Thore Cimbal
026b499d1d
Idempotent GraphQL bootstrap job (verified live): /finalize with the random SOPS admin, then the OIDC strategy and the groups 'authentik Admins' (full) and 'wiki-anwender' (read /anwender), Guests locked. Replaces the manual setup wizard entirely. OIDC client_id/secret in a SOPS secret; NetworkPolicy lets the job reach wikijs. Script as a fixed-name ConfigMap; re-run = delete the Job.
55 lines
1.7 KiB
YAML
55 lines
1.7 KiB
YAML
# Bootstrap-/Konfig-Job für Wiki.js (ADR-0014, #0048/#0049). Ersetzt den manuellen
|
|
# Setup-Assistenten: finalize (Admin aus SOPS) -> OIDC-Strategy -> Gruppen +
|
|
# Seitenregeln. Idempotent (live verifiziert 2026-08-12). Läuft einmal beim Deploy;
|
|
# erneut anstoßen = Job löschen, Flux legt ihn neu an (Skript ist re-runnable).
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: wikijs-config
|
|
namespace: matrix
|
|
spec:
|
|
backoffLimit: 10
|
|
ttlSecondsAfterFinished: 86400
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: wikijs-config
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: config
|
|
image: python:3.12-alpine
|
|
command: ["python3", "/script/wikijs-config.py"]
|
|
env:
|
|
- name: WIKI_URL
|
|
value: http://wikijs:3000
|
|
- name: WIKI_SITE_URL
|
|
value: https://wiki.axion1337.chat
|
|
- name: WIKI_ADMIN_EMAIL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: wikijs-admin-secret
|
|
key: email
|
|
- name: WIKI_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: wikijs-admin-secret
|
|
key: password
|
|
- name: OIDC_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: wikijs-oidc-secret
|
|
key: client_id
|
|
- name: OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: wikijs-oidc-secret
|
|
key: client_secret
|
|
volumeMounts:
|
|
- name: script
|
|
mountPath: /script
|
|
volumes:
|
|
- name: script
|
|
configMap:
|
|
name: wikijs-config-script
|