homelab-codex-ws/services/vikunja/env.example

# Vikunja secrets — copy to .env and fill with the REAL live values.
# .env is gitignored; never commit it.
#
# These three values MUST match the running instance or you lose access /
# break login at cutover. Do not regenerate them.

# Postgres superuser password for the vikunja DB.
POSTGRES_PASSWORD=change-me-very-strong

# Must be identical to POSTGRES_PASSWORD — this is how Vikunja connects to it.
VIKUNJA_DATABASE_PASSWORD=change-me-very-strong

# JWT signing secret. Changing it invalidates all existing sessions/tokens.
VIKUNJA_SERVICE_JWTSECRET=change-me-super-long-random-string

# OIDC client secret for the Forgejo provider (config.yml stays secret-free).
VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET=change-me-forgejo-oidc-client-secret
feat(vikunja): bring PIHA Vikunja under GitOps (postgres + Forgejo OIDC) Wraps the existing manually-run Vikunja instance on PIHA in the standard service layout. No deploy — definition only, for review. - services/vikunja/: docker-compose.yml (vikunja + postgres:16-alpine), service.yaml, README, healthcheck, config.yml (OIDC, secret-free), .env.example. Real .env stays gitignored. - Pins EXISTING named volumes (vikunja_vikunja_db, vikunja_vikunja_files) so DB + uploaded files survive cutover. - extra_hosts forgejo.okit.pl=192.168.31.5 (npm on PIHA) so OIDC discovery resolves over LAN instead of flaky public DNS. - OIDC client secret injected via env (VIKUNJA_AUTH_OPENID_PROVIDERS_ FORGEJO_CLIENTSECRET); config.yml keeps trailing-slash authurl/redirecturl. - Registers vikunja in hosts/piha/services.yaml + inventory/topology.yaml, plus hosts/piha/runtime/vikunja override (advisory mem_limits). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 2026-06-17 15:02:37 +02:00			`# Vikunja secrets — copy to .env and fill with the REAL live values.`
			`# .env is gitignored; never commit it.`
			`#`
			`# These three values MUST match the running instance or you lose access /`
			`# break login at cutover. Do not regenerate them.`

			`# Postgres superuser password for the vikunja DB.`
			`POSTGRES_PASSWORD=change-me-very-strong`

			`# Must be identical to POSTGRES_PASSWORD — this is how Vikunja connects to it.`
			`VIKUNJA_DATABASE_PASSWORD=change-me-very-strong`

			`# JWT signing secret. Changing it invalidates all existing sessions/tokens.`
			`VIKUNJA_SERVICE_JWTSECRET=change-me-super-long-random-string`

			`# OIDC client secret for the Forgejo provider (config.yml stays secret-free).`
			`VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET=change-me-forgejo-oidc-client-secret`