windyboy
c0c975584a
记录源 Linear→Plane (2026-09-03 起, Plane MCP) + plane.chans.xyz 服务行/upstream 段; inventory + hosts/synapse.chans.xyz.md 补 Plane 部署事实 (Helm plane-ce-1.8.0 / app v1.4.1, ns plane, IngressRoute/自有证书 issuer/PVC 5+5Gi local-path/无备份层); 新增 runbooks/plane-health.md (只读健康检查) 与 docs/plane-hardening/ 草稿 (values.hardened.yaml、secrets.yaml.example 占位、backup/ CronJob), 均为未应用设计稿; .gitignore 增加 .tmp-* agent 临时文件。
92 lines
3.4 KiB
Plaintext
92 lines
3.4 KiB
Plaintext
# External Secret structure for Plane CE hardening — EXAMPLE ONLY.
|
|
# No real values here; this file is safe to commit. Real values live only on the
|
|
# host (/home/windy/plane-k3s, 0600/0700) and in the cluster.
|
|
#
|
|
# Phase A — create each Secret with the CURRENT cluster values first (zero change):
|
|
# # current source Secrets (chart-generated):
|
|
# kubectl -n plane get secret plane-app-app-secrets -o jsonpath='{.data.SECRET_KEY}' | base64 -d
|
|
# kubectl -n plane get secret plane-app-live-secrets -o jsonpath='{.data.REDIS_URL}' | base64 -d
|
|
# kubectl -n plane get secret plane-app-pgdb-secrets -o jsonpath='{.data.POSTGRES_PASSWORD}' | base64 -d
|
|
# kubectl -n plane get secret plane-app-rabbitmq-secrets -o jsonpath='{.data.RABBITMQ_DEFAULT_PASS}' | base64 -d
|
|
# kubectl -n plane get secret plane-app-doc-store-secrets -o jsonpath='{.data}' | base64 -d
|
|
#
|
|
# e.g. kubectl -n plane create secret generic plane-app-keys \
|
|
# --from-literal=SECRET_KEY="$(<copy from above>)" \
|
|
# --from-literal=LIVE_SERVER_SECRET_KEY="$(<copy from above>)"
|
|
#
|
|
# All keys below are REQUIRED by chart templates/plane-ce-1.8.0 (verified 2026-09-03):
|
|
# missing keys are NOT auto-filled once an existingSecret is referenced.
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: plane-app-keys # external_secrets.app_keys_existingSecret
|
|
namespace: plane
|
|
type: Opaque
|
|
stringData:
|
|
SECRET_KEY: "" # current: copy from plane-app-app-secrets; rotate only in Phase B
|
|
LIVE_SERVER_SECRET_KEY: "" # current: same value as above / plane-app-live-secrets
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: plane-app-env # external_secrets.app_env_existingSecret
|
|
namespace: plane
|
|
type: Opaque
|
|
stringData:
|
|
REDIS_URL: "" # redis://plane-app-redis.plane.svc.cluster.local:6379/
|
|
DATABASE_URL: "" # postgresql://plane:plane@plane-app-pgdb.plane.svc.cluster.local/plane
|
|
AMQP_URL: "" # amqp://plane:plane@plane-app-rabbitmq.plane.svc.cluster.local/
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: plane-live-env # external_secrets.live_env_existingSecret
|
|
namespace: plane
|
|
type: Opaque
|
|
stringData:
|
|
REDIS_URL: "" # redis://plane-app-redis.plane.svc.cluster.local:6379/
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: plane-pgdb-credentials # external_secrets.pgdb_existingSecret
|
|
namespace: plane
|
|
type: Opaque
|
|
stringData:
|
|
POSTGRES_PASSWORD: "" # Phase A: keep current ('plane'); Phase B: ALTER USER first, then sync
|
|
POSTGRES_DB: "plane"
|
|
POSTGRES_USER: "plane"
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: plane-rabbitmq-credentials # external_secrets.rabbitmq_existingSecret
|
|
namespace: plane
|
|
type: Opaque
|
|
stringData:
|
|
RABBITMQ_DEFAULT_USER: "plane"
|
|
RABBITMQ_DEFAULT_PASS: "" # Phase A: keep current; Phase B: rabbitmqctl change_password first
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: plane-minio-credentials # external_secrets.doc_store_existingSecret
|
|
namespace: plane
|
|
type: Opaque
|
|
stringData:
|
|
FILE_SIZE_LIMIT: "20971520" # must match env.doc_upload_size_limit
|
|
AWS_S3_BUCKET_NAME: "uploads"
|
|
USE_MINIO: "1"
|
|
MINIO_ROOT_USER: "admin"
|
|
MINIO_ROOT_PASSWORD: "" # root creds take effect on first init only
|
|
AWS_ACCESS_KEY_ID: "admin"
|
|
AWS_SECRET_ACCESS_KEY: "" # == MINIO_ROOT_PASSWORD while minio.local_setup
|
|
AWS_S3_ENDPOINT_URL: "http://plane-app-minio:9000"
|