feat: bring up local dev stack — all services running
- Ory Hydra + Kratos: fixed secret management, DSN config, DB migrations, OAuth2Client CRD (helm template skips crds/ dir), login-ui env vars - SeaweedFS: added s3.json credentials file via -s3.config CLI flag - OpenBao: standalone mode with auto-unseal sidecar, keys in K8s secret - OpenSearch: increased memory to 1.5Gi / JVM 1g heap - Gitea: SSL_MODE disable, S3 bucket creation fixed - Hive: automountServiceAccountToken: false (Lima virtiofs read-only rootfs quirk) - LiveKit: API keys in values, hostPort conflict resolved - Linkerd: native sidecar (proxy.nativeSidecar=true) to avoid blocking Jobs - All placeholder images replaced: pingora→nginx:alpine, login-ui→oryd/kratos-selfservice-ui-node Full stack running: postgres, valkey, openbao, opensearch, seaweedfs, kratos, hydra, gitea, livekit, hive (placeholder), login-ui
This commit is contained in:
183
scripts/local-seed-secrets.sh
Executable file
183
scripts/local-seed-secrets.sh
Executable file
@@ -0,0 +1,183 @@
|
||||
#!/usr/bin/env bash
|
||||
# Seed all secrets for the local dev stack.
|
||||
# - Initializes OpenBao (if needed) and stores root token + unseal key
|
||||
# - Sets postgres user passwords
|
||||
# - Creates K8s secrets consumed by each service
|
||||
# - Stores all secrets in OpenBao as source of truth
|
||||
#
|
||||
# Idempotent: safe to run multiple times.
|
||||
set -euo pipefail
|
||||
|
||||
CTX="--context=sunbeam"
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
# Deterministic local-dev passwords (simple, memorable, not for production)
|
||||
DB_PASSWORD="localdev"
|
||||
S3_ACCESS_KEY="minioadmin"
|
||||
S3_SECRET_KEY="minioadmin"
|
||||
HYDRA_SYSTEM_SECRET="local-hydra-system-secret-at-least-16"
|
||||
HYDRA_COOKIE_SECRET="local-hydra-cookie-secret-at-least-16"
|
||||
HYDRA_PAIRWISE_SALT="local-hydra-pairwise-salt-value-1"
|
||||
LIVEKIT_API_KEY="devkey"
|
||||
LIVEKIT_API_SECRET="secret-placeholder"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Helper
|
||||
# ---------------------------------------------------------------------------
|
||||
ensure_ns() {
|
||||
kubectl $CTX create namespace "$1" --dry-run=client -o yaml | kubectl $CTX apply -f - 2>/dev/null
|
||||
}
|
||||
|
||||
create_secret() {
|
||||
local ns="$1"; shift
|
||||
local name="$1"; shift
|
||||
# remaining args are --from-literal=key=value
|
||||
kubectl $CTX create secret generic "$name" -n "$ns" "$@" \
|
||||
--dry-run=client -o yaml | kubectl $CTX apply -f -
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 1. Wait for postgres to be ready
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Waiting for postgres cluster..."
|
||||
for i in $(seq 1 60); do
|
||||
PHASE=$(kubectl $CTX -n data get cluster postgres -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
|
||||
if [[ "$PHASE" == "Cluster in healthy state" ]]; then
|
||||
echo " Postgres is ready."
|
||||
break
|
||||
fi
|
||||
if [[ $i -eq 60 ]]; then
|
||||
echo "WARN: Postgres not ready after 5 min, continuing anyway..."
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 2. Set postgres user passwords
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Setting postgres user passwords..."
|
||||
PG_POD=$(kubectl $CTX -n data get pods -l cnpg.io/cluster=postgres,role=primary -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
|
||||
if [[ -n "$PG_POD" ]]; then
|
||||
for user in kratos hydra gitea hive docs meet drive messages conversations people; do
|
||||
kubectl $CTX -n data exec "$PG_POD" -c postgres -- \
|
||||
psql -U postgres -c "ALTER USER $user WITH PASSWORD '$DB_PASSWORD';" 2>/dev/null || true
|
||||
done
|
||||
echo " Done."
|
||||
else
|
||||
echo "WARN: No postgres primary pod found, skipping password setup."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 3. Create K8s secrets for each service
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Creating K8s secrets..."
|
||||
|
||||
# Ory namespace
|
||||
ensure_ns ory
|
||||
# Secret name must match chart release name (secret.enabled: false means chart uses release name)
|
||||
create_secret ory hydra \
|
||||
--from-literal=dsn="postgresql://hydra:${DB_PASSWORD}@postgres-rw.data.svc.cluster.local:5432/hydra_db?sslmode=disable" \
|
||||
--from-literal=secretsSystem="$HYDRA_SYSTEM_SECRET" \
|
||||
--from-literal=secretsCookie="$HYDRA_COOKIE_SECRET" \
|
||||
--from-literal=pairwise-salt="$HYDRA_PAIRWISE_SALT"
|
||||
|
||||
# Kratos chart (secret.enabled: true, nameOverride: kratos-secrets) creates kratos-secrets
|
||||
# from Helm values — DSN is in kratos-values.yaml, random secrets generated by chart.
|
||||
# This create is a no-op placeholder; chart apply overwrites with Helm-generated values.
|
||||
|
||||
# Devtools namespace
|
||||
ensure_ns devtools
|
||||
create_secret devtools gitea-db-credentials \
|
||||
--from-literal=password="$DB_PASSWORD"
|
||||
|
||||
create_secret devtools gitea-s3-credentials \
|
||||
--from-literal=access-key="$S3_ACCESS_KEY" \
|
||||
--from-literal=secret-key="$S3_SECRET_KEY"
|
||||
|
||||
# Storage namespace
|
||||
ensure_ns storage
|
||||
create_secret storage seaweedfs-s3-credentials \
|
||||
--from-literal=S3_ACCESS_KEY="$S3_ACCESS_KEY" \
|
||||
--from-literal=S3_SECRET_KEY="$S3_SECRET_KEY"
|
||||
|
||||
# La Suite namespace
|
||||
ensure_ns lasuite
|
||||
create_secret lasuite seaweedfs-s3-credentials \
|
||||
--from-literal=S3_ACCESS_KEY="$S3_ACCESS_KEY" \
|
||||
--from-literal=S3_SECRET_KEY="$S3_SECRET_KEY"
|
||||
|
||||
create_secret lasuite hive-db-url \
|
||||
--from-literal=url="postgresql://hive:${DB_PASSWORD}@postgres-rw.data.svc.cluster.local:5432/hive_db"
|
||||
|
||||
create_secret lasuite hive-oidc \
|
||||
--from-literal=client-id="hive-local" \
|
||||
--from-literal=client-secret="hive-local-secret"
|
||||
|
||||
# Media namespace
|
||||
ensure_ns media
|
||||
|
||||
echo " Done."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 4. Initialize and unseal OpenBao (if deployed)
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Checking OpenBao..."
|
||||
OB_POD=$(kubectl $CTX -n data get pods -l app.kubernetes.io/name=openbao,component=server -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
|
||||
if [[ -z "$OB_POD" ]]; then
|
||||
echo " OpenBao pod not found, skipping."
|
||||
else
|
||||
# Wait for pod to be running (not necessarily ready — it won't be ready until unsealed)
|
||||
kubectl $CTX -n data wait pod "$OB_POD" --for=jsonpath='{.status.phase}'=Running --timeout=120s 2>/dev/null || true
|
||||
|
||||
# Check if initialized
|
||||
INIT_STATUS=$(kubectl $CTX -n data exec "$OB_POD" -c openbao -- bao status -format=json 2>/dev/null | grep '"initialized"' | grep -c 'true' || echo "0")
|
||||
|
||||
if [[ "$INIT_STATUS" != "1" ]]; then
|
||||
echo "==> Initializing OpenBao..."
|
||||
INIT_OUTPUT=$(kubectl $CTX -n data exec "$OB_POD" -c openbao -- bao operator init -key-shares=1 -key-threshold=1 -format=json 2>/dev/null)
|
||||
UNSEAL_KEY=$(echo "$INIT_OUTPUT" | jq -r '.unseal_keys_b64[0]')
|
||||
ROOT_TOKEN=$(echo "$INIT_OUTPUT" | jq -r '.root_token')
|
||||
|
||||
# Store keys in K8s secret
|
||||
create_secret data openbao-keys \
|
||||
--from-literal=key="$UNSEAL_KEY" \
|
||||
--from-literal=root-token="$ROOT_TOKEN"
|
||||
echo " Initialized. Keys stored in secret/openbao-keys."
|
||||
else
|
||||
echo " Already initialized."
|
||||
# Read unseal key from existing secret
|
||||
UNSEAL_KEY=$(kubectl $CTX -n data get secret openbao-keys -o jsonpath='{.data.key}' 2>/dev/null | base64 -d || echo "")
|
||||
ROOT_TOKEN=$(kubectl $CTX -n data get secret openbao-keys -o jsonpath='{.data.root-token}' 2>/dev/null | base64 -d || echo "")
|
||||
fi
|
||||
|
||||
# Unseal if sealed
|
||||
SEALED=$(kubectl $CTX -n data exec "$OB_POD" -c openbao -- bao status -format=json 2>/dev/null | grep '"sealed"' | grep -c 'true' || echo "0")
|
||||
if [[ "$SEALED" == "1" && -n "$UNSEAL_KEY" ]]; then
|
||||
echo "==> Unsealing OpenBao..."
|
||||
kubectl $CTX -n data exec "$OB_POD" -c openbao -- bao operator unseal "$UNSEAL_KEY"
|
||||
echo " Unsealed."
|
||||
fi
|
||||
|
||||
# Seed secrets into OpenBao
|
||||
if [[ -n "$ROOT_TOKEN" ]]; then
|
||||
echo "==> Seeding secrets into OpenBao..."
|
||||
kubectl $CTX -n data exec "$OB_POD" -c openbao -- sh -c "
|
||||
export BAO_ADDR=http://127.0.0.1:8200
|
||||
export BAO_TOKEN='$ROOT_TOKEN'
|
||||
|
||||
bao secrets enable -path=secret -version=2 kv 2>/dev/null || true
|
||||
|
||||
bao kv put secret/postgres password='$DB_PASSWORD'
|
||||
bao kv put secret/hydra db-password='$DB_PASSWORD' system-secret='$HYDRA_SYSTEM_SECRET' cookie-secret='$HYDRA_COOKIE_SECRET' pairwise-salt='$HYDRA_PAIRWISE_SALT'
|
||||
bao kv put secret/kratos db-password='$DB_PASSWORD'
|
||||
bao kv put secret/gitea db-password='$DB_PASSWORD' s3-access-key='$S3_ACCESS_KEY' s3-secret-key='$S3_SECRET_KEY'
|
||||
bao kv put secret/seaweedfs access-key='$S3_ACCESS_KEY' secret-key='$S3_SECRET_KEY'
|
||||
bao kv put secret/hive db-url='postgresql://hive:${DB_PASSWORD}@postgres-rw.data.svc.cluster.local:5432/hive_db' oidc-client-id='hive-local' oidc-client-secret='hive-local-secret'
|
||||
bao kv put secret/livekit api-key='$LIVEKIT_API_KEY' api-secret='$LIVEKIT_API_SECRET'
|
||||
" 2>/dev/null
|
||||
echo " Done."
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "==> All secrets seeded."
|
||||
@@ -5,12 +5,13 @@ set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
CTX="--context=sunbeam"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 1. Check prerequisites
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Checking prerequisites..."
|
||||
for tool in limactl mkcert kubectl helm linkerd; do
|
||||
for tool in limactl mkcert kubectl kustomize linkerd jq; do
|
||||
if ! command -v "$tool" &>/dev/null; then
|
||||
echo "ERROR: '$tool' not found. Install with: brew install $tool" >&2
|
||||
exit 1
|
||||
@@ -33,7 +34,7 @@ else
|
||||
echo "==> Creating Lima VM 'sunbeam' (k3s, 6 CPU / 12 GB / 60 GB)..."
|
||||
limactl start \
|
||||
--name=sunbeam \
|
||||
template://k3s \
|
||||
template:k3s \
|
||||
--memory=12 \
|
||||
--cpus=6 \
|
||||
--disk=60 \
|
||||
@@ -42,81 +43,145 @@ else
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 3. Export kubeconfig
|
||||
# 3. Merge kubeconfig into ~/.kube/config as context "sunbeam"
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Exporting kubeconfig..."
|
||||
mkdir -p ~/.kube
|
||||
limactl shell sunbeam kubectl config view --raw > ~/.kube/sunbeam.yaml
|
||||
export KUBECONFIG=~/.kube/sunbeam.yaml
|
||||
echo " KUBECONFIG=$KUBECONFIG"
|
||||
echo "==> Merging kubeconfig..."
|
||||
LIMA_KUBECONFIG="/Users/$USER/.lima/sunbeam/copied-from-guest/kubeconfig.yaml"
|
||||
if [[ ! -f "$LIMA_KUBECONFIG" ]]; then
|
||||
echo "ERROR: Lima kubeconfig not found at $LIMA_KUBECONFIG" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Extract cert data and set context
|
||||
mkdir -p ~/.kube /tmp/sunbeam-kube
|
||||
yq '.clusters[0].cluster.certificate-authority-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/ca.crt
|
||||
yq '.users[0].user.client-certificate-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/client.crt
|
||||
yq '.users[0].user.client-key-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/client.key
|
||||
|
||||
kubectl config set-cluster sunbeam --server=https://127.0.0.1:6443 --certificate-authority=/tmp/sunbeam-kube/ca.crt --embed-certs=true
|
||||
kubectl config set-credentials sunbeam-admin --client-certificate=/tmp/sunbeam-kube/client.crt --client-key=/tmp/sunbeam-kube/client.key --embed-certs=true
|
||||
kubectl config set-context sunbeam --cluster=sunbeam --user=sunbeam-admin
|
||||
rm -rf /tmp/sunbeam-kube
|
||||
echo " Context 'sunbeam' ready."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 4. Install Linkerd CRDs + control plane
|
||||
# 4. Disable Traefik (k3s default) if still present
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Adding Linkerd Helm repo..."
|
||||
helm repo add linkerd https://helm.linkerd.io/stable --force-update
|
||||
helm repo update linkerd
|
||||
|
||||
echo "==> Installing Linkerd CRDs..."
|
||||
helm upgrade --install linkerd-crds linkerd/linkerd-crds \
|
||||
-n mesh --create-namespace --wait
|
||||
|
||||
echo "==> Installing Linkerd control plane..."
|
||||
helm upgrade --install linkerd-control-plane linkerd/linkerd-control-plane \
|
||||
-n mesh \
|
||||
--set-file identityTrustAnchorsPEM="$(linkerd identity trust-anchors 2>/dev/null || echo '')" \
|
||||
--wait || {
|
||||
echo "==> Bootstrapping Linkerd identity (first install)..."
|
||||
linkerd install --crds | kubectl apply -f -
|
||||
linkerd install | kubectl apply -f -
|
||||
linkerd check
|
||||
}
|
||||
if kubectl $CTX get helmchart traefik -n kube-system &>/dev/null; then
|
||||
echo "==> Removing Traefik (replaced by Pingora)..."
|
||||
kubectl $CTX delete helmchart traefik traefik-crd -n kube-system 2>/dev/null || true
|
||||
fi
|
||||
# Remove startup manifest so k3s doesn't re-create it
|
||||
limactl shell sunbeam sudo rm -f /var/lib/rancher/k3s/server/manifests/traefik.yaml 2>/dev/null || true
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 5. Generate mkcert wildcard cert
|
||||
# 5. Install Gateway API CRDs + Linkerd via CLI
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Generating TLS cert..."
|
||||
bash "$SCRIPT_DIR/local-certs.sh"
|
||||
if ! kubectl $CTX get ns linkerd &>/dev/null; then
|
||||
echo "==> Installing Gateway API CRDs..."
|
||||
kubectl $CTX apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
|
||||
|
||||
echo "==> Installing Linkerd CRDs..."
|
||||
linkerd install --crds | kubectl $CTX apply -f -
|
||||
|
||||
echo "==> Installing Linkerd control plane..."
|
||||
linkerd install | kubectl $CTX apply -f -
|
||||
kubectl $CTX -n linkerd rollout status deployment/linkerd-identity --timeout=120s
|
||||
kubectl $CTX -n linkerd rollout status deployment/linkerd-destination --timeout=120s
|
||||
kubectl $CTX -n linkerd rollout status deployment/linkerd-proxy-injector --timeout=120s
|
||||
echo " Linkerd installed."
|
||||
else
|
||||
echo "==> Linkerd already installed."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 6. Generate mkcert wildcard cert
|
||||
# ---------------------------------------------------------------------------
|
||||
LIMA_IP=$(limactl shell sunbeam hostname -I | awk '{print $1}')
|
||||
DOMAIN="${LIMA_IP}.sslip.io"
|
||||
SECRETS_DIR="$REPO_ROOT/secrets/local"
|
||||
|
||||
if [[ ! -f "$SECRETS_DIR/tls.crt" ]]; then
|
||||
echo "==> Generating TLS cert for *.$DOMAIN..."
|
||||
mkdir -p "$SECRETS_DIR"
|
||||
cd "$SECRETS_DIR"
|
||||
mkcert "*.$DOMAIN"
|
||||
mv "_wildcard.${DOMAIN}.pem" tls.crt
|
||||
mv "_wildcard.${DOMAIN}-key.pem" tls.key
|
||||
cd "$REPO_ROOT"
|
||||
else
|
||||
echo "==> TLS cert already exists."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 6. Create TLS Secret in ingress namespace
|
||||
# 7. Create TLS Secret in ingress namespace
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Applying TLS Secret to ingress namespace..."
|
||||
kubectl create namespace ingress --dry-run=client -o yaml | kubectl apply -f -
|
||||
kubectl create secret tls pingora-tls \
|
||||
--cert="$REPO_ROOT/secrets/local/tls.crt" \
|
||||
--key="$REPO_ROOT/secrets/local/tls.key" \
|
||||
kubectl $CTX create namespace ingress --dry-run=client -o yaml | kubectl $CTX apply -f -
|
||||
kubectl $CTX create secret tls pingora-tls \
|
||||
--cert="$SECRETS_DIR/tls.crt" \
|
||||
--key="$SECRETS_DIR/tls.key" \
|
||||
-n ingress \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
--dry-run=client -o yaml | kubectl $CTX apply -f -
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 7. Substitute domain and apply manifests
|
||||
# 8. Apply manifests (server-side apply handles large CRDs)
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Applying manifests (domain: $DOMAIN)..."
|
||||
# Substitute DOMAIN_SUFFIX placeholder before piping to kubectl
|
||||
kubectl kustomize "$REPO_ROOT/overlays/local" --enable-helm | \
|
||||
cd "$REPO_ROOT"
|
||||
kustomize build overlays/local --enable-helm | \
|
||||
sed "s/DOMAIN_SUFFIX/${DOMAIN}/g" | \
|
||||
kubectl apply -f -
|
||||
kubectl $CTX apply --server-side --force-conflicts -f -
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 8. Wait for core components
|
||||
# 9. Seed secrets (waits for postgres, creates K8s secrets, inits OpenBao)
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Waiting for PostgreSQL cluster..."
|
||||
kubectl wait --for=condition=Ready cluster/postgres -n data --timeout=180s || true
|
||||
echo "==> Seeding secrets..."
|
||||
bash "$SCRIPT_DIR/local-seed-secrets.sh"
|
||||
|
||||
echo "==> Waiting for Redis..."
|
||||
kubectl rollout status deployment/redis -n data --timeout=120s || true
|
||||
# ---------------------------------------------------------------------------
|
||||
# 10. Restart deployments that were waiting for secrets
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Restarting services that were waiting for secrets..."
|
||||
for ns_deploy in \
|
||||
"ory/hydra" \
|
||||
"ory/kratos" \
|
||||
"ory/login-ui" \
|
||||
"devtools/gitea" \
|
||||
"storage/seaweedfs-filer" \
|
||||
"lasuite/hive" \
|
||||
"media/livekit-server"; do
|
||||
ns="${ns_deploy%%/*}"
|
||||
dep="${ns_deploy##*/}"
|
||||
kubectl $CTX -n "$ns" rollout restart deployment/"$dep" 2>/dev/null || true
|
||||
done
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 11. Wait for core components
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "==> Waiting for Valkey..."
|
||||
kubectl $CTX rollout status deployment/valkey -n data --timeout=120s || true
|
||||
|
||||
echo "==> Waiting for Kratos..."
|
||||
kubectl rollout status deployment/kratos -n ory --timeout=120s || true
|
||||
kubectl $CTX rollout status deployment/kratos -n ory --timeout=120s || true
|
||||
|
||||
echo "==> Waiting for Hydra..."
|
||||
kubectl rollout status deployment/hydra -n ory --timeout=120s || true
|
||||
kubectl $CTX rollout status deployment/hydra -n ory --timeout=120s || true
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 9. Print URLs
|
||||
# 12. Print URLs
|
||||
# ---------------------------------------------------------------------------
|
||||
bash "$SCRIPT_DIR/local-urls.sh"
|
||||
echo ""
|
||||
echo "==> Stack is up. Domain: $DOMAIN"
|
||||
echo ""
|
||||
echo "Services:"
|
||||
echo " Auth: https://auth.${DOMAIN}/"
|
||||
echo " Docs: https://docs.${DOMAIN}/"
|
||||
echo " Meet: https://meet.${DOMAIN}/"
|
||||
echo " Drive: https://drive.${DOMAIN}/"
|
||||
echo " Chat: https://chat.${DOMAIN}/"
|
||||
echo " People: https://people.${DOMAIN}/"
|
||||
echo " Gitea: https://src.${DOMAIN}/"
|
||||
echo ""
|
||||
echo "OpenBao UI: kubectl $CTX -n data port-forward svc/openbao 8200:8200"
|
||||
echo " http://localhost:8200 (token from: kubectl $CTX -n data get secret openbao-keys -o jsonpath='{.data.root-token}' | base64 -d)"
|
||||
|
||||
Reference in New Issue
Block a user