Thore Cimbal
1744de074f
Wiki.js + a dedicated Postgres + public ingress for wiki.axion1337.chat, added to the production kustomization so Flux applies it. Both pods intentionally wait on the SOPS secret `wikijs-postgres-secret` (username/password) until sorb creates it — same loud-but-visible pattern as the concierge bot. NetworkPolicy: Traefik -> wikijs:http, wikijs -> wikijs-postgres:postgres (ingress-only, named container ports). Ingress/Cert mirror the authentik pattern (letsencrypt-prod). Native OIDC login (#0049, guide 10) and git-storage are configured post-start. All manifests validated server-side (kubectl --dry-run=server).
34 lines
852 B
YAML
34 lines
852 B
YAML
# Öffentlicher Zugang zum Wiki.js unter wiki.axion1337.chat (ADR-0014, #0048).
|
|
# Muster wie apps/authentik/{certificate,ingress}.yaml. DNS-A-Record auf
|
|
# 49.13.132.245 ist von sorb angelegt. Login läuft nativ über Authentik-OIDC
|
|
# (kein Forward-Auth) — siehe Guide 10 / #0049.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: wiki-axion1337-chat-cert
|
|
namespace: matrix
|
|
spec:
|
|
secretName: wiki-axion1337-chat-tls
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- wiki.axion1337.chat
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: wikijs
|
|
namespace: matrix
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
tls:
|
|
secretName: wiki-axion1337-chat-tls
|
|
routes:
|
|
- match: Host(`wiki.axion1337.chat`)
|
|
kind: Rule
|
|
services:
|
|
- name: wikijs
|
|
port: 3000
|