basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
170 commits 7 branches 0 tags 2.5 MiB
Commit graph

5 commits

Author SHA1 Message Date
CTO Agent
3fa9f6e6f5 Enable Forgejo Actions support 
Add FORGEJO__actions__ENABLED and DEFAULT_ACTIONS_URL environment
variables to enable Actions/CI workflows in Forgejo.

This is required for DEV-334 CI/CD workflow implementation.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-18 14:20:48 +00:00
andreas.leinen
66905ba424 apps/forgejo/forgejo-postgres-secret-sealed.yaml aktualisiert 2026-07-12 14:10:45 +00:00
CTO Agent
b0fce8e16b Add managed annotation to forgejo-postgres-secret SealedSecret 
Adds sealedsecrets.bitnami.com/managed annotation to ensure proper
lifecycle management by the sealed-secrets controller. This is a
non-destructive fix that improves secret synchronization without
touching encrypted data or affecting access.

Related: DEV-290, DEV-289

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 14:03:31 +00:00
CTO Agent
08030791c1 Add Forgejo deployment manifests for Argo CD GitOps 
Migrate all Forgejo deployment resources from cluster to Git repository:
- Forgejo Deployment with PostgreSQL backend
- Forgejo Service and Ingress with TLS
- Forgejo PersistentVolumeClaim (5Gi)
- PostgreSQL StatefulSet and Service
- Backup CronJob (daily at 03:00 UTC, 14-day retention)

All existing PVCs (forgejo-data, postgres-data-forgejo-postgres-0) and
Pocket-ID SSO configuration are preserved. No data loss expected.

The Argo CD Application (app-forgejo.yaml) is already configured to
sync from apps/forgejo/ path in this repository.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-12 13:55:47 +00:00
CTO Agent
d5e8c28a6a Convert all secrets to SealedSecrets for enhanced security 
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.

Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
  * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
  * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
  * Paperclip (4 secrets): main secrets, auth, OIDC, session
  * Forgejo (2 secrets): postgres, backup
  * BookStack (2 secrets): OIDC, MySQL
  * Passbolt (2 secrets): MariaDB, app secrets
  * Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets

All sealed secrets have been applied to the cluster and services verified
to be running correctly.

Related: DEV-203

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 18:38:27 +00:00