configure backups for openproject db

Reviewed-on: #5

app-files/apps.yaml

@@ -27,7 +27,7 @@ spec:
   sources:
     - repoURL: https://argoproj.github.io/argo-helm
       chart: argo-cd
-      targetRevision: 7.6.8
+      targetRevision: 7.7.3
       helm:
         releaseName: argo
         valueFiles:
@@ -193,5 +193,5 @@ spec:
     syncOptions:
       - CreateNamespace=true
     automated:
-      selfHeal: true
+      selfHeal: false
       prune: false

hoylogo/overlays/prod/kustomization.yaml

@@ -5,7 +5,7 @@ resources:
 images:
 - name: git.ar21.de/aaron/hoylogo
   newName: git.ar21.de/aaron/hoylogo
-  newTag: "27"
+  newTag: "4"
 namespace: hoylogo
 patches:
 - patch: |-

openproject/db.yaml

@@ -7,3 +7,17 @@ spec:
   instances: 3
   storage:
     size: 1Gi
+  backup:
+    barmanObjectStore:
+      destinationPath: "s3://openproject/backups"
+      endpointURL: "https://fsn1.your-objectstorage.com"
+      s3Credentials:
+        accessKeyId:
+          name: openproject-secret
+          key: OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID
+        secretAccessKey:
+          name: openproject-secret
+          key: OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY
+      wal:
+        compression: gzip
+      retentionPolicy: "30d"

openproject/secret.yaml

@@ -7,8 +7,10 @@ metadata:
         app.kubernetes.io/name: openproject-secret
         app.kubernetes.io/part-of: openproject
 stringData:
-    clientId: ENC[AES256_GCM,data:pNsfXlI13/jOdNXbtzTrk0oYB2viicauXdzVtjljC8pd9qFXCQrnrA==,iv:x6HGIX29SedgGJiRCHwIFAXbA9ucnpO+QS1Xlgsbdks=,tag:3A53qjsmJJin2+9AA/MAuQ==,type:str]
-    clientSecret: ENC[AES256_GCM,data:dlBFp8ImgzMIpymOesrCgNBnSHkVHH/PZwMTJ2tXVjpHXnif7AAx5VMbsvk6dpDxRQPX8RTBzTVqhJbHv87Bqso3vwu7K/tjstf+iBIpTHfz6O0u5Qc6f1/ZJorb1mMk0nB3+MOZuOnVv/LkkDv7LCa6R2HSkzALZMvmLIhMuiI=,iv:NpkQxa0DhvJOCF831KeEq35wxqQ6v6/TJpM87Gnpzbc=,tag:2JcM1oAmY3HqWNVl2AAnyA==,type:str]
+    OPENPROJECT_OPENID__CONNECT_AUTHENTIK_IDENTIFIER: ENC[AES256_GCM,data:YRSk6WbIi03tMl5PE+jVeWUjiEsMogGSjcd71DWmdhrs9hx0gHz/6Q==,iv:9a5cATFe+sGFVvIcIq702XZpWbwCpkEgbHL04WC73RU=,tag:t/TAeA5lkVS4V5EWZjP96w==,type:str]
+    OPENPROJECT_OPENID__CONNECT_AUTHENTIK_SECRET: ENC[AES256_GCM,data:iP1vQTVCS9iB5qBvsT4HCpXg/7vEaqEvMBG8pkjapx7fwdzUvPnumqT/4kjT2A0G0B8hvbNbLXlBx3u3bznUjFCyQXizDmsP7y5IewtQD9x1Gjcc/3PyijUauXTIYt3DjjhJqStiDsc855LGbdBukowdQNZwTdHGYkEmZmlyNnw=,iv:msO6nSphjMFwnRZ+bzyPJDOMfAVMpYzf6bXq6m5OYJU=,tag:zxYWhn3zXHKdGNwyAoOq6g==,type:str]
+    OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID: ENC[AES256_GCM,data:d4kh/eBE35VT5dE3oIAQiIIaC54=,iv:0/Tvwi5zWHetytYPWsSTEcVX8cc7MjwQQpgD2j/2blg=,tag:WTuGgku1aQYcChf1dTShBw==,type:str]
+    OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY: ENC[AES256_GCM,data:MrOc+zr6qkv+55vjuCciijW1bnjKyjxr0mbbH/IajNjMvDIVqq7GDg==,iv:0+GBZuWA6t5Pp5gKeIczrFKdTYMznV2fTSuJxS/y6Do=,tag:zq9QtqFANlUFJL737Sa8jw==,type:str]
 type: Opaque
 sops:
     kms: []
@@ -34,50 +36,8 @@ sops:
             cEk2ZEp3UzArK1NEL0E2Zkwzd1dnMW8KWWQ861ukoDUh7l1iFBnnrsInQWfeYgD9
             d1y8yHr1kLZX66xg9erbaQbA+xtRRD+5sctypxJWPNkDO+rW+pfrAQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-04T21:12:27Z"
-    mac: ENC[AES256_GCM,data:wI/Z9/ilDAoIeYmRDwqa6cm7vnOyCKLPV3rxinVO8hhP3aVQisIJlKZH5iSZTAqE+bF0451Sqj8Ei00CiH/OXl8z7s92HeE2z2paHO51SutcLUM1RttKBcWsmdGnSvpqatlED9gziAeT487V3yECts+BS2zHppTtf+DRhjYVrd0=,iv:Pt4Jq1LFAJZo9oQmcv3PTDHmRb2HWI+gGUH/gzIuQ5s=,tag:PIcgRGoIm1tmaR6kRRIb0A==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.0
----
-apiVersion: v1
-kind: Secret
-metadata:
-    name: openproject-s3
-    namespace: openproject
-    labels:
-        app.kubernetes.io/name: openproject-s3
-        app.kubernetes.io/part-of: openproject
-stringData:
-    accessKeyId: ENC[AES256_GCM,data:vp+0gIUcQ1zFZZ+FzMsjrIEnLJQ=,iv:1vO4ZESGnGHpf/Jy3mQdrRwv7DgRv2bJNppKQ+Qpi6A=,tag:1DHkZJ9bpc9P4nd2O/3nkg==,type:str]
-    secretAccessKey: ENC[AES256_GCM,data:ppZZ3LRQKOKeBzj4OUuiQLFDxKA1MQm8HhhdoLdpOaTDHVmxlCgRDw==,iv:oZPdTGkNPdjU4rqO6IjZcrI9t0yhlkIqHFKUTBOBr0M=,tag:M5LK3hdw8hCJ7i/tQsmj4A==,type:str]
-type: Opaque
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age14uxgmvw26e7f82gkvxl0zwnfc5l75rdn5sms4zj0xrtrnlgn4qlsqh3kkt
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT0xDY1ZMNUtydlZqNyt4
-            RGZhYTJCaTdoaUNDcUU3c2djUFFrb1NPWmdBClM4ZXZ6aUU0WU1NdmFLYWlHUVBy
-            VlU0VlZnRnQwenJPdGRSTFBac1ZlSTgKLS0tIGowNGZBZjgyMGxJbTZvOWRLS2Jr
-            ZTczeDVvYytjK0dzUDY0QXdaUlVyN3cKM+tC9agxFrnjpfPXoNXxCinTNXJ2gHyO
-            xmkLs958EAJZ8LuFfne01Sak/7ojRny+PzKb9TudIggCUoxAW8S0+w==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1z5wtjmk0jw0j9qz9k5rrnp30nzqxrl3v6wgl7eryvqus28zekp4qpx9jc2
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxU2dyTnc3eCtSNFVBeFQ3
-            bTFndGdUYXVTdnpnRTJVQjI3Z0RRZ0FkQzJ3CjZ6ZHBpU2w1MDRFUzJQL1FKS1Ex
-            N011MUcyY0hlV0lYREo3Tmhhc1NXZG8KLS0tIGZpa3IyU244OXRGZ1hQdVlJbzZr
-            cEk2ZEp3UzArK1NEL0E2Zkwzd1dnMW8KWWQ861ukoDUh7l1iFBnnrsInQWfeYgD9
-            d1y8yHr1kLZX66xg9erbaQbA+xtRRD+5sctypxJWPNkDO+rW+pfrAQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-04T21:12:27Z"
-    mac: ENC[AES256_GCM,data:wI/Z9/ilDAoIeYmRDwqa6cm7vnOyCKLPV3rxinVO8hhP3aVQisIJlKZH5iSZTAqE+bF0451Sqj8Ei00CiH/OXl8z7s92HeE2z2paHO51SutcLUM1RttKBcWsmdGnSvpqatlED9gziAeT487V3yECts+BS2zHppTtf+DRhjYVrd0=,iv:Pt4Jq1LFAJZo9oQmcv3PTDHmRb2HWI+gGUH/gzIuQ5s=,tag:PIcgRGoIm1tmaR6kRRIb0A==,type:str]
+    lastmodified: "2024-11-06T20:53:34Z"
+    mac: ENC[AES256_GCM,data:3LaUkQy4IViYIjKHOJ71pIcPipv3p44ENAd31270uGsZNmOAlGqPcylF7Dlc475UfKrHXAZaagGKF80VkTaE6xca+Uq9ihUg0U5ovLyVbxBXMEjmycCBJXaKry17kju3eQec5dinqEBQ7+uU39lSKdhGPPvbZDYxu3WeZBWzrSQ=,iv:VN+W6S8t9RW06DnSoo+AY630bo4PVF027qtanv2YRh8=,tag:urMNwqclobcL7bxCJY5NbA==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.0

openproject/values.yaml

@@ -1,7 +1,7 @@
 image:
   registry: git.ar21.de
   repository: aaron/openproject
-  tag: '3'
+  tag: '6'
 appInit:
   resources:
     limits:
@@ -18,23 +18,31 @@ ingress:
 workers:
   default:
     replicas: 2
+environment:
+  OPENPROJECT_DISABLE__PASSWORD__LOGIN: true
+
 openproject:
+  admin_user:
+    password_reset: "true"
+    name: "Aaron Riedel"
+    mail: "aaron@ar21.de"
+  extraEnvVarsSecret: openproject-secret
   oidc:
     enabled: true
-    provider: Keycloak
+    provider: authentik
     displayName: aaronID
     host: auth.ar21.de
-    existingSecret: openproject-secret
-    userinfoEndpoint: https://auth.ar21.de/application/o/userinfo/
-    tokenEndpoint: https://auth.ar21.de/application/o/token/
-    authorizationEndpoint: https://auth.ar21.de/application/o/authorize/
-    endSessionEndpoint: https://auth.ar21.de/application/o/openproject/end-session/
+    identifier: null
+    secret: null
+    userinfoEndpoint: /application/o/userinfo/
+    tokenEndpoint: /application/o/token/
+    authorizationEndpoint: /application/o/authorize/
+    endSessionEndpoint: /application/o/openproject/end-session/
+    scope: "[openid email profile]"
 persistence:
   enabled: false
 s3:
   enabled: true
-  auth:
-    existingSecret: openproject-s3
   region: fsn1
   bucketName: openproject
   endpoint: https://fsn1.your-objectstorage.com