basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
310 commits 7 branches 0 tags 2.5 MiB
Commit graph

10 commits

Author SHA1 Message Date
cto-agent
8a80068b95 fix(bookstack): point probes at /status instead of / (DEV-528) 
BookStack's `/` returns 302 → /login, which caused Kubernetes to
raise ProbeWarning events on the readiness (and liveness) probes.
`/status` is BookStack's built-in monitoring endpoint: it returns
200 without a redirect and is designed for health checks.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-08-23 11:56:37 +00:00
CTO Agent
36b794a94e Document mysql-data-encrypted PVC as pre-existing, unmanaged resource 
The mysql-data-encrypted PVC exists in the cluster and is working correctly,
but attempting to manage it through Argo CD causes sync failures because the
PVC is already bound and its spec is immutable. Leaving it unmanaged while
documenting its existence.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 17:13:26 +00:00
CTO Agent
0e5566d3b9 Add missing mysql-data-encrypted PVC definition to bookstack manifests 
The MySQL deployment was referencing a PVC that wasn't defined in the
manifests. This PVC exists in the cluster but wasn't tracked by Argo CD.
Adding the definition ensures Argo CD can properly manage all resources
and prevents sync issues.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 17:11:14 +00:00
CTO Agent
2ae7e30041 Add managed label to mysql sealed secret 
This adds the sealedsecrets.bitnami.com/managed: "true" label to the
mysql sealed secret to fix Health Degraded status in Argo CD.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 12:16:48 +00:00
CTO Agent
0523d6e0c6 Fix Bookstack OIDC client ID to match Pocket ID configuration 
The deployment was using client ID "bookstack" which does not exist in
Pocket ID. Updated to use the actual client ID from Pocket ID.

This fixes the "Record not found" error when attempting to login via
Pocket ID.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 11:51:18 +00:00
CTO Agent
2e8bb89261 Update Bookstack OIDC configuration and fix Ingress hostname 
- Fix Ingress rule host from bookstack.basicstack.de to books.basicstack.de
- Update OIDC issuer from pocket-id.basicstack.de to auth.basicstack.de
- Enable AUTH_AUTO_INITIATE for seamless SSO
- Update OIDC_NAME from "Pocket-ID" to "Pocket ID"

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 11:42:22 +00:00
CTO Agent
a882636043 Fix Bookstack hostname from bookstack.basicstack.de to books.basicstack.de 
Updated APP_URL environment variable and Ingress configuration to use the correct hostname books.basicstack.de.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 11:40:46 +00:00
CTO Agent
bfbd791103 Fix bookstack deployment to use existing resources 
- Change MySQL from StatefulSet to Deployment to match existing setup
- Use existing PVC mysql-data-encrypted (contains live data) instead of creating new mysql-data
- Add PersistentVolumeClaim for bookstack-config to persist APP_KEY and configuration
- Remove duplicate MySQL resource definitions
- Align with current working deployment while making Forgejo the source of truth

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 11:24:21 +00:00
CTO Agent
62c4398787 Add complete Bookstack deployment manifests 
Added comprehensive Kubernetes deployment for Bookstack including:
- MySQL StatefulSet with PersistentVolumeClaim (10Gi encrypted storage)
- MySQL Service (ClusterIP)
- Bookstack Deployment with OIDC/Pocket-ID integration
- Bookstack Service (ClusterIP)
- Ingress with TLS certificate (bookstack.basicstack.de)

The deployment uses existing sealed secrets for MySQL credentials and
Bookstack OIDC client secret. Bookstack is configured with proper
health checks and resource limits.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 11:14:33 +00:00
CTO Agent
d5e8c28a6a Convert all secrets to SealedSecrets for enhanced security 
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.

Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
  * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
  * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
  * Paperclip (4 secrets): main secrets, auth, OIDC, session
  * Forgejo (2 secrets): postgres, backup
  * BookStack (2 secrets): OIDC, MySQL
  * Passbolt (2 secrets): MariaDB, app secrets
  * Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets

All sealed secrets have been applied to the cluster and services verified
to be running correctly.

Related: DEV-203

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 18:38:27 +00:00