basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
322 commits 7 branches 0 tags 2.5 MiB
Commit graph

6 commits

Author SHA1 Message Date
CTO
a7e81db4e1 chore(directus): bump 12.1.1 -> 12.3.0 (DEV-537) 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-08-23 15:27:14 +00:00
CTO Agent
58ffdc9bf4 Add IgnoreExtraneous annotation to Directus sealed secrets 
This tells Argo CD to ignore the unsealed secrets created by the sealed-secrets controller, preventing the health status from being degraded.

This is the same fix applied previously in DEV-289, DEV-290, and to Pocket ID for the same issue.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-25 14:57:27 +00:00
CTO Agent
1f81d61642 Fix Directus health check 403 errors (DEV-376) 
Changed liveness probe from HTTP /server/health to TCP socket check
and readiness probe to use root path instead. The /server/health
endpoint in Directus v12+ requires authentication by default,
causing 403 responses that triggered pod restarts.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-25 14:30:14 +00:00
CTO Agent
38ed8316dd Add Directus license key as sealed secret 
Adds the Directus license key (DP3WZ-8DT8F-79FME-5HJ1A-E4EMJ) as a sealed secret and configures the deployment to use it via the LICENSE_KEY environment variable.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-25 14:20:31 +00:00
CTO Agent
a309c6873c Add complete Directus configuration and update to v12.1.1 
Moved Directus deployment configuration from k8s cluster to Git repository:
- Main Directus deployment updated to v12.1.1
- PostgreSQL deployment (postgres:16-alpine)
- Services for both Directus and PostgreSQL
- Ingress with TLS/cert-manager
- Backup CronJob (daily at 2 AM)
- PVCs for database and uploads

This enables GitOps management via Argo CD.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-25 13:45:47 +00:00
CTO Agent
d5e8c28a6a Convert all secrets to SealedSecrets for enhanced security 
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.

Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
  * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
  * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
  * Paperclip (4 secrets): main secrets, auth, OIDC, session
  * Forgejo (2 secrets): postgres, backup
  * BookStack (2 secrets): OIDC, MySQL
  * Passbolt (2 secrets): MariaDB, app secrets
  * Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets

All sealed secrets have been applied to the cluster and services verified
to be running correctly.

Related: DEV-203

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 18:38:27 +00:00