mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 14:04:31 +00:00
cf33342500
knoe-auth (prole.org k3s): - Fix CNPG manifest drift: remove spec.backup.pluginConfiguration (CNPG 1.28 only), switch spec.certificates from serverTLSSecret to serverAltDNSNames - Apply knoe-auth Round 1 schema + GRANTs manually (postInitSQL had never run on live cluster) - Fix OIDC signing key generator: base64(DER) not base64(PEM) — OidcTokenService does Base64.decode() → PKCS8EncodedKeySpec which requires raw DER bytes - Add OIDC controllers: authorize, token, userinfo, jwks, discovery - Add prole Spring profile: cookieDomain, emailDomain, Kerberos config - Add secret example templates: knoe-db-user, knoe-auth-oidc-signing, knoe-auth-google-prole - Kong configmap: scope knoe-auth route to /auth prefix only Tenant onboarding: - Add etc/onboard_tenant.sh: provision/apply/rotate/status workflow backed by 1Password vaults; types: 'enterprise' (own Kerberos + domain) and 'tenant' (hosted, initContainer KDC) - Provision 'Knoe Tenant - prole.org' vault; apply all 7 k8s secrets to knoe-system - init_knoe_auth.sh: add explicit GRANT + ALTER DEFAULT PRIVILEGES for knoe role Cluster stabilisation: - gitea: roll back 14-day stuck rollout (RWO PVC + maxSurge=100% deadlock); patch deployment strategy to Recreate - supabase: create supabase_admin role, _supabase db, _analytics schema, _realtime schema in CNPG — analytics and realtime had never connected since Helm install day 1 - knoe-db barman ObjectStore: add GCS-backed objectstore manifest + scheduled backup Infrastructure: - gandalf host_vars: k3s registry config - pi host_vars: clean up stale entries - knoe-db schemas: ekosystem.sql, ekosystem_objects.sql - init_prole_app.sql: prole app DB initialisation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
57 lines
1.6 KiB
YAML
57 lines
1.6 KiB
YAML
---
|
|
hostname: gandalf
|
|
fqdn: gandalf.prole.org
|
|
ansible_host: 10.0.0.7
|
|
ansible_user: ansible
|
|
|
|
k3s_enabled: true
|
|
k3s_role: agent
|
|
k3s_cluster_init: false
|
|
k3s_server_url: "https://myrddin.prole.org:6443"
|
|
|
|
k3s_service_node_labels:
|
|
- "prole.org/node-role=general"
|
|
k3s_node_taints: []
|
|
|
|
k3s_rancher_mount_required: true
|
|
k3s_rancher_mount_src: /external/rancher
|
|
k3s_rancher_mount_fstype: none
|
|
k3s_rancher_mount_opts: bind
|
|
k3s_rancher_mount_passno: 0
|
|
|
|
k3s_required_mounts:
|
|
- /var/lib/rancher
|
|
- /synology/d003
|
|
- /synology/d005
|
|
|
|
iscsi_portal: 10.0.0.203:3260
|
|
|
|
iscsi_targets:
|
|
# PROLE-DATA-3 — knoe-db replica storage (CNPG knoe-db-3 data + WAL)
|
|
# Moved from pi.prole.org 2026-05-24 during gandalf full integration.
|
|
# Synology ACL must include gandalf initiator: iqn.1993-08.org.debian:01:5f78ddfd77a
|
|
- iqn: "iqn.2000-01.com.synology:synology.Target-13.292d45194a1"
|
|
chap_user: "prole"
|
|
chap_password: "{{ vault_iscsi_prole_password }}"
|
|
mounts:
|
|
- name: d003
|
|
path: /synology/d003
|
|
src: "UUID=757f1ee4-dc23-414b-b595-e3058c0744f0"
|
|
fstype: xfs
|
|
opts: "_netdev,noatime"
|
|
|
|
# PROLE-DATA-5
|
|
- iqn: "iqn.2000-01.com.synology:synology.Target-14.292d45194a1"
|
|
chap_user: "prole"
|
|
chap_password: "{{ vault_iscsi_prole_password }}"
|
|
mounts:
|
|
- name: d005
|
|
path: /synology/d005
|
|
device: /dev/disk/by-path/ip-10.0.0.203:3260-iscsi-iqn.2000-01.com.synology:synology.Target-14.292d45194a1-lun-1-part1
|
|
fstype: ext4
|
|
opts: "_netdev,noatime,nofail"
|
|
|
|
prole_ssl_src_dir: /etc/ssl/certs/prole
|
|
prole_ssl_files:
|
|
- gandalf.crt
|
|
- gandalf.key |