mirror of
https://github.com/rtomik/helm-charts.git
synced 2026-07-17 00:36:43 +00:00
release of norish
This commit is contained in:
Richard Tomik
17
charts/norish/Chart.yaml
Normal file
17
charts/norish/Chart.yaml
Normal file
@ -0,0 +1,17 @@
|
||||
apiVersion: v2
|
||||
name: norish
|
||||
description: Norish helm chart for Kubernetes - A recipe management and meal planning application
|
||||
type: application
|
||||
version: 0.0.1
|
||||
appVersion: "v0.13.6-beta"
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: no@m.com
|
||||
keywords:
|
||||
- recipe
|
||||
- meal-planning
|
||||
- food
|
||||
- norish
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
sources:
|
||||
- https://github.com/norishapp/norish
|
||||
544
charts/norish/readme.md
Normal file
544
charts/norish/readme.md
Normal file
@ -0,0 +1,544 @@
|
||||
cl# Norish Helm Chart
|
||||
|
||||
A Helm chart for deploying [Norish](https://github.com/norishapp/norish), a recipe management and meal planning application, on Kubernetes.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a Norish deployment on a Kubernetes cluster using the Helm package manager.
|
||||
|
||||
**IMPORTANT: This chart requires a central PostgreSQL database.** You must have a PostgreSQL server available before deploying this chart. The chart does not include a PostgreSQL deployment.
|
||||
|
||||
**Note:** This chart includes a Chrome headless sidecar container that is required for recipe parsing and scraping functionality. Chrome requires elevated security privileges (`SYS_ADMIN` capability) and additional resources (recommend 256Mi-512Mi memory).
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.0+
|
||||
- **PostgreSQL database server** (required)
|
||||
- PV provisioner support in the underlying infrastructure (if persistence is enabled)
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `norish`:
|
||||
|
||||
```bash
|
||||
$ helm repo add helm-charts https://rtomik.github.io/helm-charts
|
||||
$ helm install norish helm-charts/norish
|
||||
```
|
||||
|
||||
The command deploys Norish on the Kubernetes cluster with default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `norish` deployment:
|
||||
|
||||
```bash
|
||||
helm uninstall norish
|
||||
```
|
||||
|
||||
This command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Configuration
|
||||
|
||||
### Required Configuration
|
||||
|
||||
Before deploying, you must configure:
|
||||
|
||||
1. **PostgreSQL Database** (REQUIRED): A central PostgreSQL database must be available
|
||||
- Configure `database.host` to point to your PostgreSQL server
|
||||
- Ensure the database exists before deployment
|
||||
- Set appropriate credentials
|
||||
|
||||
2. **Master Key**: A 32-byte base64-encoded encryption key
|
||||
```bash
|
||||
# Generate a master key
|
||||
openssl rand -base64 32
|
||||
```
|
||||
|
||||
3. **Application URL**: Set `config.authUrl` to match your ingress hostname
|
||||
|
||||
### Authentication Configuration
|
||||
|
||||
**Authentication providers are now optional!** You can deploy Norish in two ways:
|
||||
|
||||
**Option 1: Password Authentication (Simple Setup)**
|
||||
- No external authentication provider required
|
||||
- Users can register and log in with email/password
|
||||
- Perfect for self-hosted, single-tenant deployments
|
||||
- Enabled automatically when no OAuth/OIDC provider is configured
|
||||
|
||||
**Option 2: OAuth/OIDC Provider (Enterprise Setup)**
|
||||
- Configure ONE of the following:
|
||||
- OIDC/OAuth2
|
||||
- GitHub OAuth
|
||||
- Google OAuth
|
||||
- Recommended for multi-user environments
|
||||
- Can be combined with password authentication via `config.passwordAuthEnabled`
|
||||
|
||||
### Example: Minimal Installation (Password Authentication)
|
||||
|
||||
This is the simplest setup using built-in password authentication:
|
||||
|
||||
```yaml
|
||||
# values.yaml
|
||||
database:
|
||||
host: "postgresql.default.svc.cluster.local"
|
||||
port: 5432
|
||||
name: norish
|
||||
username: norish
|
||||
password: "secure-password"
|
||||
|
||||
config:
|
||||
authUrl: "https://norish.example.com"
|
||||
masterKey:
|
||||
value: "<your-32-byte-base64-key>"
|
||||
# passwordAuthEnabled defaults to true when no OAuth/OIDC is configured
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- host: norish.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- norish.example.com
|
||||
```
|
||||
|
||||
Install with:
|
||||
```bash
|
||||
$ helm repo add helm-charts https://rtomik.github.io/helm-charts
|
||||
$ helm install norish helm-charts/norish -f values.yaml
|
||||
```
|
||||
|
||||
### Example: Installation with OIDC
|
||||
|
||||
For enterprise deployments with an external identity provider:
|
||||
|
||||
```yaml
|
||||
# values.yaml
|
||||
database:
|
||||
host: "postgresql.default.svc.cluster.local"
|
||||
port: 5432
|
||||
name: norish
|
||||
username: norish
|
||||
password: "secure-password"
|
||||
|
||||
config:
|
||||
authUrl: "https://norish.example.com"
|
||||
masterKey:
|
||||
value: "<your-32-byte-base64-key>"
|
||||
# Optional: Allow both OIDC and password authentication
|
||||
passwordAuthEnabled: "true"
|
||||
auth:
|
||||
oidc:
|
||||
enabled: true
|
||||
name: "MyAuth"
|
||||
issuer: "https://auth.example.com"
|
||||
clientId: "<your-client-id>"
|
||||
clientSecret: "<your-client-secret>"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- host: norish.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- norish.example.com
|
||||
```
|
||||
|
||||
Install with:
|
||||
```bash
|
||||
$ helm repo add helm-charts https://rtomik.github.io/helm-charts
|
||||
$ helm install norish helm-charts/norish -f values.yaml
|
||||
```
|
||||
|
||||
### Example: Using Existing Secrets
|
||||
|
||||
For production deployments, store sensitive data in Kubernetes secrets:
|
||||
|
||||
```yaml
|
||||
# values.yaml
|
||||
database:
|
||||
host: "postgresql.default.svc.cluster.local"
|
||||
existingSecret: "norish-db-secret"
|
||||
usernameKey: "username"
|
||||
passwordKey: "password"
|
||||
|
||||
config:
|
||||
masterKey:
|
||||
existingSecret: "norish-master-key"
|
||||
secretKey: "master-key"
|
||||
auth:
|
||||
oidc:
|
||||
enabled: true
|
||||
name: "MyAuth"
|
||||
issuer: "https://auth.example.com"
|
||||
existingSecret: "norish-oidc-secret"
|
||||
clientIdKey: "client-id"
|
||||
clientSecretKey: "client-secret"
|
||||
```
|
||||
|
||||
Create the secrets:
|
||||
```bash
|
||||
# Database credentials
|
||||
kubectl create secret generic norish-db-secret \
|
||||
--from-literal=username="norish" \
|
||||
--from-literal=password="secure-db-password"
|
||||
|
||||
# Master encryption key
|
||||
kubectl create secret generic norish-master-key \
|
||||
--from-literal=master-key="$(openssl rand -base64 32)"
|
||||
|
||||
# OIDC credentials
|
||||
kubectl create secret generic norish-oidc-secret \
|
||||
--from-literal=client-id="<your-client-id>" \
|
||||
--from-literal=client-secret="<your-client-secret>"
|
||||
```
|
||||
|
||||
### Example: Using Existing PVC
|
||||
|
||||
If you want to use an existing PersistentVolumeClaim for uploads storage:
|
||||
|
||||
```yaml
|
||||
# values.yaml
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: "my-existing-pvc"
|
||||
```
|
||||
|
||||
This is useful when:
|
||||
- You want to reuse storage from a previous installation
|
||||
- You have pre-provisioned PVCs with specific configurations
|
||||
- You're managing PVCs separately from the Helm chart
|
||||
|
||||
### Optional Configuration
|
||||
|
||||
Version v0.13.6-beta introduces additional optional configuration options:
|
||||
|
||||
```yaml
|
||||
config:
|
||||
# Log level configuration
|
||||
logLevel: "info" # Options: trace, debug, info, warn, error, fatal
|
||||
|
||||
# Additional trusted origins (useful when behind a proxy or using multiple domains)
|
||||
trustedOrigins: "http://192.168.1.100:3000,https://norish.example.com"
|
||||
|
||||
# Enable/disable password authentication
|
||||
# Defaults to true when no OAuth/OIDC is configured, false otherwise
|
||||
# Set to "true" to enable password auth alongside OAuth/OIDC
|
||||
passwordAuthEnabled: "true"
|
||||
|
||||
auth:
|
||||
oidc:
|
||||
enabled: true
|
||||
name: "MyAuth"
|
||||
issuer: "https://auth.example.com"
|
||||
# Optional: Custom well-known configuration URL
|
||||
# By default derived from issuer
|
||||
wellKnown: "https://auth.example.com/.well-known/openid-configuration"
|
||||
clientId: "<your-client-id>"
|
||||
clientSecret: "<your-client-secret>"
|
||||
```
|
||||
|
||||
### Customizing Chrome Headless Resources
|
||||
|
||||
Chrome headless is required but you can customize its resource limits:
|
||||
|
||||
```yaml
|
||||
chrome:
|
||||
enabled: true # Must be true for v0.13.6+
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
```
|
||||
|
||||
### Setting Up PostgreSQL Database
|
||||
|
||||
You need to create the database before deploying this chart:
|
||||
|
||||
```sql
|
||||
-- Connect to your PostgreSQL server
|
||||
CREATE DATABASE norish;
|
||||
CREATE USER norish WITH ENCRYPTED PASSWORD 'secure-password';
|
||||
GRANT ALL PRIVILEGES ON DATABASE norish TO norish;
|
||||
```
|
||||
|
||||
Or if using a centralized PostgreSQL Helm chart or service, ensure the database is created and accessible from your Kubernetes cluster.
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `nameOverride` | Override the chart name | `""` |
|
||||
| `fullnameOverride` | Override the full resource names | `""` |
|
||||
|
||||
### Image Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `image.repository` | Norish image repository | `norishapp/norish` |
|
||||
| `image.tag` | Norish image tag | `v0.13.6-beta` |
|
||||
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `imagePullSecrets` | Image pull secrets | `[]` |
|
||||
|
||||
### Deployment Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `replicaCount` | Number of replicas | `1` |
|
||||
| `revisionHistoryLimit` | Number of old ReplicaSets to retain | `3` |
|
||||
|
||||
### Service Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `service.type` | Kubernetes service type | `ClusterIP` |
|
||||
| `service.port` | Service port | `3000` |
|
||||
| `service.annotations` | Service annotations | `{}` |
|
||||
|
||||
### Ingress Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `ingress.enabled` | Enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.annotations` | Ingress annotations | `{"traefik.ingress.kubernetes.io/router.entrypoints": "websecure"}` |
|
||||
| `ingress.hosts` | Ingress hosts configuration | See values.yaml |
|
||||
| `ingress.tls` | Ingress TLS configuration | See values.yaml |
|
||||
|
||||
### Persistence Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `persistence.enabled` | Enable persistent storage | `true` |
|
||||
| `persistence.existingClaim` | Use an existing PVC instead of creating a new one | `""` |
|
||||
| `persistence.storageClass` | Storage class name | `""` |
|
||||
| `persistence.accessMode` | Access mode | `ReadWriteOnce` |
|
||||
| `persistence.size` | Storage size | `5Gi` |
|
||||
| `persistence.annotations` | PVC annotations | `{}` |
|
||||
|
||||
### Application Configuration
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `config.authUrl` | Application URL (required) | `"http://norish.domain.com"` |
|
||||
| `config.masterKey.value` | Master encryption key | `""` |
|
||||
| `config.masterKey.existingSecret` | Use existing secret for master key | `""` |
|
||||
| `config.logLevel` | Log level: trace, debug, info, warn, error, fatal | `""` |
|
||||
| `config.trustedOrigins` | Additional trusted origins (comma-separated) | `""` |
|
||||
| `config.passwordAuthEnabled` | Enable/disable password authentication (defaults to true when no OAuth/OIDC configured) | `""` |
|
||||
| `config.auth.oidc.enabled` | Enable OIDC authentication | `false` |
|
||||
| `config.auth.oidc.name` | OIDC provider name | `"MyAuth"` |
|
||||
| `config.auth.oidc.issuer` | OIDC issuer URL | `""` |
|
||||
| `config.auth.oidc.wellKnown` | OIDC well-known configuration URL (optional) | `""` |
|
||||
| `config.auth.oidc.clientId` | OIDC client ID | `""` |
|
||||
| `config.auth.oidc.clientSecret` | OIDC client secret | `""` |
|
||||
| `config.auth.github.enabled` | Enable GitHub OAuth | `false` |
|
||||
| `config.auth.github.clientId` | GitHub client ID | `""` |
|
||||
| `config.auth.github.clientSecret` | GitHub client secret | `""` |
|
||||
| `config.auth.google.enabled` | Enable Google OAuth | `false` |
|
||||
| `config.auth.google.clientId` | Google client ID | `""` |
|
||||
| `config.auth.google.clientSecret` | Google client secret | `""` |
|
||||
|
||||
### Database Parameters (REQUIRED)
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `database.host` | PostgreSQL database host (required) | `""` |
|
||||
| `database.port` | PostgreSQL database port | `5432` |
|
||||
| `database.name` | PostgreSQL database name | `norish` |
|
||||
| `database.username` | PostgreSQL username | `postgres` |
|
||||
| `database.password` | PostgreSQL password | `""` |
|
||||
| `database.existingSecret` | Use existing secret for database credentials | `""` |
|
||||
| `database.usernameKey` | Key in secret for username | `"username"` |
|
||||
| `database.passwordKey` | Key in secret for password | `"password"` |
|
||||
| `database.databaseKey` | Key in secret for database name | `"database"` |
|
||||
| `database.hostKey` | Key in secret for host | `"host"` |
|
||||
|
||||
### Chrome Headless Parameters (REQUIRED)
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `chrome.enabled` | Enable Chrome headless sidecar (required for v0.13.6+) | `true` |
|
||||
| `chrome.image.repository` | Chrome headless image repository | `zenika/alpine-chrome` |
|
||||
| `chrome.image.tag` | Chrome headless image tag | `latest` |
|
||||
| `chrome.image.pullPolicy` | Chrome image pull policy | `IfNotPresent` |
|
||||
| `chrome.port` | Chrome remote debugging port | `3000` |
|
||||
| `chrome.resources` | Chrome container resource limits/requests | `{}` |
|
||||
|
||||
### Security Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `podSecurityContext.runAsNonRoot` | Run as non-root user | `true` |
|
||||
| `podSecurityContext.runAsUser` | User ID to run as | `1000` |
|
||||
| `podSecurityContext.fsGroup` | Group ID for filesystem | `1000` |
|
||||
|
||||
### Resource Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `resources` | CPU/Memory resource requests/limits | `{}` |
|
||||
|
||||
### Health Check Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `probes.startup.enabled` | Enable startup probe | `true` |
|
||||
| `probes.liveness.enabled` | Enable liveness probe | `true` |
|
||||
| `probes.readiness.enabled` | Enable readiness probe | `true` |
|
||||
|
||||
## What's New in v0.13.6-beta
|
||||
|
||||
This version introduces several improvements and new features:
|
||||
|
||||
**UI/UX Improvements:**
|
||||
- Ability to change prompts used in Settings → Admin
|
||||
- Improved transcriber logic
|
||||
- Double tapping/clicking planned recipes now opens the recipe page
|
||||
- Small icon that opens the original recipe page
|
||||
- Add recipes button now opens a dropdown instead of instantly redirecting to manual creation
|
||||
|
||||
**New Features:**
|
||||
- Support for trusting additional origins using `TRUSTED_ORIGINS` environment variable (comma-separated)
|
||||
- Customizable password authentication via `PASSWORD_AUTH_ENABLED` flag
|
||||
- Configurable log level via `NEXT_PUBLIC_LOG_LEVEL`
|
||||
|
||||
**Bug Fixes:**
|
||||
- User menu remaining open when clicking import
|
||||
- Text truncation no longer uses the tailwind truncate class in the calendar
|
||||
- Comma decimals being parsed as nothing (e.g., 2,5 ended up as 25)
|
||||
- Unicode character handling
|
||||
|
||||
**Breaking Changes:**
|
||||
- Chrome headless is now mandatory for improved parsing functionality
|
||||
|
||||
## Authentication Setup
|
||||
|
||||
Norish v0.13.6-beta and later support multiple authentication methods:
|
||||
|
||||
### Password Authentication (Default)
|
||||
|
||||
When no external authentication provider is configured, Norish automatically enables password-based authentication. Users can:
|
||||
- Register new accounts with email and password
|
||||
- Log in using their credentials
|
||||
- Manage their account through the web interface
|
||||
|
||||
This is the simplest setup and perfect for:
|
||||
- Self-hosted, single-user or family deployments
|
||||
- Testing and development environments
|
||||
- Scenarios where external OAuth providers are not needed
|
||||
|
||||
### External Authentication Providers (Optional)
|
||||
|
||||
For enterprise or multi-tenant deployments, you can configure external authentication providers. After configuring a provider, you can manage additional authentication methods through the Settings → Admin interface.
|
||||
|
||||
### OIDC/OAuth2
|
||||
|
||||
```yaml
|
||||
config:
|
||||
auth:
|
||||
oidc:
|
||||
enabled: true
|
||||
name: "Authentik" # Display name
|
||||
issuer: "https://auth.example.com/application/o/norish/"
|
||||
clientId: "<your-client-id>"
|
||||
clientSecret: "<your-client-secret>"
|
||||
```
|
||||
|
||||
### GitHub OAuth
|
||||
|
||||
1. Create a GitHub OAuth App at https://github.com/settings/developers
|
||||
2. Set Authorization callback URL to: `https://norish.example.com/api/auth/callback/github`
|
||||
|
||||
```yaml
|
||||
config:
|
||||
auth:
|
||||
github:
|
||||
enabled: true
|
||||
clientId: "<your-github-client-id>"
|
||||
clientSecret: "<your-github-client-secret>"
|
||||
```
|
||||
|
||||
### Google OAuth
|
||||
|
||||
1. Create OAuth credentials at https://console.cloud.google.com/apis/credentials
|
||||
2. Set Authorized redirect URI to: `https://norish.example.com/api/auth/callback/google`
|
||||
|
||||
```yaml
|
||||
config:
|
||||
auth:
|
||||
google:
|
||||
enabled: true
|
||||
clientId: "<your-google-client-id>"
|
||||
clientSecret: "<your-google-client-secret>"
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Check Pod Status
|
||||
|
||||
```bash
|
||||
kubectl get pods -l app.kubernetes.io/name=norish
|
||||
kubectl logs -l app.kubernetes.io/name=norish
|
||||
```
|
||||
|
||||
### Check Database Connection
|
||||
|
||||
```bash
|
||||
# Test connection from app pod
|
||||
kubectl exec -it deployment/norish -- sh
|
||||
nc -zv <your-postgres-host> 5432
|
||||
```
|
||||
|
||||
### Common Issues
|
||||
|
||||
1. **Master Key Not Set**: Ensure you've generated and configured a master key
|
||||
2. **Cannot Log In**:
|
||||
- Password authentication is enabled by default when no OAuth/OIDC is configured
|
||||
- If you configured an external provider, ensure the client ID/secret are correct
|
||||
- Check the callback URL matches your ingress hostname
|
||||
3. **Database Connection Failed**:
|
||||
- Verify database host is correct and accessible from the cluster
|
||||
- Check database credentials
|
||||
- Ensure the database exists
|
||||
- Verify network policies allow connections to the database
|
||||
4. **Application Not Accessible**: Verify ingress configuration and DNS records
|
||||
5. **Chrome Headless Issues**:
|
||||
- Chrome requires `SYS_ADMIN` capability for proper operation
|
||||
- If pod fails to start, check if your cluster's security policies allow the required capabilities
|
||||
- Chrome container may require additional memory (256Mi-512Mi recommended)
|
||||
- Check Chrome container logs: `kubectl logs -l app.kubernetes.io/name=norish -c chrome-headless`
|
||||
6. **Recipe Parsing Failures**:
|
||||
- Ensure Chrome headless is running: `kubectl get pods -l app.kubernetes.io/name=norish`
|
||||
- Verify `CHROME_WS_ENDPOINT` is set correctly (automatically configured by the chart)
|
||||
- Check if Chrome is accessible from the Norish container
|
||||
|
||||
## Upgrading
|
||||
|
||||
To upgrade the chart:
|
||||
|
||||
```bash
|
||||
$ helm upgrade norish helm-charts/norish -f values.yaml
|
||||
```
|
||||
|
||||
## Support
|
||||
|
||||
- Norish Repository: https://github.com/norishapp/norish
|
||||
- Chart Repository: https://github.com/rtomik/helm-charts
|
||||
- Issue Tracker: https://github.com/rtomik/helm-charts/issues
|
||||
|
||||
## License
|
||||
|
||||
This Helm chart is provided as-is under the same license as the Norish application.
|
||||
74
charts/norish/templates/NOTES.txt
Normal file
74
charts/norish/templates/NOTES.txt
Normal file
@ -0,0 +1,74 @@
|
||||
Thank you for installing {{ .Chart.Name }}!
|
||||
|
||||
Your release is named {{ .Release.Name }}.
|
||||
|
||||
To learn more about the release, try:
|
||||
|
||||
$ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
$ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
|
||||
{{- if .Values.ingress.enabled }}
|
||||
|
||||
Application URL:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}{{ range .paths }}{{ .path }}{{ end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
|
||||
Get the application URL by running these commands:
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "norish.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "norish.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "norish.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "norish.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
|
||||
echo "Visit http://127.0.0.1:8080 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
IMPORTANT CONFIGURATION NOTES:
|
||||
|
||||
1. Database Configuration:
|
||||
{{- if .Values.database.host }}
|
||||
Using external PostgreSQL at: {{ .Values.database.host }}:{{ .Values.database.port }}
|
||||
{{- else }}
|
||||
⚠️ WARNING: Database host is not configured!
|
||||
Configure database.host to point to your PostgreSQL server.
|
||||
{{- end }}
|
||||
|
||||
2. Master Key:
|
||||
{{- if .Values.config.masterKey.existingSecret }}
|
||||
Using existing secret: {{ .Values.config.masterKey.existingSecret }}
|
||||
{{- else }}
|
||||
{{- if not .Values.config.masterKey.value }}
|
||||
⚠️ WARNING: Master key is not set! Generate one with: openssl rand -base64 32
|
||||
{{- else }}
|
||||
Master key configured from values.yaml
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
3. Authentication:
|
||||
{{- if or .Values.config.auth.oidc.enabled .Values.config.auth.github.enabled .Values.config.auth.google.enabled }}
|
||||
{{- if .Values.config.auth.oidc.enabled }}
|
||||
- OIDC provider: {{ .Values.config.auth.oidc.name }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.auth.github.enabled }}
|
||||
- GitHub OAuth enabled
|
||||
{{- end }}
|
||||
{{- if .Values.config.auth.google.enabled }}
|
||||
- Google OAuth enabled
|
||||
{{- end }}
|
||||
After first login, configure additional providers in Settings → Admin
|
||||
{{- else }}
|
||||
⚠️ WARNING: No authentication provider configured!
|
||||
Configure ONE provider (OIDC, GitHub, or Google) to create your admin account.
|
||||
{{- end }}
|
||||
|
||||
For more information, visit: https://github.com/norishapp/norish
|
||||
57
charts/norish/templates/_helpers.tpl
Normal file
57
charts/norish/templates/_helpers.tpl
Normal file
@ -0,0 +1,57 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "norish.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
*/}}
|
||||
{{- define "norish.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "norish.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "norish.labels" -}}
|
||||
helm.sh/chart: {{ include "norish.chart" . }}
|
||||
{{ include "norish.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "norish.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "norish.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Database connection URL
|
||||
*/}}
|
||||
{{- define "norish.databaseUrl" -}}
|
||||
{{- $username := .Values.database.username }}
|
||||
{{- $password := .Values.database.password }}
|
||||
{{- $host := .Values.database.host }}
|
||||
{{- $port := .Values.database.port }}
|
||||
{{- $database := .Values.database.name }}
|
||||
{{- printf "postgres://%s:%s@%s:%d/%s" $username $password $host (int $port) $database }}
|
||||
{{- end }}
|
||||
279
charts/norish/templates/deployment-app.yaml
Normal file
279
charts/norish/templates/deployment-app.yaml
Normal file
@ -0,0 +1,279 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "norish.fullname" . }}
|
||||
labels:
|
||||
{{- include "norish.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: app
|
||||
annotations:
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "norish.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "norish.selectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.port }}
|
||||
protocol: TCP
|
||||
{{- if .Values.probes.startup.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.startup.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.startup.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.startup.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.startup.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.startup.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.startup.successThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.probes.liveness.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.probes.readiness.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: AUTH_URL
|
||||
value: {{ .Values.config.authUrl | quote }}
|
||||
{{- if .Values.chrome.enabled }}
|
||||
- name: CHROME_WS_ENDPOINT
|
||||
value: "ws://localhost:{{ .Values.chrome.port }}"
|
||||
{{- end }}
|
||||
{{- if .Values.config.logLevel }}
|
||||
- name: NEXT_PUBLIC_LOG_LEVEL
|
||||
value: {{ .Values.config.logLevel | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.trustedOrigins }}
|
||||
- name: TRUSTED_ORIGINS
|
||||
value: {{ .Values.config.trustedOrigins | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.passwordAuthEnabled }}
|
||||
- name: PASSWORD_AUTH_ENABLED
|
||||
value: {{ .Values.config.passwordAuthEnabled | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.database.existingSecret }}
|
||||
- name: DB_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.database.existingSecret }}
|
||||
key: {{ .Values.database.usernameKey }}
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.database.existingSecret }}
|
||||
key: {{ .Values.database.passwordKey }}
|
||||
{{- if .Values.database.databaseKey }}
|
||||
- name: DB_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.database.existingSecret }}
|
||||
key: {{ .Values.database.databaseKey }}
|
||||
{{- else }}
|
||||
- name: DB_NAME
|
||||
value: {{ .Values.database.name | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.database.hostKey }}
|
||||
- name: DB_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.database.existingSecret }}
|
||||
key: {{ .Values.database.hostKey }}
|
||||
{{- else }}
|
||||
- name: DB_HOST
|
||||
value: {{ .Values.database.host | quote }}
|
||||
{{- end }}
|
||||
- name: DB_PORT
|
||||
value: {{ .Values.database.port | quote }}
|
||||
- name: DATABASE_URL
|
||||
value: "postgres://$(DB_USERNAME):$(DB_PASSWORD)@$(DB_HOST):$(DB_PORT)/$(DB_NAME)"
|
||||
{{- else }}
|
||||
- name: DATABASE_URL
|
||||
value: {{ include "norish.databaseUrl" . | quote }}
|
||||
{{- end }}
|
||||
- name: MASTER_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.config.masterKey.existingSecret }}
|
||||
name: {{ .Values.config.masterKey.existingSecret }}
|
||||
key: {{ .Values.config.masterKey.secretKey }}
|
||||
{{- else }}
|
||||
name: {{ include "norish.fullname" . }}-secret
|
||||
key: master-key
|
||||
{{- end }}
|
||||
{{- if .Values.config.auth.oidc.enabled }}
|
||||
- name: OIDC_NAME
|
||||
value: {{ .Values.config.auth.oidc.name | quote }}
|
||||
- name: OIDC_ISSUER
|
||||
value: {{ .Values.config.auth.oidc.issuer | quote }}
|
||||
{{- if .Values.config.auth.oidc.wellKnown }}
|
||||
- name: OIDC_WELLKNOWN
|
||||
value: {{ .Values.config.auth.oidc.wellKnown | quote }}
|
||||
{{- end }}
|
||||
- name: OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.config.auth.oidc.existingSecret }}
|
||||
name: {{ .Values.config.auth.oidc.existingSecret }}
|
||||
key: {{ .Values.config.auth.oidc.clientIdKey }}
|
||||
{{- else }}
|
||||
name: {{ include "norish.fullname" . }}-secret
|
||||
key: oidc-client-id
|
||||
{{- end }}
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.config.auth.oidc.existingSecret }}
|
||||
name: {{ .Values.config.auth.oidc.existingSecret }}
|
||||
key: {{ .Values.config.auth.oidc.clientSecretKey }}
|
||||
{{- else }}
|
||||
name: {{ include "norish.fullname" . }}-secret
|
||||
key: oidc-client-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.auth.github.enabled }}
|
||||
- name: GITHUB_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.config.auth.github.existingSecret }}
|
||||
name: {{ .Values.config.auth.github.existingSecret }}
|
||||
key: {{ .Values.config.auth.github.clientIdKey }}
|
||||
{{- else }}
|
||||
name: {{ include "norish.fullname" . }}-secret
|
||||
key: github-client-id
|
||||
{{- end }}
|
||||
- name: GITHUB_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.config.auth.github.existingSecret }}
|
||||
name: {{ .Values.config.auth.github.existingSecret }}
|
||||
key: {{ .Values.config.auth.github.clientSecretKey }}
|
||||
{{- else }}
|
||||
name: {{ include "norish.fullname" . }}-secret
|
||||
key: github-client-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.auth.google.enabled }}
|
||||
- name: GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.config.auth.google.existingSecret }}
|
||||
name: {{ .Values.config.auth.google.existingSecret }}
|
||||
key: {{ .Values.config.auth.google.clientIdKey }}
|
||||
{{- else }}
|
||||
name: {{ include "norish.fullname" . }}-secret
|
||||
key: google-client-id
|
||||
{{- end }}
|
||||
- name: GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.config.auth.google.existingSecret }}
|
||||
name: {{ .Values.config.auth.google.existingSecret }}
|
||||
key: {{ .Values.config.auth.google.clientSecretKey }}
|
||||
{{- else }}
|
||||
name: {{ include "norish.fullname" . }}-secret
|
||||
key: google-client-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: uploads
|
||||
mountPath: /app/uploads
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- if .Values.chrome.enabled }}
|
||||
- name: chrome-headless
|
||||
image: "{{ .Values.chrome.image.repository }}:{{ .Values.chrome.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.chrome.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.chrome.securityContext | nindent 12 }}
|
||||
ports:
|
||||
- name: chrome
|
||||
containerPort: {{ .Values.chrome.port }}
|
||||
protocol: TCP
|
||||
command:
|
||||
- chromium-browser
|
||||
args:
|
||||
- "--no-sandbox"
|
||||
- "--disable-gpu"
|
||||
- "--disable-dev-shm-usage"
|
||||
- "--remote-debugging-address=0.0.0.0"
|
||||
- "--remote-debugging-port={{ .Values.chrome.port }}"
|
||||
- "--headless"
|
||||
resources:
|
||||
{{- toYaml .Values.chrome.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- name: uploads
|
||||
persistentVolumeClaim:
|
||||
{{- if .Values.persistence.existingClaim }}
|
||||
claimName: {{ .Values.persistence.existingClaim }}
|
||||
{{- else }}
|
||||
claimName: {{ include "norish.fullname" . }}-uploads
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- name: uploads
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
43
charts/norish/templates/ingress.yaml
Normal file
43
charts/norish/templates/ingress.yaml
Normal file
@ -0,0 +1,43 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "norish.fullname" . }}
|
||||
labels:
|
||||
{{- include "norish.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.className }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .secretName }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "norish.fullname" $ }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
22
charts/norish/templates/pvc.yaml
Normal file
22
charts/norish/templates/pvc.yaml
Normal file
@ -0,0 +1,22 @@
|
||||
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "norish.fullname" . }}-uploads
|
||||
labels:
|
||||
{{- include "norish.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: app
|
||||
{{- with .Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size }}
|
||||
{{- end }}
|
||||
32
charts/norish/templates/secret.yaml
Normal file
32
charts/norish/templates/secret.yaml
Normal file
@ -0,0 +1,32 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "norish.fullname" . }}-secret
|
||||
labels:
|
||||
{{- include "norish.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
{{- if not .Values.config.masterKey.existingSecret }}
|
||||
master-key: {{ .Values.config.masterKey.value | required "config.masterKey.value is required when config.masterKey.existingSecret is not set" | quote }}
|
||||
{{- end }}
|
||||
{{- if not .Values.database.existingSecret }}
|
||||
database-url: {{ include "norish.databaseUrl" . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.auth.oidc.enabled }}
|
||||
{{- if not .Values.config.auth.oidc.existingSecret }}
|
||||
oidc-client-id: {{ .Values.config.auth.oidc.clientId | quote }}
|
||||
oidc-client-secret: {{ .Values.config.auth.oidc.clientSecret | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.auth.github.enabled }}
|
||||
{{- if not .Values.config.auth.github.existingSecret }}
|
||||
github-client-id: {{ .Values.config.auth.github.clientId | quote }}
|
||||
github-client-secret: {{ .Values.config.auth.github.clientSecret | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.auth.google.enabled }}
|
||||
{{- if not .Values.config.auth.google.existingSecret }}
|
||||
google-client-id: {{ .Values.config.auth.google.clientId | quote }}
|
||||
google-client-secret: {{ .Values.config.auth.google.clientSecret | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
20
charts/norish/templates/service.yaml
Normal file
20
charts/norish/templates/service.yaml
Normal file
@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "norish.fullname" . }}
|
||||
labels:
|
||||
{{- include "norish.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: app
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "norish.selectorLabels" . | nindent 4 }}
|
||||
229
charts/norish/values.yaml
Normal file
229
charts/norish/values.yaml
Normal file
@ -0,0 +1,229 @@
|
||||
## Global settings
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
## Image settings
|
||||
image:
|
||||
repository: norishapp/norish
|
||||
tag: "v0.13.6-beta"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
|
||||
## Deployment settings
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
|
||||
# Pod security settings
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
## Pod scheduling
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
## Pod annotations
|
||||
podAnnotations: {}
|
||||
|
||||
## Service settings
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3000
|
||||
annotations: {}
|
||||
|
||||
## Ingress settings
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
hosts:
|
||||
- host: norish.domain.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- norish.domain.com
|
||||
# Optional: specify the name of an existing TLS secret
|
||||
# secretName: "existing-tls-secret"
|
||||
|
||||
## Persistence settings
|
||||
persistence:
|
||||
enabled: true
|
||||
# Use an existing PVC instead of creating a new one
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
annotations: {}
|
||||
|
||||
# Extra volume mounts
|
||||
extraVolumeMounts: []
|
||||
|
||||
# Extra volumes
|
||||
extraVolumes: []
|
||||
|
||||
## Resource limits and requests
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 500m
|
||||
# memory: 512Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## Application health checks
|
||||
probes:
|
||||
startup:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 30
|
||||
successThreshold: 1
|
||||
path: /
|
||||
liveness:
|
||||
enabled: true
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
path: /
|
||||
readiness:
|
||||
enabled: true
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
path: /
|
||||
|
||||
## Application configuration
|
||||
config:
|
||||
# Application URL (required)
|
||||
# This should match your ingress hostname
|
||||
authUrl: "http://norish.domain.com"
|
||||
|
||||
# Master encryption key (required)
|
||||
# Generate with: openssl rand -base64 32
|
||||
# For production, use an existing Kubernetes Secret
|
||||
masterKey:
|
||||
existingSecret: "" # Name of existing Kubernetes secret
|
||||
secretKey: "master-key" # Key in the secret where master key is stored
|
||||
value: "" # Only used if existingSecret is not set (must be 32-byte base64)
|
||||
|
||||
# Optional configuration
|
||||
# Log level: trace, debug, info, warn, error, fatal
|
||||
# Defaults to info in production, debug in development
|
||||
logLevel: ""
|
||||
|
||||
# Additional trusted origins (comma-separated)
|
||||
# Useful when behind a proxy or using multiple domains
|
||||
# Example: "http://192.168.1.100:3000,https://norish.example.com"
|
||||
trustedOrigins: ""
|
||||
|
||||
# Enable/disable password authentication
|
||||
# Defaults to false if OIDC or OAuth is configured, true otherwise
|
||||
passwordAuthEnabled: ""
|
||||
|
||||
# Authentication provider configuration
|
||||
# Configure ONE provider for initial admin account creation
|
||||
# After first login, manage additional providers via Settings → Admin
|
||||
auth:
|
||||
# OIDC/OAuth2 provider
|
||||
oidc:
|
||||
enabled: false
|
||||
name: "MyAuth"
|
||||
issuer: ""
|
||||
clientId: ""
|
||||
clientSecret: ""
|
||||
# Optional: OIDC well-known configuration URL
|
||||
# By default derived from issuer by appending /.well-known/openid-configuration
|
||||
wellKnown: ""
|
||||
# Use existing secret for OIDC credentials
|
||||
existingSecret: ""
|
||||
clientIdKey: "oidc-client-id"
|
||||
clientSecretKey: "oidc-client-secret"
|
||||
|
||||
# GitHub OAuth
|
||||
github:
|
||||
enabled: false
|
||||
clientId: ""
|
||||
clientSecret: ""
|
||||
# Use existing secret for GitHub credentials
|
||||
existingSecret: ""
|
||||
clientIdKey: "github-client-id"
|
||||
clientSecretKey: "github-client-secret"
|
||||
|
||||
# Google OAuth
|
||||
google:
|
||||
enabled: false
|
||||
clientId: ""
|
||||
clientSecret: ""
|
||||
# Use existing secret for Google credentials
|
||||
existingSecret: ""
|
||||
clientIdKey: "google-client-id"
|
||||
clientSecretKey: "google-client-secret"
|
||||
|
||||
## External PostgreSQL database configuration (REQUIRED)
|
||||
## Norish requires a central PostgreSQL database
|
||||
## You must have a PostgreSQL server available before deploying this chart
|
||||
database:
|
||||
# Database connection details
|
||||
host: "" # Required: PostgreSQL server hostname
|
||||
port: 5432
|
||||
name: norish
|
||||
username: postgres
|
||||
password: ""
|
||||
|
||||
# Use existing secret for database credentials (recommended for production)
|
||||
existingSecret: "" # Name of existing Kubernetes secret
|
||||
usernameKey: "username" # Key in the secret for database username
|
||||
passwordKey: "password" # Key in the secret for database password
|
||||
databaseKey: "database" # Key in the secret for database name (optional)
|
||||
hostKey: "" # Key in the secret for database host (optional)
|
||||
|
||||
## Chrome Headless configuration (REQUIRED)
|
||||
## Required for improved recipe parsing and scraping
|
||||
chrome:
|
||||
enabled: true
|
||||
image:
|
||||
repository: zenika/alpine-chrome
|
||||
tag: "latest"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# Chrome port for remote debugging
|
||||
port: 3000
|
||||
|
||||
# Chrome security context - requires specific capabilities
|
||||
securityContext:
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
capabilities:
|
||||
add:
|
||||
- SYS_ADMIN
|
||||
|
||||
# Chrome resource limits
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 500m
|
||||
# memory: 512Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 256Mi
|
||||
Reference in New Issue
Block a user