basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/vikunja
History
CTO 18eba97fcb feat(vikunja): request vikunja_scope for OIDC group→team mapping (DEV-564) 
Add `vikunja_scope` to the OIDC scope list the Vikunja app requests
from Pocket ID, so the `vikunja_groups` custom claim is available for
Vikunja's automatic team provisioning.

The claim itself is set per Pocket ID user group (`vikunja_admins`,
`vikunja_members`) via `PUT /api/custom-claims/user-group/:id`.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-09-05 09:47:37 +00:00
..
README.md chore(vikunja): rename JWT env to non-deprecated service.secret (DEV-560) 2026-09-05 09:41:05 +00:00
vikunja-app-secrets-sealed.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00
vikunja-db-credentials-sealed.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00
vikunja-db-pvc.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00
vikunja-deployment.yaml feat(vikunja): request vikunja_scope for OIDC group→team mapping (DEV-564) 2026-09-05 09:47:37 +00:00
vikunja-files-pvc.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00
vikunja-ingress.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00
vikunja-oidc-secret-sealed.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00
vikunja-postgres-deployment.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00
vikunja-postgres-service.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00
vikunja-service.yaml feat(vikunja): deploy Vikunja 2.6.0 with Pocket ID OIDC (DEV-560) 2026-09-05 09:38:25 +00:00

README.md

Vikunja (vikunja.basicstack.de)

Self-hosted task manager. Unified vikunja/vikunja container (API + frontend on port 3456). Backed by a namespace-local PostgreSQL. OIDC via Pocket ID (auth.basicstack.de); local login disabled.

Layout

File Purpose
vikunja-db-pvc.yaml 10 Gi encrypted PVC for Postgres data
vikunja-files-pvc.yaml 10 Gi encrypted PVC for user-uploaded attachments (/app/vikunja/files)
vikunja-postgres-deployment.yaml Postgres 16, pinned to csi.hetzner.cloud/location=fsn1
vikunja-postgres-service.yaml ClusterIP vikunja-postgres:5432
vikunja-deployment.yaml Vikunja app, pinned to fsn1, waits on Postgres
vikunja-service.yaml ClusterIP vikunja:80 → pod 3456
vikunja-ingress.yaml Traefik + letsencrypt-prod cert
vikunja-db-credentials-sealed.yaml Postgres user password
vikunja-oidc-secret-sealed.yaml Pocket ID client id + secret
vikunja-app-secrets-sealed.yaml Vikunja JWT secret

Node placement

Both the app and Postgres pin to Hetzner location fsn1 because their PVCs live on hcloud-volumes-encrypted (datacenter-local).

OIDC

  • Pocket ID client Vikunja (id cdfff4ee-28ba-4aab-9f47-7e41b4b6b847), callback https://vikunja.basicstack.de/auth/openid/basicstack.
  • Pocket ID groups vikunja_admins and vikunja_members.
  • Vikunja does not map OIDC groups to the admin flag. Promote the first user post-login: kubectl -n vikunja exec deploy/vikunja -- /app/vikunja/vikunja user set-admin --admin <username>.

Optional: SMTP

VIKUNJA_MAILER_ENABLED=false today. To enable reminder emails, create a Stalwart mailbox vikunja@basicstack.de, add its credentials as a sealed secret vikunja-mailer, and set VIKUNJA_MAILER_ENABLED=true plus host/port/from env vars.

Change control

Manifest changes flow through Argo CD (Application: apps/app-vikunja.yaml, auto-sync + prune + selfHeal). Sealed secrets are encrypted against the cluster-active sealed-secrets key.