poimen-memory

10 Commits

Include renames

Author	SHA1	Message	Date
rock	05c0943bd4	fix: add PodSecurity contexts to all poimen deployments Build and Push / Test (push) Successful in 6m55s Details Build and Push / Build and push image (push) Successful in 23s Details - runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault - Drop ALL capabilities, no privilege escalation - readOnlyRootFilesystem on memory (with /tmp emptyDir) - git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps - All pods use their service accounts	2026-08-30 07:20:08 -07:00
rock	cc94174e63	fix: chown vault to uid 1000 after git-sync (obsidian runs as 1000) Build and Push / Test (push) Failing after 4s Details Build and Push / Build and push image (push) Skipped Details	2026-08-28 20:44:38 -07:00
rock	236e88127e	fix: add safe.directory for git-sync init container Build and Push / Test (push) Failing after 5s Details Build and Push / Build and push image (push) Skipped Details	2026-08-28 20:43:40 -07:00
rock	1cd6aa3248	fix: move obsidian vault PVC to homelab repo (infra-managed) Build and Push / Test (push) Failing after 4s Details Build and Push / Build and push image (push) Skipped Details	2026-08-28 20:42:18 -07:00
rock	5cae438e58	fix: obsidian vault PVC ReadWriteMany for shared access Build and Push / Test (push) Failing after 3s Details Build and Push / Build and push image (push) Skipped Details	2026-08-28 20:28:37 -07:00
rock	2e20c762b8	fix: move obsidian ingress to homelab repo, use obsidian.riotpiao.com Build and Push / Test (push) Failing after 4s Details Build and Push / Build and push image (push) Skipped Details vault.riotpiao.com was already taken by HashiCorp Vault. Ingress now managed centrally in homelab/k8s/bootstrap/ingress/ingress.yaml	2026-08-28 16:43:36 -07:00
rock	8f49d1a682	fix: remove broken auth annotations from obsidian ingress Build and Push / Test (push) Failing after 4s Details Build and Push / Build and push image (push) Skipped Details Bearer auth-url was misconfigured (pointed to token endpoint, not forward-auth). No Authentik outpost deployed yet. Remove for now, vault.riotpiao.com accessible directly. TODO: add forward-auth once outpost is set up.	2026-08-28 16:42:00 -07:00
rock	89f933c394	feat: obsidian git-sync from poimen-obesdient-memory repo Build and Push / Test (push) Successful in 4m52s Details Build and Push / Build and push image (push) Successful in 23s Details - Add git-sync init container to clone/pull vault content - Add SOPS-encrypted SSH deploy key (obsidian-git-ssh-secret.enc.yaml) - Add .sops.yaml config (age encryption, same key as homelab) - Repo: ssh://[email protected]:2222/rock/poimen-obesdient-memory.git - Deploy key added to Forgejo repo (read-only)	2026-08-28 16:31:48 -07:00
Story Crater Bot	4524d62568	fix: Obsidian service port and health checks, use Longhorn storage Build and Push / Test (push) Failing after 1m40s Details Build and Push / Build and push image (push) Skipped Details	2026-08-27 21:37:47 -07:00
Story Crater Bot	cb8fade9d9	refactor: replace Obsidian projector with standalone service (ppatlabs/obsidian) Build and Push / Test (push) Failing after 1m57s Details Build and Push / Build and push image (push) Skipped Details	2026-08-27 21:35:07 -07:00