openproject: update image tag to 3 (done automagically via Woodpecker pipeline)

app-files/apps.yaml

@@ -27,7 +27,7 @@ spec:
   sources:
     - repoURL: https://argoproj.github.io/argo-helm
       chart: argo-cd
-      targetRevision: 7.7.7
+      targetRevision: 7.6.8
       helm:
         releaseName: argo
         valueFiles:
@@ -193,5 +193,5 @@ spec:
     syncOptions:
       - CreateNamespace=true
     automated:
-      selfHeal: false
+      selfHeal: true
       prune: false

hoylogo/overlays/prod/kustomization.yaml

@@ -5,7 +5,7 @@ resources:
 images:
 - name: git.ar21.de/aaron/hoylogo
   newName: git.ar21.de/aaron/hoylogo
-  newTag: "4"
+  newTag: "27"
 namespace: hoylogo
 patches:
 - patch: |-

openproject/db.yaml

@@ -7,17 +7,3 @@ spec:
   instances: 3
   storage:
     size: 1Gi
-  backup:
-    barmanObjectStore:
-      destinationPath: "s3://openproject/backups"
-      endpointURL: "https://fsn1.your-objectstorage.com"
-      s3Credentials:
-        accessKeyId:
-          name: openproject-secret
-          key: OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID
-        secretAccessKey:
-          name: openproject-secret
-          key: OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY
-      wal:
-        compression: gzip
-      retentionPolicy: "30d"

openproject/secret.yaml

@@ -7,10 +7,8 @@ metadata:
         app.kubernetes.io/name: openproject-secret
         app.kubernetes.io/part-of: openproject
 stringData:
-    OPENPROJECT_OPENID__CONNECT_AUTHENTIK_IDENTIFIER: ENC[AES256_GCM,data:YRSk6WbIi03tMl5PE+jVeWUjiEsMogGSjcd71DWmdhrs9hx0gHz/6Q==,iv:9a5cATFe+sGFVvIcIq702XZpWbwCpkEgbHL04WC73RU=,tag:t/TAeA5lkVS4V5EWZjP96w==,type:str]
-    OPENPROJECT_OPENID__CONNECT_AUTHENTIK_SECRET: ENC[AES256_GCM,data:iP1vQTVCS9iB5qBvsT4HCpXg/7vEaqEvMBG8pkjapx7fwdzUvPnumqT/4kjT2A0G0B8hvbNbLXlBx3u3bznUjFCyQXizDmsP7y5IewtQD9x1Gjcc/3PyijUauXTIYt3DjjhJqStiDsc855LGbdBukowdQNZwTdHGYkEmZmlyNnw=,iv:msO6nSphjMFwnRZ+bzyPJDOMfAVMpYzf6bXq6m5OYJU=,tag:zxYWhn3zXHKdGNwyAoOq6g==,type:str]
-    OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID: ENC[AES256_GCM,data:d4kh/eBE35VT5dE3oIAQiIIaC54=,iv:0/Tvwi5zWHetytYPWsSTEcVX8cc7MjwQQpgD2j/2blg=,tag:WTuGgku1aQYcChf1dTShBw==,type:str]
-    OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY: ENC[AES256_GCM,data:MrOc+zr6qkv+55vjuCciijW1bnjKyjxr0mbbH/IajNjMvDIVqq7GDg==,iv:0+GBZuWA6t5Pp5gKeIczrFKdTYMznV2fTSuJxS/y6Do=,tag:zq9QtqFANlUFJL737Sa8jw==,type:str]
+    clientId: ENC[AES256_GCM,data:pNsfXlI13/jOdNXbtzTrk0oYB2viicauXdzVtjljC8pd9qFXCQrnrA==,iv:x6HGIX29SedgGJiRCHwIFAXbA9ucnpO+QS1Xlgsbdks=,tag:3A53qjsmJJin2+9AA/MAuQ==,type:str]
+    clientSecret: ENC[AES256_GCM,data:dlBFp8ImgzMIpymOesrCgNBnSHkVHH/PZwMTJ2tXVjpHXnif7AAx5VMbsvk6dpDxRQPX8RTBzTVqhJbHv87Bqso3vwu7K/tjstf+iBIpTHfz6O0u5Qc6f1/ZJorb1mMk0nB3+MOZuOnVv/LkkDv7LCa6R2HSkzALZMvmLIhMuiI=,iv:NpkQxa0DhvJOCF831KeEq35wxqQ6v6/TJpM87Gnpzbc=,tag:2JcM1oAmY3HqWNVl2AAnyA==,type:str]
 type: Opaque
 sops:
     kms: []
@@ -36,8 +34,50 @@ sops:
             cEk2ZEp3UzArK1NEL0E2Zkwzd1dnMW8KWWQ861ukoDUh7l1iFBnnrsInQWfeYgD9
             d1y8yHr1kLZX66xg9erbaQbA+xtRRD+5sctypxJWPNkDO+rW+pfrAQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-06T20:53:34Z"
-    mac: ENC[AES256_GCM,data:3LaUkQy4IViYIjKHOJ71pIcPipv3p44ENAd31270uGsZNmOAlGqPcylF7Dlc475UfKrHXAZaagGKF80VkTaE6xca+Uq9ihUg0U5ovLyVbxBXMEjmycCBJXaKry17kju3eQec5dinqEBQ7+uU39lSKdhGPPvbZDYxu3WeZBWzrSQ=,iv:VN+W6S8t9RW06DnSoo+AY630bo4PVF027qtanv2YRh8=,tag:urMNwqclobcL7bxCJY5NbA==,type:str]
+    lastmodified: "2024-11-04T21:12:27Z"
+    mac: ENC[AES256_GCM,data:wI/Z9/ilDAoIeYmRDwqa6cm7vnOyCKLPV3rxinVO8hhP3aVQisIJlKZH5iSZTAqE+bF0451Sqj8Ei00CiH/OXl8z7s92HeE2z2paHO51SutcLUM1RttKBcWsmdGnSvpqatlED9gziAeT487V3yECts+BS2zHppTtf+DRhjYVrd0=,iv:Pt4Jq1LFAJZo9oQmcv3PTDHmRb2HWI+gGUH/gzIuQ5s=,tag:PIcgRGoIm1tmaR6kRRIb0A==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.0
+---
+apiVersion: v1
+kind: Secret
+metadata:
+    name: openproject-s3
+    namespace: openproject
+    labels:
+        app.kubernetes.io/name: openproject-s3
+        app.kubernetes.io/part-of: openproject
+stringData:
+    accessKeyId: ENC[AES256_GCM,data:vp+0gIUcQ1zFZZ+FzMsjrIEnLJQ=,iv:1vO4ZESGnGHpf/Jy3mQdrRwv7DgRv2bJNppKQ+Qpi6A=,tag:1DHkZJ9bpc9P4nd2O/3nkg==,type:str]
+    secretAccessKey: ENC[AES256_GCM,data:ppZZ3LRQKOKeBzj4OUuiQLFDxKA1MQm8HhhdoLdpOaTDHVmxlCgRDw==,iv:oZPdTGkNPdjU4rqO6IjZcrI9t0yhlkIqHFKUTBOBr0M=,tag:M5LK3hdw8hCJ7i/tQsmj4A==,type:str]
+type: Opaque
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age14uxgmvw26e7f82gkvxl0zwnfc5l75rdn5sms4zj0xrtrnlgn4qlsqh3kkt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByT0xDY1ZMNUtydlZqNyt4
+            RGZhYTJCaTdoaUNDcUU3c2djUFFrb1NPWmdBClM4ZXZ6aUU0WU1NdmFLYWlHUVBy
+            VlU0VlZnRnQwenJPdGRSTFBac1ZlSTgKLS0tIGowNGZBZjgyMGxJbTZvOWRLS2Jr
+            ZTczeDVvYytjK0dzUDY0QXdaUlVyN3cKM+tC9agxFrnjpfPXoNXxCinTNXJ2gHyO
+            xmkLs958EAJZ8LuFfne01Sak/7ojRny+PzKb9TudIggCUoxAW8S0+w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1z5wtjmk0jw0j9qz9k5rrnp30nzqxrl3v6wgl7eryvqus28zekp4qpx9jc2
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxU2dyTnc3eCtSNFVBeFQ3
+            bTFndGdUYXVTdnpnRTJVQjI3Z0RRZ0FkQzJ3CjZ6ZHBpU2w1MDRFUzJQL1FKS1Ex
+            N011MUcyY0hlV0lYREo3Tmhhc1NXZG8KLS0tIGZpa3IyU244OXRGZ1hQdVlJbzZr
+            cEk2ZEp3UzArK1NEL0E2Zkwzd1dnMW8KWWQ861ukoDUh7l1iFBnnrsInQWfeYgD9
+            d1y8yHr1kLZX66xg9erbaQbA+xtRRD+5sctypxJWPNkDO+rW+pfrAQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-04T21:12:27Z"
+    mac: ENC[AES256_GCM,data:wI/Z9/ilDAoIeYmRDwqa6cm7vnOyCKLPV3rxinVO8hhP3aVQisIJlKZH5iSZTAqE+bF0451Sqj8Ei00CiH/OXl8z7s92HeE2z2paHO51SutcLUM1RttKBcWsmdGnSvpqatlED9gziAeT487V3yECts+BS2zHppTtf+DRhjYVrd0=,iv:Pt4Jq1LFAJZo9oQmcv3PTDHmRb2HWI+gGUH/gzIuQ5s=,tag:PIcgRGoIm1tmaR6kRRIb0A==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.0

openproject/values.yaml

@@ -1,7 +1,7 @@
 image:
   registry: git.ar21.de
   repository: aaron/openproject
-  tag: '6'
+  tag: '3'
 appInit:
   resources:
     limits:
@@ -18,31 +18,23 @@ ingress:
 workers:
   default:
     replicas: 2
-environment:
-  OPENPROJECT_DISABLE__PASSWORD__LOGIN: true
-
 openproject:
-  admin_user:
-    password_reset: "true"
-    name: "Aaron Riedel"
-    mail: "aaron@ar21.de"
-  extraEnvVarsSecret: openproject-secret
   oidc:
     enabled: true
-    provider: authentik
+    provider: Keycloak
     displayName: aaronID
     host: auth.ar21.de
-    identifier: null
-    secret: null
-    userinfoEndpoint: /application/o/userinfo/
-    tokenEndpoint: /application/o/token/
-    authorizationEndpoint: /application/o/authorize/
-    endSessionEndpoint: /application/o/openproject/end-session/
-    scope: "[openid email profile]"
+    existingSecret: openproject-secret
+    userinfoEndpoint: https://auth.ar21.de/application/o/userinfo/
+    tokenEndpoint: https://auth.ar21.de/application/o/token/
+    authorizationEndpoint: https://auth.ar21.de/application/o/authorize/
+    endSessionEndpoint: https://auth.ar21.de/application/o/openproject/end-session/
 persistence:
   enabled: false
 s3:
   enabled: true
+  auth:
+    existingSecret: openproject-s3
   region: fsn1
   bucketName: openproject
   endpoint: https://fsn1.your-objectstorage.com