28a28bf7c0
Hand-rolled manifests under apps/kaneo/ + Argo Application: - Dedicated PostgreSQL 16-alpine on hcloud-volumes-encrypted (20Gi), pinned to fsn1 via csi.hetzner.cloud/location node affinity. - Kaneo v2.22.0 (single ghcr.io/usekaneo/kaneo image; API + web on 5173). Pinned to fsn1 for consistency with the volume. - Traefik ingress at kaneo.basicstack.de with letsencrypt-prod cert. - Better Auth JWT secret and Postgres credentials as SealedSecrets. - OIDC via Pocket ID using CUSTOM_OAUTH_*, restricted to the two new Pocket ID groups kaneo-admins / kaneo-members (client id d58ff9bb-dc98-49b4-9535-4af2aba66de2). - Registration + password + email-OTP sign-in disabled; SSO only. Co-Authored-By: Paperclip <noreply@paperclip.ing>
53 lines
2.4 KiB
Markdown
53 lines
2.4 KiB
Markdown
# Kaneo
|
|
|
|
Self-hosted [Kaneo](https://github.com/usekaneo/kaneo) — open-source project
|
|
management — deployed on the BasicStack Kubernetes cluster.
|
|
|
|
- **URL:** https://kaneo.basicstack.de
|
|
- **Namespace:** `kaneo`
|
|
- **Distribution:** hand-rolled manifests, GitOps-managed by Argo CD
|
|
(see `apps/app-kaneo.yaml`).
|
|
- **Auth:** OIDC via Pocket ID (`https://auth.basicstack.de`) with
|
|
`CUSTOM_OAUTH_*` env vars. Client id + secret live in
|
|
`kaneo-oidc-secret` (SealedSecret). Access is restricted to
|
|
Pocket ID groups `kaneo-admins` / `kaneo-members`.
|
|
- **Database:** dedicated PostgreSQL in-namespace on
|
|
`hcloud-volumes-encrypted` (20Gi). Both the Postgres and Kaneo
|
|
pods pin to the `fsn1` datacenter via
|
|
`csi.hetzner.cloud/location=fsn1` node affinity — the Hetzner
|
|
volume is DC-local.
|
|
- **TLS:** Traefik ingress, cert issued by `letsencrypt-prod`
|
|
(DNS-01 via the Hetzner cert-manager webhook).
|
|
- **Image:** `ghcr.io/usekaneo/kaneo:2.22.0` (single container
|
|
bundling API + web on port 5173, health at `/api/health`).
|
|
|
|
## Files
|
|
|
|
| File | Purpose |
|
|
| --- | --- |
|
|
| `kaneo-postgres-pvc.yaml` | 20 Gi encrypted Hetzner volume for Postgres data. |
|
|
| `kaneo-postgres-deployment.yaml` | Postgres 16-alpine, pinned to `fsn1`. |
|
|
| `kaneo-postgres-service.yaml` | ClusterIP service `kaneo-postgres:5432`. |
|
|
| `kaneo-db-credentials-sealed.yaml` | Postgres user password (SealedSecret). |
|
|
| `kaneo-app-secrets-sealed.yaml` | `AUTH_SECRET` (Better Auth JWT secret, ≥32 chars). |
|
|
| `kaneo-oidc-secret-sealed.yaml` | OIDC client id + secret from Pocket ID. |
|
|
| `kaneo-deployment.yaml` | Kaneo app deployment (pinned to `fsn1`). |
|
|
| `kaneo-service.yaml` | ClusterIP service on port 80 → container 5173. |
|
|
| `kaneo-ingress.yaml` | Traefik ingress + `letsencrypt-prod` cert. |
|
|
|
|
## Post-deploy setup
|
|
|
|
1. Point browser at https://kaneo.basicstack.de and sign in via the
|
|
"Sign in with Pocket ID" (custom OAuth) button.
|
|
2. The first admin (`andreas.leinen@basicstack.de`, member of
|
|
`kaneo-admins`) must be promoted inside Kaneo — the current
|
|
upstream release does not map OIDC groups to roles.
|
|
|
|
## SMTP
|
|
|
|
SMTP env vars are intentionally not wired. Once a
|
|
`kaneo@basicstack.de` mailbox exists in Stalwart, add
|
|
`SMTP_HOST/SMTP_PORT/SMTP_USER/SMTP_PASSWORD/SMTP_FROM` via
|
|
`kaneo-smtp-sealed.yaml` and reference them from the deployment. Set
|
|
`DISABLE_EMAIL_OTP_SIGN_IN=true` so users continue to sign in via SSO
|
|
rather than email codes.
|