# PIDOKA HF Zammad

Prepared GitOps adoption manifest for the existing Zammad installation behind
`service.heckenfels.com`.

Current live state, captured 2026-06-17:

- Namespace: `zammad`
- Existing release: Helm `zammad`, chart `zammad-10.2.1`, app `6.2.0-1`
- Public path: NPM `service.heckenfels.com` -> DMZ `192.168.20.40:8080`
- Service type: `LoadBalancer`
- Storage: `local-path` PVCs on `mbrkanov-mini-it13`

Backup before adoption:

- `/home/kube-bot/backups/zammad-20260617T193554Z`
- PostgreSQL dump: `zammad-postgresql.sql.gz`
- PVC tarballs for PostgreSQL, Redis, Elasticsearch, and Zammad var storage
- `SHA256SUMS` verified successfully

Important safety notes:

- This is a static, sanitized manifest rendered from the live Helm release.
- Kubernetes Secret resources are intentionally not included.
- StatefulSets intentionally omit `volumeClaimTemplates` during adoption. The
  existing Helm-managed StatefulSets already own these PVC templates;
  server-side apply conflicts on that immutable field.
- Longhorn migration uses new explicit PVC names with a `-longhorn` suffix.
  The old `local-path` PVCs must remain in place until rollback is no longer
  required.
- Do not sync with prune enabled.
- Do not migrate namespace or PVCs during first adoption.
- First Argo CD step should be create/diff only; sync requires separate explicit OK.
- Secrets should be moved to Infisical/ESO in a separate step after key inventory.

Secret inventory, captured without values:

- `zammad-postgresql`: keys `password`, `postgres-password`
- `zammad-postgresql-pass`: key `postgresql-pass`
- `zammad-redis`: key `redis-password`
- `zammad-redis-pass`: key `redis-password`

Prepared ESO model:

- Infisical path: `platform-kubernetes/prod:/tenants/pidoka/zammad`
- Separate Argo CD application: `pidoka-hf-zammad-secrets`
- Existing Kubernetes Secret names are preserved.
- `zammad/infisical-universal-auth` was copied from an existing PIDOKA ESO namespace on 2026-06-17.
- Live ESO sync was verified on 2026-06-17:
  - `SecretStore/zammad/dmz-infisical`: `Ready=True`
  - Four Zammad `ExternalSecret` resources: `SecretSynced=True`