Testing for RR stuff...

argocd/apps/.gitignore

@@ -0,0 +1 @@
+.idea

argocd/apps/cert-manager/include/mantisbt-cerficate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: innovation-hub-niedersachsen.de-mantisbt
+  namespace: kube-system
+spec:
+  secretName: mantisbt-tls
+  commonName: 'mantisbt.innovation-hub-niedersachsen.de'
+  dnsNames:
+    - 'mantisbt.innovation-hub-niedersachsen.de'
+  issuerRef:
+    name: lets-encrypt
+    kind: ClusterIssuer
+    group: cert-manager.io

argocd/apps/cert-manager/include/mrknow-cerficate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: innovation-hub-niedersachsen.de-mrknow
+  namespace: kube-system
+spec:
+  secretName: mrknow-tls
+  commonName: 'mrknow.innovation-hub-niedersachsen.de'
+  dnsNames:
+    - 'mrknow.innovation-hub-niedersachsen.de'
+  issuerRef:
+    name: lets-encrypt
+    kind: ClusterIssuer
+    group: cert-manager.io

argocd/apps/cert-manager/include/rr-certificate.yaml

@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: rr-cert
+  namespace: kube-system
+spec:
+  secretName: rr-tls
+  issuerRef:
+    name: lets-encrypt
+    kind: ClusterIssuer
+  commonName: rr.innovation-hub-niedersachsen.de
+  dnsNames:
+    - rr.innovation-hub-niedersachsen.de

argocd/apps/cert-manager/include/sws3-cerficate.yaml

@@ -1,14 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: innovation-hub-niedersachsen.sws3
-  namespace: kube-system
-spec:
-  secretName: sws3.innovation-hub-niedersachsen.de-tls
-  commonName: 'sws3.innovation-hub-niedersachsen.de'
-  dnsNames:
-    - 'sws3.innovation-hub-niedersachsen.de'
-  issuerRef:
-    name: lets-encrypt
-    kind: ClusterIssuer
-    group: cert-manager.io

argocd/apps/cert-manager/include/wekantest-cerficate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: innovation-hub-niedersachsen.de-wekantest
+  namespace: kube-system
+spec:
+  secretName: wekantest-tls
+  commonName: 'wekantest.innovation-hub-niedersachsen.de'
+  dnsNames:
+    - 'wekantest.innovation-hub-niedersachsen.de'
+  issuerRef:
+    name: lets-encrypt
+    kind: ClusterIssuer
+    group: cert-manager.io

argocd/apps/keycloak/values-keycloak.yaml

@@ -0,0 +1,42 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: keycloak-headers
+  namespace: kube-system
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+      X-Forwarded-Port: "443"
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: keycloak
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`keycloak.innovation-hub-niedersachsen.de`)
+      kind: Rule
+      middlewares:
+        - name: keycloak-headers
+      services:
+        - name: keycloak-external
+          port: 8080
+  tls:
+    secretName: keycloak-tls
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak-external
+  namespace: kube-system
+spec:
+  type: ExternalName
+  externalName: keycloak.innohub.local
+  ports:
+    - port: 8080

argocd/apps/mantisbt/config_inc.php

@@ -0,0 +1,35 @@
+<?php
+$g_hostname               = 'mantisbt-mariadb';
+$g_db_type                = 'mysqli';
+$g_database_name          = 'mantisbt';
+$g_db_username            = 'mantisbt';
+$g_db_password            = 'MantisDBPassword_2024!';
+
+$g_default_timezone       = 'Europe/Berlin';
+
+$g_crypto_master_salt     = 'shJaiK32W2tABdTZjwRUrZN+90AWLHXaLKiOt1Fwpaw=';
+
+$g_path                   = 'https://mantisbt.innovation-hub-niedersachsen.de/';
+
+# Email settings
+$g_webmaster_email        = 'inno-netz@zpd.polizei.niedersachsen.de';
+$g_from_email             = 'mantisbt@innovation-hub-niedersachsen.de';
+$g_return_path_email      = 'mantisbt@innovation-hub-niedersachsen.de';
+$g_from_name              = 'InnoHub MantisBT';
+
+# SMTP Configuration
+$g_phpMailer_method       = PHPMAILER_METHOD_SMTP;
+$g_smtp_host              = '192.168.4.125';
+$g_smtp_port              = 25;
+$g_enable_email_notification = ON;
+
+# File upload - match PHP limit
+$g_max_file_size          = 2000000;
+$g_allowed_files          = 'png,gif,jpg,jpeg,pdf,doc,docx,xls,xlsx,ppt,pptx,txt,zip,rar,7z';
+
+# Site settings
+$g_window_title           = 'InnoHub Bug Tracker';
+$g_logo_image             = 'images/mantis_logo.png';
+
+# Security - disable after installation!
+# $g_allow_signup           = OFF;

argocd/apps/mantisbt/values-mantisbt.yaml

@@ -0,0 +1,91 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: mantisbt
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: 'https://gitea.innovation-hub-niedersachsen.de/innohub/charts/raw/main/mantisbt'
+    targetRevision: 0.4.*
+    chart: mantisbt
+    helm:
+      values: |
+        image:
+          repository: xlrl/mantisbt
+          tag: "latest"
+        
+        ingress:
+          enabled: true
+          className: traefik
+          annotations:
+            kubernetes.io/ingress.class: traefik
+            traefik.ingress.kubernetes.io/router.tls: "true"
+            traefik.ingress.kubernetes.io/router.entrypoints: websecure
+            cert-manager.io/cluster-issuer: lets-encrypt
+          hosts:
+            - mantisbt.innovation-hub-niedersachsen.de
+          tls:
+            - secretName: mantisbt-tls
+              hosts:
+                - mantisbt.innovation-hub-niedersachsen.de
+        
+        mantisbt:
+          enableAdmin: "0"
+          timezone: "Europe/Berlin"
+          masterSalt: "shJaiK32W2tABdTZjwRUrZN+90AWLHXaLKiOt1Fwpaw="
+        
+        persistence:
+          enabled: true
+          storageClass: longhorn
+          size: 10Gi
+        
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+        
+        mariadb:
+          enabled: true
+          image:
+            tag: "latest"
+          auth:
+            database: mantisbt
+            username: mantisbt
+            password: "MantisDBPassword_2024!"
+            rootPassword: "RootDBPassword_2024!"
+          primary:
+            persistence:
+              enabled: true
+              storageClass: longhorn
+              size: 8Gi
+            livenessProbe:
+              enabled: true
+              initialDelaySeconds: 120
+              periodSeconds: 10
+              timeoutSeconds: 5
+              failureThreshold: 3
+            readinessProbe:
+              enabled: true
+              initialDelaySeconds: 30
+              periodSeconds: 10
+              timeoutSeconds: 5
+              failureThreshold: 3
+
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: mantisbt
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: "privileged"
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

argocd/apps/mattermost/mattermnost.yaml

@@ -90,7 +90,7 @@ spec:
               secretName: mattermost-tls
           annotations:
             kubernetes.io/ingress.class: traefik
-            cert-manager.io/cluster-issuer: lets-encrypt-staging
+            cert-manager.io/cluster-issuer: lets-encrypt
 
   destination:
     server: 'https://kubernetes.default.svc'

argocd/apps/mrknow/traefik-mrknow.yaml

@@ -0,0 +1,165 @@
+# =============================================================================
+# Traefik IngressRoute Konfiguration für MR.KNOW / BPM Inspire
+# =============================================================================
+# Anpassen:
+#   - Host: mrknow.innovation-hub-niedersachsen.de (oder gewünschte Domain)
+#   - externalName: IP/Hostname des Portainer/Docker Hosts
+#   - secretName: TLS-Zertifikat Secret
+# =============================================================================
+
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: mrknow-headers
+  namespace: kube-system
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+      X-Forwarded-Port: "443"
+
+---
+# =============================================================================
+# IngressRoute für InForm (Frontend / Root-Pfad)
+# =============================================================================
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mrknow-inform
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`mrknow.innovation-hub-niedersachsen.de`) && !PathPrefix(`/insign`) && !PathPrefix(`/inspire`) && !PathPrefix(`/pgadmin`)
+      kind: Rule
+      middlewares:
+        - name: mrknow-headers
+      services:
+        - name: mrknow-inform-external
+          port: 8080
+  tls:
+    secretName: mrknow-tls
+
+---
+# =============================================================================
+# IngressRoute für InSign
+# =============================================================================
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mrknow-insign
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`mrknow.innovation-hub-niedersachsen.de`) && PathPrefix(`/insign`)
+      kind: Rule
+      middlewares:
+        - name: mrknow-headers
+      services:
+        - name: mrknow-insign-external
+          port: 8081
+  tls:
+    secretName: mrknow-tls
+
+---
+# =============================================================================
+# IngressRoute für InSpire
+# =============================================================================
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mrknow-inspire
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`mrknow.innovation-hub-niedersachsen.de`) && PathPrefix(`/inspire`)
+      kind: Rule
+      middlewares:
+        - name: mrknow-headers
+      services:
+        - name: mrknow-inspire-external
+          port: 8082
+  tls:
+    secretName: mrknow-tls
+
+# ---
+# =============================================================================
+# IngressRoute für PgAdmin (optional)
+# =============================================================================
+# apiVersion: traefik.io/v1alpha1
+# kind: IngressRoute
+# metadata:
+#   name: mrknow-pgadmin
+#   namespace: kube-system
+# spec:
+#   entryPoints:
+#     - websecure
+#   routes:
+#     - match: Host(`mrknow.innovation-hub-niedersachsen.de`) && PathPrefix(`/pgadmin`)
+#       kind: Rule
+#       middlewares:
+#         - name: mrknow-headers
+#       services:
+#         - name: mrknow-pgadmin-external
+#           port: 5050
+#   tls:
+#     secretName: mrknow-tls
+
+---
+# =============================================================================
+# External Services - Verbindung zum Portainer/Docker Host
+# =============================================================================
+# WICHTIG: externalName auf den Hostnamen/IP deines Docker-Hosts anpassen!
+# =============================================================================
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: mrknow-inform-external
+  namespace: kube-system
+spec:
+  type: ExternalName
+  externalName: mrknow.innohub.local
+  ports:
+    - port: 8080
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mrknow-insign-external
+  namespace: kube-system
+spec:
+  type: ExternalName
+  externalName: mrknow.innohub.local
+  ports:
+    - port: 8081
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mrknow-inspire-external
+  namespace: kube-system
+spec:
+  type: ExternalName
+  externalName: mrknow.innohub.local
+  ports:
+    - port: 8082
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mrknow-pgadmin-external
+  namespace: kube-system
+spec:
+  type: ExternalName
+  externalName: mrknow.innohub.local
+  ports:
+    - port: 5050

argocd/apps/n8n/values-n8n.yaml

@@ -34,7 +34,6 @@ spec:
         # PostgreSQL Datenbank
         db:
           type: "postgresdb"
-        
         postgresql:
           enabled: true
           primary:
@@ -48,11 +47,14 @@ spec:
           auth:
             username: "n8n"
             password: "n8n"
+            postgresPassword: "35PuQG99qi"
             database: "n8n"
         
         # MinIO für Binary Data
         minio:
           enabled: true
+          rootUser: "vkYCY4YJsFv11E18az7o"
+          rootPassword: "gOVBJMs5qxABhReVQwe3M43mfS8RsejUJSKOWr5N"
           persistence:
             enabled: true
             storageClass: "longhorn"
@@ -63,6 +65,8 @@ spec:
         # Redis für Queue Mode
         redis:
           enabled: true
+          auth:
+            password: "y8GBnBTleK"
           master:
             persistence:
               enabled: true

argocd/apps/nextcloud/nextcloud.yaml

@@ -85,6 +85,7 @@ spec:
           enabled: true
           auth:
             password: redisInnoDBUser
+          # architecture: standalone
           master:
             extraEnvVars:
               - name: REDIS_MASTER_HOST
@@ -92,15 +93,15 @@ spec:
               - name: REDIS_MASTER_PORT_NUMBER
                 value: "6379"
             readinessProbe:
-              timeoutSeconds: 10    
-          replica:
+              timeoutSeconds: 20    
+            replica:
             extraEnvVars:
               - name: REDIS_MASTER_HOST
                 value: "nextcloud-redis-master"
               - name: REDIS_MASTER_PORT_NUMBER
                 value: "6379"
             readinessProbe:
-              timeoutSeconds: 10    
+              timeoutSeconds: 20    
         
         postgresql:
           enabled: true

argocd/apps/open-webui/openwebui.yaml

@@ -1,57 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: open-webui
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: 'https://helm.openwebui.com/'
-    targetRevision: 8.*.*
-    helm:
-      parameters:
-        - name: serviceAccount.enable
-          value: 'false'
-        - name: persistence.size
-          value: 200Gi
-        - name: existingClaim
-          value: "open-webui"
-        - name: ollama.enabled
-          value: 'false'  
-      #  - name: ollama.persistentVolume.enabled
-      #    value: 'true'
-      #  - name: ollama.persistence.existingClaim
-      #    value: "open-webui-llm-storage"
-      #  - name: ollama.persistenceVolume.size
-      #    value: 200Gi
-        - name: ingress.class
-          value: 'traefik'
-        - name: ingress.enabled
-          value: 'true'
-        - name: ingress.host
-          value: "innollm.innovation-hub-niedersachsen.de"
-        - name: ingress.tls
-          value: 'true'
-        - name: ingress.existingSecret
-          value: 'innollm-tls'
-        - name: ingress.annotations.kubernetes\.io\/ingress\.class
-          value: traefik
-        - name: ingress.annotations.traefik\.ingress\.kubernetes\.io\/router\.tls
-          value: 'true'
-          forceString: true
-        - name: ingress.annotations.cert-manager\.io\/cluster-issuer
-          value: lets-encrypt
-    chart: open-webui
-  destination:
-    server: 'https://kubernetes.default.svc'
-    namespace: open-webui
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels: 
-        pod-security.kubernetes.io/enforce: 'privileged'
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true

argocd/apps/open-webui/values-openwebui.yaml

@@ -0,0 +1,72 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: open-webui
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: 'https://helm.openwebui.com/'
+    targetRevision: 9.*.*
+    chart: open-webui
+    helm:
+      values: |
+        serviceAccount:
+          enable: false
+
+        persistence:
+          size: 200Gi
+          storageClass: longhorn
+
+        ollama:
+          enabled: false
+        
+        extraEnvVars:
+          - name: OAUTH_LOGOUT_REDIRECT_URL
+            value: "https://innollm.innovation-hub-niedersachsen.de/"
+          - name: ENABLE_OAUTH_LOGOUT
+            value: "true"
+          - name: WEBUI_SECRET_KEY
+            value: "17e027e793724fcbf0400c91374d6960f1beec64b52939c4ee20c1b6faf859ad"
+          - name: CORS_ALLOW_ORIGIN
+            value: "https://innollm.innovation-hub-niedersachsen.de"
+          - name: USER_AGENT
+            value: "Open-WebUI/InnoHub"
+
+        ingress:
+          enabled: true
+          class: traefik
+          host: "innollm.innovation-hub-niedersachsen.de"
+          tls: true
+          existingSecret: "innollm-tls"
+          annotations:
+            kubernetes.io/ingress.class: traefik
+            traefik.ingress.kubernetes.io/router.tls: "true"
+            cert-manager.io/cluster-issuer: lets-encrypt
+        
+        sso:
+          enabled: true
+          enableSignup: true
+          mergeAccountsByEmail: false
+          enableRoleManagement: false
+          enableGroupManagement: false
+          oidc:
+            enabled: true
+            clientId: "open-webui"
+            clientSecret: "RFkQ5RDXv6KE4DiQsOq3BJejWFElu90G"
+            providerUrl: "https://keycloak.innovation-hub-niedersachsen.de/realms/innohub/.well-known/openid-configuration"
+            providerName: "Keycloak"
+
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: open-webui
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: 'privileged'
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

argocd/apps/seaweedfs/admin-s3-secrets.yaml

@@ -1,46 +1,46 @@
-apiVersion: v1
-kind: Secret
-type: Opaque
-metadata:
-  name: admin-s3-secret
-  namespace: seaweedfs
-  labels:
-    app.kubernetes.io/name: seaweedfs
-    app.kubernetes.io/component: seaweedfs-s3
-
-stringData:
-  seaweedfs_s3_config: |
-    {
-      "identities": [
-        {
-          "name": "tatort",
-          "credentials": [
-            {
-              "accessKey": "wjpKrmaqXra99rX3D61H",
-              "secretKey": "fTPi0u0FR6Lv9Y9IKydWv6WM0EA5XrsK008HCt9u"
-            }
-          ],
-          "actions": ["Read", "Write", "Admin"]
-        },
-        {
-          "name": "plane",
-          "credentials": [
-            {
-              "accessKey": "a0ccb47cc0994bf51ecd",
-              "secretKey": "0d54ee2f943f2a56b8cafc3afe9cb1e2f9fecac2"
-            }
-          ],
-          "actions": ["Read", "Write", "Admin"]
-        },
-        {
-          "name": "n8n",
-          "credentials": [
-            {
-              "accessKey": "WPpTwIoSMgrPChsS3rdS",
-              "secretKey": "C59o3EAhsUKBWj1oiPtiYRq3GhLMFeYDeiMxJ4SW"
-            }
-          ],
-          "actions": ["Read", "Write", "Admin"]
-        }
-      ]
-    }
+#apiVersion: v1
+#kind: Secret
+#type: Opaque
+#metadata:
+#  name: admin-s3-secret
+#  namespace: seaweedfs
+#  labels:
+#    app.kubernetes.io/name: seaweedfs
+#    app.kubernetes.io/component: seaweedfs-s3
+#
+#stringData:
+#  seaweedfs_s3_config: |
+#    {
+#      "identities": [
+#        {
+#          "name": "tatort",
+#          "credentials": [
+#            {
+#              "accessKey": "wjpKrmaqXra99rX3D61H",
+#              "secretKey": "fTPi0u0FR6Lv9Y9IKydWv6WM0EA5XrsK008HCt9u"
+#            }
+#          ],
+#          "actions": ["Read", "Write", "Admin"]
+#        },
+#        {
+#          "name": "plane",
+#          "credentials": [
+#            {
+#              "accessKey": "a0ccb47cc0994bf51ecd",
+#              "secretKey": "0d54ee2f943f2a56b8cafc3afe9cb1e2f9fecac2"
+#            }
+#          ],
+#          "actions": ["Read", "Write", "Admin"]
+#        },
+#        {
+#          "name": "n8n",
+#          "credentials": [
+#            {
+#              "accessKey": "WPpTwIoSMgrPChsS3rdS",
+#              "secretKey": "C59o3EAhsUKBWj1oiPtiYRq3GhLMFeYDeiMxJ4SW"
+#            }
+#          ],
+#          "actions": ["Read", "Write", "Admin"]
+#        }
+#      ]
+#    }

argocd/apps/seaweedfs/seaweedfs-jwt-secret.yaml

@@ -1,10 +1,10 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: seaweedfs-jwt
-  namespace: seaweedfs
-stringData:
-  jwt.json: |
-    {
-      "secret": "inno-super-secret-key"
-    }
+#apiVersion: v1
+#kind: Secret
+#metadata:
+#  name: seaweedfs-jwt
+#  namespace: seaweedfs
+#stringData:
+#  jwt.json: |
+#    {
+#      "secret": "inno-super-secret-key"
+#    }

argocd/apps/wekan/values-wekan.yaml

@@ -9,7 +9,7 @@ spec:
   source:
     repoURL: 'https://wekan.github.io/charts/'
     chart: wekan
-    targetRevision: 8.*.*
+    targetRevision: 7.97.0
     helm:
       values: |
         replicaCount: 1
@@ -21,6 +21,36 @@ spec:
             value: smtp://192.168.4.125:25?ignoreTLS=true&tls={rejectUnauthorized:false}&secure=false
           - name: MAIL_FROM
             value: Noreplay admin@innovation-hub-niedersachsen.de
+          - name: OAUTH2_ENABLED
+            value: "true"
+          - name: OAUTH2_LOGIN_STYLE
+            value: "redirect"
+          - name: OAUTH2_CLIENT_ID
+            value: "wekan"
+          - name: OAUTH2_SERVER_URL
+            value: "https://keycloak.innovation-hub-niedersachsen.de"
+          - name: OAUTH2_AUTH_ENDPOINT
+            value: "/realms/innohub/protocol/openid-connect/auth"
+          - name: OAUTH2_USERINFO_ENDPOINT
+            value: "/realms/innohub/protocol/openid-connect/userinfo"
+          - name: OAUTH2_TOKEN_ENDPOINT
+            value: "/realms/innohub/protocol/openid-connect/token"
+          - name: OAUTH2_SECRET
+            value: "vp1kG3WgUdPCUAWvECZbAmBdST6Vgm0I"
+          - name: OAUTH2_ID_MAP
+            value: "sub"
+          - name: OAUTH2_USERNAME_MAP
+            value: "preferred_username"
+          - name: OAUTH2_EMAIL_MAP
+            value: "email"
+          - name: OAUTH2_FULLNAME_MAP
+            value: "name"
+          - name: OAUTH2_ADFS_ENABLED
+            value: "false"
+          - name: OAUTH2_B2C_ENABLED
+            value: "false"
+          - name: OAUTH2_REQUEST_PERMISSIONS
+            value: "openid profile email"        
 
         end_point: wekan.innovation-hub-niedersachsen.de
         root_url: https://wekan.innovation-hub-niedersachsen.de
@@ -62,6 +92,8 @@ spec:
       
         mongodb:
           enabled: true
+          image:
+            tag: 7.0.28
           storage:
             className: longhorn
           nodeSelector:

argocd/apps/wekantest/values-wekantest.yaml

@@ -0,0 +1,110 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: wekantest
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: 'https://wekan.github.io/charts/'
+    chart: wekan
+    targetRevision: 8.*.*
+    helm:
+      values: |
+        replicaCount: 1
+        dbname: wekan
+        env:
+          - name: MONGO_URL
+            value: mongodb://wekantest-mongodb:27017/wekan
+          - name: MAIL_URL
+            value: smtp://192.168.4.125:25?ignoreTLS=true&tls={rejectUnauthorized:false}&secure=false
+          - name: MAIL_FROM
+            value: Noreplay admin@innovation-hub-niedersachsen.de
+          - name: OAUTH2_ENABLED
+            value: "true"
+          - name: OAUTH2_LOGIN_STYLE
+            value: "redirect"
+          - name: OAUTH2_CLIENT_ID
+            value: "wekantest"
+          - name: OAUTH2_SERVER_URL
+            value: "https://keycloak.innovation-hub-niedersachsen.de"
+          - name: OAUTH2_AUTH_ENDPOINT
+            value: "/realms/innohub/protocol/openid-connect/auth"
+          - name: OAUTH2_USERINFO_ENDPOINT
+            value: "/realms/innohub/protocol/openid-connect/userinfo"
+          - name: OAUTH2_TOKEN_ENDPOINT
+            value: "/realms/innohub/protocol/openid-connect/token"
+          - name: OAUTH2_SECRET
+            value: "cOJpL4jiiA6OL8fFqA3lb4KCbxjjl7AQ"
+          - name: OAUTH2_ID_MAP
+            value: "sub"
+          - name: OAUTH2_USERNAME_MAP
+            value: "preferred_username"
+          - name: OAUTH2_EMAIL_MAP
+            value: "email"
+          - name: OAUTH2_FULLNAME_MAP
+            value: "name"
+          - name: OAUTH2_ADFS_ENABLED
+            value: "false"
+          - name: OAUTH2_B2C_ENABLED
+            value: "false"
+          - name: OAUTH2_REQUEST_PERMISSIONS
+            value: "openid profile email"
+
+        end_point: wekantest.innovation-hub-niedersachsen.de
+        root_url: https://wekantest.innovation-hub-niedersachsen.de
+        
+        # Probe-Einstellungen anpassen
+        livenessProbe:
+          enabled: true
+          initialDelaySeconds: 60
+          periodSeconds: 15
+          timeoutSeconds: 10
+          failureThreshold: 5
+        
+        readinessProbe:
+          enabled: true
+          initialDelaySeconds: 20
+          periodSeconds: 15
+          timeoutSeconds: 10
+          failureThreshold: 3
+        
+        ingress:
+          enabled: true
+          annotations: 
+            kubernetes.io/ingress.class: traefik
+            traefik.ingress.kubernetes.io/router.entrypoints: websecure
+            traefik.ingress.kubernetes.io/router.tls: "true"
+            cert-manager.io/cluster-issuer: lets-encrypt
+          hosts:
+            - wekantest.innovation-hub-niedersachsen.de
+          tls:
+            - secretName: wekantest-tls
+              hosts:
+                - wekantest.innovation-hub-niedersachsen.de
+        route:
+          enabled: false
+
+        sharedDataFolder:
+          enabled: true
+          storageClass: longhorn
+      
+        mongodb:
+          enabled: true
+          storage:
+            className: longhorn
+          nodeSelector:
+            kubernetes.io/hostname: k3s-prod
+
+  destination:
+    server: 'https://kubernetes.default.svc'
+    namespace: wekantest
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels: 
+        pod-security.kubernetes.io/enforce: "privileged"
+    automated:
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

config/rr/rr-ingressroute.yaml

@@ -0,0 +1,53 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: rr-stripprefix
+  namespace: kube-system
+spec:
+  stripPrefix:
+    prefixes:
+      - /
+---
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: rr-transport
+  namespace: kube-system
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: rr-external
+  namespace: kube-system
+  annotations:
+    cert-manager.io/cluster-issuer: "lets-encrypt"
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`rr.innovation-hub-niedersachsen.de`)
+      kind: Rule
+      services:
+        - name: rr-external-service
+          port: 5173
+          scheme: http
+          serversTransport: rr-transport
+      middlewares:
+        - name: rr-stripprefix
+  tls:
+    secretName: rr-tls
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: rr-external-service
+  namespace: kube-system
+spec:
+  type: ExternalName
+  externalName: 192-168-4-106.nip.io
+  ports:
+    - port: 5173
+      targetPort: 5173