157 lines
4.6 KiB
YAML
157 lines
4.6 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: kaneo
|
|
namespace: kaneo
|
|
labels:
|
|
app: kaneo
|
|
component: app
|
|
spec:
|
|
replicas: 0
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: kaneo
|
|
component: app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: kaneo
|
|
component: app
|
|
spec:
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: csi.hetzner.cloud/location
|
|
operator: In
|
|
values:
|
|
- fsn1
|
|
initContainers:
|
|
- name: wait-for-postgres
|
|
image: postgres:16-alpine
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
until pg_isready -h kaneo-postgres -U kaneo -d kaneo; do
|
|
echo "Waiting for PostgreSQL..."
|
|
sleep 2
|
|
done
|
|
containers:
|
|
- name: kaneo
|
|
image: ghcr.io/usekaneo/kaneo:2.22.0
|
|
ports:
|
|
- name: http
|
|
containerPort: 5173
|
|
env:
|
|
# Public URL of this Kaneo instance.
|
|
- name: KANEO_CLIENT_URL
|
|
value: https://kaneo.basicstack.de
|
|
- name: CORS_ORIGINS
|
|
value: https://kaneo.basicstack.de
|
|
# Better Auth JWT secret (>=32 chars).
|
|
- name: AUTH_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: kaneo-app-secrets
|
|
key: auth-secret
|
|
# Database credentials. DATABASE_URL is preferred; POSTGRES_* are
|
|
# accepted as a fallback and useful for the built-in migrations.
|
|
- name: POSTGRES_DB
|
|
value: kaneo
|
|
- name: POSTGRES_USER
|
|
value: kaneo
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: kaneo-db-credentials
|
|
key: postgres-password
|
|
- name: POSTGRES_HOST
|
|
value: kaneo-postgres
|
|
- name: POSTGRES_PORT
|
|
value: "5432"
|
|
- name: DATABASE_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: kaneo-db-credentials
|
|
key: database-url
|
|
# Self-hosted: keep public registration off, log in via OIDC only.
|
|
- name: DISABLE_REGISTRATION
|
|
value: "true"
|
|
- name: DISABLE_PASSWORD_REGISTRATION
|
|
value: "true"
|
|
- name: DISABLE_EMAIL_OTP_SIGN_IN
|
|
value: "true"
|
|
- name: KANEO_CLOUD
|
|
value: "false"
|
|
# Custom OAuth / OIDC via Pocket ID.
|
|
- name: CUSTOM_OAUTH_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: kaneo-oidc-secret
|
|
key: client-id
|
|
- name: CUSTOM_OAUTH_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: kaneo-oidc-secret
|
|
key: client-secret
|
|
- name: CUSTOM_OAUTH_DISCOVERY_URL
|
|
value: https://auth.basicstack.de/.well-known/openid-configuration
|
|
- name: CUSTOM_OAUTH_AUTHORIZATION_URL
|
|
value: https://auth.basicstack.de/authorize
|
|
- name: CUSTOM_OAUTH_TOKEN_URL
|
|
value: https://auth.basicstack.de/api/oidc/token
|
|
- name: CUSTOM_OAUTH_USER_INFO_URL
|
|
value: https://auth.basicstack.de/api/oidc/userinfo
|
|
- name: CUSTOM_OAUTH_LOGOUT_URL
|
|
value: https://auth.basicstack.de/api/oidc/end-session
|
|
- name: CUSTOM_OAUTH_SCOPES
|
|
value: openid,profile,email,groups
|
|
- name: CUSTOM_AUTH_PKCE
|
|
value: "true"
|
|
# SMTP: outbound only, used for workspace invites / notifications.
|
|
# Sign-in still requires OIDC (DISABLE_EMAIL_OTP_SIGN_IN=true above).
|
|
- name: SMTP_HOST
|
|
value: mail.basicstack.de
|
|
- name: SMTP_PORT
|
|
value: "587"
|
|
- name: SMTP_SECURE
|
|
value: "false"
|
|
- name: SMTP_REQUIRE_TLS
|
|
value: "true"
|
|
- name: SMTP_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: kaneo-smtp
|
|
key: smtp-user
|
|
- name: SMTP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: kaneo-smtp
|
|
key: smtp-password
|
|
- name: SMTP_FROM
|
|
value: "Kaneo <kaneo@basicstack.de>"
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: http
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: http
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|