0 Fork 0

Files

T

jakman85andClaude Opus 4.8 7f86e1099b fix(nextcloud-sso): register post-logout redirect URI + harden admin promotion

Two SSO follow-ups the operator hit after Nextcloud OIDC login worked.

1. Sign-out "redirect failed". On logout user_oidc redirects the browser to
   Keycloak's end_session_endpoint with post_logout_redirect_uri=<Nextcloud
   base '/'> and client_id=nextcloud but NO id_token_hint (provider
   sendIdTokenHint=0). Keycloak then validates that redirect against the
   client's post.logout.redirect.uris attribute, which was empty -> "Invalid
   redirect uri" -> the operator's "redirect failed". Register
   https://nextcloud.home.keithjackson.dev/* on the nextcloud client
   (attributes.post.logout.redirect.uris). Applied live via kcadm and captured
   here so git stays authoritative (a RealmImport no-ops on the existing realm).

2. postStart step (d) mirrors platform-admins -> built-in admin group, but the
   previous single best-effort pass ran occ group:adduser once with output
   swallowed and no retry. At early boot (container Started ~9s after create)
   that call can transiently fail (DB / maintenance race), silently dropping the
   promotion until the next restart. Harden step (d) with a verify-and-retry
   loop (like step (c)): re-read group:list and re-add any platform-admins
   member still missing from admin until verified (bounded ~30s), no-op for
   existing members.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-27 20:13:45 -05:00

vms

docs: reconcile the documentation with the deployed reality

2026-08-27 00:00:05 -05:00

wave-0

fix(plex): mount config PVC at /config (image's real config dir)

2026-08-27 18:53:46 -05:00

wave-1

fix(nextcloud-sso): register post-logout redirect URI + harden admin promotion

2026-08-27 20:13:45 -05:00

wave-2

fix(seerr): add fsGroup podSecurityContext to resolve non-root PVC CrashLoop

2026-08-27 16:58:17 -05:00

README.md

refactor(apps): split monolithic apps Kustomization into dependency waves

2026-08-26 12:19:00 -05:00

README.md

apps

App-tier manifests, rendered from catalog/*.yaml ServiceDefinitions by catalog/render.py and split into dependency-ordered waves (wave-<N>/).

Each wave-<N>/ is reconciled by its own Flux Kustomization apps-wave-<N> (clusters/base/apps-wave-<N>.yaml), which dependsOn wave N-1 (wave 0 dependsOn platform-config) and health-gates (wait: true) ONLY that wave. A crashlooping workload in a later wave can no longer stall an earlier wave or block new revisions.
wave-<N>/kustomization.yaml and clusters/base/apps-wave-<N>.yaml are generated — run python3 catalog/render.py --emit-waves after onboarding a service; do not hand-edit them.
Wave assignment = longest dependency-path depth over the catalog dependencies: graph; a co-located CNPG database <svc>-db is a leaf and always lands strictly below its consumer.

See ../DESIGN-waves.md for the wave table, Flux topology, and the cutover runbook.