhir-data}"
+
+usage() {
+    cat << EOF
+Usage: $0 [OPTIONS]
+
+Prepare existing kubeadm cluster for FHIR IG Builder deployment.
+After this script, use the unified setup process like minikube and KIND.
+
+OPTIONS:
+    -n, --namespace NS       Kubernetes namespace (default: fhir)
+    -s, --storage-class SC   Storage class for PVCs (default: auto-detect)
+    -d, --data-dir DIR       Host data directory (default: /opt/fhir-data)
+    -l, --node-selector SEL  Node selector for workloads (optional)
+    -h, --help              Show this help message
+
+ENVIRONMENT VARIABLES:
+    NAMESPACE               Same as --namespace
+    STORAGE_CLASS           Same as --storage-class
+    DATA_DIR               Same as --data-dir
+    NODE_SELECTOR          Same as --node-selector
+
+EXAMPLES:
+    # Basic cluster preparation
+    $0
+
+    # Preparation with specific storage class
+    $0 --storage-class local-path
+
+    # Complete setup workflow:
+    $0                                    # Prepare cluster
+    ./setup.sh --type kubeadm --namespace ${NAMESPACE}  # Run unified setup
+    ./build-images.sh --type kubeadm     # Build/pull images
+    kubectl apply -f ci-build.deployment.generated.yaml  # Deploy
+
+PREREQUISITES:
+    - Functioning kubeadm cluster with kubectl access
+    - Sufficient resources (20GB+ memory, 100GB+ storage)
+    - Container runtime (Docker, containerd, or CRI-O)
+    - Optional: Local container registry or pull access to gcr.io
+
+EOF
+}
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -n|--namespace)
+            NAMESPACE="$2"
+            shift 2
+            ;;
+        -s|--storage-class)
+            STORAGE_CLASS="$2"
+            shift 2
+            ;;
+        -d|--data-dir)
+            DATA_DIR="$2"
+            shift 2
+            ;;
+        -l|--node-selector)
+            NODE_SELECTOR="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+echo "Setting up FHIR IG Builder on kubeadm cluster..."
+echo "Namespace: $NAMESPACE"
+echo "Data Directory: $DATA_DIR"
+if [[ -n "$STORAGE_CLASS" ]]; then
+    echo "Storage Class: $STORAGE_CLASS"
+else
+    echo "Storage Class: Auto-detect"
+fi
+if [[ -n "$NODE_SELECTOR" ]]; then
+    echo "Node Selector: $NODE_SELECTOR"
+fi
+echo
+
+# Check if kubectl is installed and cluster is accessible
+if ! command -v kubectl >/dev/null 2>&1; then
+    echo "Error: kubectl is not installed."
+    echo "Install kubectl: https://kubernetes.io/docs/tasks/tools/"
+    exit 1
+fi
+
+# Test cluster access
+echo "Testing cluster access..."
+if ! kubectl cluster-info >/dev/null 2>&1; then
+    echo "Error: Cannot access Kubernetes cluster."
+    echo "Ensure kubectl is configured and cluster is running."
+    exit 1
+fi
+
+# Check cluster resources
+echo "Checking cluster resources..."
+NODES=$(kubectl get nodes --no-headers | wc -l)
+READY_NODES=$(kubectl get nodes --no-headers | grep -c Ready || true)
+echo "Cluster has $NODES nodes ($READY_NODES ready)"
+
+if [[ $READY_NODES -eq 0 ]]; then
+    echo "Error: No ready nodes found in cluster."
+    exit 1
+fi
+
+# Detect storage class if not specified
+if [[ -z "$STORAGE_CLASS" ]]; then
+    echo "Auto-detecting storage class..."
+
+    # Try to find a default storage class
+    STORAGE_CLASS=$(kubectl get storageclass -o jsonpath='{.items[?(@.metadata.annotations.storageclass\.kubernetes\.io/is-default-class=="true")].metadata.name}' 2>/dev/null || true)
+
+    if [[ -z "$STORAGE_CLASS" ]]; then
+        # Fall back to first available storage class
+        STORAGE_CLASS=$(kubectl get storageclass -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+    fi
+
+    if [[ -z "$STORAGE_CLASS" ]]; then
+        echo "Warning: No storage class found. You may need to install a storage provisioner."
+        echo "Common options:"
+        echo "  - local-path-provisioner: kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml"
+        echo "  - OpenEBS: kubectl apply -f https://openebs.github.io/charts/openebs-operator.yaml"
+        echo "  - Longhorn: kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/master/deploy/longhorn.yaml"
+        read -p "Continue without storage class? (y/N): " -n 1 -r
+        echo
+        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+            exit 1
+        fi
+    else
+        echo "Using storage class: $STORAGE_CLASS"
+    fi
+fi
+
+# Create data directories on all nodes (if using local storage)
+if [[ "$STORAGE_CLASS" == *"local"* ]] || [[ -z "$STORAGE_CLASS" ]]; then
+    echo "Creating data directories on cluster nodes..."
+
+    # Get list of node names
+    NODES_LIST=$(kubectl get nodes -o jsonpath='{.items[*].metadata.name}')
+
+    for node in $NODES_LIST; do
+        echo "Setting up data directory on node: $node"
+
+        # Try to create directory via kubectl exec (for nodes that allow it)
+        if kubectl get pods -A --field-selector spec.nodeName="$node" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null | grep -q .; then
+            # Use a pod on the node to create directories
+            kubectl run fhir-setup-$RANDOM --rm -i --restart=Never \
+                --overrides='{"spec":{"nodeName":"'$node'","hostPID":true,"hostNetwork":true,"containers":[{"name":"setup","image":"alpine","command":["nsenter","--target","1","--mount","--","sh","-c","mkdir -p '$DATA_DIR' && chmod 755 '$DATA_DIR' && echo \"Directory created on '$node'\""],"securityContext":{"privileged":true}}]}}' \
+                --image=alpine -- echo "Setup complete" 2>/dev/null || true
+        else
+            echo "Warning: Could not automatically create $DATA_DIR on node $node"
+            echo "You may need to manually run: sudo mkdir -p $DATA_DIR && sudo chmod 755 $DATA_DIR"
+        fi
+    done
+fi
+
+# Create kubeadm-specific persistent volumes configuration
+echo "Creating kubeadm persistent volumes configuration..."
+cat > ../mount/kubeadm-persistent-volumes.yaml << EOF
+# kubeadm-specific persistent volume configuration
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fhir-ci-build-pvc
+  namespace: ${NAMESPACE}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Gi
+$(if [[ -n "$STORAGE_CLASS" ]]; then echo "  storageClassName: $STORAGE_CLASS"; fi)
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: caddy-cert-pvc
+  namespace: ${NAMESPACE}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+$(if [[ -n "$STORAGE_CLASS" ]]; then echo "  storageClassName: $STORAGE_CLASS"; fi)
+EOF
+
+# Create node selector configuration if specified
+if [[ -n "$NODE_SELECTOR" ]]; then
+    echo "Creating node selector configuration..."
+    cat > ../mount/kubeadm-node-selector.yaml << EOF
+# Node selector configuration for kubeadm deployment
+NODE_SELECTOR: "$NODE_SELECTOR"
+EOF
+fi
+
+echo ""
+echo "✅ kubeadm cluster '$(kubectl config current-context)' prepared successfully!"
+echo ""
+echo "The cluster is now ready for the unified setup process."
+echo ""
+echo "Configuration summary:"
+echo "  - Namespace: $NAMESPACE"
+echo "  - Data Directory: $DATA_DIR"
+if [[ -n "$STORAGE_CLASS" ]]; then
+    echo "  - Storage Class: $STORAGE_CLASS"
+fi
+if [[ -n "$NODE_SELECTOR" ]]; then
+    echo "  - Node Selector: $NODE_SELECTOR"
+fi
+echo ""
+echo "Generated files:"
+echo "  - ../mount/kubeadm-persistent-volumes.yaml"
+if [[ -n "$NODE_SELECTOR" ]]; then
+    echo "  - ../mount/kubeadm-node-selector.yaml"
+fi
+echo ""
+echo "Next steps (follow the same process as minikube and KIND):"
+echo "1. Run unified setup:"
+echo "   ./setup.sh --type kubeadm --namespace $NAMESPACE"
+echo ""
+echo "2. Build Docker images:"
+echo "   ./build-images.sh --type kubeadm"
+echo ""
+echo "3. Deploy the application:"
+echo "   kubectl apply -f ../mount/ci-build.deployment.generated.yaml  # Deploy"
+echo ""
+echo "4. Test with example job:"
+echo "   kubectl apply -f example-job-for-minikube.yaml"
+echo ""
+echo "5. Monitor deployment:"
+echo "   kubectl get pods -n $NAMESPACE"
+echo ""
+echo "6. Access services (if needed):"
+echo "   kubectl port-forward -n $NAMESPACE svc/ci-build-service 8080:80"
+echo ""
+echo "Cleanup when done:"
+echo "   kubectl delete namespace $NAMESPACE"
+echo ""
\ No newline at end of file
diff --git a/k8s/setup-minikube.sh b/k8s/setup-minikube.sh
new file mode 100755
index 00000000..1a738d6b
--- /dev/null
+++ b/k8s/setup-minikube.sh
@@ -0,0 +1,146 @@
+#!/bin/bash
+
+# minikube cluster setup and initialization script for FHIR IG Builder
+# This script starts minikube and prepares it for the unified setup process
+
+set -e
+
+MEMORY="${MEMORY:-20000}"
+NAMESPACE="${NAMESPACE:-fhir}"
+
+usage() {
+    cat << EOF
+Usage: $0 [OPTIONS]
+
+Start and prepare minikube cluster for FHIR IG Builder development.
+After this script, use the unified setup process like KIND and kubeadm.
+
+OPTIONS:
+    -m, --memory MB         Memory allocation for minikube (default: 20000)
+    -n, --namespace NS      Kubernetes namespace (default: fhir)
+    -h, --help             Show this help message
+
+ENVIRONMENT VARIABLES:
+    MEMORY                 Same as --memory
+    NAMESPACE              Same as --namespace
+
+EXAMPLES:
+    # Default minikube setup
+    $0
+
+    # Custom memory allocation
+    $0 --memory 16000
+
+    # Complete setup workflow:
+    $0                                    # Start minikube
+    ./setup.sh --type minikube           # Run unified setup
+    ./build-images.sh --type minikube    # Build images
+    kubectl apply -f ci-build.deployment.generated.yaml  # Deploy
+
+PREREQUISITES:
+    - minikube installed
+    - Docker or another container runtime
+    - kubectl installed
+    - Sufficient system resources (20GB+ memory recommended)
+
+EOF
+}
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -m|--memory)
+            MEMORY="$2"
+            shift 2
+            ;;
+        -n|--namespace)
+            NAMESPACE="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+echo "Setting up FHIR IG Builder with minikube..."
+echo "Memory: ${MEMORY}MB"
+echo "Namespace: $NAMESPACE"
+echo
+
+# Check if minikube is installed
+if ! command -v minikube >/dev/null 2>&1; then
+    echo "Error: minikube is not installed."
+    echo "Install minikube: https://minikube.sigs.k8s.io/docs/start/"
+    exit 1
+fi
+
+# Check if kubectl is installed
+if ! command -v kubectl >/dev/null 2>&1; then
+    echo "Error: kubectl is not installed."
+    echo "Install kubectl: https://kubernetes.io/docs/tasks/tools/"
+    exit 1
+fi
+
+# Check if minikube is already running
+if minikube status >/dev/null 2>&1; then
+    echo "minikube is already running."
+    read -p "Do you want to restart it with new configuration? (y/N): " -n 1 -r
+    echo
+    if [[ $REPLY =~ ^[Yy]$ ]]; then
+        echo "Stopping minikube..."
+        minikube stop
+        echo "Starting minikube with memory=${MEMORY}MB..."
+        minikube start --memory="$MEMORY"
+    else
+        echo "Using existing minikube cluster."
+    fi
+else
+    echo "Starting minikube with memory=${MEMORY}MB..."
+    minikube start --memory="$MEMORY"
+fi
+
+# Set Docker environment to use minikube's Docker daemon
+echo "Setting Docker environment..."
+eval $(minikube docker-env)
+
+# Verify cluster is ready
+echo "Waiting for cluster to be ready..."
+kubectl wait --for=condition=Ready nodes --all --timeout=300s
+
+echo ""
+echo "✅ minikube cluster started successfully!"
+echo ""
+echo "The cluster is now ready for the unified setup process."
+echo ""
+echo "Next steps (follow the same process as KIND and kubeadm):"
+echo "1. Run unified setup:"
+echo "   ./setup.sh --type minikube --namespace $NAMESPACE"
+echo ""
+echo "2. Build Docker images:"
+echo "   ./build-images.sh --type minikube"
+echo ""
+echo "3. Deploy the application:"
+echo "   kubectl apply -f ci-build.deployment.generated.yaml"
+echo ""
+echo "4. Test with example job:"
+echo "   kubectl apply -f example-job-for-minikube.yaml"
+echo ""
+echo "5. Monitor deployment:"
+echo "   kubectl get pods -n $NAMESPACE"
+echo ""
+echo "6. Access services (if needed):"
+echo "   kubectl port-forward -n $NAMESPACE svc/ci-build-service 8080:80"
+echo ""
+echo "Cleanup when done:"
+echo "   minikube stop"
+echo ""
+echo "Note: This script has set your Docker environment to use minikube's daemon."
+echo "To revert: eval \$(minikube docker-env -u)"
+echo ""
\ No newline at end of file
diff --git a/k8s/setup.sh b/k8s/setup.sh
new file mode 100755
index 00000000..7306ca43
--- /dev/null
+++ b/k8s/setup.sh
@@ -0,0 +1,325 @@
+#!/bin/bash
+
+# Unified setup script for both local and GCloud deployments
+
+set -e
+
+# Configuration
+DEPLOYMENT_TYPE="${DEPLOYMENT_TYPE:-gcloud}"
+REGISTRY_PREFIX="${REGISTRY_PREFIX:-gcr.io/fhir-org-starter-project}"
+NAMESPACE="${NAMESPACE:-fhir}"
+
+usage() {
+    cat << EOF
+Usage: $0 [OPTIONS]
+
+Setup FHIR IG Builder for either local or GCloud deployment.
+
+OPTIONS:
+    -t, --type TYPE         Deployment type: 'local', 'minikube', 'kind', 'k3s', 'kubeadm', or 'gcloud' (default: gcloud)
+    -r, --registry PREFIX   Registry prefix (default: gcr.io/fhir-org-starter-project for gcloud, localhost:5000 for local types)
+    -n, --namespace NS      Kubernetes namespace (default: fhir)
+    -h, --help             Show this help message
+
+ENVIRONMENT VARIABLES:
+    DEPLOYMENT_TYPE         Same as --type
+    REGISTRY_PREFIX         Same as --registry
+    NAMESPACE              Same as --namespace
+    ZULIP_EMAIL            Email for Zulip notifications
+    ZULIP_API_KEY          API key for Zulip
+
+EXAMPLES:
+    # GCloud setup (default)
+    $0
+
+    # GCloud with explicit registry
+    $0 --type gcloud --registry gcr.io/fhir-org-starter-project
+
+    # Local setup with minikube/kind
+    $0 --type local --registry localhost:5000
+
+    # kubeadm cluster setup
+    $0 --type kubeadm --registry localhost:5000
+
+EOF
+}
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -t|--type)
+            DEPLOYMENT_TYPE="$2"
+            shift 2
+            ;;
+        -r|--registry)
+            REGISTRY_PREFIX="$2"
+            shift 2
+            ;;
+        -n|--namespace)
+            NAMESPACE="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+# Validate deployment type
+if [[ "$DEPLOYMENT_TYPE" != "local" && "$DEPLOYMENT_TYPE" != "gcloud" && "$DEPLOYMENT_TYPE" != "kubeadm" && "$DEPLOYMENT_TYPE" != "minikube" && "$DEPLOYMENT_TYPE" != "kind" && "$DEPLOYMENT_TYPE" != "k3s" ]]; then
+    echo "Error: DEPLOYMENT_TYPE must be 'local', 'minikube', 'kind', 'k3s', 'kubeadm', or 'gcloud'"
+    exit 1
+fi
+
+# Set defaults based on deployment type
+if [[ ("$DEPLOYMENT_TYPE" == "local" || "$DEPLOYMENT_TYPE" == "minikube" || "$DEPLOYMENT_TYPE" == "kind" || "$DEPLOYMENT_TYPE" == "k3s" || "$DEPLOYMENT_TYPE" == "kubeadm") && "$REGISTRY_PREFIX" == "gcr.io/fhir-org-starter-project" ]]; then
+    REGISTRY_PREFIX="localhost:5000"
+elif [[ "$DEPLOYMENT_TYPE" == "gcloud" && "$REGISTRY_PREFIX" == "localhost:5000" ]]; then
+    REGISTRY_PREFIX="gcr.io/fhir-org-starter-project"
+fi
+
+# Handle empty registry prefix for local image builds
+if [[ "$REGISTRY_PREFIX" == "" ]]; then
+    # For local builds without registry, just use image names directly
+    export CI_BUILD_IMAGE="ci-build:latest"
+    export CADDY_IMAGE="caddy-ratelimit:latest"
+else
+    # Use registry prefix
+    export CI_BUILD_IMAGE="${REGISTRY_PREFIX}/ci-build:latest"
+    export CADDY_IMAGE="${REGISTRY_PREFIX}/caddy-ratelimit:latest"
+fi
+
+echo "Setting up FHIR IG Builder..."
+echo "Deployment Type: $DEPLOYMENT_TYPE"
+echo "Registry: $REGISTRY_PREFIX"
+echo "Namespace: $NAMESPACE"
+echo
+
+# Create namespace
+kubectl create ns "$NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
+
+# Create SSH keys for CI build
+if [ ! -f ../mount/id ]; then
+    echo "Generating SSH keys in mount directory..."
+    ssh-keygen -t rsa -f ../mount/id -N ""
+fi
+
+# Create secrets
+echo "Creating secrets..."
+
+# CI build keys
+kubectl -n "$NAMESPACE" create secret generic ci-build-keys \
+    --from-file=id=../mount/id \
+    --from-file=id.pub=../mount/id.pub \
+    --dry-run=client -o yaml | kubectl apply -f -
+
+# FHIR settings - create files if they don't exist for all deployment types
+if [ ! -f ../mount/keyfile.ini ]; then
+    if [[ "$DEPLOYMENT_TYPE" == "gcloud" ]]; then
+        echo "Creating placeholder keyfile.ini for GCloud deployment..."
+        echo "# Please replace with actual keyfile.ini from project maintainer" > ../mount/keyfile.ini
+        echo "Warning: Using placeholder keyfile.ini. Builds may fail without real credentials."
+    else
+        echo "Creating dummy keyfile.ini for local development..."
+        echo "# Dummy keyfile for local development" > ../mount/keyfile.ini
+    fi
+fi
+
+if [ ! -f ../mount/fhir-settings.json ]; then
+    if [[ "$DEPLOYMENT_TYPE" == "gcloud" ]]; then
+        echo "Creating placeholder fhir-settings.json for GCloud deployment..."
+        echo '{"warning": "Please replace with actual fhir-settings.json from project maintainer"}' > ../mount/fhir-settings.json
+        echo "Warning: Using placeholder fhir-settings.json. Builds may fail without real settings."
+    else
+        echo "Creating dummy fhir-settings.json for local development..."
+        echo '{}' > ../mount/fhir-settings.json
+    fi
+fi
+
+# Create Kubernetes secret for all deployment types
+kubectl -n "$NAMESPACE" create secret generic fhir-settings \
+    --from-file=keyfile.ini=../mount/keyfile.ini \
+    --from-file=fhir-settings.json=../mount/fhir-settings.json \
+    --dry-run=client -o yaml | kubectl apply -f -
+
+echo "Created fhir-settings secret with:"
+if [[ "$DEPLOYMENT_TYPE" == "gcloud" ]]; then
+    echo "  - keyfile.ini (placeholder - replace with real credentials)"
+    echo "  - fhir-settings.json (placeholder - replace with real settings)"
+else
+    echo "  - keyfile.ini (dummy for local development)"
+    echo "  - fhir-settings.json (dummy for local development)"
+fi
+
+# Zulip secrets
+ZULIP_EMAIL="${ZULIP_EMAIL:-bot@localhost}"
+ZULIP_API_KEY="${ZULIP_API_KEY:-dummy-api-key}"
+
+if [[ "$DEPLOYMENT_TYPE" == "gcloud" && ("$ZULIP_EMAIL" == "bot@localhost" || "$ZULIP_API_KEY" == "dummy-api-key") ]]; then
+    echo "Warning: Using dummy Zulip credentials for GCloud deployment."
+    echo "Set ZULIP_EMAIL and ZULIP_API_KEY environment variables for production use."
+elif [[ "$DEPLOYMENT_TYPE" == "kubeadm" && ("$ZULIP_EMAIL" == "bot@localhost" || "$ZULIP_API_KEY" == "dummy-api-key") ]]; then
+    echo "Info: Using dummy Zulip credentials for kubeadm deployment."
+    echo "Set ZULIP_EMAIL and ZULIP_API_KEY environment variables for production notifications."
+fi
+
+kubectl -n "$NAMESPACE" create secret generic zulip-secrets \
+    --from-literal=email="$ZULIP_EMAIL" \
+    --from-literal=api_key="$ZULIP_API_KEY" \
+    --dry-run=client -o yaml | kubectl apply -f -
+
+# Setup storage based on deployment type
+if [[ "$DEPLOYMENT_TYPE" == "local" || "$DEPLOYMENT_TYPE" == "minikube" || "$DEPLOYMENT_TYPE" == "kind" || "$DEPLOYMENT_TYPE" == "k3s" ]]; then
+    echo "Setting up local persistent volumes..."
+    envsubst < persistent-volumes.template.yaml | kubectl apply -f -
+elif [[ "$DEPLOYMENT_TYPE" == "kubeadm" ]]; then
+    echo "Setting up kubeadm persistent volumes..."
+    if [[ -f kubeadm-persistent-volumes.yaml ]]; then
+        kubectl apply -f kubeadm-persistent-volumes.yaml
+    else
+        echo "Warning: kubeadm-persistent-volumes.yaml not found."
+        echo "Run ./setup-kubeadm.sh first to configure storage."
+        envsubst < persistent-volumes.template.yaml | kubectl apply -f -
+    fi
+elif [[ "$DEPLOYMENT_TYPE" == "gcloud" ]]; then
+    echo "Setting up GCloud persistent disks..."
+
+    # Check if disks exist, create if not
+    if ! gcloud compute disks describe fhir-ci-build-disk --zone=us-east1-d &>/dev/null; then
+        echo "Creating fhir-ci-build-disk..."
+        gcloud compute disks create fhir-ci-build-disk --size 100GB --zone=us-east1-d
+    fi
+
+    if ! gcloud compute disks describe caddy-cert-disk --zone=us-east1-d &>/dev/null; then
+        echo "Creating caddy-cert-disk..."
+        gcloud compute disks create caddy-cert-disk --size=10GB --zone=us-east1-d
+    fi
+fi
+
+# Create Caddy configuration
+echo "Creating Caddy configuration..."
+kubectl -n "$NAMESPACE" create configmap caddy-conf-volume \
+    --from-file=Caddyfile \
+    --dry-run=client -o yaml | kubectl apply -f -
+
+# Apply base configurations
+echo "Applying base configurations..."
+kubectl apply -f ci-build.configmap.yaml
+kubectl apply -f ci-build.service.yaml
+
+# Create service account
+kubectl -n "$NAMESPACE" create serviceaccount igbuild --dry-run=client -o yaml | kubectl apply -f -
+
+# Generate deployment configuration
+echo "Generating deployment configuration..."
+export DEPLOYMENT_TYPE REGISTRY_PREFIX NAMESPACE CI_BUILD_IMAGE CADDY_IMAGE
+
+# Set variables for template substitution
+if [[ "$DEPLOYMENT_TYPE" == "minikube" ]]; then
+    export IMAGE_PULL_POLICY="Never"
+    export VOLUMES_CONFIG="      - name: caddy-cert-disk
+        persistentVolumeClaim:
+          claimName: caddy-cert-pvc
+      - name: fhir-ci-build-disk
+        persistentVolumeClaim:
+          claimName: fhir-ci-build-pvc"
+    export NODE_SELECTOR_CONFIG=""
+elif [[ "$DEPLOYMENT_TYPE" == "kind" || "$DEPLOYMENT_TYPE" == "local" ]]; then
+    export IMAGE_PULL_POLICY="Never"
+    export VOLUMES_CONFIG="      - name: caddy-cert-disk
+        persistentVolumeClaim:
+          claimName: caddy-cert-pvc
+      - name: fhir-ci-build-disk
+        persistentVolumeClaim:
+          claimName: fhir-ci-build-pvc"
+    export NODE_SELECTOR_CONFIG=""
+elif [[ "$DEPLOYMENT_TYPE" == "k3s" ]]; then
+    export IMAGE_PULL_POLICY="IfNotPresent"
+    export VOLUMES_CONFIG="      - name: caddy-cert-disk
+        persistentVolumeClaim:
+          claimName: caddy-cert-pvc
+      - name: fhir-ci-build-disk
+        persistentVolumeClaim:
+          claimName: fhir-ci-build-pvc"
+    export NODE_SELECTOR_CONFIG=""
+elif [[ "$DEPLOYMENT_TYPE" == "kubeadm" ]]; then
+    export IMAGE_PULL_POLICY="IfNotPresent"
+    export VOLUMES_CONFIG="      - name: caddy-cert-disk
+        persistentVolumeClaim:
+          claimName: caddy-cert-pvc
+      - name: fhir-ci-build-disk
+        persistentVolumeClaim:
+          claimName: fhir-ci-build-pvc"
+
+    # Check for node selector configuration
+    if [[ -f ../mount/kubeadm-node-selector.yaml ]]; then
+        NODE_SELECTOR=$(grep "NODE_SELECTOR:" ../mount/kubeadm-node-selector.yaml | cut -d'"' -f2)
+        if [[ -n "$NODE_SELECTOR" ]]; then
+            export NODE_SELECTOR_CONFIG="      nodeSelector:
+        ${NODE_SELECTOR}"
+        else
+            export NODE_SELECTOR_CONFIG=""
+        fi
+    else
+        export NODE_SELECTOR_CONFIG=""
+    fi
+else
+    export IMAGE_PULL_POLICY="Always"
+    export VOLUMES_CONFIG="      - name: caddy-cert-disk
+        gcePersistentDisk:
+          fsType: ext4
+          pdName: caddy-cert-disk
+      - name: fhir-ci-build-disk
+        gcePersistentDisk:
+          fsType: ext4
+          pdName: fhir-ci-build-disk"
+    export NODE_SELECTOR_CONFIG=""
+fi
+
+envsubst < ci-build.deployment.template.yaml > ../mount/ci-build.deployment.generated.yaml
+
+echo ""
+echo "Setup complete for $DEPLOYMENT_TYPE deployment!"
+echo ""
+
+if [[ "$DEPLOYMENT_TYPE" == "local" || "$DEPLOYMENT_TYPE" == "minikube" || "$DEPLOYMENT_TYPE" == "kind" || "$DEPLOYMENT_TYPE" == "k3s" ]]; then
+    echo "Next steps for $DEPLOYMENT_TYPE deployment:"
+    echo "1. Build Docker images:"
+    echo "   ./build-images.sh --type $DEPLOYMENT_TYPE"
+    echo ""
+    echo "2. Deploy the application:"
+    echo "   kubectl apply -f ../mount/ci-build.deployment.generated.yaml"
+    echo ""
+    echo "3. Test with example job:"
+    echo "   kubectl apply -f example-job-for-minikube.yaml"
+elif [[ "$DEPLOYMENT_TYPE" == "kubeadm" ]]; then
+    echo "Next steps for kubeadm deployment:"
+    echo "1. Build or pull Docker images:"
+    echo "   ./build-images.sh --type kubeadm"
+    echo ""
+    echo "2. Deploy the application:"
+    echo "   kubectl apply -f ../mount/ci-build.deployment.generated.yaml"
+    echo ""
+    echo "3. Test with example job:"
+    echo "   kubectl apply -f example-job-for-minikube.yaml"
+    echo ""
+    echo "4. Monitor deployment:"
+    echo "   kubectl get pods -n $NAMESPACE"
+else
+    echo "Next steps for GCloud deployment:"
+    echo "1. Build and push Docker images:"
+    echo "   ./build-images.sh --type gcloud"
+    echo ""
+    echo "2. Deploy the application:"
+    echo "   kubectl apply -f ../mount/ci-build.deployment.generated.yaml"
+    echo ""
+    echo "3. Deploy Cloud Function trigger:"
+    echo "   cd ../triggers/ig-commit-trigger"
+    echo "   gcloud functions deploy ig-commit-trigger --runtime nodejs22 --trigger-http"
+fi
\ No newline at end of file