a4f4c814ec
This commit converts all application secrets to SealedSecrets, preventing plaintext secrets from being stored in git. Changes: - Added .gitignore to prevent future plaintext secret commits - Created 20 SealedSecret manifests across 8 applications: * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC * Paperclip (4 secrets): main secrets, auth, OIDC, session * Forgejo (2 secrets): postgres, backup * BookStack (2 secrets): OIDC, MySQL * Passbolt (2 secrets): MariaDB, app secrets * Pocket ID (1 secret) - Removed hardcoded secrets from 6 stalwart deployment files - Replaced plaintext credentials with references to sealed secrets All sealed secrets have been applied to the cluster and services verified to be running correctly. Related: DEV-203 Co-Authored-By: Paperclip <noreply@paperclip.ing> |
||
|---|---|---|
| .. | ||
| README.md | ||
| stalwart-admin-credentials-sealed.yaml | ||
| stalwart-backup-restore.md | ||
| stalwart-bootstrap-completion-guide.md | ||
| stalwart-config-complete.json | ||
| stalwart-config-fix-v2.yaml | ||
| stalwart-config-fix.yaml | ||
| stalwart-config-with-data.json | ||
| stalwart-console-pod.yaml | ||
| stalwart-dashboard-configmap.yaml | ||
| stalwart-deployment-new.yaml | ||
| stalwart-deployment-oidc-only.yaml | ||
| stalwart-deployment-with-oidc.yaml | ||
| stalwart-deployment.yaml | ||
| stalwart-grafana-dashboard.json | ||
| stalwart-helm-fix.yaml | ||
| stalwart-helm-values-oidc.yaml | ||
| stalwart-monitoring.yaml | ||
| stalwart-oauth2-proxy-secret-sealed.yaml | ||
| stalwart-oidc-config.yaml | ||
| stalwart-oidc-sealed.yaml | ||
| stalwart-s3-backup-sealed.yaml | ||
| stalwart-service-patch.yaml | ||
| stalwart-statefulset-patch-v2.yaml | ||
| stalwart-statefulset-patch-v3.yaml | ||
| stalwart-statefulset-patch.yaml | ||
| stalwart-values-correct.yaml | ||
| stalwart-values-fixed-ports.yaml | ||
| stalwart-values.yaml | ||
Stalwart Mail Server Deployment
This directory contains the complete deployment configuration for the Stalwart mail server on the basicstack.de cluster.
Files Overview
Deployment Manifests
stalwart-deployment.yaml- Basic deployment configurationstalwart-deployment-new.yaml- Updated deployment variantstalwart-deployment-with-oidc.yaml- Deployment with OIDC integrationstalwart-deployment-oidc-only.yaml- OIDC-only authentication deployment
Helm Configuration
stalwart-values.yaml- Main Helm values filestalwart-values-fixed-ports.yaml- Values with corrected port configurationsstalwart-values-correct.yaml- Verified correct valuesstalwart-helm-values-oidc.yaml- Helm values for OIDC setupstalwart-helm-fix.yaml- Helm chart fixes
Configuration
stalwart-oidc-config.yaml- OIDC provider configurationstalwart-config-fix.yaml- Configuration correctionsstalwart-config-fix-v2.yaml- Updated configuration fix
Monitoring
stalwart-monitoring.yaml- Prometheus ServiceMonitor and metricsstalwart-dashboard-configmap.yaml- Grafana dashboard configuration
Maintenance
stalwart-console-pod.yaml- Debug/console pod for troubleshootingstalwart-service-patch.yaml- Service configuration patchstalwart-statefulset-patch.yaml- StatefulSet patches (v1, v2, v3)
Documentation
stalwart-backup-restore.md- Backup and restore proceduresstalwart-bootstrap-completion-guide.md- Initial setup guide
Deployment Notes
This is a reference implementation showing the evolution of a production deployment. Multiple variants are preserved to show:
- Different authentication strategies (local vs. OIDC)
- Configuration iterations and fixes
- Monitoring integration
- Operational procedures
When deploying a new service, you don't need this many files - choose the appropriate manifest for your use case and adapt it.
Current Production Deployment
Review the files to determine which manifest represents the current production state, or check the cluster directly with:
kubectl get deployment,statefulset -n stalwart