# Pocket ID Deployment

This directory contains the Kubernetes manifests for the Pocket ID deployment at https://auth.basicstack.de

## Components

- **deployment.yaml**: Main Pocket ID application deployment
  - Image: `ghcr.io/pocket-id/pocket-id:v2.11.0`
  - Resources: 100m CPU / 256Mi RAM (requests), 500m CPU / 512Mi RAM (limits)
  - Healthchecks: liveness and readiness probes using built-in healthcheck command

- **service.yaml**: ClusterIP service exposing port 1411

- **pvc.yaml**: PersistentVolumeClaim for application data
  - **CRITICAL**: Has `argocd.argoproj.io/sync-options: Delete=false` annotation to prevent data loss
  - Storage: 5Gi on local-path storage class
  - Contains all user accounts, OIDC clients, and application configuration

- **ingress.yaml**: Traefik ingress with TLS
  - Host: auth.basicstack.de
  - TLS certificate managed by cert-manager (letsencrypt-prod)

- **pocket-id-secrets-sealed.yaml**: SealedSecret containing ENCRYPTION_KEY
  - Managed by sealed-secrets controller
  - Automatically unsealed to create `pocket-id-secrets` Secret

## Migration to Argo CD

This deployment was migrated from manual kubectl deployments to Argo CD GitOps on 2026-07-12.

### Safety Measures

1. **PVC Protection**: The PVC has `Delete=false` sync option to prevent accidental deletion
2. **Resource Adoption**: Existing resources are adopted by Argo CD without recreation
3. **Data Preservation**: The existing PVC volume is reused, preserving all data
4. **Secret Management**: Secrets are managed via SealedSecrets for secure GitOps
5. **TLS Certificate**: Managed by cert-manager, automatically renewed

### Verification Steps

After Argo CD sync:
1. Verify all resources are healthy in Argo CD UI
2. Check pod is running: `kubectl get pods -n pocket-id`
3. Verify web UI is accessible: https://auth.basicstack.de
4. Test OIDC login flow with an existing client
5. Verify all existing OIDC clients are still present in admin UI

### Important Notes

- **DO NOT** delete the PVC - it contains all application data
- The ENCRYPTION_KEY in the sealed secret must match the existing key to decrypt stored data
- All existing OIDC client IDs and secrets are preserved in the PVC data
- The TLS secret is managed by cert-manager and should NOT be committed to Git