basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/outline
History
cto-agent 38c7b8c624 feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 
- Namespace `outline` with Postgres 16, Redis 7, and Outline 1.10.0
- Stateful pods pinned to Hetzner location `fsn1` (encrypted CSI volumes)
- Pocket ID OIDC integration (group-restricted to outline_admins/outline_members)
- Hetzner Object Storage bucket `outline-basicstack` (region hel1) with CORS
- Traefik Ingress with cert-manager `letsencrypt-prod` (DNS-01)
- Sealed secrets for postgres, app (SECRET_KEY/UTILS_SECRET/URLs), OIDC, S3
- Argo CD Application `outline` in `apps/app-outline.yaml`

SMTP notifications deferred (see apps/outline/README.md).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-09-05 09:42:21 +00:00
..
app-secrets-sealed.yaml feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00
namespace.yaml feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00
oidc-sealed.yaml feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00
outline.yaml feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00
postgres-credentials-sealed.yaml feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00
postgres.yaml feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00
README.md feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00
redis.yaml feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00
s3-sealed.yaml feat(outline): deploy Outline knowledge base at outline.basicstack.de (DEV-559) 2026-09-05 09:42:21 +00:00

README.md

Outline (outline.basicstack.de)

Self-hosted knowledge base — Outline.

Stack

  • App: outlinewiki/outline:1.10.0 (Deployment, 1 replica, Recreate strategy)
  • Database: Postgres 16 (StatefulSet, PVC 10Gi on hcloud-volumes-encrypted)
  • Cache/queue: Redis 7 (StatefulSet, PVC 2Gi on hcloud-volumes-encrypted)
  • Object storage: Hetzner Object Storage bucket outline-basicstack (region hel1)
  • Auth: Pocket ID OIDC (Outline client, restricted to outline_admins / outline_members)
  • Ingress: Traefik, TLS via letsencrypt-prod (DNS-01)
  • Node placement: stateful pods pinned to Hetzner location fsn1 (matches CSI-encrypted PVCs)

Files

File Purpose
namespace.yaml Namespace declaration
postgres.yaml Postgres StatefulSet + Service (fsn1-pinned)
redis.yaml Redis StatefulSet + Service (fsn1-pinned)
outline.yaml App Deployment + Service + Ingress (+ PVC for local cache)
postgres-credentials-sealed.yaml Sealed Postgres user/db/password
app-secrets-sealed.yaml Sealed SECRET_KEY, UTILS_SECRET, DATABASE_URL, REDIS_URL
oidc-sealed.yaml Sealed OIDC client id + secret
s3-sealed.yaml Sealed S3 access key, secret, endpoint, region, bucket

Deployment references

  • Argo Application: apps/app-outline.yaml
  • Pocket ID OIDC client id: b4a84bbd-fae4-445e-868e-5c1197e5d155
  • Pocket ID groups: outline_admins (2b41fc67-eb7b-43d8-8954-85426214f1a8), outline_members (aa6df56f-b868-4de1-adf7-8696e990aa53)
  • DNS: outline.basicstack.de A → 138.199.128.63 (cluster ingress)
  • S3 endpoint: https://hel1.your-objectstorage.com bucket outline-basicstack (CORS whitelisted to https://outline.basicstack.de)

Deferred items

  • SMTP: Outline runs without email notifications. To enable, create/reuse a Stalwart mailbox (e.g. outline@basicstack.de) and add a sealed outline-smtp secret with smtp-host, smtp-port, smtp-username, smtp-password, then extend outline.yaml with the SMTP_* env vars.
  • Admin promotion: first Pocket ID user in outline_admins becomes the initial team owner via first-login. If the admin role does not stick automatically, promote in Settings → Members after login.