mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 15:04:31 +00:00
cf33342500
knoe-auth (prole.org k3s): - Fix CNPG manifest drift: remove spec.backup.pluginConfiguration (CNPG 1.28 only), switch spec.certificates from serverTLSSecret to serverAltDNSNames - Apply knoe-auth Round 1 schema + GRANTs manually (postInitSQL had never run on live cluster) - Fix OIDC signing key generator: base64(DER) not base64(PEM) — OidcTokenService does Base64.decode() → PKCS8EncodedKeySpec which requires raw DER bytes - Add OIDC controllers: authorize, token, userinfo, jwks, discovery - Add prole Spring profile: cookieDomain, emailDomain, Kerberos config - Add secret example templates: knoe-db-user, knoe-auth-oidc-signing, knoe-auth-google-prole - Kong configmap: scope knoe-auth route to /auth prefix only Tenant onboarding: - Add etc/onboard_tenant.sh: provision/apply/rotate/status workflow backed by 1Password vaults; types: 'enterprise' (own Kerberos + domain) and 'tenant' (hosted, initContainer KDC) - Provision 'Knoe Tenant - prole.org' vault; apply all 7 k8s secrets to knoe-system - init_knoe_auth.sh: add explicit GRANT + ALTER DEFAULT PRIVILEGES for knoe role Cluster stabilisation: - gitea: roll back 14-day stuck rollout (RWO PVC + maxSurge=100% deadlock); patch deployment strategy to Recreate - supabase: create supabase_admin role, _supabase db, _analytics schema, _realtime schema in CNPG — analytics and realtime had never connected since Helm install day 1 - knoe-db barman ObjectStore: add GCS-backed objectstore manifest + scheduled backup Infrastructure: - gandalf host_vars: k3s registry config - pi host_vars: clean up stale entries - knoe-db schemas: ekosystem.sql, ekosystem_objects.sql - init_prole_app.sql: prole app DB initialisation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
# knoe-db barman ObjectStore — k3s/prole.org
|
|
#
|
|
# Backup pipeline:
|
|
# CNPG (WAL archive + daily basebackup)
|
|
# → Garage S3 (local, knoe-system namespace, s3://knoe-db-backups/)
|
|
# → [TODO] rclone CronJob syncs Garage → AWS S3 bucket (off-site durability)
|
|
#
|
|
# The rclone sync job needs:
|
|
# - AWS S3 bucket + IAM credentials (secret: knoe-db-barman-s3-aws)
|
|
# - CronJob in knoe-db namespace running rclone sync on the same schedule
|
|
# - Once in place, 30d retention here + AWS lifecycle policy for long-term cold storage
|
|
apiVersion: barmancloud.cnpg.io/v1
|
|
kind: ObjectStore
|
|
metadata:
|
|
name: knoe-db-barman-objectstore
|
|
namespace: knoe-db
|
|
spec:
|
|
retentionPolicy: 30d
|
|
configuration:
|
|
destinationPath: s3://knoe-db-backups/
|
|
endpointURL: http://garage.knoe-system.svc.cluster.local:3900
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: knoe-db-barman-s3
|
|
key: ACCESS_KEY_ID
|
|
secretAccessKey:
|
|
name: knoe-db-barman-s3
|
|
key: SECRET_ACCESS_KEY
|
|
region:
|
|
name: knoe-db-barman-s3
|
|
key: REGION
|
|
wal:
|
|
compression: gzip
|
|
data:
|
|
compression: gzip
|