Oskar Kapala
f7e1391f30
Wraps the existing manually-run Vikunja instance on PIHA in the standard service layout. No deploy — definition only, for review. - services/vikunja/: docker-compose.yml (vikunja + postgres:16-alpine), service.yaml, README, healthcheck, config.yml (OIDC, secret-free), .env.example. Real .env stays gitignored. - Pins EXISTING named volumes (vikunja_vikunja_db, vikunja_vikunja_files) so DB + uploaded files survive cutover. - extra_hosts forgejo.okit.pl=192.168.31.5 (npm on PIHA) so OIDC discovery resolves over LAN instead of flaky public DNS. - OIDC client secret injected via env (VIKUNJA_AUTH_OPENID_PROVIDERS_ FORGEJO_CLIENTSECRET); config.yml keeps trailing-slash authurl/redirecturl. - Registers vikunja in hosts/piha/services.yaml + inventory/topology.yaml, plus hosts/piha/runtime/vikunja override (advisory mem_limits). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
18 lines
762 B
Plaintext
18 lines
762 B
Plaintext
# Vikunja secrets — copy to .env and fill with the REAL live values.
|
|
# .env is gitignored; never commit it.
|
|
#
|
|
# These three values MUST match the running instance or you lose access /
|
|
# break login at cutover. Do not regenerate them.
|
|
|
|
# Postgres superuser password for the vikunja DB.
|
|
POSTGRES_PASSWORD=change-me-very-strong
|
|
|
|
# Must be identical to POSTGRES_PASSWORD — this is how Vikunja connects to it.
|
|
VIKUNJA_DATABASE_PASSWORD=change-me-very-strong
|
|
|
|
# JWT signing secret. Changing it invalidates all existing sessions/tokens.
|
|
VIKUNJA_SERVICE_JWTSECRET=change-me-super-long-random-string
|
|
|
|
# OIDC client secret for the Forgejo provider (config.yml stays secret-free).
|
|
VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET=change-me-forgejo-oidc-client-secret
|