feat(wordpress): migrate renner.uno off the Hetzner VM into the cluster #492

Merged

k.renner merged 3 commits from wordpress-renner-uno into master 2026-08-16 20:07:04 +00:00

Conversation 2 Commits 3 Files Changed 21

+854 -2

3 Commits

Author	SHA1	Message	Date
claude-botandClaude Opus 5	aa37fb0a0a	fix(wordpress): correct the network-policy claim and make the Velero selector safe ... Addresses the automated review on #492. Blocking: two comments claimed the public/admin split was kept honest by kubernetes/apps/wordpress/network-policy.yaml. That file does not exist — the comment was written against the paperless template and never updated once the namespace policy proved sufficient. The deeper point in the review is the real one: a paperless-style workload-scoped policy would be a no-op here, because traefik must reach the pod directly for every public page. The split is enforced by the Ingress path rules and Authentik, not at the network layer, and the comment now says so — an auditor looking for a network control would otherwise have gone hunting for a file that was never there. Velero: the schedule excluded the database PVC by app.kubernetes.io/instance, a label the mariadb-operator was only assumed to set. A wrong assumption there fails silently and sweeps the live database volume into the snapshot. Inverted to select the content PVC by labels this repo sets on it, the same direction openbao-daily already uses. The Service-name assumption flagged as a suggestion is kept: the CRD's separate primaryService/secondaryService fields indicate the base Service carries the resource name, and a mismatch fails loudly at pod startup. Written down as a first-deploy check rather than left implicit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98	2026-08-16 22:01:01 +02:00
claude-botandClaude Opus 5	b784ce3d38	feat(wordpress): host www.renner.uno in the cluster behind an Authentik gate ... Migrates the Hetzner VM 'wordpress-hochzeit' into the cluster. The site is not the frozen wedding archive it looks like: it carries an unpublished, fully composed birth announcement from 2026-05-14, so wp-admin has to keep working for a human author rather than being replaced by a Git workflow. Split routing on one host: '/' goes straight to WordPress so the blog stays publicly readable, while /wp-admin and /wp-login.php route through a dedicated wordpress-gate outpost. The inverse -- gate the host and skip_path_regex the public paths, as paperless-gate does -- would need a negative lookahead, and the outpost's RE2 has none. Gating all of /wp-admin is only safe because the dead wpgiftregistry plugin is dropped in the migration: it was the sole emitter of ajaxurl on this site, and of 121 admin-ajax hits in the current log window not one returned 200. Core lives in the pinned image, not on the volume, so upgrading is a tag bump in Git. Only wp-content is persisted. Backups are split the same way CNPG/Barman and Velero are elsewhere: the operator takes a logical dump to Hetzner Object Storage at 02:45, Velero takes the wp-content PVC at 08:45 and skips the database volume -- a crash-consistent snapshot of a running database is not a backup. Group membership for the gate is owned by Git, as with the Home Assistant, Shelly and zone-configurator gates. s.renner is the Authentik account for the site's WordPress Editor, whose login there is still the pre-2019 s.birzer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98	2026-08-16 21:48:49 +02:00
claude-botandClaude Opus 5	b976a67be8	feat(mariadb): add mariadb-operator and the wordpress backup bucket ... WordPress speaks MySQL natively. The PostgreSQL route would mean pg4wp, an SQL-rewriting shim whose README lists WordPress 6.5.3 as its newest tested version while renner.uno runs 7.0.4 — every core update would become a compatibility gamble. Charts are OCI artifacts, so this follows the OCIRepository pattern from spegel rather than the HelmRepository pattern used for CNPG. CRDs ship as a separate chart that upstream requires first, hence the dependsOn. The version range is capped at the year boundary: the project uses calendar versioning and ships an upgrade guide with each minor. renner-uno-k8s-mariadb carries the same 30d noncurrent-version expiry as the CNPG and Velero buckets, matched to the Backup resource's maxRetention. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98	2026-08-16 21:48:36 +02:00