claude-botandClaude Opus 5
aa37fb0a0a
Addresses the automated review on #492. Blocking: two comments claimed the public/admin split was kept honest by kubernetes/apps/wordpress/network-policy.yaml. That file does not exist — the comment was written against the paperless template and never updated once the namespace policy proved sufficient. The deeper point in the review is the real one: a paperless-style workload-scoped policy would be a no-op here, because traefik must reach the pod directly for every public page. The split is enforced by the Ingress path rules and Authentik, not at the network layer, and the comment now says so — an auditor looking for a network control would otherwise have gone hunting for a file that was never there. Velero: the schedule excluded the database PVC by app.kubernetes.io/instance, a label the mariadb-operator was only assumed to set. A wrong assumption there fails silently and sweeps the live database volume into the snapshot. Inverted to select the content PVC by labels this repo sets on it, the same direction openbao-daily already uses. The Service-name assumption flagged as a suggestion is kept: the CRD's separate primaryService/secondaryService fields indicate the base Service carries the resource name, and a mismatch fails loudly at pod startup. Written down as a first-deploy check rather than left implicit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98
36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
# Only wp-content is persisted, not the whole docroot. WordPress core comes
|
|
# from the pinned image, so upgrading the site means bumping a tag in Git
|
|
# rather than clicking "update" in wp-admin — which is the entire point of
|
|
# moving off the Hetzner VM, where core was a mutable pile of PHP on disk.
|
|
#
|
|
# Consequence to be aware of: WordPress's own core updater will fail against
|
|
# a read-only core. Plugin and theme installs still work, because those land
|
|
# in wp-content.
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: wordpress-content
|
|
namespace: wordpress
|
|
labels:
|
|
# The Velero Schedule selects ON this label rather than excluding the
|
|
# database PVC by one the mariadb-operator is merely assumed to set. If
|
|
# that assumption were wrong the exclusion would fail silently and Velero
|
|
# would snapshot the live database volume; selecting a label this repo
|
|
# owns cannot fail that way. Same direction as openbao-daily, which picks
|
|
# its snapshot PVC by app.kubernetes.io/component.
|
|
app.kubernetes.io/name: wordpress
|
|
app.kubernetes.io/component: content
|
|
annotations:
|
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
# RWO is sufficient: a single replica with strategy Recreate. ceph-block is
|
|
# the cluster default; named explicitly so a default change can't silently
|
|
# move the media library onto another class.
|
|
storageClassName: ceph-block
|
|
resources:
|
|
requests:
|
|
# The migrated wp-content is 29 MB compressed, 13 MB of it uploads.
|
|
storage: 10Gi
|