docs(plane): 自托管 Plane 落地事实入仓库 + plane-health runbook + hardening 草稿

记录源 Linear→Plane (2026-09-03 起, Plane MCP) + plane.chans.xyz 服务行/upstream 段; inventory + hosts/synapse.chans.xyz.md 补 Plane 部署事实 (Helm plane-ce-1.8.0 / app v1.4.1, ns plane, IngressRoute/自有证书 issuer/PVC 5+5Gi local-path/无备份层); 新增 runbooks/plane-health.md (只读健康检查) 与 docs/plane-hardening/ 草稿 (values.hardened.yaml、secrets.yaml.example 占位、backup/ CronJob), 均为未应用设计稿; .gitignore 增加 .tmp-* agent 临时文件。
2026-09-13 19:12:32 +08:00
parent c9dcde1274
commit c0c975584a
11 changed files with 512 additions and 5 deletions
@@ -0,0 +1,91 @@
+# External Secret structure for Plane CE hardening — EXAMPLE ONLY.
+# No real values here; this file is safe to commit. Real values live only on the
+# host (/home/windy/plane-k3s, 0600/0700) and in the cluster.
+#
+# Phase A — create each Secret with the CURRENT cluster values first (zero change):
+#   # current source Secrets (chart-generated):
+#   kubectl -n plane get secret plane-app-app-secrets     -o jsonpath='{.data.SECRET_KEY}'            | base64 -d
+#   kubectl -n plane get secret plane-app-live-secrets   -o jsonpath='{.data.REDIS_URL}'             | base64 -d
+#   kubectl -n plane get secret plane-app-pgdb-secrets   -o jsonpath='{.data.POSTGRES_PASSWORD}'     | base64 -d
+#   kubectl -n plane get secret plane-app-rabbitmq-secrets -o jsonpath='{.data.RABBITMQ_DEFAULT_PASS}' | base64 -d
+#   kubectl -n plane get secret plane-app-doc-store-secrets -o jsonpath='{.data}'                    | base64 -d
+#
+# e.g. kubectl -n plane create secret generic plane-app-keys \
+#        --from-literal=SECRET_KEY="$(<copy from above>)" \
+#        --from-literal=LIVE_SERVER_SECRET_KEY="$(<copy from above>)"
+#
+# All keys below are REQUIRED by chart templates/plane-ce-1.8.0 (verified 2026-09-03):
+# missing keys are NOT auto-filled once an existingSecret is referenced.
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plane-app-keys          # external_secrets.app_keys_existingSecret
+  namespace: plane
+type: Opaque
+stringData:
+  SECRET_KEY: ""                # current: copy from plane-app-app-secrets; rotate only in Phase B
+  LIVE_SERVER_SECRET_KEY: ""    # current: same value as above / plane-app-live-secrets
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plane-app-env           # external_secrets.app_env_existingSecret
+  namespace: plane
+type: Opaque
+stringData:
+  REDIS_URL: ""                 # redis://plane-app-redis.plane.svc.cluster.local:6379/
+  DATABASE_URL: ""              # postgresql://plane:plane@plane-app-pgdb.plane.svc.cluster.local/plane
+  AMQP_URL: ""                  # amqp://plane:plane@plane-app-rabbitmq.plane.svc.cluster.local/
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plane-live-env          # external_secrets.live_env_existingSecret
+  namespace: plane
+type: Opaque
+stringData:
+  REDIS_URL: ""                 # redis://plane-app-redis.plane.svc.cluster.local:6379/
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plane-pgdb-credentials  # external_secrets.pgdb_existingSecret
+  namespace: plane
+type: Opaque
+stringData:
+  POSTGRES_PASSWORD: ""         # Phase A: keep current ('plane'); Phase B: ALTER USER first, then sync
+  POSTGRES_DB: "plane"
+  POSTGRES_USER: "plane"
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plane-rabbitmq-credentials  # external_secrets.rabbitmq_existingSecret
+  namespace: plane
+type: Opaque
+stringData:
+  RABBITMQ_DEFAULT_USER: "plane"
+  RABBITMQ_DEFAULT_PASS: ""     # Phase A: keep current; Phase B: rabbitmqctl change_password first
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plane-minio-credentials # external_secrets.doc_store_existingSecret
+  namespace: plane
+type: Opaque
+stringData:
+  FILE_SIZE_LIMIT: "20971520"          # must match env.doc_upload_size_limit
+  AWS_S3_BUCKET_NAME: "uploads"
+  USE_MINIO: "1"
+  MINIO_ROOT_USER: "admin"
+  MINIO_ROOT_PASSWORD: ""              # root creds take effect on first init only
+  AWS_ACCESS_KEY_ID: "admin"
+  AWS_SECRET_ACCESS_KEY: ""            # == MINIO_ROOT_PASSWORD while minio.local_setup
+  AWS_S3_ENDPOINT_URL: "http://plane-app-minio:9000"