basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/kaneo
History
CTO 28a28bf7c0 feat(kaneo): deploy Kaneo project management (DEV-561) 
Hand-rolled manifests under apps/kaneo/ + Argo Application:

- Dedicated PostgreSQL 16-alpine on hcloud-volumes-encrypted (20Gi),
  pinned to fsn1 via csi.hetzner.cloud/location node affinity.
- Kaneo v2.22.0 (single ghcr.io/usekaneo/kaneo image; API + web on
  5173). Pinned to fsn1 for consistency with the volume.
- Traefik ingress at kaneo.basicstack.de with letsencrypt-prod cert.
- Better Auth JWT secret and Postgres credentials as SealedSecrets.
- OIDC via Pocket ID using CUSTOM_OAUTH_*, restricted to the two
  new Pocket ID groups kaneo-admins / kaneo-members (client id
  d58ff9bb-dc98-49b4-9535-4af2aba66de2).
- Registration + password + email-OTP sign-in disabled; SSO only.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-09-05 09:38:04 +00:00
..
kaneo-app-secrets-sealed.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
kaneo-db-credentials-sealed.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
kaneo-deployment.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
kaneo-ingress.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
kaneo-oidc-secret-sealed.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
kaneo-postgres-deployment.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
kaneo-postgres-pvc.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
kaneo-postgres-service.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
kaneo-service.yaml feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00
README.md feat(kaneo): deploy Kaneo project management (DEV-561) 2026-09-05 09:38:04 +00:00

README.md

Kaneo

Self-hosted Kaneo — open-source project management — deployed on the BasicStack Kubernetes cluster.

  • URL: https://kaneo.basicstack.de
  • Namespace: kaneo
  • Distribution: hand-rolled manifests, GitOps-managed by Argo CD (see apps/app-kaneo.yaml).
  • Auth: OIDC via Pocket ID (https://auth.basicstack.de) with CUSTOM_OAUTH_* env vars. Client id + secret live in kaneo-oidc-secret (SealedSecret). Access is restricted to Pocket ID groups kaneo-admins / kaneo-members.
  • Database: dedicated PostgreSQL in-namespace on hcloud-volumes-encrypted (20Gi). Both the Postgres and Kaneo pods pin to the fsn1 datacenter via csi.hetzner.cloud/location=fsn1 node affinity — the Hetzner volume is DC-local.
  • TLS: Traefik ingress, cert issued by letsencrypt-prod (DNS-01 via the Hetzner cert-manager webhook).
  • Image: ghcr.io/usekaneo/kaneo:2.22.0 (single container bundling API + web on port 5173, health at /api/health).

Files

File Purpose
kaneo-postgres-pvc.yaml 20 Gi encrypted Hetzner volume for Postgres data.
kaneo-postgres-deployment.yaml Postgres 16-alpine, pinned to fsn1.
kaneo-postgres-service.yaml ClusterIP service kaneo-postgres:5432.
kaneo-db-credentials-sealed.yaml Postgres user password (SealedSecret).
kaneo-app-secrets-sealed.yaml AUTH_SECRET (Better Auth JWT secret, ≥32 chars).
kaneo-oidc-secret-sealed.yaml OIDC client id + secret from Pocket ID.
kaneo-deployment.yaml Kaneo app deployment (pinned to fsn1).
kaneo-service.yaml ClusterIP service on port 80 → container 5173.
kaneo-ingress.yaml Traefik ingress + letsencrypt-prod cert.

Post-deploy setup

  1. Point browser at https://kaneo.basicstack.de and sign in via the "Sign in with Pocket ID" (custom OAuth) button.
  2. The first admin (andreas.leinen@basicstack.de, member of kaneo-admins) must be promoted inside Kaneo — the current upstream release does not map OIDC groups to roles.

SMTP

SMTP env vars are intentionally not wired. Once a kaneo@basicstack.de mailbox exists in Stalwart, add SMTP_HOST/SMTP_PORT/SMTP_USER/SMTP_PASSWORD/SMTP_FROM via kaneo-smtp-sealed.yaml and reference them from the deployment. Set DISABLE_EMAIL_OTP_SIGN_IN=true so users continue to sign in via SSO rather than email codes.