windyboy
c0c975584a
记录源 Linear→Plane (2026-09-03 起, Plane MCP) + plane.chans.xyz 服务行/upstream 段; inventory + hosts/synapse.chans.xyz.md 补 Plane 部署事实 (Helm plane-ce-1.8.0 / app v1.4.1, ns plane, IngressRoute/自有证书 issuer/PVC 5+5Gi local-path/无备份层); 新增 runbooks/plane-health.md (只读健康检查) 与 docs/plane-hardening/ 草稿 (values.hardened.yaml、secrets.yaml.example 占位、backup/ CronJob), 均为未应用设计稿; .gitignore 增加 .tmp-* agent 临时文件。
110 lines
4.3 KiB
YAML
110 lines
4.3 KiB
YAML
# Plane CE hardened values — DRAFT (2026-09-03), NOT applied.
|
|
# Target file on host: /home/windy/plane-k3s/values.yaml (synapse.chans.xyz)
|
|
# Reference release: plane-app, chart plane-ce-1.8.0 (values.yaml L1-362 + templates verified 2026-09-03).
|
|
# No secrets in this file. Secret *values* live only in k8s Secrets (see secrets.yaml.example).
|
|
#
|
|
# Two phases:
|
|
# Phase A: externalize secrets (reference names below) with CURRENT values copied -> zero change.
|
|
# Phase B: rotate credentials one by one (see README.md). SECRET_KEY rotation is cheap only while
|
|
# SMTP/OAuth are unconfigured (no encrypted config rows yet).
|
|
|
|
planeVersion: v1.4.1
|
|
|
|
ingress:
|
|
enabled: true
|
|
appHost: plane.chans.xyz
|
|
ingressClass: traefik
|
|
traefik:
|
|
# 20 MiB (chart default). Keep aligned with env.doc_upload_size_limit below.
|
|
maxRequestBodyBytes: 20971520
|
|
|
|
ssl:
|
|
createIssuer: true
|
|
issuer: http # HTTP-01; ssl_token_existingSecret not needed
|
|
email: admin@chans.xyz
|
|
generateCerts: true
|
|
|
|
postgres:
|
|
storageClass: local-path
|
|
volumeSize: 5Gi
|
|
# NOTE: chart 1.8.0 exposes NO resources knob for the bundled datastores
|
|
# (stateful templates render no resources block). Add limits via
|
|
# --post-renderer/kustomize or `kubectl -n plane patch sts ...` re-applied on
|
|
# every upgrade (P2 task; see README.md).
|
|
|
|
redis:
|
|
storageClass: local-path
|
|
# image: valkey/valkey:7.2.11-alpine # already pinned by chart default; uncomment to make explicit
|
|
|
|
minio:
|
|
# P2: pin. Digest of the currently running :latest (2026-09-03, pod plane-app-minio-wl-0).
|
|
image: minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
|
|
# image_mc: minio/mc@sha256:... # optional: pin one-shot bucket-init client the same way
|
|
storageClass: local-path
|
|
volumeSize: 5Gi
|
|
|
|
rabbitmq:
|
|
storageClass: local-path
|
|
|
|
env:
|
|
# Fail the render instead of ever falling back to the chart's PUBLIC constants
|
|
# (values.yaml L340-341 in chart 1.8.0). Requires external_secrets below.
|
|
requireExplicitSecrets: true
|
|
|
|
# SECRET_KEY / LIVE_SERVER_SECRET_KEY are deliberately OMITTED here.
|
|
# They live in k8s Secret `plane-app-keys` (referenced below). With
|
|
# requireExplicitSecrets=true and app_keys_existingSecret set, the chart renders
|
|
# neither key itself and app+live workloads both envFrom `plane-app-keys` LAST
|
|
# (later envFrom wins), which keeps the shared signing key consistent.
|
|
|
|
pgdb_name: plane
|
|
docstore_bucket: uploads
|
|
# Align app-side upload cap with the Traefik body limit (was 5242880/5MiB).
|
|
# Keep both at 20MiB, or lower both together.
|
|
doc_upload_size_limit: "20971520"
|
|
|
|
external_secrets:
|
|
# Shared signing keys (used by app + live). REQUIRED keys: SECRET_KEY, LIVE_SERVER_SECRET_KEY.
|
|
app_keys_existingSecret: plane-app-keys
|
|
# REQUIRED keys: REDIS_URL, DATABASE_URL, AMQP_URL (chart-derived URLs; update on DB/queue rotation).
|
|
app_env_existingSecret: plane-app-env
|
|
# REQUIRED keys: REDIS_URL.
|
|
live_env_existingSecret: plane-live-env
|
|
# REQUIRED keys: POSTGRES_PASSWORD, POSTGRES_DB, POSTGRES_USER.
|
|
pgdb_existingSecret: plane-pgdb-credentials
|
|
# REQUIRED keys: RABBITMQ_DEFAULT_USER, RABBITMQ_DEFAULT_PASS.
|
|
rabbitmq_existingSecret: plane-rabbitmq-credentials
|
|
# REQUIRED keys: FILE_SIZE_LIMIT, AWS_S3_BUCKET_NAME, USE_MINIO, MINIO_ROOT_USER,
|
|
# MINIO_ROOT_PASSWORD, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_S3_ENDPOINT_URL.
|
|
doc_store_existingSecret: plane-minio-credentials
|
|
# ssl_token_existingSecret: '' # DNS-01 only (cloudflare/digitalocean); unused with HTTP-01
|
|
|
|
# Optional, P2: HTTP -> HTTPS 301. The chart's own IngressRoute binds only
|
|
# 'websecure' (http:// currently 404s). extraObjects is rendered verbatim (toYaml).
|
|
# Uncomment and `helm upgrade` once reviewed:
|
|
# extraObjects:
|
|
# - apiVersion: traefik.io/v1alpha1
|
|
# kind: Middleware
|
|
# metadata:
|
|
# name: plane-https-redirect
|
|
# namespace: plane
|
|
# spec:
|
|
# redirectScheme:
|
|
# scheme: https
|
|
# permanent: true
|
|
# - apiVersion: traefik.io/v1alpha1
|
|
# kind: IngressRoute
|
|
# metadata:
|
|
# name: plane-http-to-https
|
|
# namespace: plane
|
|
# spec:
|
|
# entryPoints: [web]
|
|
# routes:
|
|
# - match: Host(`plane.chans.xyz`)
|
|
# kind: Rule
|
|
# middlewares:
|
|
# - name: plane-https-redirect
|
|
# services:
|
|
# - name: plane-app-web
|
|
# port: 3000
|