YourBOX Overview
Identity
Section titled “Identity”| Field | Value |
|---|---|
| Owner | Anthony |
| Criticality | Medium |
| Runtime | Symfony 7 on PHP 8.5, nginx and php-fpm, Tailwind CSS frontend |
| Data | PostgreSQL 16, Meilisearch, MinIO or Azure Blob via Flysystem |
| Identity | Authentik OIDC in production, Symfony form login in dev and on VPS |
| Delivery | docker compose, Ansible, Azure, Kubernetes via Helm and Argo CD |
Purpose
Section titled “Purpose”YourBOX is the streaming application I started in 2020. It lets registered users upload videos, browse a catalog, search by keyword, comment, reply to comments, like or dislike both videos and comments, and manage their profile. The modernization rewrites the application onto Symfony 7 while keeping the existing routes deployable through a strangler bundle, so that each migration step ships and reviews independently.
The application doubles as a reference workload for the DevSecOps homelab. The same container image is delivered across docker compose, a VPS via Ansible, Azure and the homelab Kubernetes cluster, exercising end to end the supply chain, secret management, observability and Zero Trust networking patterns documented across this site.
Documentation Map
Section titled “Documentation Map”| Page | Scope |
|---|---|
| Architecture | Runtime topology, bounded contexts, request flow and integrations |
| Verification Baseline | PHP 8.5 alignment, multi stage Dockerfile, hadolint, Trivy, test suite |
| Symfony Migration | Strangler bundle, route porting procedure and dependency graph |
| Secret Management | SOPS in dev, OpenBao with External Secrets in production, env contract |
| Authentication | Authentik OIDC firewall, local form firewall and user mirror table |
| Video Storage | Flysystem adapter, MinIO and Azure Blob backends, HLS transcoding |
| Search | Meilisearch index, Symfony Messenger projection, reindex procedure |
| Admin Panel | EasyAdmin layout for videos, users, moderation and reports |
| Frontend | Twig templates, Tailwind tokens, Stimulus controllers and Turbo |
| CI/CD | Pipeline stages, shared GitLab CI templates and Plumber control |
| VPS Deployment | docker compose, Ansible playbook and Traefik HTTPS smoke test |
| Kubernetes GitOps | Helm chart, sealed secrets and Argo CD wiring in homelab-platform |
| Observability | Prometheus exporter, Loki via Promtail, Grafana dashboards, ELK shipper |
| Security Controls | Authentik flows, secret handling, container hardening, network policy |
Critical Dependencies
Section titled “Critical Dependencies”- Authentik on the trusted admin plane for production single sign on.
- OpenBao for secret storage, projected through the External Secrets Operator on Kubernetes.
- MinIO (homelab) or Azure Blob Storage for video assets, behind the Flysystem abstraction.
- PostgreSQL 16 for relational data (users, videos, comments, votes).
- Meilisearch for the video search index.
- GitLab CI for build, scan and signature.
- The homelab Kubernetes cluster and Argo CD for production delivery.
Escalation
Section titled “Escalation”- Check the application runbook in this service section.
- Inspect the GitLab pipeline that produced the deployed image.
- Inspect the platform health (network policies, Argo CD, External Secrets) if the application is running on Kubernetes.
- Engage the identity provider runbook in homelab-platform if authentication is degraded.