stack.basicstack.de/apps/outline/README.md

# Outline (outline.basicstack.de)

Self-hosted knowledge base — [Outline](https://www.getoutline.com/).

## Stack

- **App:** `outlinewiki/outline:1.10.0` (Deployment, 1 replica, `Recreate` strategy)
- **Database:** Postgres 16 (StatefulSet, PVC 10Gi on `hcloud-volumes-encrypted`)
- **Cache/queue:** Redis 7 (StatefulSet, PVC 2Gi on `hcloud-volumes-encrypted`)
- **Object storage:** Hetzner Object Storage bucket `outline-basicstack` (region `hel1`)
- **Auth:** Pocket ID OIDC (`Outline` client, restricted to `outline_admins` / `outline_members`)
- **Ingress:** Traefik, TLS via `letsencrypt-prod` (DNS-01)
- **Node placement:** stateful pods pinned to Hetzner location `fsn1` (matches CSI-encrypted PVCs)

## Files

| File | Purpose |
| ---- | ------- |
| `namespace.yaml` | Namespace declaration |
| `postgres.yaml` | Postgres StatefulSet + Service (fsn1-pinned) |
| `redis.yaml` | Redis StatefulSet + Service (fsn1-pinned) |
| `outline.yaml` | App Deployment + Service + Ingress (+ PVC for local cache) |
| `postgres-credentials-sealed.yaml` | Sealed Postgres user/db/password |
| `app-secrets-sealed.yaml` | Sealed `SECRET_KEY`, `UTILS_SECRET`, `DATABASE_URL`, `REDIS_URL` |
| `oidc-sealed.yaml` | Sealed OIDC client id + secret |
| `s3-sealed.yaml` | Sealed S3 access key, secret, endpoint, region, bucket |

## Deployment references

- Argo Application: `apps/app-outline.yaml`
- Pocket ID OIDC client id: `b4a84bbd-fae4-445e-868e-5c1197e5d155` (PKCE **disabled** — Outline's OIDC plugin does not send `code_challenge`; group restriction on, allowed groups: `outline_admins`, `outline_members`)
- Pocket ID groups: `outline_admins` (`2b41fc67-eb7b-43d8-8954-85426214f1a8`), `outline_members` (`aa6df56f-b868-4de1-adf7-8696e990aa53`)
- DNS: `outline.basicstack.de` A → `138.199.128.63` (cluster ingress)
- S3 endpoint: `https://hel1.your-objectstorage.com` bucket `outline-basicstack` (CORS whitelisted to `https://outline.basicstack.de`)

## Deferred items

- **SMTP:** Outline runs without email notifications. To enable, create/reuse a Stalwart mailbox (e.g. `outline@basicstack.de`) and add a sealed `outline-smtp` secret with `smtp-host`, `smtp-port`, `smtp-username`, `smtp-password`, then extend `outline.yaml` with the `SMTP_*` env vars.
- **Admin promotion:** first Pocket ID user in `outline_admins` becomes the initial team owner via first-login. If the admin role does not stick automatically, promote in Settings → Members after login.