release of norish

charts/tandoor/templates/NOTES.txt

@@ -0,0 +1,43 @@
+Tandoor Recipes has been deployed successfully!
+
+{{- if .Values.ingress.enabled }}
+
+Access Tandoor at:
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+
+{{- else if contains "NodePort" .Values.service.type }}
+
+Get the application URL by running:
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "tandoor.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+
+{{- else if contains "LoadBalancer" .Values.service.type }}
+
+Get the application URL by running:
+  NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "tandoor.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+
+{{- else if contains "ClusterIP" .Values.service.type }}
+
+Access Tandoor by port-forwarding:
+  kubectl --namespace {{ .Release.Namespace }} port-forward service/{{ include "tandoor.fullname" . }} 8080:{{ .Values.service.port }}
+
+Then visit: http://localhost:8080
+
+{{- end }}
+
+IMPORTANT: This chart requires an external PostgreSQL database.
+Make sure your PostgreSQL database is configured and accessible at:
+  Host: {{ .Values.postgresql.host }}
+  Port: {{ .Values.postgresql.port }}
+  Database: {{ .Values.postgresql.database }}
+
+For more information, visit:
+  - Tandoor Documentation: https://docs.tandoor.dev/
+  - Configuration Reference: https://docs.tandoor.dev/system/configuration/

charts/tandoor/templates/_helpers.tpl

@@ -0,0 +1,59 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "tandoor.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "tandoor.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "tandoor.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "tandoor.labels" -}}
+helm.sh/chart: {{ include "tandoor.chart" . }}
+{{ include "tandoor.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "tandoor.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "tandoor.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+PostgreSQL host
+*/}}
+{{- define "tandoor.postgresql.host" -}}
+{{- .Values.postgresql.host }}
+{{- end }}
+
+{{/*
+PostgreSQL port
+*/}}
+{{- define "tandoor.postgresql.port" -}}
+{{- .Values.postgresql.port | toString }}
+{{- end }}

charts/tandoor/templates/deployment.yaml

@@ -0,0 +1,402 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "tandoor.fullname" . }}
+  labels:
+    {{- include "tandoor.labels" . | nindent 4 }}
+  annotations:
+    checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "tandoor.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        {{- include "tandoor.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.config.tandoorPort }}
+              protocol: TCP
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          env:
+            # Database configuration
+            - name: DB_ENGINE
+              value: "django.db.backends.postgresql"
+            - name: POSTGRES_HOST
+              value: {{ include "tandoor.postgresql.host" . | quote }}
+            - name: POSTGRES_PORT
+              value: {{ include "tandoor.postgresql.port" . | quote }}
+            - name: POSTGRES_DB
+              value: {{ .Values.postgresql.database | quote }}
+            - name: POSTGRES_USER
+              value: {{ .Values.postgresql.username | quote }}
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.existingSecret | default (printf "%s-secrets" (include "tandoor.fullname" .)) }}
+                  key: {{ .Values.postgresql.passwordKey | default "postgresql-password" }}
+
+            # Security
+            - name: SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.secretKey.existingSecret | default (printf "%s-secrets" (include "tandoor.fullname" .)) }}
+                  key: {{ .Values.config.secretKey.secretKey | default "secret-key" }}
+            - name: ALLOWED_HOSTS
+              value: {{ .Values.config.allowedHosts | quote }}
+            {{- if .Values.config.csrfTrustedOrigins }}
+            - name: CSRF_TRUSTED_ORIGINS
+              value: {{ .Values.config.csrfTrustedOrigins | quote }}
+            {{- end }}
+            - name: CORS_ALLOW_ALL_ORIGINS
+              value: {{ ternary "1" "0" .Values.config.corsAllowOrigins | quote }}
+
+            # Server configuration
+            - name: TANDOOR_PORT
+              value: {{ .Values.config.tandoorPort | quote }}
+            - name: GUNICORN_WORKERS
+              value: {{ .Values.config.gunicornWorkers | quote }}
+            - name: GUNICORN_THREADS
+              value: {{ .Values.config.gunicornThreads | quote }}
+            - name: GUNICORN_TIMEOUT
+              value: {{ .Values.config.gunicornTimeout | quote }}
+            - name: GUNICORN_MEDIA
+              value: {{ .Values.config.gunicornMedia | quote }}
+
+            # URL configuration
+            {{- if .Values.config.scriptName }}
+            - name: SCRIPT_NAME
+              value: {{ .Values.config.scriptName | quote }}
+            {{- end }}
+
+            # Session cookie configuration
+            {{- if .Values.config.sessionCookieDomain }}
+            - name: SESSION_COOKIE_DOMAIN
+              value: {{ .Values.config.sessionCookieDomain | quote }}
+            {{- end }}
+            - name: SESSION_COOKIE_NAME
+              value: {{ .Values.config.sessionCookieName | quote }}
+
+            # Time and locale
+            - name: TZ
+              value: {{ .Values.config.timezone | quote }}
+
+            # Feature toggles
+            - name: ENABLE_SIGNUP
+              value: {{ ternary "1" "0" .Values.config.enableSignup | quote }}
+            - name: ENABLE_METRICS
+              value: {{ ternary "1" "0" .Values.config.enableMetrics | quote }}
+            - name: ENABLE_PDF_EXPORT
+              value: {{ ternary "1" "0" .Values.config.enablePdfExport | quote }}
+            - name: SORT_TREE_BY_NAME
+              value: {{ ternary "1" "0" .Values.config.sortTreeByName | quote }}
+
+            # Social authentication
+            - name: SOCIAL_DEFAULT_ACCESS
+              value: {{ .Values.config.socialDefaultAccess | quote }}
+            - name: SOCIAL_DEFAULT_GROUP
+              value: {{ .Values.config.socialDefaultGroup | quote }}
+            {{- if or .Values.config.socialProviders .Values.config.oidc.enabled }}
+            - name: SOCIAL_PROVIDERS
+              value: {{ .Values.config.socialProviders | default "allauth.socialaccount.providers.openid_connect" | quote }}
+            {{- end }}
+            {{- if .Values.config.socialAccountProviders }}
+            - name: SOCIALACCOUNT_PROVIDERS
+              value: {{ .Values.config.socialAccountProviders | quote }}
+            {{- end }}
+
+            # OpenID Connect / OAuth configuration (e.g., Authentik, Keycloak)
+            # Note: For production, consider using extraEnvFrom with a secret containing SOCIALACCOUNT_PROVIDERS
+            {{- if .Values.config.oidc.enabled }}
+            {{- $clientId := .Values.config.oidc.clientId }}
+            {{- $clientSecret := .Values.config.oidc.clientSecret }}
+            - name: SOCIALACCOUNT_PROVIDERS
+              value: '{"openid_connect":{"APPS":[{"provider_id":"{{ .Values.config.oidc.providerId }}","name":"{{ .Values.config.oidc.providerName }}","client_id":"{{ $clientId }}","secret":"{{ $clientSecret }}","settings":{"server_url":"{{ .Values.config.oidc.serverUrl }}"}}]}}'
+            {{- end }}
+
+            # Remote user authentication
+            - name: REMOTE_USER_AUTH
+              value: {{ ternary "1" "0" .Values.config.remoteUserAuth | quote }}
+
+            # LDAP configuration
+            {{- if .Values.config.ldap.enabled }}
+            - name: LDAP_AUTH
+              value: "1"
+            - name: AUTH_LDAP_SERVER_URI
+              value: {{ .Values.config.ldap.serverUri | quote }}
+            {{- if .Values.config.ldap.bindDn }}
+            - name: AUTH_LDAP_BIND_DN
+              value: {{ .Values.config.ldap.bindDn | quote }}
+            {{- end }}
+            {{- if or .Values.config.ldap.bindPassword .Values.config.ldap.existingSecret }}
+            - name: AUTH_LDAP_BIND_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.ldap.existingSecret | default (printf "%s-secrets" (include "tandoor.fullname" .)) }}
+                  key: {{ .Values.config.ldap.bindPasswordKey | default "ldap-bind-password" }}
+            {{- end }}
+            {{- if .Values.config.ldap.userSearchBaseDn }}
+            - name: AUTH_LDAP_USER_SEARCH_BASE_DN
+              value: {{ .Values.config.ldap.userSearchBaseDn | quote }}
+            {{- end }}
+            {{- if .Values.config.ldap.tlsCacertFile }}
+            - name: AUTH_LDAP_TLS_CACERTFILE
+              value: {{ .Values.config.ldap.tlsCacertFile | quote }}
+            {{- end }}
+            {{- if .Values.config.ldap.startTls }}
+            - name: AUTH_LDAP_START_TLS
+              value: "True"
+            {{- end }}
+            {{- end }}
+
+            # Email configuration
+            {{- if .Values.config.email.host }}
+            - name: EMAIL_HOST
+              value: {{ .Values.config.email.host | quote }}
+            - name: EMAIL_PORT
+              value: {{ .Values.config.email.port | quote }}
+            {{- if .Values.config.email.user }}
+            - name: EMAIL_HOST_USER
+              value: {{ .Values.config.email.user | quote }}
+            - name: EMAIL_HOST_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.email.existingSecret | default (printf "%s-secrets" (include "tandoor.fullname" .)) }}
+                  key: {{ .Values.config.email.passwordKey | default "email-password" }}
+            {{- end }}
+            - name: EMAIL_USE_TLS
+              value: {{ ternary "1" "0" .Values.config.email.useTls | quote }}
+            - name: EMAIL_USE_SSL
+              value: {{ ternary "1" "0" .Values.config.email.useSsl | quote }}
+            - name: DEFAULT_FROM_EMAIL
+              value: {{ .Values.config.email.defaultFrom | quote }}
+            - name: ACCOUNT_EMAIL_SUBJECT_PREFIX
+              value: {{ .Values.config.email.accountEmailSubjectPrefix | quote }}
+            {{- end }}
+
+            # S3/Object storage configuration
+            {{- if .Values.config.s3.enabled }}
+            - name: S3_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.s3.existingSecret | default (printf "%s-secrets" (include "tandoor.fullname" .)) }}
+                  key: {{ .Values.config.s3.accessKeyKey | default "s3-access-key" }}
+            - name: S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.s3.existingSecret | default (printf "%s-secrets" (include "tandoor.fullname" .)) }}
+                  key: {{ .Values.config.s3.secretAccessKeyKey | default "s3-secret-access-key" }}
+            - name: S3_BUCKET_NAME
+              value: {{ .Values.config.s3.bucketName | quote }}
+            {{- if .Values.config.s3.regionName }}
+            - name: S3_REGION_NAME
+              value: {{ .Values.config.s3.regionName | quote }}
+            {{- end }}
+            {{- if .Values.config.s3.endpointUrl }}
+            - name: S3_ENDPOINT_URL
+              value: {{ .Values.config.s3.endpointUrl | quote }}
+            {{- end }}
+            {{- if .Values.config.s3.customDomain }}
+            - name: S3_CUSTOM_DOMAIN
+              value: {{ .Values.config.s3.customDomain | quote }}
+            {{- end }}
+            - name: S3_QUERYSTRING_AUTH
+              value: {{ ternary "1" "0" .Values.config.s3.querystringAuth | quote }}
+            - name: S3_QUERYSTRING_EXPIRE
+              value: {{ .Values.config.s3.querystringExpire | quote }}
+            {{- end }}
+
+            # AI features
+            {{- if .Values.config.ai.enabled }}
+            - name: SPACE_AI_ENABLED
+              value: "1"
+            - name: SPACE_AI_CREDITS_MONTHLY
+              value: {{ .Values.config.ai.creditsMonthly | quote }}
+            - name: AI_RATELIMIT
+              value: {{ .Values.config.ai.rateLimit | quote }}
+            {{- end }}
+
+            # Food Data Central API
+            - name: FDC_API_KEY
+              value: {{ .Values.config.fdcApiKey | quote }}
+
+            # External connectors
+            - name: DISABLE_EXTERNAL_CONNECTORS
+              value: {{ ternary "1" "0" .Values.config.disableExternalConnectors | quote }}
+            - name: EXTERNAL_CONNECTORS_QUEUE_SIZE
+              value: {{ .Values.config.externalConnectorsQueueSize | quote }}
+
+            # Rate limiting
+            {{- if .Values.config.ratelimitUrlImportRequests }}
+            - name: RATELIMIT_URL_IMPORT_REQUESTS
+              value: {{ .Values.config.ratelimitUrlImportRequests | quote }}
+            {{- end }}
+            - name: DRF_THROTTLE_RECIPE_URL_IMPORT
+              value: {{ .Values.config.drfThrottleRecipeUrlImport | quote }}
+
+            # Space defaults
+            - name: SPACE_DEFAULT_MAX_RECIPES
+              value: {{ .Values.config.spaceDefaultMaxRecipes | quote }}
+            - name: SPACE_DEFAULT_MAX_USERS
+              value: {{ .Values.config.spaceDefaultMaxUsers | quote }}
+            - name: SPACE_DEFAULT_MAX_FILES
+              value: {{ .Values.config.spaceDefaultMaxFiles | quote }}
+            - name: SPACE_DEFAULT_ALLOW_SHARING
+              value: {{ ternary "1" "0" .Values.config.spaceDefaultAllowSharing | quote }}
+
+            # User preference defaults
+            - name: FRACTION_PREF_DEFAULT
+              value: {{ ternary "1" "0" .Values.config.fractionPrefDefault | quote }}
+            - name: COMMENT_PREF_DEFAULT
+              value: {{ ternary "1" "0" .Values.config.commentPrefDefault | quote }}
+            - name: STICKY_NAV_PREF_DEFAULT
+              value: {{ ternary "1" "0" .Values.config.stickyNavPrefDefault | quote }}
+            - name: MAX_OWNED_SPACES_PREF_DEFAULT
+              value: {{ .Values.config.maxOwnedSpacesPrefDefault | quote }}
+
+            # Cosmetic
+            - name: UNAUTHENTICATED_THEME_FROM_SPACE
+              value: {{ .Values.config.unauthenticatedThemeFromSpace | quote }}
+            - name: FORCE_THEME_FROM_SPACE
+              value: {{ .Values.config.forceThemeFromSpace | quote }}
+
+            # Performance
+            - name: SHOPPING_MIN_AUTOSYNC_INTERVAL
+              value: {{ .Values.config.shoppingMinAutosyncInterval | quote }}
+            - name: EXPORT_FILE_CACHE_DURATION
+              value: {{ .Values.config.exportFileCacheDuration | quote }}
+
+            # Legal URLs
+            {{- if .Values.config.termsUrl }}
+            - name: TERMS_URL
+              value: {{ .Values.config.termsUrl | quote }}
+            {{- end }}
+            {{- if .Values.config.privacyUrl }}
+            - name: PRIVACY_URL
+              value: {{ .Values.config.privacyUrl | quote }}
+            {{- end }}
+            {{- if .Values.config.imprintUrl }}
+            - name: IMPRINT_URL
+              value: {{ .Values.config.imprintUrl | quote }}
+            {{- end }}
+
+            # hCaptcha
+            {{- if .Values.config.hcaptcha.siteKey }}
+            - name: HCAPTCHA_SITEKEY
+              value: {{ .Values.config.hcaptcha.siteKey | quote }}
+            - name: HCAPTCHA_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.hcaptcha.existingSecret | default (printf "%s-secrets" (include "tandoor.fullname" .)) }}
+                  key: {{ .Values.config.hcaptcha.secretKeyKey | default "hcaptcha-secret" }}
+            {{- end }}
+
+            # Debugging
+            - name: DEBUG
+              value: {{ ternary "1" "0" .Values.config.debug | quote }}
+            - name: DEBUG_TOOLBAR
+              value: {{ ternary "1" "0" .Values.config.debugToolbar | quote }}
+            - name: SQL_DEBUG
+              value: {{ ternary "1" "0" .Values.config.sqlDebug | quote }}
+            - name: LOG_LEVEL
+              value: {{ .Values.config.logLevel | quote }}
+            - name: GUNICORN_LOG_LEVEL
+              value: {{ .Values.config.gunicornLogLevel | quote }}
+
+            # Custom environment variables
+            {{- range .Values.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          {{- with .Values.extraEnvFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: staticfiles
+              mountPath: /opt/recipes/staticfiles
+            - name: mediafiles
+              mountPath: /opt/recipes/mediafiles
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        {{- if .Values.persistence.staticfiles.enabled }}
+        - name: staticfiles
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.staticfiles.existingClaim | default (printf "%s-staticfiles" (include "tandoor.fullname" .)) }}
+        {{- else }}
+        - name: staticfiles
+          emptyDir: {}
+        {{- end }}
+        {{- if .Values.persistence.mediafiles.enabled }}
+        - name: mediafiles
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.mediafiles.existingClaim | default (printf "%s-mediafiles" (include "tandoor.fullname" .)) }}
+        {{- else }}
+        - name: mediafiles
+          emptyDir: {}
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/tandoor/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "tandoor.fullname" . }}
+  labels:
+    {{- include "tandoor.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "tandoor.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/tandoor/templates/pvc.yaml

@@ -0,0 +1,44 @@
+{{- if and .Values.persistence.staticfiles.enabled (not .Values.persistence.staticfiles.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "tandoor.fullname" . }}-staticfiles
+  labels:
+    {{- include "tandoor.labels" . | nindent 4 }}
+  {{- with .Values.persistence.staticfiles.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.staticfiles.accessMode | quote }}
+  {{- if .Values.persistence.staticfiles.storageClass }}
+  storageClassName: {{ .Values.persistence.staticfiles.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.staticfiles.size | quote }}
+---
+{{- end }}
+
+{{- if and .Values.persistence.mediafiles.enabled (not .Values.persistence.mediafiles.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "tandoor.fullname" . }}-mediafiles
+  labels:
+    {{- include "tandoor.labels" . | nindent 4 }}
+  {{- with .Values.persistence.mediafiles.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.mediafiles.accessMode | quote }}
+  {{- if .Values.persistence.mediafiles.storageClass }}
+  storageClassName: {{ .Values.persistence.mediafiles.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.mediafiles.size | quote }}
+{{- end }}

charts/tandoor/templates/secret.yaml

@@ -0,0 +1,49 @@
+{{- $needsSecret := false -}}
+{{- if not .Values.config.secretKey.existingSecret -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+{{- if not .Values.postgresql.existingSecret -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+{{- if and .Values.config.ldap.enabled .Values.config.ldap.bindPassword (not .Values.config.ldap.existingSecret) -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+{{- if and .Values.config.email.host .Values.config.email.user (not .Values.config.email.existingSecret) -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+{{- if and .Values.config.s3.enabled (not .Values.config.s3.existingSecret) -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+{{- if and .Values.config.hcaptcha.siteKey .Values.config.hcaptcha.secret (not .Values.config.hcaptcha.existingSecret) -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+
+{{- if $needsSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "tandoor.fullname" . }}-secrets
+  labels:
+    {{- include "tandoor.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- if not .Values.config.secretKey.existingSecret }}
+  {{ .Values.config.secretKey.secretKey | default "secret-key" }}: {{ .Values.config.secretKey.value | default "change-me-tandoor-secret-key-at-least-50-characters-long-for-security" | b64enc }}
+  {{- end }}
+  {{- if not .Values.postgresql.existingSecret }}
+  {{ .Values.postgresql.passwordKey | default "postgresql-password" }}: {{ .Values.postgresql.password | default "tandoor" | b64enc }}
+  {{- end }}
+  {{- if and .Values.config.ldap.enabled .Values.config.ldap.bindPassword (not .Values.config.ldap.existingSecret) }}
+  {{ .Values.config.ldap.bindPasswordKey | default "ldap-bind-password" }}: {{ .Values.config.ldap.bindPassword | b64enc }}
+  {{- end }}
+  {{- if and .Values.config.email.host .Values.config.email.user (not .Values.config.email.existingSecret) }}
+  {{ .Values.config.email.passwordKey | default "email-password" }}: {{ .Values.config.email.password | default "" | b64enc }}
+  {{- end }}
+  {{- if and .Values.config.s3.enabled (not .Values.config.s3.existingSecret) }}
+  {{ .Values.config.s3.accessKeyKey | default "s3-access-key" }}: {{ .Values.config.s3.accessKey | default "" | b64enc }}
+  {{ .Values.config.s3.secretAccessKeyKey | default "s3-secret-access-key" }}: {{ .Values.config.s3.secretAccessKey | default "" | b64enc }}
+  {{- end }}
+  {{- if and .Values.config.hcaptcha.siteKey .Values.config.hcaptcha.secret (not .Values.config.hcaptcha.existingSecret) }}
+  {{ .Values.config.hcaptcha.secretKeyKey | default "hcaptcha-secret" }}: {{ .Values.config.hcaptcha.secret | b64enc }}
+  {{- end }}
+{{- end }}

charts/tandoor/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "tandoor.fullname" . }}
+  labels:
+    {{- include "tandoor.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "tandoor.selectorLabels" . | nindent 4 }}