basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
104 commits 7 branches 0 tags 2.5 MiB
Commit graph

3 commits

Author SHA1 Message Date
CTO Agent
bfbd791103 Fix bookstack deployment to use existing resources 
- Change MySQL from StatefulSet to Deployment to match existing setup
- Use existing PVC mysql-data-encrypted (contains live data) instead of creating new mysql-data
- Add PersistentVolumeClaim for bookstack-config to persist APP_KEY and configuration
- Remove duplicate MySQL resource definitions
- Align with current working deployment while making Forgejo the source of truth

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 11:24:21 +00:00
CTO Agent
62c4398787 Add complete Bookstack deployment manifests 
Added comprehensive Kubernetes deployment for Bookstack including:
- MySQL StatefulSet with PersistentVolumeClaim (10Gi encrypted storage)
- MySQL Service (ClusterIP)
- Bookstack Deployment with OIDC/Pocket-ID integration
- Bookstack Service (ClusterIP)
- Ingress with TLS certificate (bookstack.basicstack.de)

The deployment uses existing sealed secrets for MySQL credentials and
Bookstack OIDC client secret. Bookstack is configured with proper
health checks and resource limits.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 11:14:33 +00:00
CTO Agent
d5e8c28a6a Convert all secrets to SealedSecrets for enhanced security 
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.

Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
  * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
  * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
  * Paperclip (4 secrets): main secrets, auth, OIDC, session
  * Forgejo (2 secrets): postgres, backup
  * BookStack (2 secrets): OIDC, MySQL
  * Passbolt (2 secrets): MariaDB, app secrets
  * Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets

All sealed secrets have been applied to the cluster and services verified
to be running correctly.

Related: DEV-203

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 18:38:27 +00:00