basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
298 commits 7 branches 0 tags 2.5 MiB
Commit graph

12 commits

Author SHA1 Message Date
CTO Agent
64f61981ba chore(paperclip): Remove legacy plain Ingress for paperclip.basicstack.de (DEV-456) 
Pangolin's IngressRoute 1-paperclip-router (pangolin ns) now owns the
paperclip.basicstack.de route (SSO gate via badger middleware). The legacy
Ingress at paperclip/paperclip bypassed Pangolin entirely and produced
"secret paperclip/paperclip-tls does not exist" noise in Traefik.

Cluster deletion follows in this heartbeat; Argo sync policy has no
automated prune, so removal from source is safe first.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-08-08 14:56:06 +00:00
CTO Agent
38f970b0e9 Fix Paperclip storage and permissions 
- Change PVC storage class from local-path to hcloud-volumes-encrypted
- Extend initContainer to create full directory structure including instances/default/data/run-logs
- This fixes permission errors when agents try to create run logs

Resolves: DEV-388

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 11:10:21 +00:00
andreas.leinen
797ac22512 apps/paperclip/ingress.yaml aktualisiert 
correction of the base url
 2026-07-26 10:39:45 +00:00
andreas.leinen
49c6a2cd4a apps/paperclip/deployment.yaml aktualisiert 
Correction of the base url
 2026-07-26 10:39:10 +00:00
CTO Agent
ad28439642 Add namespace.yaml to prevent accidental deletion 
Add explicit namespace definition to ensure ArgoCD doesn't delete the namespace during sync operations.

Resolves: DEV-387

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 10:09:40 +00:00
CTO Agent
c0dd78d172 Use exec probe for health checks instead of HTTP probe 
The /api/health endpoint returns 403 when accessed externally but works from localhost. Changed readiness and liveness probes to use exec with wget from inside the container to work around this restriction.

Resolves: DEV-387

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 10:07:16 +00:00
CTO Agent
c0aecf125a Fix Paperclip health check endpoint path 
Change health check from /health to /api/health to match the actual API endpoint. The server is healthy but the readiness/liveness probes were failing because they were checking the wrong path.

Resolves: DEV-387

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 10:05:50 +00:00
CTO Agent
c7c0ac2998 Revert "Use existing encrypted PVCs and postgres deployment" 
This reverts commit 8cac765a64.
 2026-07-26 10:04:28 +00:00
CTO Agent
8cac765a64 Use existing encrypted PVCs and postgres deployment 
- Change paperclip deployment to use paperclip-data-encrypted PVC (preserves existing data)
- Remove pvc.yaml (use existing PVC instead of creating new one)
- Remove postgres StatefulSet and service (use existing postgres deployment)

This preserves the existing 43-day-old data in the encrypted volumes instead of creating a fresh deployment.

Resolves: DEV-387

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 10:03:33 +00:00
CTO Agent
1b613f06f5 Fix Paperclip deployment scheduling and ArgoCD degraded status 
- Reduce resource requests from 500m/1Gi to 200m/512Mi to fit available cluster capacity
- Reduce resource limits from 2000m/4Gi to 1000m/2Gi for better resource sharing
- Add IgnoreExtraneous annotation to paperclip-secrets SealedSecret to fix ArgoCD degraded status

Resolves: DEV-387

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 10:00:04 +00:00
CTO Agent
4773547808 Add complete Paperclip deployment manifests to apps/paperclip 
Add all necessary Kubernetes manifests for Paperclip deployment:
- deployment.yaml: Main Paperclip application deployment
- service.yaml: ClusterIP service for Paperclip (port 3100)
- ingress.yaml: Traefik ingress for paperclip.home.imicros.de
- pvc.yaml: 50Gi persistent volume for Paperclip data
- postgres-statefulset.yaml: PostgreSQL 16 StatefulSet
- postgres-service.yaml: PostgreSQL service

This completes the GitOps configuration for Paperclip in the
apps/paperclip directory. The ArgoCD application at apps/app-paperclip.yaml
is already configured to deploy from this path.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-26 09:47:55 +00:00
CTO Agent
d5e8c28a6a Convert all secrets to SealedSecrets for enhanced security 
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.

Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
  * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
  * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
  * Paperclip (4 secrets): main secrets, auth, OIDC, session
  * Forgejo (2 secrets): postgres, backup
  * BookStack (2 secrets): OIDC, MySQL
  * Passbolt (2 secrets): MariaDB, app secrets
  * Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets

All sealed secrets have been applied to the cluster and services verified
to be running correctly.

Related: DEV-203

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 18:38:27 +00:00