basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
234 commits 7 branches 0 tags 2.5 MiB
Commit graph

10 commits

Author SHA1 Message Date
CTO Agent
2f1fe3dd6b Fix Pangolin TLS certificate by switching to HTTP-01 challenge 
The DNS-01 challenge has been stuck for 5+ days due to Hetzner DNS
webhook issues. Switched to the more reliable HTTP-01 challenge method
by using the new letsencrypt-http01 ClusterIssuer.

This resolves the missing certificate issue for pangolin.basicstack.de.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-08-01 10:36:43 +00:00
CTO Agent
2e8e8ee3eb Fix Pangolin health probes: route to Web UI port 3002 instead of Internal API port 3001 
Pangolin runs three servers:
- Dashboard API on port 3000
- Internal API on port 3001
- Web UI on port 3002

The current configuration was routing traffic to port 3001 (Internal API), which
returns 404 for the root path, causing health probe failures and restart loops.

Changes:
- Update containerPort from 3001 to 3002
- Update livenessProbe to check port 3002
- Update readinessProbe to check port 3002
- Update Service to expose port 3002
- Update Ingress to route to port 3002

This allows health probes to pass (port 3002 returns 200 for /) and routes
web traffic to the correct Web UI server.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 17:16:03 +00:00
CTO Agent
3905fb1037 Fix Pangolin config: use YAML format with required fields 
Pangolin requires config/config.yml (YAML, not TOML) with specific required fields:
- gerbil.start_port, gerbil.base_endpoint
- app.dashboard_url, app.log_level
- domains.domain1.base_domain
- server.secret, server.cors.origins
- flags (signup, verification)
- database.path
- oidc configuration

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 12:23:19 +00:00
CTO Agent
0447c7378f Use environment-specific config filename (prod.toml) 
Pangolin with ENVIRONMENT=prod likely looks for prod.toml in the config directory.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 12:21:07 +00:00
CTO Agent
954b27d457 Try mounting config at /config.toml 
Testing different config file location to match Pangolin's expectations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 12:20:34 +00:00
CTO Agent
af85adbd53 Fix Pangolin config file mount path 
Mount config file to /app/config/config.toml instead of /app/config.toml as the application expects it in the config directory.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 12:19:25 +00:00
CTO Agent
1c740828ed Add Pangolin configuration file 
Pangolin requires a config.toml file to start. Added ConfigMap with basic configuration including URL, database path, and OIDC settings. Updated deployment to mount the config file.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 12:17:14 +00:00
CTO Agent
3d0d5f3f3a Reduce Pangolin resource requests for initial deployment 
Cluster nodes are at 93-99% memory capacity. Reduced requests from 512Mi to 256Mi and CPU from 200m to 100m to allow pod scheduling.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 12:14:42 +00:00
CTO Agent
2c8a7ca1e8 Add Pangolin Kubernetes manifests 
Created complete Kubernetes deployment for Pangolin SSO gateway:

- PVC: 10Gi encrypted storage for data persistence
- Deployment: fosrl/pangolin:1.21.0 with OIDC configuration
  - Resources: 200m/512Mi requests, 1000m/2Gi limits
  - Recreate strategy for single-replica deployment
  - Health probes configured
- Service: ClusterIP on port 3001
- Ingress: pangolin.basicstack.de with TLS via cert-manager
- SealedSecret: Contains admin password and OIDC credentials
  - Client ID: 6cb8db32-410b-4df6-b2af-298af447b09a
  - Integrated with Pocket ID at auth.basicstack.de
  - Authorized group: pangolin-admins
- Argo CD Application: Automated sync with CreateNamespace

OIDC authentication configured for pangolin-admins group members:
- andreas.leinen@basicstack.de
- admin@basicstack.de

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 12:09:07 +00:00
CTO Agent
629882d29d Add Pangolin repository structure and DNS configuration 
Created apps/pangolin/ directory with namespace.yaml defining the pangolin namespace.
Configured DNS A record for pangolin.basicstack.de → 178.105.17.239 (cluster ingress IP).
Updated DNS_REQUIREMENTS.md to document the new Pangolin service.

This completes Phase 1 of the Pangolin deployment (DEV-390):
- Repository structure created with namespace definition
- DNS record configured and verified in Hetzner zone
- Documentation updated

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 11:58:00 +00:00