1743815703
Namespace-scoped Postgres 16 + unified Vikunja container behind Traefik ingress at vikunja.basicstack.de. Both pods pinned to Hetzner fsn1 due to their encrypted PVCs (10 Gi DB, 10 Gi attachments). Local auth disabled; sign-in only via Pocket ID (client `Vikunja`, groups `vikunja_admins` / `vikunja_members`). SMTP mailer left disabled pending mailbox provisioning. Co-Authored-By: Paperclip <noreply@paperclip.ing>
36 lines
2 KiB
Markdown
36 lines
2 KiB
Markdown
# Vikunja (vikunja.basicstack.de)
|
|
|
|
Self-hosted task manager. Unified `vikunja/vikunja` container (API + frontend on port 3456). Backed by a namespace-local PostgreSQL. OIDC via Pocket ID (`auth.basicstack.de`); local login disabled.
|
|
|
|
## Layout
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| `vikunja-db-pvc.yaml` | 10 Gi encrypted PVC for Postgres data |
|
|
| `vikunja-files-pvc.yaml` | 10 Gi encrypted PVC for user-uploaded attachments (`/app/vikunja/files`) |
|
|
| `vikunja-postgres-deployment.yaml` | Postgres 16, pinned to `csi.hetzner.cloud/location=fsn1` |
|
|
| `vikunja-postgres-service.yaml` | ClusterIP `vikunja-postgres:5432` |
|
|
| `vikunja-deployment.yaml` | Vikunja app, pinned to `fsn1`, waits on Postgres |
|
|
| `vikunja-service.yaml` | ClusterIP `vikunja:80` → pod `3456` |
|
|
| `vikunja-ingress.yaml` | Traefik + `letsencrypt-prod` cert |
|
|
| `vikunja-db-credentials-sealed.yaml` | Postgres user password |
|
|
| `vikunja-oidc-secret-sealed.yaml` | Pocket ID client id + secret |
|
|
| `vikunja-app-secrets-sealed.yaml` | Vikunja JWT secret |
|
|
|
|
## Node placement
|
|
|
|
Both the app and Postgres pin to Hetzner location `fsn1` because their PVCs live on `hcloud-volumes-encrypted` (datacenter-local).
|
|
|
|
## OIDC
|
|
|
|
- Pocket ID client `Vikunja` (id `cdfff4ee-28ba-4aab-9f47-7e41b4b6b847`), callback `https://vikunja.basicstack.de/auth/openid/basicstack`.
|
|
- Pocket ID groups `vikunja_admins` and `vikunja_members`.
|
|
- Vikunja does not map OIDC groups to the admin flag. Promote the first user post-login: `kubectl -n vikunja exec deploy/vikunja -- /app/vikunja/vikunja user chmod --admin <username>`.
|
|
|
|
## Optional: SMTP
|
|
|
|
`VIKUNJA_MAILER_ENABLED=false` today. To enable reminder emails, create a Stalwart mailbox `vikunja@basicstack.de`, add its credentials as a sealed secret `vikunja-mailer`, and set `VIKUNJA_MAILER_ENABLED=true` plus host/port/from env vars.
|
|
|
|
## Change control
|
|
|
|
Manifest changes flow through Argo CD (Application: `apps/app-vikunja.yaml`, auto-sync + prune + selfHeal). Sealed secrets are encrypted against the cluster-active sealed-secrets key.
|