Add Pangolin Kubernetes manifests

Created complete Kubernetes deployment for Pangolin SSO gateway:

- PVC: 10Gi encrypted storage for data persistence
- Deployment: fosrl/pangolin:1.21.0 with OIDC configuration
  - Resources: 200m/512Mi requests, 1000m/2Gi limits
  - Recreate strategy for single-replica deployment
  - Health probes configured
- Service: ClusterIP on port 3001
- Ingress: pangolin.basicstack.de with TLS via cert-manager
- SealedSecret: Contains admin password and OIDC credentials
  - Client ID: 6cb8db32-410b-4df6-b2af-298af447b09a
  - Integrated with Pocket ID at auth.basicstack.de
  - Authorized group: pangolin-admins
- Argo CD Application: Automated sync with CreateNamespace

OIDC authentication configured for pangolin-admins group members:
- andreas.leinen@basicstack.de
- admin@basicstack.de

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/app-pangolin.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: pangolin
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/stack.basicstack.de.git
+    targetRevision: main
+    path: apps/pangolin
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: pangolin
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true

apps/pangolin/pangolin-deployment.yaml

@@ -0,0 +1,143 @@
+---
+# Pangolin Data PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pangolin-data
+  namespace: pangolin
+  annotations:
+    argocd.argoproj.io/sync-options: Delete=false
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: hcloud-volumes-encrypted
+  resources:
+    requests:
+      storage: 10Gi
+---
+# Pangolin Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pangolin
+  namespace: pangolin
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pangolin
+  template:
+    metadata:
+      labels:
+        app: pangolin
+    spec:
+      containers:
+      - name: pangolin
+        image: fosrl/pangolin:1.21.0
+        ports:
+        - containerPort: 3001
+          name: http
+        env:
+        - name: PANGOLIN_URL
+          value: "https://pangolin.basicstack.de"
+        - name: DATABASE_PATH
+          value: "/data/pangolin.db"
+        # OIDC Configuration
+        - name: OIDC_ENABLED
+          value: "true"
+        - name: OIDC_ISSUER
+          value: "https://auth.basicstack.de"
+        - name: OIDC_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: pangolin-secrets
+              key: oidc-client-id
+        - name: OIDC_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: pangolin-secrets
+              key: oidc-client-secret
+        - name: OIDC_CALLBACK_URL
+          value: "https://pangolin.basicstack.de/auth/callback"
+        - name: OIDC_SCOPES
+          value: "openid profile email groups"
+        # Admin Credentials
+        - name: ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: pangolin-secrets
+              key: admin-password
+        volumeMounts:
+        - name: pangolin-data
+          mountPath: /data
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "200m"
+          limits:
+            memory: "2Gi"
+            cpu: "1000m"
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 3001
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 6
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 3001
+          initialDelaySeconds: 30
+          periodSeconds: 5
+          timeoutSeconds: 3
+          failureThreshold: 3
+      volumes:
+      - name: pangolin-data
+        persistentVolumeClaim:
+          claimName: pangolin-data
+---
+# Pangolin Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: pangolin
+  namespace: pangolin
+spec:
+  type: ClusterIP
+  selector:
+    app: pangolin
+  ports:
+  - port: 3001
+    targetPort: 3001
+    protocol: TCP
+---
+# Pangolin Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: pangolin
+  namespace: pangolin
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - pangolin.basicstack.de
+    secretName: pangolin-tls
+  rules:
+  - host: pangolin.basicstack.de
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: pangolin
+            port:
+              number: 3001

apps/pangolin/pangolin-secrets-sealed.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: pangolin-secrets
+  namespace: pangolin
+spec:
+  encryptedData:
+    admin-password: AgCdZss9e7VyQTcs7TqsX6B1VuieMdBM0N1zf5xWXdNsNKLaqOdrqg/w/ZQTG5LaValIY5Jf2ghfNf3qhYdmH9jZk01KUCEUoX8FTd56ka6NRlFmos9DjYWGad3DjUlo3nFRgAv04hZ33hKCMZNuyPab1+W1OD+Lw/ohobVae8YsOFSNCf8XmttR78010mtMAFqX5zy/ylHN2Ht3XdH7WwNrcfkJvkASpExipJjOBYBG14apKoe6L+idXH73Raa+3AhQWSeQjaa6WB9u5RvfNSyPYxgGfXp8H5PfOFbL2kFxjqKm73VDmlZ4i/hK061iswtX7jzeORGMX7e0qlN+N2dxHDBop59fQ8Z8WiW/PU1WLo7OcrG/c4RswyWanb//DD+1VMGqxBxFE3yng/TKUKNOIbX5SR2pCHHkrBPVxq8vgmZTJdUxtlvLWO4UQBgHjtDJqTNRyj6bb+/ebjfACU+WQPK/DmSp3FWtpEpOR3k7cMN01BjyyOv4jVMgzvmHOXKHm9S0aT617nYfCCh5UFbsBMNFQRydVQyvLcpom6fqKPm0voX6TzyuvShAOIbRGr8fS/vnjZW2RoajiMEZpgYd5q/aDQwSbBkrBVYx0kPFxw/J6iyV3puyCvhEjHShRefWmjqTT+aJy/XkP7svQFqHDZLBUWvCZdtIAorNqbSmZ+m6qbYbUpLVZ54ktqiQgeGAXZIOhbirAhgb2ygNf6ChJ/496zujEzTWqeOpI4I80h7AUJNVPQYsNYBXjg==
+    oidc-client-id: AgB1ySL0hutCIK8fa+8KY2RO+NtAez+QB0RSPi1TnJCxQfWkOgICs0ammNTBDJTt/7uEIn3+BLNPvDAh1N9adtsOfDiGiLAAq4PJDTHZo9LdN2iTybVo3b2TmIUlH5pP8mOc07Hxafl7ffcQRmFG8JaCO36KOAhPMpJRcetBet2JqEM22PUXXM+ywJ9hbOCIOizJANZROMEy8AHCBrhrL7Fk9rftwlhoAfh+DVbxOKvKdp0FyeE/RFHMWq0bifvyqmROdSESKgk3gMMnqpu9f8mZOXaHCljJLPF8KxIfp4ezpZPA5xQMAfv771VPwS11RHVc3f4OFwxvXrBpkOqK2N1GkI5ns5T5nCWESfeO9ebVq0SiVhtvLW2rZZQdS3/kdMPHerEZeNrxnm/0QvvvnOz8ZmLXulWLK7bUEndOx15kgf2VFTnTOOVSsHmZAKvLVD2NDQtbD4u6OuiOuwoewuPv33Z77mpJT1RhCtYmnN37cJrDUqaD9HwIUvqEjcefOLUXbwBNHqajBrPGWBsMciWxcZyAeXMDsFTHOZgj6i4Ua7qbl0vIbtHU7p7ik9oQSIF46493HAOMaUU1F3fUNJbmZKWr5Z1SifvYm7dLsXQDUMXKXCGj8nC/jUU5JHLnHCQRPKQ7tdN1dEum60x68riU+x6ZAchZ9XL27ecranXAVIgpqNW/6Ss1UWEoVbiNoU21HFtjyZ0RrUGJxTwI6TimOU7MYgfaiQ4fnnQK56yMlIpDhnw=
+    oidc-client-secret: AgB1lGh6Moy0TgMM2+8Vo0Q6mvYF44AGR9xetmXpA1Li+FUq+EtdMENePVeL3WtC0H0C01EF16Zdje4YKgf8XQvClaxongS/yWYhHghOj5l5ZuHsimYt6/aPYWpyiBuOHKzAv4OlXxMxtUi5OQ2D8Ntg/iJd1FeQMvmOqFmuX0XBIRpFqCiLmschbfkBVX0u10Gb32YlV+5nVYu9E3jFDYnSxz+TnivXgaRmQUcYA9+/GzGSkVYOpRT3vzfFHdIAi7ZfXXecj+VPXX66yKwsqbwph1+0GUtNOsH9BZ8SNtVqMxkIwh+8IXJS99nL5WI8Imenq7tfTehHHQnh1HMQYAPZwHkg26l1+Jq90nL0jY+nEbtsAcz/NNIopIFWaoOWVaiQx/i4aAEF2a1TilZEZ/Jq14b+U4HeXVuGkIGiSejiF0HA8JdgUpWWtcNnSD8X1a/GCk/27rMcTq0GCUN1E2+CE07fQVr0ya75GV5e823Hg4y8EKES4CBxrj4HiSarNhdLMFbuT2houNYwdFInxkWfIPAKtsZikPL2jQUzv2eQpNF7r/O9N6NcIEoW91PU4lmM8MoS/Zn4DEuDBQTqpVTCUOtBd2EwjJCKWMuF9b88+R8xL99NzuMqSTcKOy5DHnG0EV9Gv1GFWxcdg2m+1ODU6q1WKYuigwgoZDsgiJy9USqNdQfQscmNtn0BqpUQmFOiLD9NhaAOcJkY1vMOu94BYiz+WhfpRLNPu0dWtxKINg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: pangolin-secrets
+      namespace: pangolin