Sascha Dodenhöft
c48ab60392
- New k8s/joplin/ deployment for note.expertfab.de (Postgres + Server + Traefik ingress with cert-manager), replicas=2 to match cluster size - coredns-custom.yaml: route note.expertfab.de internally to Traefik LB - Commit previously-built k8s manifests (documenso, erpnext oauth2-proxy, paperless oauth2-proxy) that were running but not in git - docs/access.md: add Joplin section and Documenso/Cloudflare entries Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
113 lines
9.0 KiB
YAML
113 lines
9.0 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: documenso-env
|
|
namespace: documenso
|
|
type: Opaque
|
|
stringData:
|
|
NEXTAUTH_URL: "https://signing.expertfab.de"
|
|
NEXTAUTH_SECRET: "KB23sNTjQgqLNcH5ySfbCS+W+yK5KU7SigmPOMPPOk0="
|
|
NEXT_PUBLIC_WEBAPP_URL: "https://signing.expertfab.de"
|
|
NEXT_PRIVATE_DATABASE_URL: "postgres://documenso:9QtScsD5IymypPxR2eMNFoMFYVUp7cL@documenso-postgres:5432/documenso"
|
|
NEXT_PRIVATE_DIRECT_DATABASE_URL: "postgres://documenso:9QtScsD5IymypPxR2eMNFoMFYVUp7cL@documenso-postgres:5432/documenso"
|
|
NEXT_PRIVATE_ENCRYPTION_KEY: "11d8ecb4ad0ec906f8ba4694ade72f4c8f1764810395c95c7d8ca275fd700ad0"
|
|
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY: "496a5868e588c1119a9bfaae687167630eb46f5fbee7295177e91ac386b5c927"
|
|
NEXT_PUBLIC_UPLOAD_TRANSPORT: "database"
|
|
NEXT_PRIVATE_SMTP_TRANSPORT: "smtp-auth"
|
|
NEXT_PRIVATE_SMTP_HOST: "smtprelay.expertfab.de"
|
|
NEXT_PRIVATE_SMTP_PORT: "587"
|
|
NEXT_PRIVATE_SMTP_SECURE: "false"
|
|
NEXT_PRIVATE_SMTP_USERNAME: "it-admin@expertfab.de"
|
|
NEXT_PRIVATE_SMTP_PASSWORD: "Relay22$$"
|
|
NEXT_PRIVATE_SMTP_FROM_NAME: "ExpertFab Documenso"
|
|
NEXT_PRIVATE_SMTP_FROM_ADDRESS: "it-admin@expertfab.de"
|
|
NEXT_PRIVATE_SIGNING_TRANSPORT: "local"
|
|
NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH: "/opt/documenso/cert.p12"
|
|
NEXT_PRIVATE_SIGNING_PASSPHRASE: "documenso"
|
|
PORT: "3000"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: documenso-signing-cert
|
|
namespace: documenso
|
|
type: Opaque
|
|
data:
|
|
# Self-signed P12 generated on 2026-05-22, passphrase: documenso
|
|
cert.p12: MIIR1gIBAzCCEYwGCSqGSIb3DQEHAaCCEX0EghF5MIIRdTCCBzIGCSqGSIb3DQEHBqCCByMwggcfAgEAMIIHGAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqGSIb3DQEFDDAcBAjxKAuTQvIqvQICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEJbg2Sde5sYZeni+eon3qliAggawUT4QJaqIdLMR0kKAZG2ky07IPDtcP17hIJdXonCTXHrciHFnSv2vFYvKG7l7Q65JtMzCgYXIKfKv/IDtqM4Zbt/LAaQjA55xjrgJ9wP0CWNq/HNbdqZrXEQjWjsikoxpcIyoh/ath5/PKDl5MvP9ZJXvoEQ5LD3w8MfcHKR4GnGxcyz72C6Y+uKbvJHBlM+96d03N6b4PvyIgEyuiP23rFzNSB7F7DJlCnPGrjr3Frajw6aBPB4rIHp4KFyX6Kja4NHUWMFHSecL8redKmrTAZEUbYwoU7FZ/dm3RRrcn4arH/oeFXLm8X0+jhr6Fk+SMkZRufW96qSiIYd9F0yJejyLttUhwrWWnJ8GhWsH5GUnl+AeNXkBMDF9zw9F0eNwXx3utdyV7yPIWFfQtrC+Y3BToLR78FlRoQV0dVT1vU1Rxo8wqskwshAi2WxrKnNP/bW+p3BJlXDUFxU5qUGoV6DIDKIc07RjN4h8W/Gz3xcvNRdl+2418pEQr9+Qlff30xITYYUxfZxvwwDLYHrBkbR6u2OB2lm/kEPfIrQrYS3KaWeqdDHbkqrLFYmyPfhYLRbSvZHOzUjI+r7FiQtEXvrKPYyX804Aut2fbrLiL1j3RfVpV6Cu0zMMTrLVtILFFXUZgj/fPVpFJU+wD09ASbHj6L5dVX7gMEx5v/EeeQJ2Jv9I3en27Z7ualCYnHZ32z8qkjm7CWnlm9jS7JAuDyu6+aFVMJywz7rXIyEp567hBZPaHWJoIznQ+bmt0jHDpJ0FpAdQT4zvQOVQL3ylA9+ldKmjuwLMSqAh3BAo5CYXHhnoKcEhN92f9VvA2oTvVY5NegPYdFss9yqClYB8GKHsE8abpFK5jmXy97GG3UENkGUo+L1SGO+2NjCYwcBPcvYdOUfO4gMdavkmiqnJ4OiqKTdnff9/VL7Q81fTrcySswFm/kxb8vnG9i151k2p+pd4AVHF5BfWg3f4kc7kz2ZsKFOxFwU+f6Y5kNhT+dcmBDe2tIWGZxGRlG7BA2ngj7hDv8Jnu1UEprjR5OG4qoNEFP07ruqNI6zLq7rwAcHPsETY01w5q3dgf6ZGnA0LcQjfU7dwrd5ix4w3ZP6ZlDkf0AKC3aNgI0koVbMmjFd3URDPwdbbWJerZ0oTEpy+F7fpWAoFmoa+mhaIq9URbm0k/uY26Co8GuzugnqTa9xxeEkIo5smHbhBtV9c/jYbk9k9mpI24KGb7ENRabO+03pEU0a2Go2frEm9Ob8z3APOmV+d14p2f0euHMsMoj0pkfN5oZgvf0Im1RE6wbpHrWu1ZWzx18EFo+Kwyv5VXbqq4OYVwB0dp6V9QQf5UF0orcWcnDkeGK+kTx+zJMxt3Yexpjr0/O9Qkh+AoxSJTvmZT+INR6DORF1N/tFTKB5v+QzT2Nsge6lvKswpHGcFxfDlTp0zht7ANjVkAbw8q74bf8ommIqyfg0MA8bGOBeFtigUIjo5ugio6XAak/6sTjezxaRZKxlR9loQ8R9Ze14P17ua1oXrQpvRDPUg0JbjiJla0w04s3iUrDOMN3lFMUN+1cv+aaMs5WwIoyfK73oSyhPMnNg9wx4FtMGCXqfUgZVsNBWBXOzlXZAVqdzVCgOv/OQ2R2h3P2YJ7DR2icGD/YJ9g48+D79bFyiLu8U/dTaqeQG5fnCoaMxBzzfuiFFNyEyc16Zn5vU1i96Fp88WEAs3oG3sWKTupwfhwsRq8wx8O9Wta0qhmEGWCYlOduH8T6afiPjjxJPipEuGqt2PUYVOfoP6p97XNjDhD+7wn2ydCAAy9oA9m5N65k2EBBLWY9E1UfR7+aaLQDvZlCv8rAHoOK6IYvlNJQlkgYTq99YeVRqDKER278lTdntTp36IPnfF1z7NMUrEu+/TkCwJNuTBC8hDXC/MqSDGTRSsrlo+a4IQnDeZE8jUPtet6Edx8LHWG57bW1m/k0UFZlJit1uWOH/dmcM+scMBi9qk8Y160ycrOlPzmFER/5+qK70elhIhCsNRGPK8FOV3zgDYv18hXyG8Vgj9qrvTC4XC+ree7scws83AysXPToIx/50lO9wBrxt7U4t6qhQCgfqwXD6GlfR2S2SZCfbovmWoQzcM/jRJyK8paJCbqr0QRiEhrTo/WCiGzwlJZj/+mMsauUR2RWzRImrljuwuPl78+4yXpjdaP0Spsi7YkJFjSjIs7JYBxljs9DlBhmCjkvAAv5lJMiA8IzlnipugS1WMMRFx9j9WUjO4Bh6oDdlR+6a9bYlLQINMWlFW4/L/xyswggo7BgkqhkiG9w0BBwGgggosBIIKKDCCCiQwggogBgsqhkiG9w0BDAoBAqCCCbEwggmtMFcGCSqGSIb3DQEFDTBKMCkGCSqGSIb3DQEFDDAcBAh2+2s5EPXSRAICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEGrm01TUqaxeEB2RPJ1tc8kEgglQBQAdNG0CjPrSjJEXtMV58VOJYOui+uBmV8Y7NbMqOfg0pv7C3cKpirjSNxW6Rd4rlotsWJnYjM/zXiuexmdZ9P1LRrvQTHD020NEr4DAl3FkFTEQCU72D+2CPc+WiF4ffDzOEdvvuoeSyqOxY/y0vibwQKQeFnJrIIr/xA1Rh5u11+UApB2hmzxKVBBba7EZIqNACZKSpAaPq1CQDTwX847xjXvnlXrq50xO8kzOWn39qgRfXyvmTIvulNPT4lzTgLCe1ww/wdHB6MLfSd2BQFwFcnBiFNjCCUCFvVkOHPQOFu5fijpTiV6/Wp7RvDmoGsgMP4XF5pAuboiCMZPuJYrwowFnFt4RCQ6N7NF/rNHHRPMK9uhyp3Zv7WTVVCXSgPZfUjGPT0MZp+Z+gkmYiy/UEGkX4y1p7JvmmHWgjDys4d3PSV3y42C3jXn3YdGsrTvQov7K7DT/zuvGgxnyKPK56NButSAbulDNxMSnUgzqJuLj97vrmsLZdQfUAsslF1HNwRGWmNiInEyfYHjGt3E9VXraujxqL90xZPk1w4qJq7spSaG/pxjV3xCFWcfzXFzoAY9UItmYqROVhmhlGmragtoIrsCO5Up2Sro7Xl2sWLxavm8I6DIAKeBEg1JEywNsfU98C05CNfgPc1FzhTNqrrQiJkfRsDOlSIuQfkx68DjqBzUAPhgRSMs1DNTIEWpjSwq0efyzpZIYLcwcc1F8ZvdJRvBXXyG3ymm5cLyx1cN/6twKMYW9GJgqcevCoDUyZ+9ojK8RZstPc9IqQjq4Xad3fBM/o2dt4/f7Wsr/t+nzZDhJrhTGkfXWa4XVxerX0sjdKqQQBk7oTUITUcLybx667Ms/TKMw5nWuGMvSj8tG705As7wpcorubczkg7Jtyfo6pBV2zFX/A21MxYRPkL1g2mtw4tOmd1rHfizEO7RCTwiBGDXWsUmvD0xmq8P0hhdX6oUcXXPxz20VqIzhiCT9ui/aCUzMwjNpvV+wOOWf7HHP4LbaTtFxtU16O3Vw00vtsUyokbCFcy0Zxu3C/o26cAWVFislI8yIp2TujsTnjpUg6NxjvsJKZ1rfecHFGJPFBh1knClXMeqPaBBIy/1d3Ja2whvKe7pvkf/ahetDENtH0m38nQMPYBgZMKWOvuIpyFFyFAz93Xxm7ipdksWQTWjQBUE0t1onyrM6AQM4WPaRuGqTWWzg49nqCcBZEif0eSFQYM0yUZJ8j6DTsKcPFIxJXGCI+HuDs210GKhKhICLAILJHPpJREdK3r90IwMOlS1wnAkZVwumk27A1rVj/J4lcezS0VZgEp3GcQYmkdbhpqJWeZYchwrhg/7xcb8zpJCHhyakXDBKsj1p1NZS26rPvcXLJHXRSzk9k8U1wyUo3BEib/F1LaFWWY7KSm66S7rfLq8n9zGvZPvmtZ49GFzjEJay//TLkSjwH/dC3tfHTNcLupA7oMiciJuIqbz/8Ae0zETAJECBgykOPTegkA2fSIyYK66lGrUyNU/znrKiSmR/6aMqOxUGwOA8+CUk5xMuMI8LnF62qrvLXg02rUmiNyfGqUVO5kGNMYAFGOMKzZmUDNYUdiB+ArO8dT0uI96XGwq09wwlMonlePhttV4bj53h9e3gIbanANX6RSbY8QzltekpKdY6CwapQv7jg6G6I4rsRUUR4dJB3iJ4n3QAgNp+022z5PuR+5RsYimDt5apdJqPc5MwVRVoBrzBjJi50aD0f7fkoW8ctjiBkfATrWtLj1NyjhhUfqooXh6Wg+zmx63BZq+kthXvvo8JP57ys7Ga2Li7PaIMKjOLkho4vF0NWQ5YkhyE7eBtbfRXjizXkgU5iOnbZjcmZbsF8v7v3iO6UyhAilurBCRBkNgs3isP9zN14VuGgPzri8mhi0Y6xkdXyRKgfUkyT8cTK7TP+0qk4Z3932j8sjjy2raCt69NrVCXkXIhj+SQ6rPEOdQ77cTTQ2830NCGngFSXL+EIKPXlgBba4xk2wkbAu4JdFSNQBdCD4TdAuGoS68OGOeCZfwYGYv6Vr2wPr7U4FxE2Tl++jSbe3mTHLVYcFyXK9m3ivL4rQXY4j3w6YPf3N7NmEVaGHireqcpPBZJEImdD4nw00jLPV3cFaQaU73X5jhwhqOijMd8nJkbXweV2h6ZJfZyzNmW2l+17nkknta4a5/4vLayj92gU5mh7gGSChXNZLT1qDfoJWvxfwGN9HrNmnYMqUq29ajFK0lY5fzJD6LrH0WlEoVbDLxUMSxtaL1h7IT27JwCQ7mY8PHnydynyiAPBubngUC9t2xZ0jKUEGuhD4OapQ9uMecHFH9m/r+hFq3ZwZ+BZ7bKjcofC50hU+aYLhT6TBOUXNA+KQqKU0wq5L0nURHg479vg6ONn3rlC2v/PEsIIQgzo3RkPoc94l8A0i6L2bs/MHiSYchgtRXl7IJKyTtqknikxLoWjr422PbJdkGS86I32FR0I8eEUizxmMu3mR+CdLbE0Uk+1SHGS6W1k5RYZOrUvrY1ylbvjmdLlH2izIVt/FXAcALU9wzXYf9zYCAUvvH4u9pKB15n//D+pEaptHdY78uMFKGQ+YEp+iVppqbl193StVDunvYpMlnq2aPfIQ+rHUrD/QxWzp/aoxJqOlRi06BtmHn+uXK6BsRzzrxkP/1AkcZwDV3q2ClMocXqBPWI32tq9qCmp7qfZI+eyn37eod9TtE+2znshtNOzQ/HyfHKyR3eduU3qkI1UNx16qA34w6vSExt/EIvGE+GAcdwHVcLKqySZ02p7rfX17fVT0gP1DnbOahDnJpies6LkUyVDnTx26BT+Bo12DZDEWo+vRea7I19+xczP3Vwm+F7kOviYxbevkgJD/diX/4UjgDkoG3wdRJpYbimaLfuLhZE7Lu5opzlkFYVHmsDNmKLjHXg23r7wD4XlRjrsqF3kjg3ehXD4T9PwBAFEAWzwETg1nCEs+eojbUSd6gIjgfDouDffBbNp/ftGgDCQIA20aeBeuvwDnOaIGFrlWbRfCQkNCfUyVQjqOouRZ/CssxSWOTztZWjl60NSnOvaGUZeFKVkV4c2Q2B9kdigqpgUP4bNn33SzrcrpTfVVmEhTL2LxBrJKma8m6TZtVPMmOUd1mCfqU8GL8VQRlk/RCt5vPWkVjtoZnoK6TKZFExXDAjBgkqhkiG9w0BCRUxFgQU/nj0KNx7oSwMYnu/YTW9n9LDR44wNQYJKoZIhvcNAQkUMSgeJgBFAHgAcABlAHIAdABGAGEAYgAgAEQAbwBjAHUAbQBlAG4AcwBvMEEwMTANBglghkgBZQMEAgEFAAQgRESPiXKK1M4KbFD1FLeLBJRHZ/7vl3pt2+bnitjwZakECJN9FtnaP+0tAgIIAA==
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: documenso
|
|
namespace: documenso
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
selector:
|
|
matchLabels:
|
|
app: documenso
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: documenso
|
|
spec:
|
|
containers:
|
|
- name: documenso
|
|
image: documenso/documenso:latest
|
|
ports:
|
|
- containerPort: 3000
|
|
envFrom:
|
|
- secretRef:
|
|
name: documenso-env
|
|
volumeMounts:
|
|
- name: signing-cert
|
|
mountPath: /opt/documenso/cert.p12
|
|
subPath: cert.p12
|
|
readOnly: true
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
failureThreshold: 6
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
initialDelaySeconds: 90
|
|
periodSeconds: 30
|
|
failureThreshold: 5
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1500Mi
|
|
volumes:
|
|
- name: signing-cert
|
|
secret:
|
|
secretName: documenso-signing-cert
|
|
items:
|
|
- key: cert.p12
|
|
path: cert.p12
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: documenso
|
|
namespace: documenso
|
|
spec:
|
|
selector:
|
|
app: documenso
|
|
ports:
|
|
- port: 3000
|
|
targetPort: 3000
|