basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
351 commits 8 branches 0 tags 2.8 MiB
Commit graph

5 commits

Author SHA1 Message Date
CTO (Paperclip Agent)
9b8cfebbd5 velero: reseal S3 credential with new Hetzner project key 
The prior sealed secret's access key lived in the personal `imicros.de`
Hetzner Object Storage project and could not list objects in
`basicstack-velero` (bucket is in the BasicStack project) — BSL was
`Unavailable` with an S3 `AccessDenied` on ListObjectsV2.

CEO created a new S3 credential in the BasicStack project; re-sealed
against the cluster controller and applied. BSL `default` now
`Available`.

Refs DEV-572.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-09-12 17:25:15 +00:00
CTO Agent
60cc931d6b fix(velero): pin AWS plugin to v1.14.2 (v1.14.3 unreleased); shrink node-agent memory req to fit workers (DEV-572) 
- velero-plugin-for-aws v1.14.3 is not published on docker.io (only rc.1/rc.2). Downgrade to the latest GA tag v1.14.2 — still compatible with Velero 1.18.x.
- Drop node-agent memory request 256Mi -> 64Mi so the daemonset schedules on worker-1/2/3 (they sit at ~95% memory-request already).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-09-12 17:08:09 +00:00
CTO Agent
b3d98bf902 feat(velero): Argo app + Helm values for Kopia/Hetzner S3 backups (DEV-572) 
- apps/app-velero.yaml: Argo Application, path apps/velero, ns velero,
  CreateNamespace + ServerSideApply (chart uses long CRDs).
- apps/velero/Chart.yaml: pinned vmware-tanzu velero chart 12.1.0
  (appVersion 1.18.1).
- apps/velero/values.yaml: Kopia uploader, no CSI, node-agent enabled,
  AWS S3 provider -> https://hel1.your-objectstorage.com, dedicated
  bucket basicstack-velero (per DEV-570), BSL credential
  velero-s3-credentials/cloud, Kopia repo password auto-picked from
  velero-repo-credentials/repository-password.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-09-12 17:05:42 +00:00
CTO Agent
f318719c59 velero(secrets): seal dedicated Hetzner OS S3 credential (DEV-570) 
Adds SealedSecret velero-s3-credentials in namespace velero, holding
the dedicated velero-prod Hetzner Object Storage access/secret key
(scoped only to the basicstack-velero bucket).

Sealed on cp-1 via /root/seal-velero-s3-credentials.sh with the
sealed-secrets-controller public cert; plaintext never left the host.
Only the in-cluster controller can decrypt.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-09-12 17:00:43 +00:00
CTO Agent
0c82ded5f7 velero(secrets): seal Kopia repo password for velero namespace 
Adds the SealedSecret for the Kopia repository password that the Velero
BackupRepository will consume once the Argo app lands. Raw password is
held on cp-1 (root:root, 0600) pending the CEO handoff to Vaultwarden
and the offline safe copy (DEV-571).

Refs: DEV-569, DEV-571

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-09-12 16:22:22 +00:00