feat(teable): mint its tailnet key and put its PVCs in the backup set #951

Merged

coilyco-ops merged 1 commit from feat/teable-tailnet-and-backups into main

2026-08-26 21:13:47 +00:00

coilyco-ops commented

2026-08-26 21:11:29 +00:00

Owner

Support for coilyco-bridge/deploy#794 and its enablement PR coilyco-bridge/deploy#801. Two things teable needs that live here rather than in the deploy repo.

The authkey

The ingress-tailscale chart reads /coilysiren/teable/ts-authkey, and that parameter is minted by aws_ssm_parameter.ts_authkey, which iterates terraform/tailscale/services.yaml. Teable was not in that list, so the parameter does not exist and the sidecar would never authenticate. Adding it also mints tag:svc-teable through service_tag_owners, the same as every other entry.

The backups

The teable database is the only copy of roughly 250 real people's names and employers, which is the whole reason the rows are not in git. restic-backup.sh discovers Bound PVCs per namespace from RESTIC_BACKUP_NAMESPACES, and teable was not in the default, so its database and attachment volumes would have been unprotected from the first import.

The loop skips a namespace that does not exist yet, so this lands safely before the deploy does.

This is not applied

terraform/tailscale needs TAILSCALE_API_KEY, or the TAILSCALE_OAUTH_CLIENT_ID + TAILSCALE_OAUTH_CLIENT_SECRET pair, exported in the shell. Those admin credentials stay out of SSM by design (docs/tailscale.md), so an agent cannot apply this.

The operator step, with those exported:

just terraform-tailscale plan
just terraform-tailscale apply

Teable's rollout waits on externalsecret/ts-authkey until that runs, so deploy#801 should not merge before it.

Support for coilyco-bridge/deploy#794 and its enablement PR coilyco-bridge/deploy#801. Two things teable needs that live here rather than in the deploy repo. ## The authkey The `ingress-tailscale` chart reads `/coilysiren/teable/ts-authkey`, and that parameter is minted by `aws_ssm_parameter.ts_authkey`, which iterates `terraform/tailscale/services.yaml`. Teable was not in that list, so the parameter does not exist and the sidecar would never authenticate. Adding it also mints `tag:svc-teable` through `service_tag_owners`, the same as every other entry. ## The backups The teable database is the only copy of roughly 250 real people's names and employers, which is the whole reason the rows are not in git. `restic-backup.sh` discovers Bound PVCs per namespace from `RESTIC_BACKUP_NAMESPACES`, and `teable` was not in the default, so its database and attachment volumes would have been unprotected from the first import. The loop skips a namespace that does not exist yet, so this lands safely before the deploy does. ## This is not applied `terraform/tailscale` needs `TAILSCALE_API_KEY`, or the `TAILSCALE_OAUTH_CLIENT_ID` + `TAILSCALE_OAUTH_CLIENT_SECRET` pair, exported in the shell. Those admin credentials stay out of SSM by design (`docs/tailscale.md`), so an agent cannot apply this. The operator step, with those exported: ``` just terraform-tailscale plan just terraform-tailscale apply ``` Teable's rollout waits on `externalsecret/ts-authkey` until that runs, so deploy#801 should not merge before it.

coilyco-ops added 1 commit

2026-08-26 21:11:29 +00:00

feat(teable): mint its tailnet key and put its PVCs in the backup set

TruffleHog / Scan for secrets (pull_request) Successful in 5s

Details

CI / lint (pull_request) Successful in 42s

Details

b3b25a261f

deploy#794 deploys Teable tailnet-only as the store for the connections index.
Two things it needs live here rather than in the deploy repo.

THE AUTHKEY. The ingress-tailscale chart reads /coilysiren/teable/ts-authkey,
and that parameter is minted by aws_ssm_parameter.ts_authkey, which iterates
terraform/tailscale/services.yaml. Teable was not in that list, so the
parameter does not exist and the sidecar would never authenticate.

Adding it here also mints tag:svc-teable through service_tag_owners, the same
as every other entry.

THE BACKUPS. The teable database is the only copy of roughly 250 real people's
names and employers, which is the whole reason the rows are not in git.
restic-backup.sh discovers Bound PVCs per namespace from RESTIC_BACKUP_NAMESPACES,
and teable was not in the default, so its database and attachment volumes would
have been unprotected from the first import. The loop skips a namespace that
does not exist yet, so this lands safely before the deploy does.

NOT APPLIED. terraform/tailscale needs TAILSCALE_API_KEY or the OAuth client
pair exported in the shell, and those admin credentials stay out of SSM by
design (docs/tailscale.md), so an agent cannot apply this. `just
terraform-tailscale plan` then `apply` with those exported is the operator step
that actually mints the key. Teable's rollout waits on
externalsecret/ts-authkey until it runs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: sysadmin

coilyco-ops merged commit 4e09ed9e9d into main

2026-08-26 21:13:47 +00:00

coilyco-ops deleted branch feat/teable-tailnet-and-backups

2026-08-26 21:13:47 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-26 21:13:49 +00:00

feat(teable): mint its tailnet key and put its PVCs in the backup set (#951)

coilyco-ops referenced this pull request from a commit

2026-08-27 04:10:52 +00:00

fix(restic): dump every database, not just Forgejo's (#928)

coilyco-ops referenced this pull request

2026-08-27 04:12:51 +00:00