feat(outline): onboard the Outline wiki #705
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/onboard-outline"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Onboards the Outline wiki at
outline.sean.farm, Part B of the plan that Part A(
create_repository) unblocked.What is here
Everything for Outline that this repository owns:
infrastructure/outline-argocd/manifest.yamlinfrastructure/outline-argocd/oidc.yamloutlineinfrastructure/outline-argocd/credentials.yamlinfrastructure/valkey-outline/infrastructure/tenantdatabase/outline.yaml,policy.yamlinfrastructure/rustfs-identities/outline.yamlinfrastructure/portal/clusters/seanfarm/infrastructure/{outline,valkey-outline}.yamlOutline's own Deployment, Service and HTTPRoute are NOT here. They belong to
sean/outlineand reach the cluster through the root Application.No ForgejoRepository CR
This is the first repository created by Binjovi's
create_repositoryMCP tool,which queues the repository and its codeberg push mirror together. A CR would be
a second owner of the same object, and the two disagree the first time either is
edited.
tests/outline.shrefuses one.Three settings that carry more weight than they look
maxmemory-policy noevictionon the Valkey. Outline drives it throughbull, and BullMQ must not run on a Redis with a cache eviction policy: anevicted key is a silently dropped job, not an error. A default
allkeys-lruValkey passes every health check and loses work.
appendonly yes. The same queues are the only record of in-flight work,and a node roll restarts this pod by design.
${URL}/auth/oidc.callback, read fromplugins/oidc/server/auth/oidcRouter.tsat v1.10.1. Hydra refuses aredirect_urithat does not match character for character, and reports it onHydra's own login page — a wrong path here looks like a broken Outline with the
cause in another namespace.
arm64
The registrar runs on the multi-arch house toolchain (the pin from #701), the
Valkey image is pinned to an index digest verified to carry a
linux/arm64child, and the Valkey carries the
arm-canarytoleration.Guard
tests/outline.shis new and wired intotests/check.sh. It checks the wholeshape as one object and carries seven negative controls, each proved to go red.
tests/lib/rustfs-contracts.jqnow also readsAWS_ACCESS_KEY_IDas an identityaccess key: each consumer's driver fixes its own spelling, and without this an
identity escapes the check merely by having been written against a different
upstream.
Ships with
sean/binjovi-plansdeclares theoutlinebucket and its policy inobject-store.json; Binjovi converges them. Until that catalog is released, theSecret here holds a key RustFS has never heard of and uploads answer 403 — the
intended order, not a fault.
https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
Give outline.sean.farm everything this repository owns: the namespace, the ArgoCD seed that lets sean/outline own its own Deployment, a CNPG tenant database, a Valkey for the queues, a scoped RustFS key, a Hydra OIDC client, the gateway listeners, the certificate and the portal card. THE REPOSITORY HAS NO ForgejoRepository CR. It is the first one created by Binjovi's create_repository MCP tool, which queues the repository and its codeberg push mirror together. A CR would be a second owner of the same object. tests/outline.sh refuses one. Three settings carry more weight than they look: maxmemory-policy noeviction on the Valkey. Outline drives it through bull, and BullMQ must not run on a Redis with a cache eviction policy: an evicted key is a silently dropped job, not an error. A default allkeys-lru Valkey passes every health check and loses work. appendonly yes. The same queues are the only record of in-flight work, and a node roll restarts this pod by design. The exact OIDC callback, ${URL}/auth/oidc.callback, read from Outline's own router. Hydra refuses a redirect_uri that does not match character for character, and reports it on Hydra's login page -- so a wrong path here looks like a broken Outline with the cause in another namespace. The registrar runs on the multi-arch house toolchain, the Valkey image is pinned to a verified multi-arch index digest, and the Valkey carries the arm-canary toleration: every node in this fleet is arm64. tests/lib/rustfs-contracts.jq now also reads AWS_ACCESS_KEY_ID as an identity access key. Each consumer's driver fixes its own spelling, and without this an identity escapes the check merely by having been written against a different upstream. The bucket and the policy behind the key are declared in sean/binjovi-plans object-store.json, which Binjovi converges; that change ships beside this one. Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d38887583492fa51ca2452