basicstack/stack.basicstack.de

History

CTO (Paperclip Agent) ec3e9624b3 feat(velero): schedules + PVC exclude annotations (DEV-573) - velero/schedules/: cluster-all @ 03:00 (30d TTL, manifests only), per-namespace <ns>-manifests @ 03:15+n min (30 in-scope namespaces, 30d TTL, no fs backup), and per-namespace <ns>-data @ 03:45+n min for the whitelist (pocket-id, vaultwarden, vikunja, passbolt; 14d TTL, defaultVolumesToFsBackup=true). - All schedules exclude velero, kube-system, kube-node-lease, kube-public so the Kopia password Secret never lands in S3. - apps/app-velero-schedules.yaml: sibling Argo app syncing that directory into namespace velero with prune+selfHeal. - opencloud, harbor(registry+trivy): pod-template annotation backup.velero.io/backup-volumes-excludes as a safety net so blob- heavy PVCs are never fs-backed-up even under a manual defaultVolumes run. nextcloud/monitoring workloads are not Argo-tracked yet — they were patched live in the same commit but need a follow-up to source- control them. Co-Authored-By: Paperclip <noreply@paperclip.ing>		2026-09-12 17:35:49 +00:00
..
Chart.yaml	Refactor Harbor deployment to follow project structure pattern	2026-07-18 14:02:31 +00:00
harbor-secrets-sealed.yaml	Fix Harbor ArgoCD degraded status by ignoring unsealed secret	2026-07-25 15:05:37 +00:00
README.md	Refactor Harbor deployment to follow project structure pattern	2026-07-18 14:02:31 +00:00
values.yaml	feat(velero): schedules + PVC exclude annotations (DEV-573)	2026-09-12 17:35:49 +00:00

README.md

Harbor Container Registry

Harbor is deployed at https://harbor.basicstack.de

Initial Access

The initial admin credentials are stored in the harbor-secrets sealed secret:

Username: admin
Password: Retrieved from secret key harborAdminPassword

OIDC Authentication Setup

Harbor requires OIDC to be configured via the web UI or API after initial deployment. The Helm chart does not support OIDC configuration at deployment time.

Steps to Configure Pocket ID OIDC

Create OIDC Client in Pocket ID
- Navigate to https://auth.basicstack.de
- Create a new client with these settings:
  - Client ID: harbor
  - Redirect URIs: https://harbor.basicstack.de/c/oidc/callback
  - Scopes: openid, profile, email, groups
- Save the client secret
Configure OIDC in Harbor
- Log in to Harbor as admin: https://harbor.basicstack.de
- Navigate to: Administration → Configuration → Authentication
- Select OIDC as the authentication mode
- Fill in the following:
  - OIDC Provider Name: PocketID
  - OIDC Endpoint: https://auth.basicstack.de
  - OIDC Client ID: harbor
  - OIDC Client Secret: (paste the secret from Pocket ID)
  - Group Claim Name: groups
  - OIDC Admin Group: admins
  - OIDC Scope: openid,profile,email,groups
  - Verify Certificate: ✓ (enabled)
  - Automatic onboarding: ✓ (enabled)
  - Username Claim: email
- Click Test OIDC Server to verify connectivity
- Click Save to apply the configuration
Test OIDC Login
- Log out of Harbor
- Return to the Harbor login page
- You should now see a "Login via OIDC Provider" button
- Click it to authenticate via Pocket ID

Reference Documentation

Harbor OIDC Configuration: https://goharbor.io/docs/2.12.0/administration/configure-authentication/oidc-auth/
Pocket ID Harbor Example: https://pocket-id.org/docs/client-examples/harbor

Storage

Harbor uses encrypted Hetzner Cloud volumes for persistence:

Registry data: 50Gi
PostgreSQL database: 10Gi
Redis cache: 5Gi
Trivy vulnerability database: 5Gi
Job service logs: 5Gi

All PVCs are configured with resourcePolicy: keep to prevent data loss during upgrades.

Architecture

Ingress: Traefik with Let's Encrypt TLS certificates
Database: Internal PostgreSQL
Cache: Internal Redis
Vulnerability Scanning: Trivy enabled
Authentication: OIDC via Pocket ID (after manual configuration)