basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/passbolt
History
CTO Agent a5a1190c3b Fix Passbolt ArgoCD degraded status 
Add IgnoreExtraneous annotation to MariaDB sealed secret template metadata.
This prevents ArgoCD from seeing the unsealed secret (created by sealed-secrets controller) as an extraneous resource.

Same fix pattern as DEV-377, DEV-378, and DEV-379.

Resolves DEV-385

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-26 09:17:04 +00:00
..
ingress.yaml Fix Passbolt ingress class from nginx to traefik 2026-07-25 17:38:54 +00:00
mariadb-deployment.yaml Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00
mariadb-pvc.yaml Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00
mariadb-secret-sealed.yaml Fix Passbolt ArgoCD degraded status 2026-07-26 09:17:04 +00:00
mariadb-service.yaml Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00
namespace.yaml Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00
passbolt-deployment.yaml Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00
passbolt-pvc.yaml Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00
passbolt-secret-sealed.yaml Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00
passbolt-service.yaml Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00
README.md Move Passbolt deployment configuration to Git 2026-07-25 16:57:35 +00:00

README.md

Passbolt Deployment

This directory contains the Kubernetes manifests for the Passbolt password manager deployment.

Components

  • MariaDB: Database backend for Passbolt

    • mariadb-deployment.yaml: MariaDB deployment
    • mariadb-service.yaml: MariaDB service
    • mariadb-pvc.yaml: Persistent volume claim for MariaDB data
    • mariadb-secret-sealed.yaml: Sealed secret containing database credentials

  • Passbolt: Password manager application

    • passbolt-deployment.yaml: Passbolt application deployment
    • passbolt-service.yaml: Passbolt service
    • passbolt-pvc.yaml: Persistent volume claim for Passbolt data (GPG keys, JWT tokens)
    • passbolt-ingress.yaml: Ingress configuration for HTTPS access
    • passbolt-secret-sealed.yaml: Sealed secret containing application configuration

SMTP Configuration

Passbolt is configured to send emails through Stalwart mail server:

  • SMTP Host: stalwart-mail.stalwart.svc.cluster.local
  • SMTP Port: 25
  • SMTP Username: passbolt
  • SMTP Password: Configured via sealed secret
  • From Address: passbolt@basicstack.de
  • TLS: Disabled (internal cluster communication)

Initial Setup - Creating the First Admin User

Once the application is deployed, you can create your first admin user by running the following command:

kubectl exec -it <passbolt-pod-name> -n passbolt -- /bin/bash -c "su -s /bin/bash -c \"bin/cake passbolt register_user -u <email> -f <firstname> -l <lastname> -r admin\" www-data"

Replace the placeholders:

  • <passbolt-pod-name>: The name of the Passbolt pod (find it with kubectl get pods -n passbolt)
  • <email>: The admin user's email address
  • <firstname>: The admin user's first name
  • <lastname>: The admin user's last name

The command will output a registration link similar to:

https://passbolt.basicstack.de/setup/install/1eafab88-a17d-4ad8-97af-77a97f5ff552/f097be64-3703-41e2-8ea2-d59cbe1c15bc

Open this link in your browser to complete the user registration and set up your GPG key.

Accessing Passbolt

Once configured, Passbolt is available at: https://passbolt.basicstack.de

ArgoCD Sync

This application is managed by ArgoCD. All changes should be made through this Git repository to ensure proper GitOps workflow.