rock
2501a68528
fix: add PodSecurity contexts to all poimen deployments
...
- runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault
- Drop ALL capabilities, no privilege escalation
- readOnlyRootFilesystem on memory (with /tmp emptyDir)
- git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps
- All pods use their service accounts
2026-08-30 07:20:08 -07:00
rock
10d7a0be77
fix: chown vault to uid 1000 after git-sync (obsidian runs as 1000)
2026-08-28 20:44:38 -07:00
rock
c1167563b1
fix: add safe.directory for git-sync init container
2026-08-28 20:43:40 -07:00
rock
82507cf2a3
fix: move obsidian vault PVC to homelab repo (infra-managed)
2026-08-28 20:42:18 -07:00
rock
23019fdb27
fix: obsidian vault PVC ReadWriteMany for shared access
2026-08-28 20:28:37 -07:00
rock
a60c74fc78
fix: move obsidian ingress to homelab repo, use obsidian.riotpiao.com
...
vault.riotpiao.com was already taken by HashiCorp Vault.
Ingress now managed centrally in homelab/k8s/bootstrap/ingress/ingress.yaml
2026-08-28 16:43:36 -07:00
rock
2ddd2d6cdf
fix: remove broken auth annotations from obsidian ingress
...
Bearer auth-url was misconfigured (pointed to token endpoint, not
forward-auth). No Authentik outpost deployed yet. Remove for now,
vault.riotpiao.com accessible directly. TODO: add forward-auth
once outpost is set up.
2026-08-28 16:42:00 -07:00
rock
b94898d0d4
feat: obsidian git-sync from poimen-obesdient-memory repo
...
- Add git-sync init container to clone/pull vault content
- Add SOPS-encrypted SSH deploy key (obsidian-git-ssh-secret.enc.yaml)
- Add .sops.yaml config (age encryption, same key as homelab)
- Repo: ssh://[email protected] :2222/rock/poimen-obesdient-memory.git
- Deploy key added to Forgejo repo (read-only)
2026-08-28 16:31:48 -07:00
Story Crater Bot
69ec8aeec2
fix: Obsidian service port and health checks, use Longhorn storage
2026-08-27 21:37:47 -07:00
Story Crater Bot
0eecca815b
refactor: replace Obsidian projector with standalone service (ppatlabs/obsidian)
2026-08-27 21:35:07 -07:00
rock
Story Crater Bot