Commit graph

7 commits

Author SHA1 Message Date
a980fd9bfe apps/pocket-id/README.md aktualisiert 2026-07-18 13:12:34 +00:00
ae1cfb0e37 apps/pocket-id/deployment.yaml aktualisiert 2026-07-18 13:12:21 +00:00
ea7b1d64a4 apps/pocket-id/deployment.yaml aktualisiert
Update to version v2.10.0
2026-07-12 14:53:18 +00:00
CTO Agent
3149867b9b Add IgnoreExtraneous annotation to Pocket ID sealed secret template
This tells Argo CD to ignore the unsealed secret created by the sealed-secrets controller, preventing the health status from being degraded.

This is the same fix applied in DEV-289 and DEV-290 for Forgejo and Argo.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-12 14:49:32 +00:00
CTO Agent
2cdbd04848 Add Pocket ID migration verification and rollout guide
Documents the complete migration process, safety measures, and verification steps
for the Pocket ID Argo CD migration.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-12 14:36:50 +00:00
CTO Agent
794cf51d0c Add Pocket ID deployment manifests for Argo CD GitOps
Migrated Pocket ID deployment from manual kubectl to GitOps. All existing resources
will be adopted by Argo CD without recreation, preserving data and configuration.

Key safety measures:
- PVC has Delete=false annotation to prevent data loss
- Existing sealed secret reused for ENCRYPTION_KEY
- TLS certificate managed by cert-manager (not in Git)
- All OIDC clients and user data preserved in existing PVC

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-12 14:35:28 +00:00
CTO Agent
d5e8c28a6a Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.

Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
  * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
  * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
  * Paperclip (4 secrets): main secrets, auth, OIDC, session
  * Forgejo (2 secrets): postgres, backup
  * BookStack (2 secrets): OIDC, MySQL
  * Passbolt (2 secrets): MariaDB, app secrets
  * Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets

All sealed secrets have been applied to the cluster and services verified
to be running correctly.

Related: DEV-203

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00