Forte/launchpad
6
0
Fork 0
Code Issues 1 Pull Requests 5 Actions Packages Wiki Activity
518 Commits 29 Branches 0 Tags
47d1f1ec39cf318477e3cad0fa5aaaba599d66ae
Commit Graph
4 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sten 47d1f1ec39 fix(infra): drop bad postgres securityContext + un-own shared namespace
AI Code Review / ai-review (pull_request) Successful in 6s
Details 
Address Codex review on PR #17:

[P1] Postgres official image's entrypoint requires root to chown a
fresh PVC, then drops to the postgres user via gosu. Forcing
runAsNonRoot+runAsUser=999 blocks the chown and initdb fails on a
fresh volume. Drop the securityContext; matches the existing
vaultwarden-postgresql pattern.

[P2] The forte-drop namespace was declared as a managed resource
in the postgres Application. Since minio lives in the same
namespace from a separate Application, an Argo prune of the pg
app would delete the namespace and cascade-delete minio. Remove
the Namespace resource; rely on syncOptions: CreateNamespace=true
on both apps (already set).
 2026-05-28 16:13:08 +02:00
Sten 69848e42f0 fix(infra): pin minio/mc tags + add postgres securityContext + harden bootstrap script
AI Code Review / ai-review (pull_request) Successful in 15s
Details 
Address ai-review feedback on PR #17:
- Pin quay.io/minio/minio and mc to specific RELEASE tags (Renovate
  will bump). 'latest' is unpredictable in GitOps.
- Bootstrap script: set -e -> set -euo pipefail.
- Postgres container: runAsNonRoot, uid/gid 999, drop ALL caps,
  no privilege escalation. Matches PSS restricted profile.
 2026-05-28 16:05:48 +02:00
Sten 416615a9e0 feat(infra): add forte-drop sealed secrets
AI Code Review / ai-review (pull_request) Successful in 5s
Details 
Pg and minio credentials sealed against upc-dev sealed-secrets-controller.
 2026-05-28 15:56:24 +02:00
Sten 3ce93017f9 feat(infra): forte-drop postgres + minio for upc-dev
AI Code Review / ai-review (pull_request) Successful in 34s
Details 
Two new ArgoCD Applications:
- forte-drop-postgresql: in-cluster Postgres 16 StatefulSet, 5Gi PVC,
  POSTGRES_DB=drops, creds from forte-drop-pg-creds SealedSecret.
- forte-drop-minio: in-cluster MinIO StatefulSet, 20Gi PVC, bootstrap
  Job creates the 'drops' bucket post-sync, creds from
  forte-drop-minio-creds SealedSecret.

Both live in namespace 'forte-drop'. Mirrors the Vaultwarden pattern.

Sealed secrets are added in a follow-up commit by the maintainer:
  kubeseal --fetch-cert > pub.pem
  kubeseal --cert pub.pem --format yaml < private/forte-drop-pg-creds.yaml > \
    infra/overlays/upc-dev/forte-drop-postgresql/resources/forte-drop-pg-creds-sealed.yaml
  kubeseal --cert pub.pem --format yaml < private/forte-drop-minio-creds.yaml > \
    infra/overlays/upc-dev/forte-drop-minio/resources/forte-drop-minio-creds-sealed.yaml
 2026-05-28 14:33:19 +02:00