Go to file

root 6b0402ff8b Add narrow ingress-read RBAC for management-platform-sa in default ns

Odoo's and Nextcloud's Ingress objects live in the default namespace
(historical, from the original Docker->k8s migration) rather than their
own app namespace like n8n/mautic/erpnext. management-platform-sa had
no binding there at all. Granting the full backup ClusterRole in
default would be way too broad (default also hosts unrelated live
services, and that role includes secrets/pod writes) - so this adds a
separate ClusterRole scoped to just ingresses get/list/watch, bound
only in default. Needed for the Application Sites page fix (next
commit) to read real domain/TLS state instead of guessing.

Applied and verified live: can read ingresses in default, still denied
secrets/pod-delete there.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017avLHFqkiti3g62Anq9sVA

2026-08-21 01:43:37 +02:00

backup

Lower backup/restore RAM safety threshold 1536MB -> 1024MB

2026-08-21 01:43:37 +02:00

docker-compose

Sync from main server - 2026-06-04 18:24:37

2026-08-14 12:20:58 +02:00

k8s

Give management-platform a scoped ServiceAccount for k8s backup/restore

2026-08-20 11:30:03 +02:00

platform

Checkout: hostPath-mount the VPS's own CloudOps checkout instead of cloning