basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/outline/README.md
CTO 2c9e90ac2b docs(outline): note PKCE must be disabled on the Pocket ID client 
Outline's OIDC plugin does not send `code_challenge`, so the Pocket ID
client must be created with `pkceEnabled: false` (default is `true`).
Login fails with `?notice=auth-error` and Pocket ID rejects
`/authorize` when PKCE is enforced.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-09-05 09:57:39 +00:00

2.4 KiB
Raw Blame History

Outline (outline.basicstack.de)

Self-hosted knowledge base — Outline.

Stack

  • App: outlinewiki/outline:1.10.0 (Deployment, 1 replica, Recreate strategy)
  • Database: Postgres 16 (StatefulSet, PVC 10Gi on hcloud-volumes-encrypted)
  • Cache/queue: Redis 7 (StatefulSet, PVC 2Gi on hcloud-volumes-encrypted)
  • Object storage: Hetzner Object Storage bucket outline-basicstack (region hel1)
  • Auth: Pocket ID OIDC (Outline client, restricted to outline_admins / outline_members)
  • Ingress: Traefik, TLS via letsencrypt-prod (DNS-01)
  • Node placement: stateful pods pinned to Hetzner location fsn1 (matches CSI-encrypted PVCs)

Files

File Purpose
namespace.yaml Namespace declaration
postgres.yaml Postgres StatefulSet + Service (fsn1-pinned)
redis.yaml Redis StatefulSet + Service (fsn1-pinned)
outline.yaml App Deployment + Service + Ingress (+ PVC for local cache)
postgres-credentials-sealed.yaml Sealed Postgres user/db/password
app-secrets-sealed.yaml Sealed SECRET_KEY, UTILS_SECRET, DATABASE_URL, REDIS_URL
oidc-sealed.yaml Sealed OIDC client id + secret
s3-sealed.yaml Sealed S3 access key, secret, endpoint, region, bucket

Deployment references

  • Argo Application: apps/app-outline.yaml
  • Pocket ID OIDC client id: b4a84bbd-fae4-445e-868e-5c1197e5d155 (PKCE disabled — Outline's OIDC plugin does not send code_challenge; group restriction on, allowed groups: outline_admins, outline_members)
  • Pocket ID groups: outline_admins (2b41fc67-eb7b-43d8-8954-85426214f1a8), outline_members (aa6df56f-b868-4de1-adf7-8696e990aa53)
  • DNS: outline.basicstack.de A → 138.199.128.63 (cluster ingress)
  • S3 endpoint: https://hel1.your-objectstorage.com bucket outline-basicstack (CORS whitelisted to https://outline.basicstack.de)

Deferred items

  • SMTP: Outline runs without email notifications. To enable, create/reuse a Stalwart mailbox (e.g. outline@basicstack.de) and add a sealed outline-smtp secret with smtp-host, smtp-port, smtp-username, smtp-password, then extend outline.yaml with the SMTP_* env vars.
  • Admin promotion: first Pocket ID user in outline_admins becomes the initial team owner via first-login. If the admin role does not stick automatically, promote in Settings → Members after login.