mealie helm chart release with upgraded version

README.md

@@ -1,2 +1,4 @@
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/rtomik-helm-charts)](https://artifacthub.io/packages/search?repo=rtomik-helm-charts)
 # helm-charts
 Repo for helm charts
+Donetick Helm chart

artifacthub-repo.yml

@@ -0,0 +1,15 @@
+# Artifact Hub repository metadata file
+#
+# Some settings like the verified publisher flag or the ignored packages won't
+# be applied until the next time the repository is processed. Please keep in
+# mind that the repository won't be processed if it has not changed since the
+# last time it was processed. Depending on the repository kind, this is checked
+# in a different way. For Helm http based repositories, we consider it has
+# changed if the `index.yaml` file changes. For git based repositories, it does
+# when the hash of the last commit in the branch you set up changes. This does
+# NOT apply to ownership claim operations, which are processed immediately.
+#
+repositoryID: 11743389-27d2-4d03-a271-1dd96844082f
+owners: # (optional, used to claim repository ownership)
+  - name: rtomik
+    email: n@gmail.com

charts/donetick/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
 name: donetick
-description: A Helm chart for Donetick application
+description: Donetick helm chart for Kubernetes
 type: application
-version: 0.1.0
-appVersion: "latest"
+version: 1.0.1
+appVersion: "v0.1.38"
 maintainers:
   - name: Richard Tomik
     email: no@m.com

charts/donetick/readme.md

@@ -6,6 +6,10 @@ A Helm chart for deploying the Donetick task management application on Kubernete
 
 This chart deploys [Donetick](https://github.com/donetick/donetick) on a Kubernetes cluster using the Helm package manager. 
 
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/donetick
+
+
 ## Prerequisites
 
 - Kubernetes 1.19+
@@ -14,21 +18,21 @@ This chart deploys [Donetick](https://github.com/donetick/donetick) on a Kuberne
 
 ## Installing the Chart
 
-To install the chart with the release name `my-donetick`:
+To install the chart with the release name `donetick`:
 
 ```bash
 $ helm repo add donetick-chart https://rtomik.github.io/helm-charts
-$ helm install my-donetick donetick-chart/donetick
+$ helm install donetick donetick-chart/donetick
 ```
 
 > **Tip**: List all releases using `helm list`
 
 ## Uninstalling the Chart
 
-To uninstall/delete the `my-donetick` deployment:
+To uninstall/delete the `donetick` deployment:
 
 ```bash
-$ helm delete my-donetick
+$  helm uninstall donetick
 ```
 
 ## Parameters
@@ -107,4 +111,4 @@ $ helm delete my-donetick
 | `persistence.enabled`         | Enable persistence using PVC                         | `true`        |
 | `persistence.storageClass`    | PVC Storage Class                                    | `"longhorn"`  |
 | `persistence.accessMode`      | PVC Access Mode                                      | `ReadWriteOnce` |
-| `persistence.size`            |
+| `persistence.size`            |

charts/donetick/templates/configmap.yaml

@@ -64,7 +64,8 @@ data:
       appHost: {{ .Values.config.email.appHost | default "" | quote }}
     oauth2:
       {{- if .Values.config.oauth2.existingSecret }}
-      # Client ID and Secret will be injected from Secret
+      client_id: $DT_OAUTH2_CLIENT_ID
+      client_secret: $DT_OAUTH2_CLIENT_SECRET
       {{- else }}
       client_id: {{ .Values.config.oauth2.client_id | default "" | quote }}
       client_secret: {{ .Values.config.oauth2.client_secret | default "" | quote }}

charts/donetick/values.yaml

@@ -5,7 +5,7 @@ fullnameOverride: ""
 ## Image settings
 image:
   repository: donetick/donetick
-  tag: latest
+  tag: "v0.1.38"
   pullPolicy: IfNotPresent
   
 ## Deployment settings
@@ -41,8 +41,8 @@ service:
 
 ## Ingress settings
 ingress:
-  enabled: true
-  className: "traefik"
+  enabled: false
+  className: ""
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
   hosts:
@@ -58,8 +58,8 @@ ingress:
 
 ## Persistence settings
 persistence:
-  enabled: true
-  storageClass: "longhorn"
+  enabled: false
+  storageClass: ""
   accessMode: ReadWriteOnce
   size: 1Gi
   annotations: {}
@@ -85,13 +85,13 @@ extraVolumeMounts: []
 extraVolumes: []
 
 ## Resource limits and requests
-resources:
-  limits:
-    cpu: 500m
-    memory: 512Mi
-  requests:
-    cpu: 100m
-    memory: 128Mi
+# resources:
+#   limits:
+#     cpu: 500m
+#     memory: 512Mi
+#   requests:
+#     cpu: 100m
+#     memory: 128Mi
 
 ## Application health checks
 probes:

charts/jellyseerr/Chart.yaml

@@ -0,0 +1,16 @@
+apiVersion: v2
+name: jellyseerr
+description: Jellyseerr helm chart for Kubernetes
+type: application
+version: 0.0.1
+appVersion: 2.5.2
+maintainers:
+  - name: Richard Tomik
+    email: no@m.com
+keywords:
+  - jellyseerr
+  - jellyfin
+  - media-requests
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/fallenbagel/jellyseerr

charts/jellyseerr/NOTES.txt

@@ -0,0 +1,32 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "jellyseerr.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "jellyseerr.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "jellyseerr.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "jellyseerr.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+
+2. Jellyseerr will be available at port {{ .Values.service.port }}
+
+{{- if .Values.persistence.enabled }}
+3. Data is persisted using PVC: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "jellyseerr.fullname" . }}-config{{ end }}
+{{- else }}
+3. WARNING: No persistence enabled. Data will be lost when pods are restarted.
+{{- end }}
+
+For more information about using this Helm chart, please refer to the README.md file.

charts/jellyseerr/readme.md

@@ -0,0 +1,145 @@
+# Jellyseerr Helm Chart
+
+A Helm chart for deploying [Jellyseerr](https://github.com/fallenbagel/jellyseerr) on Kubernetes.
+
+## Introduction
+
+This chart deploys Jellyseerr on a Kubernetes cluster using the Helm package manager. Jellyseerr is a fork of Overseerr for Jellyfin support.
+
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/jellyseerr
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.0+
+- PV provisioner support in the underlying infrastructure (if persistence is needed)
+
+## Installing the Chart
+
+To install the chart with the release name `jellyseerr`:
+
+```bash
+helm repo add rtomik-charts https://rtomik.github.io/helm-charts
+helm install jellyseerr rtomik-charts/jellyseerr 
+```
+
+> **Tip**: List all releases using `helm list`
+
+## Uninstalling the Chart
+
+To uninstall/delete the `jellyseerr` deployment:
+
+```bash
+helm uninstall jellyseerr
+```
+
+## Parameters
+
+### Global parameters
+
+| Name                   | Description                                                   | Value  |
+|------------------------|---------------------------------------------------------------|--------|
+| `nameOverride`         | String to partially override the release name                 | `""`   |
+| `fullnameOverride`     | String to fully override the release name                     | `""`   |
+
+### Image parameters
+
+| Name                    | Description                                                  | Value                          |
+|-------------------------|--------------------------------------------------------------|--------------------------------|
+| `image.repository`      | Jellyseerr image repository                                  | `ghcr.io/fallenbagel/jellyseerr` |
+| `image.tag`             | Jellyseerr image tag                                         | `latest`                       |
+| `image.pullPolicy`      | Jellyseerr image pull policy                                 | `IfNotPresent`                 |
+| `imagePullSecrets`      | Global Docker registry secret names as an array              | `[]`                           |
+
+### Deployment parameters
+
+| Name                                 | Description                                      | Value     |
+|--------------------------------------|--------------------------------------------------|-----------|
+| `replicaCount`                       | Number of Jellyseerr replicas                    | `1`       |
+| `revisionHistoryLimit`               | Number of revisions to retain for rollback       | `3`       |
+| `podSecurityContext.runAsNonRoot`    | Run containers as non-root user                  | `true`    |
+| `podSecurityContext.runAsUser`       | User ID for the container                        | `1000`    |
+| `podSecurityContext.fsGroup`         | Group ID for the container filesystem            | `1000`    |
+| `containerSecurityContext`           | Security context for the container               | See values.yaml |
+| `nodeSelector`                       | Node labels for pod assignment                   | `{}`      |
+| `tolerations`                        | Tolerations for pod assignment                   | `[]`      |
+| `affinity`                           | Affinity for pod assignment                      | `{}`      |
+
+### Service parameters
+
+| Name                       | Description                                  | Value       |
+|----------------------------|----------------------------------------------|-------------|
+| `service.type`             | Kubernetes Service type                      | `ClusterIP` |
+| `service.port`             | Service HTTP port                            | `5055`      |
+
+### Ingress parameters
+
+| Name                       | Description                                  | Value                 |
+|----------------------------|----------------------------------------------|------------------------|
+| `ingress.enabled`          | Enable ingress record generation             | `false`               |
+| `ingress.className`        | IngressClass name                            | `""`                  |
+| `ingress.annotations`      | Additional annotations for the Ingress resource | `{}`               |
+| `ingress.hosts`            | Array of host and path objects               | See values.yaml       |
+| `ingress.tls`              | TLS configuration                            | `[]`                  |
+
+### Persistence parameters
+
+| Name                          | Description                                  | Value           |
+|-------------------------------|----------------------------------------------|-----------------|
+| `persistence.enabled`         | Enable persistence using PVC                 | `true`          |
+| `persistence.existingClaim`   | Use an existing PVC                          | `""`            |
+| `persistence.storageClass`    | PVC Storage Class                            | `""`            |
+| `persistence.accessMode`      | PVC Access Mode                              | `ReadWriteOnce` |
+| `persistence.size`            | PVC Storage Size                             | `1Gi`           |
+| `persistence.annotations`     | Additional custom annotations for the PVC    | `{}`            |
+
+### Environment variables
+
+| Name                     | Description                                  | Value           |
+|--------------------------|----------------------------------------------|-----------------|
+| `env`                    | Environment variables for Jellyseerr          | See values.yaml |
+| `extraEnv`               | Additional environment variables             | `[]`            |
+
+### Resources parameters
+
+| Name                     | Description                                  | Value           |
+|--------------------------|----------------------------------------------|-----------------|
+| `resources.limits`       | The resources limits for containers          | See values.yaml |
+| `resources.requests`     | The resources requests for containers        | See values.yaml |
+
+## Configuration
+
+The following table lists the configurable parameters of the Jellyseerr chart and their default values.
+
+### Environment Variables
+
+You can configure Jellyseerr by setting environment variables:
+
+```yaml
+env:
+  - name: TZ
+    value: "America/New_York"
+  - name: LOG_LEVEL
+    value: "info"
+  - name: PORT
+    value: "5055"
+```
+
+### Using Persistence
+
+By default, persistence is enabled with a 1Gi volume:
+
+```yaml
+persistence:
+  enabled: true
+  size: 1Gi
+```
+
+You can also use an existing PVC:
+
+```yaml
+persistence:
+  enabled: true
+  existingClaim: my-jellyseerr-pvc
+```

charts/jellyseerr/templates/_helpers.tpl

@@ -0,0 +1,45 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "jellyseerr.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "jellyseerr.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "jellyseerr.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "jellyseerr.labels" -}}
+helm.sh/chart: {{ include "jellyseerr.chart" . }}
+{{ include "jellyseerr.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "jellyseerr.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "jellyseerr.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

charts/jellyseerr/templates/deployment.yaml

@@ -0,0 +1,107 @@
+### templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "jellyseerr.fullname" . }}
+  labels:
+    {{- include "jellyseerr.labels" . | nindent 4 }}
+  annotations:
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "jellyseerr.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        {{- include "jellyseerr.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.startupArgs }}
+          args:
+            {{- range .Values.startupArgs }}
+            - {{ . | quote }}
+            {{- end }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          env:
+          {{- range .Values.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+          {{- end }}
+          {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: config
+              mountPath: /app/config
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "jellyseerr.fullname" . }}-config{{ end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/jellyseerr/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "jellyseerr.fullname" . }}
+  labels:
+    {{- include "jellyseerr.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "jellyseerr.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/jellyseerr/templates/pvc.yaml

@@ -0,0 +1,21 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "jellyseerr.fullname" . }}-config
+  labels:
+    {{- include "jellyseerr.labels" . | nindent 4 }}
+  {{- with .Values.persistence.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  {{- if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- end }}

charts/jellyseerr/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "jellyseerr.fullname" . }}
+  labels:
+    {{- include "jellyseerr.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "jellyseerr.selectorLabels" . | nindent 4 }}

charts/jellyseerr/values.yaml

@@ -0,0 +1,117 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Image settings
+image:
+  repository: ghcr.io/fallenbagel/jellyseerr
+  tag: 2.5.2
+  pullPolicy: IfNotPresent
+  
+## Deployment settings
+replicaCount: 1
+revisionHistoryLimit: 3
+
+# Optional startup arguments
+startupArgs: []
+
+# Pod security settings
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  fsGroup: 1000
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+## Pod scheduling
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+## Pod annotations
+podAnnotations: {}
+
+## Service settings
+service:
+  type: ClusterIP
+  port: 5055
+
+## Ingress settings
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+    # cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+    - host: jellyseerr.domain.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+  # - hosts:
+  #     - jellyseerr.domain.com
+  #   secretName: jellyseerr-tls
+
+## Persistence settings
+persistence:
+  enabled: true
+  existingClaim: ""
+  storageClass: ""
+  accessMode: ReadWriteOnce
+  size: 1Gi
+  annotations: {}
+
+## Environment variables
+env:
+  - name: TZ
+    value: "UTC"
+  - name: LOG_LEVEL
+    value: "info"
+  - name: PORT
+    value: "5055"
+
+# Extra environment variables (for advanced use cases)
+extraEnv: []
+  # - name: NODE_ENV
+  #   value: "production"
+
+# Extra volume mounts
+extraVolumeMounts: []
+
+# Extra volumes 
+extraVolumes: []
+
+## Resource limits and requests
+# resources:
+#   limits:
+#     cpu: 500m
+#     memory: 512Mi
+#   requests:
+#     cpu: 100m
+#     memory: 128Mi
+
+## Application health checks
+probes:
+  liveness:
+    enabled: true
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 6
+    successThreshold: 1
+    path: /api/v1/status
+  readiness:
+    enabled: true
+    initialDelaySeconds: 5
+    periodSeconds: 5
+    timeoutSeconds: 3
+    failureThreshold: 3
+    successThreshold: 1
+    path: /api/v1/status

charts/joplin-server/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: joplin-server
+description: Joplin Server helm chart for Kubernetes - Note-taking and synchronization server
+type: application
+version: 0.0.2
+appVersion: "3.4.2"
+maintainers:
+  - name: Richard Tomik
+    email: no@m.com
+keywords:
+  - notes
+  - synchronization
+  - joplin
+  - productivity
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/laurent22/joplin

charts/joplin-server/NOTES.txt

@@ -0,0 +1,106 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "joplin-server.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "joplin-server.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "joplin-server.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "joplin-server.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+
+2. Joplin Server is configured with:
+   - Database: PostgreSQL ({{ .Values.postgresql.external.host }}:{{ .Values.postgresql.external.port }}/{{ .Values.postgresql.external.database }})
+   - Storage: {{ .Values.joplin.storage.driver }}
+   {{- if eq .Values.joplin.storage.driver "filesystem" }}
+   - Data path: {{ .Values.joplin.storage.filesystemPath }}
+   {{- end }}
+   - User registration: {{ if .Values.joplin.server.enableUserRegistration }}enabled{{ else }}disabled{{ end }}
+   - Sharing: {{ if .Values.joplin.server.enableSharing }}enabled{{ else }}disabled{{ end }}
+
+{{- if and (eq .Values.joplin.storage.driver "filesystem") .Values.persistence.enabled }}
+3. Data is persisted using PVC: {{ include "joplin-server.fullname" . }}-data
+{{- else if eq .Values.joplin.storage.driver "filesystem" }}
+3. WARNING: No persistence enabled. Data will be lost when pods are restarted.
+{{- else }}
+3. Using {{ .Values.joplin.storage.driver }} storage - no local persistence needed.
+{{- end }}
+
+{{- if .Values.transcribe.enabled }}
+4. AI Transcription service is enabled:
+   - Transcribe service accessible internally at: {{ include "joplin-server.fullname" . }}-transcribe:{{ .Values.transcribe.service.port }}
+   {{- if .Values.transcribe.persistence.enabled }}
+   - Transcribe images stored in PVC: {{ include "joplin-server.fullname" . }}-transcribe-images
+   {{- end }}
+{{- end }}
+
+{{- if .Values.joplin.email.enabled }}
+5. Email notifications configured:
+   - SMTP host: {{ .Values.joplin.email.host }}:{{ .Values.joplin.email.port }}
+   - From: {{ .Values.joplin.email.fromName }} <{{ .Values.joplin.email.fromEmail }}>
+{{- end }}
+
+{{- if not .Values.joplin.admin.email }}
+
+6. IMPORTANT: First-time setup required!
+   After accessing the application, you'll need to create your first admin user.
+   Consider setting joplin.admin.email and joplin.admin.password for automated setup.
+{{- else }}
+
+6. Admin user configured:
+   - Email: {{ .Values.joplin.admin.email }}
+   {{- if .Values.joplin.admin.existingSecret }}
+   - Password: Retrieved from secret {{ .Values.joplin.admin.existingSecret }}
+   {{- else }}
+   - Password: Set in values (consider using existingSecret for production)
+   {{- end }}
+{{- end }}
+
+{{- if not .Values.postgresql.external.enabled }}
+
+7. WARNING: PostgreSQL database not configured!
+   Please configure postgresql.external settings to connect to your PostgreSQL database.
+   Joplin Server requires a PostgreSQL database to function.
+{{- else if and .Values.postgresql.external.enabled (not .Values.postgresql.external.existingSecret) }}
+
+7. SECURITY NOTE: Database credentials in plain text.
+   For production use, consider using postgresql.external.existingSecret to store database credentials securely.
+{{- end }}
+
+{{- $defaultHost := "joplin.domain.com" }}
+{{- $actualHost := "" }}
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+{{- $actualHost = .host }}
+{{- end }}
+{{- end }}
+{{- if and $actualHost (ne $actualHost $defaultHost) }}
+{{- if and .Values.probes.liveness.httpHeaders (len .Values.probes.liveness.httpHeaders) }}
+{{- $probeHost := "" }}
+{{- range .Values.probes.liveness.httpHeaders }}
+{{- if eq .name "Host" }}
+{{- $probeHost = .value }}
+{{- end }}
+{{- end }}
+{{- if eq $probeHost $defaultHost }}
+
+8. IMPORTANT: Health check configuration needs updating!
+   Your ingress host is "{{ $actualHost }}" but health checks are configured for "{{ $defaultHost }}".
+   Update probes.*.httpHeaders.Host value to match your domain for proper health checks.
+{{- end }}
+{{- end }}
+{{- end }}
+
+For more information about using this Helm chart, please refer to the readme.md file.

charts/joplin-server/readme.md

@@ -0,0 +1,460 @@
+# Joplin Server Helm Chart
+
+A Helm chart for deploying Joplin Server on Kubernetes - Note-taking and synchronization server.
+
+## Introduction
+
+This chart deploys [Joplin Server](https://github.com/laurent22/joplin) on a Kubernetes cluster using the Helm package manager. Joplin Server is the synchronization server for Joplin, allowing you to sync your notes across devices.
+
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/joplin-server
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.0+
+- **External PostgreSQL database** (Required - Joplin Server does not support SQLite in production)
+- PV provisioner support in the underlying infrastructure (if persistence is needed for file storage)
+
+## Installing the Chart
+
+To install the chart with the release name `joplin-server`:
+
+```bash
+$ helm repo add joplin-chart https://rtomik.github.io/helm-charts
+$ helm install joplin-server joplin-chart/joplin-server
+```
+
+> **Important**: You must configure PostgreSQL database settings before installation.
+
+## Uninstalling the Chart
+
+To uninstall/delete the `joplin-server` deployment:
+
+```bash
+$ helm uninstall joplin-server
+```
+
+## Parameters
+
+### Global parameters
+
+| Name                   | Description                                    | Value |
+|------------------------|------------------------------------------------|-------|
+| `nameOverride`         | String to partially override the release name | `""`  |
+| `fullnameOverride`     | String to fully override the release name     | `""`  |
+
+### Image parameters
+
+| Name                    | Description                       | Value              |
+|-------------------------|-----------------------------------|--------------------|
+| `image.repository`      | Joplin Server image repository    | `joplin/server`    |
+| `image.tag`             | Joplin Server image tag           | `latest`           |
+| `image.pullPolicy`      | Joplin Server image pull policy   | `IfNotPresent`     |
+
+### Deployment parameters
+
+| Name                                 | Description                                   | Value     |
+|--------------------------------------|-----------------------------------------------|-----------|
+| `replicaCount`                       | Number of Joplin Server replicas             | `1`       |
+| `revisionHistoryLimit`               | Number of revisions to retain for rollback   | `3`       |
+| `podSecurityContext.runAsNonRoot`    | Run containers as non-root user               | `true`    |
+| `podSecurityContext.runAsUser`       | User ID for the container                     | `1001`    |
+| `podSecurityContext.fsGroup`         | Group ID for the container filesystem        | `1001`    |
+| `containerSecurityContext`           | Security context for the container           | See values.yaml |
+| `nodeSelector`                       | Node labels for pod assignment               | `{}`      |
+| `tolerations`                        | Tolerations for pod assignment               | `[]`      |
+| `affinity`                           | Affinity for pod assignment                  | `{}`      |
+
+### Service parameters
+
+| Name           | Description           | Value       |
+|----------------|-----------------------|-------------|
+| `service.type` | Kubernetes Service type | `ClusterIP` |
+| `service.port` | Service HTTP port     | `22300`     |
+
+### Ingress parameters
+
+| Name                    | Description                               | Value           |
+|-------------------------|-------------------------------------------|-----------------|
+| `ingress.enabled`       | Enable ingress record generation          | `false`         |
+| `ingress.className`     | IngressClass name                         | `""`            |
+| `ingress.annotations`   | Additional annotations for the Ingress    | See values.yaml |
+| `ingress.hosts`         | Array of host and path objects            | See values.yaml |
+| `ingress.tls`           | TLS configuration                         | See values.yaml |
+
+### Environment variables
+
+| Name                      | Description                                   | Value                    |
+|---------------------------|-----------------------------------------------|--------------------------|
+| `env.APP_PORT`            | Application port                              | `22300`                  |
+| `env.APP_BASE_URL`        | Base URL for the application                  | `http://localhost:22300` |
+| `env.DB_CLIENT`           | Database client (always pg for PostgreSQL)   | `pg`                     |
+
+### PostgreSQL configuration (Required)
+
+| Name                                   | Description                                   | Value     |
+|----------------------------------------|-----------------------------------------------|-----------|
+| `postgresql.external.enabled`          | Use external PostgreSQL database (required)  | `true`    |
+| `postgresql.external.host`             | PostgreSQL host                              | `""`      |
+| `postgresql.external.port`             | PostgreSQL port                              | `5432`    |
+| `postgresql.external.database`         | PostgreSQL database name                     | `joplin`  |
+| `postgresql.external.user`             | PostgreSQL username                          | `joplin`  |
+| `postgresql.external.password`         | PostgreSQL password                          | `""`      |
+| `postgresql.external.existingSecret`   | Name of existing secret with PostgreSQL credentials | `""`      |
+| `postgresql.external.userKey`          | Key in the secret for username               | `username` |
+| `postgresql.external.passwordKey`      | Key in the secret for password               | `password` |
+| `postgresql.external.hostKey`          | Key in the secret for host (optional)        | `""`      |
+| `postgresql.external.portKey`          | Key in the secret for port (optional)        | `""`      |
+| `postgresql.external.databaseKey`      | Key in the secret for database name (optional) | `""`      |
+
+### Joplin Server Configuration
+
+#### Admin Settings
+
+| Name                                   | Description                                   | Value     |
+|----------------------------------------|-----------------------------------------------|-----------|
+| `joplin.admin.email`                   | First admin user email                        | `""`      |
+| `joplin.admin.password`                | First admin user password                     | `""`      |
+| `joplin.admin.existingSecret`          | Name of existing secret with admin credentials | `""`      |
+| `joplin.admin.emailKey`                | Key in the secret for admin email            | `admin-email` |
+| `joplin.admin.passwordKey`             | Key in the secret for admin password         | `admin-password` |
+
+#### Server Settings
+
+| Name                                      | Description                                   | Value     |
+|-------------------------------------------|-----------------------------------------------|-----------|
+| `joplin.server.maxRequestBodySize`       | Maximum request body size                     | `200mb`   |
+| `joplin.server.sessionTimeout`           | Session timeout in seconds                    | `86400`   |
+| `joplin.server.enableUserRegistration`   | Enable/disable user registration              | `false`   |
+| `joplin.server.enableSharing`            | Enable/disable sharing                        | `true`    |
+| `joplin.server.enablePublicNotes`        | Enable/disable public notes                   | `true`    |
+
+#### Storage Settings
+
+| Name                                      | Description                                   | Value        |
+|-------------------------------------------|-----------------------------------------------|--------------|
+| `joplin.storage.driver`                  | Storage driver (filesystem, s3, azure)       | `filesystem` |
+| `joplin.storage.filesystemPath`          | Path for filesystem storage                   | `/var/lib/joplin` |
+
+##### S3 Storage (Optional)
+
+| Name                                        | Description                                 | Value     |
+|---------------------------------------------|---------------------------------------------|-----------|
+| `joplin.storage.s3.bucket`                 | S3 bucket name                              | `""`      |
+| `joplin.storage.s3.region`                 | S3 region                                   | `""`      |
+| `joplin.storage.s3.accessKeyId`            | S3 access key ID                            | `""`      |
+| `joplin.storage.s3.secretAccessKey`        | S3 secret access key                        | `""`      |
+| `joplin.storage.s3.endpoint`               | S3 endpoint (for S3-compatible services)    | `""`      |
+| `joplin.storage.s3.existingSecret`         | Name of existing secret with S3 credentials | `""`      |
+| `joplin.storage.s3.accessKeyIdKey`         | Key in the secret for access key ID         | `access-key-id` |
+| `joplin.storage.s3.secretAccessKeyKey`     | Key in the secret for secret access key     | `secret-access-key` |
+
+#### Email Settings (Optional)
+
+| Name                                   | Description                                   | Value     |
+|----------------------------------------|-----------------------------------------------|-----------|
+| `joplin.email.enabled`                 | Enable email notifications                    | `false`   |
+| `joplin.email.host`                    | SMTP host                                     | `""`      |
+| `joplin.email.port`                    | SMTP port                                     | `587`     |
+| `joplin.email.username`                | SMTP username                                 | `""`      |
+| `joplin.email.password`                | SMTP password                                 | `""`      |
+| `joplin.email.fromEmail`               | From email address                            | `""`      |
+| `joplin.email.fromName`                | From name                                     | `Joplin Server` |
+| `joplin.email.secure`                  | Use TLS/SSL                                   | `true`    |
+| `joplin.email.existingSecret`          | Name of existing secret with email credentials | `""`      |
+| `joplin.email.usernameKey`             | Key in the secret for SMTP username          | `email-username` |
+| `joplin.email.passwordKey`             | Key in the secret for SMTP password          | `email-password` |
+
+#### Logging Settings
+
+| Name                           | Description                          | Value     |
+|--------------------------------|--------------------------------------|-----------|
+| `joplin.logging.level`         | Log level (error, warn, info, debug) | `info`    |
+| `joplin.logging.target`        | Log target (console, file)           | `console` |
+
+### Persistence settings (for filesystem storage)
+
+| Name                          | Description                      | Value           |
+|-------------------------------|----------------------------------|-----------------|
+| `persistence.enabled`         | Enable persistence using PVC     | `true`          |
+| `persistence.storageClass`    | PVC Storage Class                | `""`            |
+| `persistence.accessMode`      | PVC Access Mode                  | `ReadWriteOnce` |
+| `persistence.size`            | PVC Size                         | `10Gi`          |
+| `persistence.annotations`     | Annotations for PVC              | `{}`            |
+
+### Transcribe Service (Optional AI Transcription)
+
+| Name                                      | Description                                   | Value        |
+|-------------------------------------------|-----------------------------------------------|--------------|
+| `transcribe.enabled`                      | Enable transcribe service                     | `false`      |
+| `transcribe.image.repository`             | Transcribe image repository                   | `joplin/transcribe` |
+| `transcribe.image.tag`                    | Transcribe image tag                          | `latest`     |
+| `transcribe.image.pullPolicy`             | Transcribe image pull policy                  | `IfNotPresent` |
+| `transcribe.api.key`                      | Shared secret between Joplin and Transcribe  | `""`         |
+| `transcribe.api.existingSecret`           | Name of existing secret with transcribe API key | `""`         |
+| `transcribe.api.keyName`                  | Key in the secret for transcribe API key     | `transcribe-api-key` |
+| `transcribe.service.type`                 | Transcribe service type                       | `ClusterIP`  |
+| `transcribe.service.port`                 | Transcribe service port                       | `4567`       |
+| `transcribe.htr.imagesFolder`             | HTR images folder path                        | `/app/images` |
+
+#### Transcribe Database (Separate from main database)
+
+| Name                                        | Description                                 | Value       |
+|---------------------------------------------|---------------------------------------------|-------------|
+| `transcribe.database.host`                  | Transcribe database host                    | `""`        |
+| `transcribe.database.port`                  | Transcribe database port                    | `5432`      |
+| `transcribe.database.database`              | Transcribe database name                    | `transcribe` |
+| `transcribe.database.user`                  | Transcribe database username                | `transcribe` |
+| `transcribe.database.password`              | Transcribe database password                | `""`        |
+| `transcribe.database.existingSecret`        | Name of existing secret with transcribe DB credentials | `""`        |
+| `transcribe.database.userKey`               | Key in the secret for username              | `username`  |
+| `transcribe.database.passwordKey`           | Key in the secret for password              | `password`  |
+
+### Resource Configuration
+
+| Name        | Description                          | Value |
+|-------------|--------------------------------------|-------|
+| `resources` | Resource limits and requests         | `{}`  |
+
+### Health Checks
+
+| Name                                      | Description                              | Value |
+|-------------------------------------------|------------------------------------------|-------|
+| `probes.liveness.enabled`                 | Enable liveness probe                    | `true` |
+| `probes.liveness.initialDelaySeconds`     | Initial delay for liveness probe         | `60`   |
+| `probes.liveness.periodSeconds`           | Period for liveness probe                | `30`   |
+| `probes.liveness.timeoutSeconds`          | Timeout for liveness probe               | `10`   |
+| `probes.liveness.failureThreshold`        | Failure threshold for liveness probe     | `3`    |
+| `probes.liveness.successThreshold`        | Success threshold for liveness probe     | `1`    |
+| `probes.liveness.path`                    | Path for liveness probe                  | `/api/ping` |
+| `probes.liveness.httpHeaders`             | HTTP headers for liveness probe          | `[{"name": "Host", "value": "joplin.domain.com"}]` |
+| `probes.readiness.enabled`                | Enable readiness probe                   | `true` |
+| `probes.readiness.initialDelaySeconds`    | Initial delay for readiness probe        | `30`   |
+| `probes.readiness.periodSeconds`          | Period for readiness probe               | `10`   |
+| `probes.readiness.timeoutSeconds`         | Timeout for readiness probe              | `5`    |
+| `probes.readiness.failureThreshold`       | Failure threshold for readiness probe    | `3`    |
+| `probes.readiness.successThreshold`       | Success threshold for readiness probe    | `1`    |
+| `probes.readiness.path`                   | Path for readiness probe                 | `/api/ping` |
+| `probes.readiness.httpHeaders`            | HTTP headers for readiness probe         | `[{"name": "Host", "value": "joplin.domain.com"}]` |
+
+### Autoscaling
+
+| Name                                        | Description                              | Value   |
+|---------------------------------------------|------------------------------------------|---------|
+| `autoscaling.enabled`                       | Enable horizontal pod autoscaling        | `false` |
+| `autoscaling.minReplicas`                   | Minimum number of replicas               | `1`     |
+| `autoscaling.maxReplicas`                   | Maximum number of replicas               | `3`     |
+| `autoscaling.targetCPUUtilizationPercentage`| Target CPU utilization percentage        | `80`    |
+| `autoscaling.targetMemoryUtilizationPercentage`| Target memory utilization percentage     | `80`    |
+
+### Security Settings
+
+| Name                              | Description                          | Value   |
+|-----------------------------------|--------------------------------------|---------|
+| `security.httpsRedirect`          | Enable/disable HTTPS redirect        | `false` |
+| `security.tls.enabled`            | Enable custom TLS certificate        | `false` |
+| `security.tls.existingSecret`     | Name of existing secret with TLS cert| `""`    |
+| `security.tls.certificateKey`     | Key in the secret for TLS certificate| `tls.crt` |
+| `security.tls.privateKeyKey`      | Key in the secret for TLS private key| `tls.key` |
+
+## Configuration Examples
+
+### Basic Installation with PostgreSQL
+
+```yaml
+postgresql:
+  external:
+    enabled: true
+    host: "postgresql.example.com"
+    port: 5432
+    database: "joplin"
+    user: "joplin"
+    password: "secure-password"
+
+ingress:
+  enabled: true
+  hosts:
+    - host: joplin.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - joplin.example.com
+      secretName: joplin-tls
+
+env:
+  APP_BASE_URL: "https://joplin.example.com"
+
+# IMPORTANT: Update health check host headers to match your domain
+probes:
+  liveness:
+    httpHeaders:
+      - name: Host
+        value: joplin.example.com
+  readiness:
+    httpHeaders:
+      - name: Host
+        value: joplin.example.com
+
+joplin:
+  admin:
+    email: "admin@example.com"
+    password: "admin-password"
+  server:
+    enableUserRegistration: true
+```
+
+### Using Kubernetes Secrets
+
+#### Full Secret Configuration
+```yaml
+postgresql:
+  external:
+    enabled: true
+    existingSecret: "joplin-postgresql-secret"
+    hostKey: "host"
+    portKey: "port"
+    databaseKey: "database"
+    userKey: "username"
+    passwordKey: "password"
+
+joplin:
+  admin:
+    existingSecret: "joplin-admin-secret"
+    emailKey: "email"
+    passwordKey: "password"
+```
+
+#### Mixed Configuration (Host in values, credentials in secret)
+```yaml
+postgresql:
+  external:
+    enabled: true
+    host: "postgres-cluster-pooler.dbs.svc.cluster.local"
+    port: 5432
+    database: "joplin-server"
+    existingSecret: "joplin-db-credentials"
+    userKey: "username"
+    passwordKey: "password"
+    # hostKey, portKey, databaseKey left empty - using values above
+```
+
+### S3 Storage Configuration
+
+```yaml
+joplin:
+  storage:
+    driver: "s3"
+    s3:
+      bucket: "joplin-notes"
+      region: "us-east-1"
+      existingSecret: "joplin-s3-secret"
+      accessKeyIdKey: "access-key-id"
+      secretAccessKeyKey: "secret-access-key"
+
+# No persistence needed when using S3
+persistence:
+  enabled: false
+```
+
+### Email Notifications Setup
+
+```yaml
+joplin:
+  email:
+    enabled: true
+    host: "smtp.example.com"
+    port: 587
+    fromEmail: "joplin@example.com"
+    fromName: "Joplin Server"
+    secure: true
+    existingSecret: "joplin-email-secret"
+    usernameKey: "username"
+    passwordKey: "password"
+```
+
+### Transcribe Service (AI Features)
+
+```yaml
+transcribe:
+  enabled: true
+  api:
+    existingSecret: "joplin-transcribe-secret"
+    keyName: "api-key"
+  database:
+    host: "postgresql.example.com"
+    port: 5432
+    database: "transcribe"
+    user: "transcribe"
+    existingSecret: "transcribe-db-secret"
+    userKey: "username"
+    passwordKey: "password"
+  persistence:
+    enabled: true
+    size: 5Gi
+```
+
+## First-time Setup
+
+1. **Configure PostgreSQL**: Ensure your PostgreSQL database is accessible and credentials are configured
+2. **Admin User**: Set admin email/password or access the web interface to create the first admin user
+3. **User Registration**: Configure whether users can self-register or admin approval is required
+4. **Storage**: Choose between filesystem (requires persistence) or cloud storage (S3/Azure)
+
+## Security Considerations
+
+For production deployments:
+
+1. Use external secrets for all sensitive information (database passwords, admin credentials, etc.)
+2. Enable TLS/SSL for all communications
+3. Configure proper RBAC and network policies
+4. Use dedicated databases with proper access controls
+5. Disable user registration if not needed
+6. Use cloud storage for better scalability and backup
+
+## Troubleshooting
+
+Common issues and solutions:
+
+1. **Health Check Issues / "No Available Server"**: 
+   - Ensure `probes.*.httpHeaders` includes the correct Host header matching your domain
+   - Health checks use `/api/ping` endpoint which requires proper host validation
+   - Example fix:
+   ```yaml
+   probes:
+     liveness:
+       httpHeaders:
+         - name: Host
+           value: your-joplin-domain.com
+     readiness:
+       httpHeaders:
+         - name: Host
+           value: your-joplin-domain.com
+   ```
+
+2. **Database connection issues**: Verify PostgreSQL credentials and network connectivity
+3. **Storage permissions**: Check filesystem permissions for persistent volumes
+4. **First admin user**: If no admin configured, access the web interface to create one
+5. **Transcribe issues**: Verify Docker socket access and separate database configuration
+6. **Origin validation errors**: Make sure `env.APP_BASE_URL` matches your ingress host
+
+For detailed troubleshooting, check the application logs:
+
+```bash
+kubectl logs -f deployment/joplin-server
+```
+
+Check pod status and events:
+```bash
+kubectl describe pod -l app.kubernetes.io/name=joplin-server
+```
+
+## Backing Up
+
+- **Database**: Use PostgreSQL backup tools (pg_dump, etc.)
+- **File Storage**: 
+  - Filesystem: Backup the PVC data
+  - S3: Files are already stored in S3 (ensure proper S3 backup policies)
+- **Configuration**: Backup your Kubernetes secrets and config

charts/joplin-server/templates/_helpers.tpl

@@ -0,0 +1,45 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "joplin-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "joplin-server.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "joplin-server.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "joplin-server.labels" -}}
+helm.sh/chart: {{ include "joplin-server.chart" . }}
+{{ include "joplin-server.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "joplin-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "joplin-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

charts/joplin-server/templates/deployment.yaml

@@ -0,0 +1,377 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "joplin-server.fullname" . }}
+  labels:
+    {{- include "joplin-server.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "joplin-server.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        {{- include "joplin-server.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 22300
+              protocol: TCP
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+              {{- if .Values.probes.liveness.httpHeaders }}
+              httpHeaders:
+                {{- toYaml .Values.probes.liveness.httpHeaders | nindent 16 }}
+              {{- end }}
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+              {{- if .Values.probes.readiness.httpHeaders }}
+              httpHeaders:
+                {{- toYaml .Values.probes.readiness.httpHeaders | nindent 16 }}
+              {{- end }}
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          env:
+          {{- range $key, $value := .Values.env }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+          {{- end }}
+          {{- if .Values.postgresql.external.enabled }}
+            - name: POSTGRES_HOST
+              {{- if and .Values.postgresql.external.existingSecret .Values.postgresql.external.hostKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.external.existingSecret }}
+                  key: {{ .Values.postgresql.external.hostKey }}
+              {{- else }}
+              value: {{ .Values.postgresql.external.host | quote }}
+              {{- end }}
+            - name: POSTGRES_PORT
+              {{- if and .Values.postgresql.external.existingSecret .Values.postgresql.external.portKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.external.existingSecret }}
+                  key: {{ .Values.postgresql.external.portKey }}
+              {{- else }}
+              value: {{ .Values.postgresql.external.port | quote }}
+              {{- end }}
+            - name: POSTGRES_DATABASE
+              {{- if and .Values.postgresql.external.existingSecret .Values.postgresql.external.databaseKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.external.existingSecret }}
+                  key: {{ .Values.postgresql.external.databaseKey }}
+              {{- else }}
+              value: {{ .Values.postgresql.external.database | quote }}
+              {{- end }}
+            - name: POSTGRES_USER
+              {{- if and .Values.postgresql.external.existingSecret .Values.postgresql.external.userKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.external.existingSecret }}
+                  key: {{ .Values.postgresql.external.userKey }}
+              {{- else }}
+              value: {{ .Values.postgresql.external.user | quote }}
+              {{- end }}
+            - name: POSTGRES_PASSWORD
+              {{- if and .Values.postgresql.external.existingSecret .Values.postgresql.external.passwordKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.external.existingSecret }}
+                  key: {{ .Values.postgresql.external.passwordKey }}
+              {{- else }}
+              value: {{ .Values.postgresql.external.password | quote }}
+              {{- end }}
+          {{- end }}
+          {{- if .Values.joplin.admin.email }}
+            - name: ADMIN_EMAIL
+              {{- if .Values.joplin.admin.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.joplin.admin.existingSecret }}
+                  key: {{ .Values.joplin.admin.emailKey }}
+              {{- else }}
+              value: {{ .Values.joplin.admin.email | quote }}
+              {{- end }}
+          {{- end }}
+          {{- if .Values.joplin.admin.password }}
+            - name: ADMIN_PASSWORD
+              {{- if .Values.joplin.admin.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.joplin.admin.existingSecret }}
+                  key: {{ .Values.joplin.admin.passwordKey }}
+              {{- else }}
+              value: {{ .Values.joplin.admin.password | quote }}
+              {{- end }}
+          {{- end }}
+          {{- if .Values.joplin.server.maxRequestBodySize }}
+            - name: MAX_REQUEST_BODY_SIZE
+              value: {{ .Values.joplin.server.maxRequestBodySize | quote }}
+          {{- end }}
+          {{- if .Values.joplin.server.sessionTimeout }}
+            - name: SESSION_TIMEOUT
+              value: {{ .Values.joplin.server.sessionTimeout | quote }}
+          {{- end }}
+            - name: ENABLE_USER_REGISTRATION
+              value: {{ .Values.joplin.server.enableUserRegistration | quote }}
+            - name: ENABLE_SHARING
+              value: {{ .Values.joplin.server.enableSharing | quote }}
+            - name: ENABLE_PUBLIC_NOTES
+              value: {{ .Values.joplin.server.enablePublicNotes | quote }}
+          {{- if eq .Values.joplin.storage.driver "filesystem" }}
+            - name: STORAGE_CONNECTION_STRING
+              value: "Type=Filesystem; Path={{ .Values.joplin.storage.filesystemPath }}"
+          {{- else if eq .Values.joplin.storage.driver "s3" }}
+            - name: STORAGE_CONNECTION_STRING
+              value: "Type=S3; Bucket={{ .Values.joplin.storage.s3.bucket }}; Region={{ .Values.joplin.storage.s3.region }}{{- if .Values.joplin.storage.s3.endpoint }}; Endpoint={{ .Values.joplin.storage.s3.endpoint }}{{- end }}"
+          {{- else }}
+            - name: STORAGE_CONNECTION_STRING
+              value: "Type=Database"
+          {{- end }}
+          {{- if and (eq .Values.joplin.storage.driver "s3") .Values.joplin.storage.s3.bucket }}
+            - name: AWS_ACCESS_KEY_ID
+              {{- if .Values.joplin.storage.s3.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.joplin.storage.s3.existingSecret }}
+                  key: {{ .Values.joplin.storage.s3.accessKeyIdKey }}
+              {{- else }}
+              value: {{ .Values.joplin.storage.s3.accessKeyId | quote }}
+              {{- end }}
+            - name: AWS_SECRET_ACCESS_KEY
+              {{- if .Values.joplin.storage.s3.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.joplin.storage.s3.existingSecret }}
+                  key: {{ .Values.joplin.storage.s3.secretAccessKeyKey }}
+              {{- else }}
+              value: {{ .Values.joplin.storage.s3.secretAccessKey | quote }}
+              {{- end }}
+          {{- end }}
+          {{- if .Values.joplin.email.enabled }}
+            - name: SMTP_HOST
+              value: {{ .Values.joplin.email.host | quote }}
+            - name: SMTP_PORT
+              value: {{ .Values.joplin.email.port | quote }}
+            - name: SMTP_USERNAME
+              {{- if .Values.joplin.email.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.joplin.email.existingSecret }}
+                  key: {{ .Values.joplin.email.usernameKey }}
+              {{- else }}
+              value: {{ .Values.joplin.email.username | quote }}
+              {{- end }}
+            - name: SMTP_PASSWORD
+              {{- if .Values.joplin.email.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.joplin.email.existingSecret }}
+                  key: {{ .Values.joplin.email.passwordKey }}
+              {{- else }}
+              value: {{ .Values.joplin.email.password | quote }}
+              {{- end }}
+            - name: SMTP_FROM_EMAIL
+              value: {{ .Values.joplin.email.fromEmail | quote }}
+            - name: SMTP_FROM_NAME
+              value: {{ .Values.joplin.email.fromName | quote }}
+            - name: SMTP_SECURE
+              value: {{ .Values.joplin.email.secure | quote }}
+          {{- end }}
+          {{- if .Values.transcribe.enabled }}
+            - name: TRANSCRIBE_ENABLED
+              value: "true"
+            - name: TRANSCRIBE_API_KEY
+              {{- if .Values.transcribe.api.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.transcribe.api.existingSecret }}
+                  key: {{ .Values.transcribe.api.keyName }}
+              {{- else }}
+              value: {{ .Values.transcribe.api.key | quote }}
+              {{- end }}
+            - name: TRANSCRIBE_BASE_URL
+              value: "http://{{ include "joplin-server.fullname" . }}-transcribe:{{ .Values.transcribe.service.port }}"
+          {{- end }}
+            - name: LOG_LEVEL
+              value: {{ .Values.joplin.logging.level | quote }}
+            - name: LOG_TARGET
+              value: {{ .Values.joplin.logging.target | quote }}
+          {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+          {{- if eq .Values.joplin.storage.driver "filesystem" }}
+            - name: data
+              mountPath: {{ .Values.joplin.storage.filesystemPath }}
+          {{- end }}
+          {{- if and .Values.security.tls.enabled .Values.security.tls.existingSecret }}
+            - name: tls-certs
+              mountPath: /app/certs
+              readOnly: true
+          {{- end }}
+          {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+        {{- if .Values.transcribe.enabled }}
+        - name: transcribe
+          image: "{{ .Values.transcribe.image.repository }}:{{ .Values.transcribe.image.tag }}"
+          imagePullPolicy: {{ .Values.transcribe.image.pullPolicy }}
+          ports:
+            - name: transcribe
+              containerPort: 4567
+              protocol: TCP
+          env:
+            - name: APP_PORT
+              value: "4567"
+            - name: DB_CLIENT
+              value: "pg"
+            - name: API_KEY
+              {{- if .Values.transcribe.api.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.transcribe.api.existingSecret }}
+                  key: {{ .Values.transcribe.api.keyName }}
+              {{- else }}
+              value: {{ .Values.transcribe.api.key | quote }}
+              {{- end }}
+            - name: HTR_CLI_IMAGES_FOLDER
+              value: {{ .Values.transcribe.htr.imagesFolder | quote }}
+            {{- if .Values.transcribe.database.host }}
+            - name: QUEUE_DATABASE_HOST
+              {{- if .Values.transcribe.database.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.transcribe.database.existingSecret }}
+                  key: {{ .Values.transcribe.database.hostKey }}
+              {{- else }}
+              value: {{ .Values.transcribe.database.host | quote }}
+              {{- end }}
+            - name: QUEUE_DATABASE_PORT
+              {{- if .Values.transcribe.database.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.transcribe.database.existingSecret }}
+                  key: {{ .Values.transcribe.database.portKey }}
+              {{- else }}
+              value: {{ .Values.transcribe.database.port | quote }}
+              {{- end }}
+            - name: QUEUE_DATABASE_NAME
+              {{- if .Values.transcribe.database.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.transcribe.database.existingSecret }}
+                  key: {{ .Values.transcribe.database.databaseKey }}
+              {{- else }}
+              value: {{ .Values.transcribe.database.database | quote }}
+              {{- end }}
+            - name: QUEUE_DATABASE_USER
+              {{- if .Values.transcribe.database.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.transcribe.database.existingSecret }}
+                  key: {{ .Values.transcribe.database.userKey }}
+              {{- else }}
+              value: {{ .Values.transcribe.database.user | quote }}
+              {{- end }}
+            - name: QUEUE_DATABASE_PASSWORD
+              {{- if .Values.transcribe.database.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.transcribe.database.existingSecret }}
+                  key: {{ .Values.transcribe.database.passwordKey }}
+              {{- else }}
+              value: {{ .Values.transcribe.database.password | quote }}
+              {{- end }}
+            {{- end }}
+          volumeMounts:
+            - name: transcribe-images
+              mountPath: {{ .Values.transcribe.htr.imagesFolder }}
+            - name: docker-socket
+              mountPath: /var/run/docker.sock
+        {{- end }}
+      volumes:
+      {{- if eq .Values.joplin.storage.driver "filesystem" }}
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "joplin-server.fullname" . }}-data
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+      {{- end }}
+      {{- if .Values.transcribe.enabled }}
+        - name: transcribe-images
+          {{- if .Values.transcribe.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "joplin-server.fullname" . }}-transcribe-images
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        - name: docker-socket
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+      {{- end }}
+      {{- if and .Values.security.tls.enabled .Values.security.tls.existingSecret }}
+        - name: tls-certs
+          secret:
+            secretName: {{ .Values.security.tls.existingSecret }}
+      {{- end }}
+      {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/joplin-server/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "joplin-server.fullname" . }}
+  labels:
+    {{- include "joplin-server.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "joplin-server.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/joplin-server/templates/pvc.yaml

@@ -0,0 +1,44 @@
+{{- if and (eq .Values.joplin.storage.driver "filesystem") .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "joplin-server.fullname" . }}-data
+  labels:
+    {{- include "joplin-server.labels" . | nindent 4 }}
+  {{- with .Values.persistence.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  {{- if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- end }}
+---
+{{- if and .Values.transcribe.enabled .Values.transcribe.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "joplin-server.fullname" . }}-transcribe-images
+  labels:
+    {{- include "joplin-server.labels" . | nindent 4 }}
+    app.kubernetes.io/component: transcribe
+  {{- with .Values.transcribe.persistence.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.transcribe.persistence.accessMode | quote }}
+  {{- if .Values.transcribe.persistence.storageClass }}
+  storageClassName: {{ .Values.transcribe.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.transcribe.persistence.size | quote }}
+{{- end }}

charts/joplin-server/templates/service.yaml

@@ -0,0 +1,34 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "joplin-server.fullname" . }}
+  labels:
+    {{- include "joplin-server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "joplin-server.selectorLabels" . | nindent 4 }}
+---
+{{- if .Values.transcribe.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "joplin-server.fullname" . }}-transcribe
+  labels:
+    {{- include "joplin-server.labels" . | nindent 4 }}
+    app.kubernetes.io/component: transcribe
+spec:
+  type: {{ .Values.transcribe.service.type }}
+  ports:
+    - port: {{ .Values.transcribe.service.port }}
+      targetPort: transcribe
+      protocol: TCP
+      name: transcribe
+  selector:
+    {{- include "joplin-server.selectorLabels" . | nindent 4 }}
+{{- end }}

charts/joplin-server/values.yaml

@@ -0,0 +1,268 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Image settings
+image:
+  repository: joplin/server
+  tag: "3.4.2"
+  pullPolicy: IfNotPresent
+  
+## Deployment settings
+replicaCount: 1
+revisionHistoryLimit: 3
+
+# Pod security settings
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1001
+  fsGroup: 1001
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+## Pod scheduling
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+## Service settings
+service:
+  type: ClusterIP
+  port: 22300
+
+## Ingress settings
+ingress:
+  enabled: false
+  className: ""
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: joplin.domain.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - joplin.domain.com
+
+## Resource limits and requests
+# resources:
+#   limits:
+#     cpu: 500m
+#     memory: 512Mi
+#   requests:
+#     cpu: 100m
+#     memory: 256Mi
+
+## Application health checks
+probes:
+  liveness:
+    enabled: true
+    initialDelaySeconds: 60
+    periodSeconds: 30
+    timeoutSeconds: 10
+    failureThreshold: 3
+    successThreshold: 1
+    path: /api/ping
+    # Host header for health checks to bypass origin validation
+    # Update this to match your actual domain
+    httpHeaders:
+      - name: Host
+        value: joplin.domain.com
+  readiness:
+    enabled: true
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+    path: /api/ping
+    # Host header for health checks to bypass origin validation
+    # Update this to match your actual domain
+    httpHeaders:
+      - name: Host
+        value: joplin.domain.com
+
+## Autoscaling configuration
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 3
+  targetCPUUtilizationPercentage: 80
+  targetMemoryUtilizationPercentage: 80
+
+## Environment variables
+env:
+  # Application Settings
+  APP_PORT: "22300"
+  APP_BASE_URL: "http://localhost:22300"
+  
+  # Database Settings (PostgreSQL required)
+  DB_CLIENT: "pg"
+
+# Extra environment variables (for advanced use cases)
+extraEnv: []
+
+# Extra volume mounts
+extraVolumeMounts: []
+
+# Extra volumes 
+extraVolumes: []
+
+## PostgreSQL configuration (External database required)
+postgresql:
+  # External PostgreSQL settings (required)
+  external:
+    enabled: false
+    host: ""
+    port: 5432
+    database: "joplin"
+    user: "joplin"
+    password: ""
+    # Use existing secret for database credentials
+    existingSecret: ""
+    userKey: "username"
+    passwordKey: "password"
+    # Optional: only set if host/port/database are also in the secret
+    hostKey: ""
+    portKey: ""
+    databaseKey: ""
+
+## Joplin Server Configuration
+joplin:
+  # Admin settings
+  admin:
+    # First admin user email (set during first setup)
+    email: ""
+    # First admin user password (set during first setup) 
+    password: ""
+    # Use existing secret for admin credentials
+    existingSecret: ""
+    emailKey: "admin-email"
+    passwordKey: "admin-password"
+  
+  # Server settings
+  server:
+    # Maximum request body size (in bytes)
+    maxRequestBodySize: "200mb"
+    # Session timeout in seconds
+    sessionTimeout: 86400
+    # Enable/disable user registration
+    enableUserRegistration: false
+    # Enable/disable sharing
+    enableSharing: true
+    # Enable/disable public notes
+    enablePublicNotes: true
+  
+  # Storage settings
+  storage:
+    # Storage driver: database, filesystem, s3, or azure
+    driver: "database"
+    # For filesystem storage (requires persistence)
+    filesystemPath: "/var/lib/joplin"
+    # For S3 storage (optional)
+    s3:
+      bucket: ""
+      region: ""
+      accessKeyId: ""
+      secretAccessKey: ""
+      endpoint: ""
+      # Use existing secret for S3 credentials
+      existingSecret: ""
+      accessKeyIdKey: "access-key-id"
+      secretAccessKeyKey: "secret-access-key"
+  
+  # Email settings (for user registration and notifications)
+  email:
+    enabled: false
+    host: ""
+    port: 587
+    username: ""
+    password: ""
+    fromEmail: ""
+    fromName: "Joplin Server"
+    # Use TLS/SSL
+    secure: true
+    # Use existing secret for email credentials
+    existingSecret: ""
+    usernameKey: "email-username"
+    passwordKey: "email-password"
+  
+  # Logging settings
+  logging:
+    level: "info"  # error, warn, info, debug
+    target: "console"  # console, file
+
+## Persistence settings (for filesystem storage)
+persistence:
+  enabled: false
+  storageClass: ""
+  accessMode: ReadWriteOnce
+  size: 3Gi
+  annotations: {}
+
+## Transcribe service (optional AI transcription)
+transcribe:
+  enabled: false
+  image:
+    repository: joplin/transcribe
+    tag: "latest"
+    pullPolicy: IfNotPresent
+  
+  # Transcribe API settings
+  api:
+    # Shared secret between Joplin Server and Transcribe service
+    key: ""
+    # Use existing secret for transcribe API key
+    existingSecret: ""
+    keyName: "transcribe-api-key"
+  
+  # Transcribe service settings
+  service:
+    type: ClusterIP
+    port: 4567
+  
+  # HTR CLI settings
+  htr:
+    # Images folder path
+    imagesFolder: "/app/images"
+  
+  # Transcribe persistence (for image storage)
+  persistence:
+    enabled: false
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 5Gi
+    annotations: {}
+  
+  # Transcribe database (separate from main Joplin database)
+  database:
+    host: ""
+    port: 5432
+    database: "transcribe"
+    user: "transcribe"
+    password: ""
+    # Use existing secret for transcribe database credentials
+    existingSecret: ""
+    userKey: "username"
+    passwordKey: "password"
+    hostKey: "host"
+    portKey: "port"
+    databaseKey: "database"
+
+## Security settings
+security:
+  # Enable/disable HTTPS redirect
+  httpsRedirect: false
+  # Custom TLS certificate
+  tls:
+    enabled: false
+    # Use existing secret for TLS certificate
+    existingSecret: ""
+    certificateKey: "tls.crt"
+    privateKeyKey: "tls.key"

charts/karakeep/Chart.yaml

@@ -0,0 +1,16 @@
+apiVersion: v2
+name: karakeep
+description: Karakeep helm chart for Kubernetes
+type: application
+version: 0.0.1
+appVersion: "0.26.0"
+maintainers:
+  - name: Richard Tomik
+    email: no@m.com
+keywords:
+  - bookmark-manager
+  - karakeep
+  - productivity
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/karakeep-app/karakeep

charts/karakeep/NOTES.txt

@@ -0,0 +1,46 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "karakeep.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "karakeep.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "karakeep.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "{{ include "karakeep.selectorLabels" . }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:3000 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 3000:$CONTAINER_PORT
+{{- end }}
+
+2. Karakeep has been deployed with the following components:
+   - Main application (Karakeep)
+   - MeiliSearch for search functionality
+   - Chrome browser for web scraping
+
+{{- if not .Values.persistence.enabled }}
+3. WARNING: Persistence is disabled. Data will be lost when pods are restarted.
+   Enable persistence by setting:
+   persistence.enabled=true
+{{- end }}
+
+4. IMPORTANT: Configuration for production:
+   - Generate a secure 32-character random string for NEXTAUTH_SECRET
+   - NEXTAUTH_URL is automatically set when ingress is enabled
+   - Update secrets or environment variables as needed
+
+{{- if not .Values.secrets.create }}
+{{- if not .Values.secrets.existingSecret }}
+5. Optional: Configure additional API keys via secrets:
+   - OPENAI_API_KEY for AI features
+   - MEILI_MASTER_KEY for MeiliSearch authentication
+{{- end }}
+{{- end }}

charts/karakeep/readme.md

@@ -0,0 +1,108 @@
+# Karakeep Helm Chart
+
+This Helm chart deploys [Karakeep](https://github.com/karakeep-app/karakeep), a bookmark management application, along with its required services on a Kubernetes cluster.
+
+## Components
+
+This chart deploys three containers in a single pod:
+
+1. **Karakeep**: The main bookmark management application
+2. **Chrome**: Headless Chrome browser for web scraping and preview generation
+3. **MeiliSearch**: Search engine for fast bookmark search functionality
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.2.0+
+- PV provisioner support in the underlying infrastructure (if persistence is enabled)
+
+## Installing the Chart
+
+To install the chart with the release name `karakeep`:
+
+```bash
+helm repo add karakeep-chart https://rtomik.github.io/helm-charts
+helm install karakeep karakeep-chart/karakeep
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `karakeep` deployment:
+
+```bash
+helm delete karakeep
+```
+
+## Configuration
+
+The following table lists the configurable parameters and their default values.
+
+### Global Settings
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `nameOverride` | Override the name of the chart | `""` |
+| `fullnameOverride` | Override the full name of the chart | `""` |
+| `replicaCount` | Number of replicas | `1` |
+
+### Karakeep Configuration
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `karakeep.image.repository` | Karakeep image repository | `ghcr.io/karakeep-app/karakeep` |
+| `karakeep.image.tag` | Karakeep image tag | `"release"` |
+| `karakeep.image.pullPolicy` | Image pull policy | `IfNotPresent` |
+
+### Chrome Configuration
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `chrome.image.repository` | Chrome image repository | `gcr.io/zenika-hub/alpine-chrome` |
+| `chrome.image.tag` | Chrome image tag | `"124"` |
+
+### MeiliSearch Configuration
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `meilisearch.image.repository` | MeiliSearch image repository | `getmeili/meilisearch` |
+| `meilisearch.image.tag` | MeiliSearch image tag | `"v1.13.3"` |
+
+### Persistence
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `persistence.enabled` | Enable persistent storage | `true` |
+| `persistence.data.size` | Size of data volume | `5Gi` |
+| `persistence.data.storageClass` | Storage class for data volume | `""` |
+| `persistence.meilisearch.size` | Size of MeiliSearch volume | `2Gi` |
+| `persistence.meilisearch.storageClass` | Storage class for MeiliSearch volume | `""` |
+
+### Ingress
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `ingress.enabled` | Enable ingress | `false` |
+| `ingress.hosts[0].host` | Hostname | `karakeep.domain.com` |
+
+### Secrets
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `secrets.create` | Create secret for environment variables | `false` |
+| `secrets.existingSecret` | Use existing secret | `""` |
+| `secrets.env` | Environment variables to store in secret | `{}` |
+
+**Important Configuration:**
+1. The default `NEXTAUTH_SECRET` is set to a placeholder value. For production deployments, you should either:
+   - Override the value: `--set karakeep.env[3].value="your-secure-32-character-string"`
+   - Use secrets: `--set secrets.create=true --set secrets.env.NEXTAUTH_SECRET="your-secure-32-character-string"`
+
+2. When ingress is enabled, `NEXTAUTH_URL` is automatically set to the ingress hostname. For custom configurations:
+   - Override manually: `--set karakeep.env[4].value="https://your-domain.com"`
+
+## Notes
+
+- This chart creates a multi-container pod with all three services running together
+- Data persistence is enabled by default with separate volumes for Karakeep data and MeiliSearch indices
+- The services communicate via localhost since they share the same pod network
+- Chrome runs with security flags for containerized environments

charts/karakeep/templates/_helpers.tpl

@@ -0,0 +1,70 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "karakeep.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "karakeep.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "karakeep.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "karakeep.labels" -}}
+helm.sh/chart: {{ include "karakeep.chart" . }}
+{{ include "karakeep.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "karakeep.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "karakeep.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the secret to use
+*/}}
+{{- define "karakeep.secretName" -}}
+{{- if .Values.secrets.existingSecret }}
+{{- .Values.secrets.existingSecret }}
+{{- else }}
+{{- include "karakeep.fullname" . }}-secret
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the data PVC
+*/}}
+{{- define "karakeep.dataPvcName" -}}
+{{- include "karakeep.fullname" . }}-data
+{{- end }}
+
+{{/*
+Create the name of the meilisearch PVC
+*/}}
+{{- define "karakeep.meilisearchPvcName" -}}
+{{- include "karakeep.fullname" . }}-meilisearch
+{{- end }}

charts/karakeep/templates/deployment.yaml

@@ -0,0 +1,191 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "karakeep.fullname" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "karakeep.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "karakeep.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        # Karakeep main application
+        - name: karakeep
+          image: "{{ .Values.karakeep.image.repository }}:{{ .Values.karakeep.image.tag }}"
+          imagePullPolicy: {{ .Values.karakeep.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.karakeep.service.port }}
+              protocol: TCP
+          env:
+            {{- range .Values.karakeep.env }}
+            - name: {{ .name }}
+              {{- if and (eq .name "NEXTAUTH_URL") $.Values.ingress.enabled }}
+              {{- $host := (index $.Values.ingress.hosts 0).host }}
+              {{- if $.Values.ingress.tls }}
+              value: "https://{{ $host }}"
+              {{- else }}
+              value: "http://{{ $host }}"
+              {{- end }}
+              {{- else }}
+              value: {{ .value | quote }}
+              {{- end }}
+            {{- end }}
+            {{- range .Values.karakeep.extraEnv }}
+            - name: {{ .name }}
+              {{- if .value }}
+              value: {{ .value | quote }}
+              {{- else if .valueFrom }}
+              valueFrom:
+                {{- toYaml .valueFrom | nindent 16 }}
+              {{- end }}
+            {{- end }}
+          {{- if or .Values.secrets.create .Values.secrets.existingSecret }}
+          envFrom:
+            - secretRef:
+                name: {{ include "karakeep.secretName" . }}
+          {{- end }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- with .Values.karakeep.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+
+        # Chrome browser sidecar
+        - name: chrome
+          image: "{{ .Values.chrome.image.repository }}:{{ .Values.chrome.image.tag }}"
+          imagePullPolicy: {{ .Values.chrome.image.pullPolicy }}
+          args:
+            {{- range .Values.chrome.args }}
+            - {{ . | quote }}
+            {{- end }}
+          ports:
+            - name: debug
+              containerPort: {{ .Values.chrome.service.port }}
+              protocol: TCP
+          securityContext:
+            {{- toYaml .Values.chrome.securityContext | nindent 12 }}
+          {{- with .Values.chrome.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /json/version
+              port: debug
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /json/version
+              port: debug
+            initialDelaySeconds: 10
+            periodSeconds: 5
+
+        # MeiliSearch sidecar
+        - name: meilisearch
+          image: "{{ .Values.meilisearch.image.repository }}:{{ .Values.meilisearch.image.tag }}"
+          imagePullPolicy: {{ .Values.meilisearch.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.meilisearch.service.port }}
+              protocol: TCP
+          env:
+            {{- range .Values.meilisearch.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+            {{- range .Values.meilisearch.extraEnv }}
+            - name: {{ .name }}
+              {{- if .value }}
+              value: {{ .value | quote }}
+              {{- else if .valueFrom }}
+              valueFrom:
+                {{- toYaml .valueFrom | nindent 16 }}
+              {{- end }}
+            {{- end }}
+          {{- if or .Values.secrets.create .Values.secrets.existingSecret }}
+          envFrom:
+            - secretRef:
+                name: {{ include "karakeep.secretName" . }}
+          {{- end }}
+          volumeMounts:
+            - name: meilisearch-data
+              mountPath: /meili_data
+          securityContext:
+            {{- toYaml .Values.meilisearch.securityContext | nindent 12 }}
+          {{- with .Values.meilisearch.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            failureThreshold: 30
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+
+      volumes:
+        {{- if .Values.persistence.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "karakeep.dataPvcName" . }}
+        - name: meilisearch-data
+          persistentVolumeClaim:
+            claimName: {{ include "karakeep.meilisearchPvcName" . }}
+        {{- else }}
+        - name: data
+          emptyDir: {}
+        - name: meilisearch-data
+          emptyDir: {}
+        {{- end }}

charts/karakeep/templates/ingress.yaml

@@ -0,0 +1,41 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "karakeep.fullname" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "karakeep.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/karakeep/templates/pvc.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "karakeep.dataPvcName" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+    component: data
+spec:
+  accessModes:
+    - {{ .Values.persistence.data.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.data.size }}
+  {{- if .Values.persistence.data.storageClass }}
+  {{- if (eq "-" .Values.persistence.data.storageClass) }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: {{ .Values.persistence.data.storageClass }}
+  {{- end }}
+  {{- end }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "karakeep.meilisearchPvcName" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+    component: meilisearch
+spec:
+  accessModes:
+    - {{ .Values.persistence.meilisearch.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.meilisearch.size }}
+  {{- if .Values.persistence.meilisearch.storageClass }}
+  {{- if (eq "-" .Values.persistence.meilisearch.storageClass) }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: {{ .Values.persistence.meilisearch.storageClass }}
+  {{- end }}
+  {{- end }}
+{{- end }}

charts/karakeep/templates/secret.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.secrets.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "karakeep.secretName" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- range $key, $value := .Values.secrets.env }}
+  {{ $key }}: {{ $value | b64enc }}
+  {{- end }}
+{{- end }}

charts/karakeep/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "karakeep.fullname" . }}
+  labels:
+    {{- include "karakeep.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "karakeep.selectorLabels" . | nindent 4 }}

charts/karakeep/values.yaml

@@ -0,0 +1,170 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Deployment settings
+replicaCount: 1
+revisionHistoryLimit: 3
+
+# Pod security settings
+podSecurityContext:
+  runAsNonRoot: false
+  runAsUser: 0
+  fsGroup: 0
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+## Pod scheduling
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+## Karakeep Web Application
+karakeep:
+  image:
+    repository: ghcr.io/karakeep-app/karakeep
+    tag: "0.26.0"
+    pullPolicy: IfNotPresent
+  
+  securityContext: {}
+  
+  env:
+    - name: DATA_DIR
+      value: "/data"
+    - name: MEILI_ADDR
+      value: "http://localhost:7700"
+    - name: BROWSER_WEB_URL
+      value: "http://localhost:9222"
+    - name: NEXTAUTH_SECRET
+      value: "changeme-generate-a-secure-random-string"
+    - name: NEXTAUTH_URL
+      value: "http://localhost:3000"
+  
+  extraEnv: []
+    # - name: OPENAI_API_KEY
+    #   valueFrom:
+    #     secretKeyRef:
+    #       name: karakeep-secrets
+    #       key: openai-api-key
+  
+  service:
+    port: 3000
+  
+  #resources:
+  #  limits:
+  #    cpu: 500m
+  #    memory: 1Gi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 256Mi
+
+## Chrome Browser Service
+chrome:
+  image:
+    repository: gcr.io/zenika-hub/alpine-chrome
+    tag: "124"
+    pullPolicy: IfNotPresent
+  
+  securityContext: {}
+  
+  args:
+    - --no-sandbox
+    - --disable-gpu
+    - --disable-dev-shm-usage
+    - --remote-debugging-address=0.0.0.0
+    - --remote-debugging-port=9222
+    - --hide-scrollbars
+  
+  service:
+    port: 9222
+  
+  #resources:
+  #  limits:
+  #    cpu: 500m
+  #    memory: 512Mi
+  #  requests:
+  #    cpu: 100m
+  #    memory: 128Mi
+
+## MeiliSearch Service
+meilisearch:
+  image:
+    repository: getmeili/meilisearch
+    tag: "v1.13.3"
+    pullPolicy: IfNotPresent
+  
+  securityContext: {}
+  
+  env:
+    - name: MEILI_NO_ANALYTICS
+      value: "true"
+    - name: MEILI_MAX_INDEXING_MEMORY
+      value: "512MiB"
+    - name: MEILI_MAX_INDEXING_THREADS
+      value: "2"
+  
+  extraEnv: []
+  
+  service:
+    port: 7700
+  
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1Gi
+    requests:
+      cpu: 100m
+      memory: 256Mi
+
+## Service settings
+service:
+  type: ClusterIP
+  port: 3000
+
+## Ingress settings
+ingress:
+  enabled: false
+  className: ""
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: karakeep.<domain.com>
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - karakeep.<domain.com>
+
+## Persistence settings
+persistence:
+  enabled: true
+  
+  # Karakeep data storage
+  data:
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 5Gi
+  
+  # MeiliSearch data storage
+  meilisearch:
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 2Gi
+
+## Secret configuration
+secrets:
+  # Set to true to create a secret for environment variables
+  create: false
+  # Name of existing secret to use
+  existingSecret: ""
+  # Environment variables to include in secret
+  env: {}
+    # NEXTAUTH_SECRET: "your-secure-random-string"
+    # OPENAI_API_KEY: "your-openai-api-key"
+    # MEILI_MASTER_KEY: "your-meilisearch-master-key"

charts/mealie/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: mealie
+description: Mealie helm chart for Kubernetes - Recipe management and meal planning
+type: application
+version: 0.0.2
+appVersion: "v3.2.1"
+maintainers:
+  - name: Richard Tomik
+    email: no@m.com
+keywords:
+  - recipe-management
+  - meal-planning
+  - cooking
+  - mealie
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/mealie-recipes/mealie

charts/mealie/NOTES.txt

@@ -0,0 +1,84 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "mealie.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "mealie.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "mealie.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "mealie.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+
+2. Mealie application is configured with:
+   - Database: {{ .Values.env.DB_ENGINE }}
+   - User signup: {{ if eq .Values.env.ALLOW_SIGNUP "true" }}enabled{{ else }}disabled{{ end }}
+   - API port: {{ .Values.env.API_PORT }}
+
+{{- if .Values.persistence.enabled }}
+3. Data is persisted using PVC: {{ include "mealie.fullname" . }}-data
+{{- else }}
+3. WARNING: No persistence enabled. Data will be lost when pods are restarted.
+{{- end }}
+
+{{- if .Values.postgresql.external.enabled }}
+4. Using external PostgreSQL database:
+   - Host: {{ .Values.postgresql.external.host }}
+   - Database: {{ .Values.postgresql.external.database }}
+{{- end }}
+
+{{- if or .Values.email.enabled .Values.ldap.enabled .Values.oidc.enabled .Values.openai.enabled }}
+5. Additional features enabled:
+{{- if .Values.email.enabled }}
+   - SMTP Email notifications configured
+{{- end }}
+{{- if .Values.ldap.enabled }}
+   - LDAP authentication enabled
+{{- end }}
+{{- if .Values.oidc.enabled }}
+   - OpenID Connect (OIDC) authentication enabled
+{{- end }}
+{{- if .Values.openai.enabled }}
+   - OpenAI integration enabled for AI features
+{{- end }}
+{{- end }}
+
+{{- if or .Values.postgresql.external.existingSecret .Values.email.existingSecret .Values.ldap.existingSecret .Values.oidc.existingSecret .Values.openai.existingSecret .Values.tls.existingSecret }}
+
+6. Using external secrets for sensitive information:
+{{- if .Values.postgresql.external.existingSecret }}
+   - Database credentials from: {{ .Values.postgresql.external.existingSecret }}
+{{- end }}
+{{- if .Values.email.existingSecret }}
+   - SMTP credentials from: {{ .Values.email.existingSecret }}
+{{- end }}
+{{- if .Values.ldap.existingSecret }}
+   - LDAP credentials from: {{ .Values.ldap.existingSecret }}
+{{- end }}
+{{- if .Values.oidc.existingSecret }}
+   - OIDC credentials from: {{ .Values.oidc.existingSecret }}
+{{- end }}
+{{- if .Values.openai.existingSecret }}
+   - OpenAI API key from: {{ .Values.openai.existingSecret }}
+{{- end }}
+{{- if .Values.tls.existingSecret }}
+   - TLS certificates from: {{ .Values.tls.existingSecret }}
+{{- end }}
+{{- else }}
+
+6. SECURITY NOTE: For production use, it's recommended to store sensitive data in Kubernetes Secrets.
+   Consider using existingSecret options for database, email, LDAP, OIDC, and OpenAI configurations.
+{{- end }}
+
+For more information about using this Helm chart, please refer to the readme.md file.

charts/mealie/readme.md

@@ -0,0 +1,352 @@
+# Mealie Helm Chart
+
+A Helm chart for deploying Mealie recipe management and meal planning application on Kubernetes.
+
+## Introduction
+
+This chart deploys [Mealie](https://github.com/mealie-recipes/mealie) on a Kubernetes cluster using the Helm package manager. Mealie is a self-hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in Vue for a pleasant user experience for the whole family.
+
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/mealie
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.0+
+- PV provisioner support in the underlying infrastructure (if persistence is needed)
+- External Postgresql DB like https://cloudnative-pg.io/
+
+## Installing the Chart
+
+To install the chart with the release name `mealie`:
+
+```bash
+$ helm repo add mealie-chart https://rtomik.github.io/helm-charts
+$ helm install mealie mealie-chart/mealie
+```
+
+> **Tip**: List all releases using `helm list`
+
+## Uninstalling the Chart
+
+To uninstall/delete the `mealie` deployment:
+
+```bash
+$ helm uninstall mealie
+```
+
+## Parameters
+
+### Global parameters
+
+| Name                   | Description                                    | Value |
+|------------------------|------------------------------------------------|-------|
+| `nameOverride`         | String to partially override the release name | `""`  |
+| `fullnameOverride`     | String to fully override the release name     | `""`  |
+
+### Image parameters
+
+| Name                    | Description                       | Value                             |
+|-------------------------|-----------------------------------|-----------------------------------|
+| `image.repository`      | Mealie image repository           | `ghcr.io/mealie-recipes/mealie`   |
+| `image.tag`             | Mealie image tag                  | `v3.1.1`                         |
+| `image.pullPolicy`      | Mealie image pull policy          | `IfNotPresent`                    |
+
+### Deployment parameters
+
+| Name                                 | Description                                   | Value     |
+|--------------------------------------|-----------------------------------------------|-----------|
+| `replicaCount`                       | Number of Mealie replicas                     | `1`       |
+| `revisionHistoryLimit`               | Number of revisions to retain for rollback   | `3`       |
+| `podSecurityContext.runAsNonRoot`    | Run containers as non-root user               | `false`   |
+| `podSecurityContext.runAsUser`       | User ID for the container                     | `911`     |
+| `podSecurityContext.fsGroup`         | Group ID for the container filesystem        | `911`     |
+| `containerSecurityContext`           | Security context for the container           | See values.yaml |
+| `nodeSelector`                       | Node labels for pod assignment               | `{}`      |
+| `tolerations`                        | Tolerations for pod assignment               | `[]`      |
+| `affinity`                           | Affinity for pod assignment                  | `{}`      |
+
+### Service parameters
+
+| Name           | Description           | Value       |
+|----------------|-----------------------|-------------|
+| `service.type` | Kubernetes Service type | `ClusterIP` |
+| `service.port` | Service HTTP port     | `9000`      |
+
+### Ingress parameters
+
+| Name                    | Description                               | Value           |
+|-------------------------|-------------------------------------------|-----------------|
+| `ingress.enabled`       | Enable ingress record generation          | `false`         |
+| `ingress.className`     | IngressClass name                         | `""`            |
+| `ingress.annotations`   | Additional annotations for the Ingress    | See values.yaml |
+| `ingress.hosts`         | Array of host and path objects            | See values.yaml |
+| `ingress.tls`           | TLS configuration                         | See values.yaml |
+
+### Persistence parameters
+
+| Name                          | Description                      | Value           |
+|-------------------------------|----------------------------------|-----------------|
+| `persistence.enabled`         | Enable persistence using PVC     | `true`          |
+| `persistence.storageClass`    | PVC Storage Class                | `""`            |
+| `persistence.accessMode`      | PVC Access Mode                  | `ReadWriteOnce` |
+| `persistence.size`            | PVC Size                         | `5Gi`           |
+| `persistence.annotations`     | Annotations for PVC              | `{}`            |
+
+### Environment variables
+
+| Name                                  | Description                                   | Value           |
+|---------------------------------------|-----------------------------------------------|-----------------|
+| `env.PUID`                           | UserID permissions between host OS and container | `911`           |
+| `env.PGID`                           | GroupID permissions between host OS and container | `911`           |
+| `env.DEFAULT_GROUP`                  | The default group for users                  | `Home`          |
+| `env.DEFAULT_HOUSEHOLD`              | The default household for users in each group | `Family`        |
+| `env.BASE_URL`                       | Used for Notifications                       | `http://localhost:9000` |
+| `env.TOKEN_TIME`                     | The time in hours that a login/auth token is valid | `48`            |
+| `env.API_PORT`                       | The port exposed by backend API              | `9000`          |
+| `env.API_DOCS`                       | Turns on/off access to the API documentation | `true`          |
+| `env.TZ`                             | Must be set to get correct date/time on the server | `UTC`           |
+| `env.ALLOW_SIGNUP`                   | Allow user sign-up without token             | `false`         |
+| `env.ALLOW_PASSWORD_LOGIN`           | Whether or not to display username+password input fields | `true`          |
+| `env.LOG_LEVEL`                      | Logging level                                | `info`          |
+| `env.DAILY_SCHEDULE_TIME`            | Time to run daily server tasks (HH:MM)       | `23:45`         |
+
+### PostgreSQL configuration
+
+| Name                                   | Description                                   | Value     |
+|----------------------------------------|-----------------------------------------------|-----------|
+| `postgresql.enabled`                   | Enable PostgreSQL support                    | `false`   |
+| `postgresql.external.enabled`          | Use external PostgreSQL database             | `false`   |
+| `postgresql.external.host`             | PostgreSQL host                              | `""`      |
+| `postgresql.external.port`             | PostgreSQL port                              | `5432`    |
+| `postgresql.external.database`         | PostgreSQL database name                     | `mealie`  |
+| `postgresql.external.user`             | PostgreSQL username                          | `mealie`  |
+| `postgresql.external.password`         | PostgreSQL password                          | `""`      |
+| `postgresql.external.existingSecret`   | Name of existing secret with PostgreSQL credentials | `""`      |
+| `postgresql.external.userKey`          | Key in the secret for username               | `username` |
+| `postgresql.external.passwordKey`      | Key in the secret for password               | `password` |
+
+### Email (SMTP) configuration
+
+| Name                     | Description                          | Value     |
+|--------------------------|--------------------------------------|-----------|
+| `email.enabled`          | Enable SMTP email support            | `false`   |
+| `email.host`             | SMTP host                            | `""`      |
+| `email.port`             | SMTP port                            | `587`     |
+| `email.fromName`         | From name for emails                 | `Mealie`  |
+| `email.authStrategy`     | SMTP auth strategy (TLS, SSL, NONE)  | `TLS`     |
+| `email.fromEmail`        | From email address                   | `""`      |
+| `email.user`             | SMTP username                        | `""`      |
+| `email.password`         | SMTP password                        | `""`      |
+| `email.existingSecret`   | Name of existing secret with SMTP credentials | `""`      |
+| `email.userKey`          | Key in the secret for SMTP username  | `smtp-user` |
+| `email.passwordKey`      | Key in the secret for SMTP password  | `smtp-password` |
+
+### LDAP Authentication
+
+| Name                     | Description                          | Value     |
+|--------------------------|--------------------------------------|-----------|
+| `ldap.enabled`           | Enable LDAP authentication           | `false`   |
+| `ldap.serverUrl`         | LDAP server URL                      | `""`      |
+| `ldap.tlsInsecure`       | Do not verify server certificate     | `false`   |
+| `ldap.tlsCaCertFile`     | Path to CA certificate file          | `""`      |
+| `ldap.enableStartTls`    | Use STARTTLS to connect to server    | `false`   |
+| `ldap.baseDn`            | Starting point for user authentication | `""`      |
+| `ldap.queryBind`         | Optional bind user for LDAP searches | `""`      |
+| `ldap.queryPassword`     | Password for the bind user            | `""`      |
+| `ldap.userFilter`        | LDAP filter to narrow down eligible users | `""`      |
+| `ldap.adminFilter`       | LDAP filter for admin users          | `""`      |
+| `ldap.idAttribute`       | LDAP attribute for user ID            | `uid`     |
+| `ldap.nameAttribute`     | LDAP attribute for user name          | `name`    |
+| `ldap.mailAttribute`     | LDAP attribute for user email         | `mail`    |
+
+### OpenID Connect (OIDC)
+
+| Name                         | Description                              | Value     |
+|------------------------------|------------------------------------------|-----------|
+| `oidc.enabled`               | Enable OIDC authentication               | `false`   |
+| `oidc.signupEnabled`         | Allow new users via OIDC                 | `true`    |
+| `oidc.configurationUrl`      | URL to OIDC configuration                | `""`      |
+| `oidc.clientId`              | OIDC client ID                           | `""`      |
+| `oidc.clientSecret`          | OIDC client secret                       | `""`      |
+| `oidc.userGroup`             | Required OIDC user group                 | `""`      |
+| `oidc.adminGroup`            | OIDC admin group                         | `""`      |
+| `oidc.autoRedirect`          | Bypass login page and redirect to IdP   | `false`   |
+| `oidc.providerName`          | Provider name shown in login button     | `OAuth`   |
+| `oidc.rememberMe`            | Extend session as if "Remember Me" was checked | `false`   |
+| `oidc.signingAlgorithm`      | Algorithm used to sign the id token     | `RS256`   |
+| `oidc.userClaim`             | Claim to look up existing user by       | `email`   |
+| `oidc.nameClaim`             | Claim for user's full name               | `name`    |
+| `oidc.groupsClaim`           | Claim for user groups                    | `groups`  |
+
+### OpenAI Integration
+
+| Name                               | Description                              | Value     |
+|------------------------------------|------------------------------------------|-----------|
+| `openai.enabled`                   | Enable OpenAI integration                | `false`   |
+| `openai.baseUrl`                   | Base URL for OpenAI API                  | `""`      |
+| `openai.apiKey`                    | OpenAI API key                           | `""`      |
+| `openai.model`                     | OpenAI model to use                      | `gpt-4o`  |
+| `openai.customHeaders`             | Custom HTTP headers for OpenAI requests | `""`      |
+| `openai.customParams`              | Custom HTTP query params for OpenAI requests | `""`      |
+| `openai.enableImageServices`       | Enable OpenAI image services            | `true`    |
+| `openai.workers`                   | Number of OpenAI workers per request    | `2`       |
+| `openai.sendDatabaseData`          | Send Mealie data to OpenAI to improve accuracy | `true`    |
+| `openai.requestTimeout`            | Timeout for OpenAI requests in seconds  | `60`      |
+
+### TLS Configuration
+
+| Name                     | Description                          | Value     |
+|--------------------------|--------------------------------------|-----------|
+| `tls.enabled`            | Enable TLS configuration             | `false`   |
+| `tls.certificatePath`    | Path to TLS certificate file         | `""`      |
+| `tls.privateKeyPath`     | Path to TLS private key file         | `""`      |
+| `tls.existingSecret`     | Name of existing secret with TLS certificates | `""`      |
+| `tls.certificateKey`     | Key in the secret for TLS certificate | `tls.crt` |
+| `tls.privateKeyKey`      | Key in the secret for TLS private key | `tls.key` |
+
+### Theme Configuration
+
+| Name                          | Description                    | Value     |
+|-------------------------------|--------------------------------|-----------|
+| `theme.light.primary`         | Light theme primary color      | `#E58325` |
+| `theme.light.accent`          | Light theme accent color       | `#007A99` |
+| `theme.light.secondary`       | Light theme secondary color    | `#973542` |
+| `theme.light.success`         | Light theme success color      | `#43A047` |
+| `theme.light.info`            | Light theme info color         | `#1976D2` |
+| `theme.light.warning`         | Light theme warning color      | `#FF6D00` |
+| `theme.light.error`           | Light theme error color        | `#EF5350` |
+| `theme.dark.primary`          | Dark theme primary color       | `#E58325` |
+| `theme.dark.accent`           | Dark theme accent color        | `#007A99` |
+| `theme.dark.secondary`        | Dark theme secondary color     | `#973542` |
+| `theme.dark.success`          | Dark theme success color       | `#43A047` |
+| `theme.dark.info`             | Dark theme info color          | `#1976D2` |
+| `theme.dark.warning`          | Dark theme warning color       | `#FF6D00` |
+| `theme.dark.error`            | Dark theme error color         | `#EF5350` |
+
+### Resource Configuration
+
+| Name        | Description                          | Value |
+|-------------|--------------------------------------|-------|
+| `resources` | Resource limits and requests         | `{}`  |
+
+### Health Checks
+
+| Name                                      | Description                              | Value |
+|-------------------------------------------|------------------------------------------|-------|
+| `probes.liveness.enabled`                 | Enable liveness probe                    | `true` |
+| `probes.liveness.initialDelaySeconds`     | Initial delay for liveness probe         | `60`   |
+| `probes.liveness.periodSeconds`           | Period for liveness probe                | `30`   |
+| `probes.liveness.timeoutSeconds`          | Timeout for liveness probe               | `10`   |
+| `probes.liveness.failureThreshold`        | Failure threshold for liveness probe     | `3`    |
+| `probes.liveness.successThreshold`        | Success threshold for liveness probe     | `1`    |
+| `probes.liveness.path`                    | Path for liveness probe                  | `/`    |
+| `probes.readiness.enabled`                | Enable readiness probe                   | `true` |
+| `probes.readiness.initialDelaySeconds`    | Initial delay for readiness probe        | `30`   |
+| `probes.readiness.periodSeconds`          | Period for readiness probe               | `10`   |
+| `probes.readiness.timeoutSeconds`         | Timeout for readiness probe              | `5`    |
+| `probes.readiness.failureThreshold`       | Failure threshold for readiness probe    | `3`    |
+| `probes.readiness.successThreshold`       | Success threshold for readiness probe    | `1`    |
+| `probes.readiness.path`                   | Path for readiness probe                 | `/`    |
+
+### Autoscaling
+
+| Name                                        | Description                              | Value   |
+|---------------------------------------------|------------------------------------------|---------|
+| `autoscaling.enabled`                       | Enable horizontal pod autoscaling        | `false` |
+| `autoscaling.minReplicas`                   | Minimum number of replicas               | `1`     |
+| `autoscaling.maxReplicas`                   | Maximum number of replicas               | `3`     |
+| `autoscaling.targetCPUUtilizationPercentage`| Target CPU utilization percentage        | `80`    |
+| `autoscaling.targetMemoryUtilizationPercentage`| Target memory utilization percentage     | `80`    |
+
+## Configuration Examples
+
+### Basic Installation with Persistence
+
+```yaml
+persistence:
+  enabled: true
+  size: 10Gi
+  storageClass: "fast-ssd"
+
+ingress:
+  enabled: true
+  hosts:
+    - host: mealie.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - mealie.example.com
+      secretName: mealie-tls
+```
+
+### PostgreSQL Database Configuration
+
+```yaml
+postgresql:
+  external:
+    enabled: true
+    host: "postgresql.example.com"
+    port: 5432
+    database: "mealie"
+    user: "mealie"
+    existingSecret: "mealie-postgresql-secret"
+    userKey: "username"
+    passwordKey: "password"
+
+env:
+  DB_ENGINE: "postgres"
+```
+
+### OIDC Authentication Setup
+
+```yaml
+oidc:
+  enabled: true
+  configurationUrl: "https://auth.example.com/.well-known/openid-configuration"
+  clientId: "mealie-client"
+  existingSecret: "mealie-oidc-secret"
+  clientIdKey: "client-id"
+  clientSecretKey: "client-secret"
+  autoRedirect: true
+  providerName: "CompanySSO"
+```
+
+### OpenAI Integration
+
+```yaml
+openai:
+  enabled: true
+  baseUrl: "https://api.openai.com/v1"
+  existingSecret: "mealie-openai-secret"
+  apiKeyKey: "api-key"
+  model: "gpt-4"
+  enableImageServices: true
+```
+
+## Security Considerations
+
+For production deployments, it's recommended to:
+
+1. Use external secrets for sensitive information
+2. Enable TLS/SSL for all communications
+3. Configure proper RBAC and network policies
+4. Use a dedicated database with proper access controls
+5. Enable authentication (LDAP/OIDC) and disable public signup
+
+## Troubleshooting
+
+Common issues and solutions:
+
+1. **Database connection issues**: Verify database credentials and network connectivity
+2. **Persistence issues**: Check StorageClass and PVC configuration
+3. **Authentication problems**: Verify LDAP/OIDC configuration and network access
+4. **Performance issues**: Adjust resource limits and consider using external database
+
+For more detailed troubleshooting, check the application logs:
+
+```bash
+kubectl logs -f deployment/mealie
+```

charts/mealie/templates/_helpers.tpl

@@ -0,0 +1,45 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "mealie.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "mealie.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "mealie.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "mealie.labels" -}}
+helm.sh/chart: {{ include "mealie.chart" . }}
+{{ include "mealie.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "mealie.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "mealie.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

charts/mealie/templates/deployment.yaml

@@ -0,0 +1,337 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "mealie.fullname" . }}
+  labels:
+    {{- include "mealie.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "mealie.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        {{- include "mealie.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 9000
+              protocol: TCP
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          env:
+          {{- range $key, $value := .Values.env }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+          {{- end }}
+          {{- if .Values.postgresql.external.enabled }}
+            - name: DB_ENGINE
+              value: "postgres"
+            - name: POSTGRES_SERVER
+              value: {{ .Values.postgresql.external.host | quote }}
+            - name: POSTGRES_PORT
+              value: {{ .Values.postgresql.external.port | quote }}
+            - name: POSTGRES_DB
+              value: {{ .Values.postgresql.external.database | quote }}
+            - name: POSTGRES_USER
+              {{- if .Values.postgresql.external.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.external.existingSecret }}
+                  key: {{ .Values.postgresql.external.userKey }}
+              {{- else }}
+              value: {{ .Values.postgresql.external.user | quote }}
+              {{- end }}
+            - name: POSTGRES_PASSWORD
+              {{- if .Values.postgresql.external.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.external.existingSecret }}
+                  key: {{ .Values.postgresql.external.passwordKey }}
+              {{- else }}
+              value: {{ .Values.postgresql.external.password | quote }}
+              {{- end }}
+          {{- end }}
+          {{- if .Values.email.enabled }}
+            - name: SMTP_HOST
+              {{- if .Values.email.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.email.existingSecret }}
+                  key: "smtp-host"
+              {{- else }}
+              value: {{ .Values.email.host | quote }}
+              {{- end }}
+            - name: SMTP_PORT
+              value: {{ .Values.email.port | quote }}
+            - name: SMTP_FROM_NAME
+              value: {{ .Values.email.fromName | quote }}
+            - name: SMTP_AUTH_STRATEGY
+              value: {{ .Values.email.authStrategy | quote }}
+            - name: SMTP_FROM_EMAIL
+              value: {{ .Values.email.fromEmail | quote }}
+            {{- if and .Values.email.user (or (eq .Values.email.authStrategy "TLS") (eq .Values.email.authStrategy "SSL")) }}
+            - name: SMTP_USER
+              {{- if .Values.email.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.email.existingSecret }}
+                  key: {{ .Values.email.userKey }}
+              {{- else }}
+              value: {{ .Values.email.user | quote }}
+              {{- end }}
+            {{- end }}
+            {{- if and .Values.email.password (or (eq .Values.email.authStrategy "TLS") (eq .Values.email.authStrategy "SSL")) }}
+            - name: SMTP_PASSWORD
+              {{- if .Values.email.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.email.existingSecret }}
+                  key: {{ .Values.email.passwordKey }}
+              {{- else }}
+              value: {{ .Values.email.password | quote }}
+              {{- end }}
+            {{- end }}
+          {{- end }}
+          {{- if .Values.ldap.enabled }}
+            - name: LDAP_AUTH_ENABLED
+              value: "true"
+            - name: LDAP_SERVER_URL
+              value: {{ .Values.ldap.serverUrl | quote }}
+            - name: LDAP_TLS_INSECURE
+              value: {{ .Values.ldap.tlsInsecure | quote }}
+            {{- if .Values.ldap.tlsCaCertFile }}
+            - name: LDAP_TLS_CACERTFILE
+              value: {{ .Values.ldap.tlsCaCertFile | quote }}
+            {{- end }}
+            - name: LDAP_ENABLE_STARTTLS
+              value: {{ .Values.ldap.enableStartTls | quote }}
+            - name: LDAP_BASE_DN
+              value: {{ .Values.ldap.baseDn | quote }}
+            {{- if .Values.ldap.queryBind }}
+            - name: LDAP_QUERY_BIND
+              value: {{ .Values.ldap.queryBind | quote }}
+            {{- end }}
+            {{- if .Values.ldap.queryPassword }}
+            - name: LDAP_QUERY_PASSWORD
+              {{- if .Values.ldap.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.ldap.existingSecret }}
+                  key: {{ .Values.ldap.passwordKey }}
+              {{- else }}
+              value: {{ .Values.ldap.queryPassword | quote }}
+              {{- end }}
+            {{- end }}
+            {{- if .Values.ldap.userFilter }}
+            - name: LDAP_USER_FILTER
+              value: {{ .Values.ldap.userFilter | quote }}
+            {{- end }}
+            {{- if .Values.ldap.adminFilter }}
+            - name: LDAP_ADMIN_FILTER
+              value: {{ .Values.ldap.adminFilter | quote }}
+            {{- end }}
+            - name: LDAP_ID_ATTRIBUTE
+              value: {{ .Values.ldap.idAttribute | quote }}
+            - name: LDAP_NAME_ATTRIBUTE
+              value: {{ .Values.ldap.nameAttribute | quote }}
+            - name: LDAP_MAIL_ATTRIBUTE
+              value: {{ .Values.ldap.mailAttribute | quote }}
+          {{- end }}
+          {{- if .Values.oidc.enabled }}
+            - name: OIDC_AUTH_ENABLED
+              value: "true"
+            - name: OIDC_SIGNUP_ENABLED
+              value: {{ .Values.oidc.signupEnabled | quote }}
+            - name: OIDC_CONFIGURATION_URL
+              value: {{ .Values.oidc.configurationUrl | quote }}
+            - name: OIDC_CLIENT_ID
+              {{- if .Values.oidc.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.oidc.existingSecret }}
+                  key: {{ .Values.oidc.clientIdKey }}
+              {{- else }}
+              value: {{ .Values.oidc.clientId | quote }}
+              {{- end }}
+            - name: OIDC_CLIENT_SECRET
+              {{- if .Values.oidc.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.oidc.existingSecret }}
+                  key: {{ .Values.oidc.clientSecretKey }}
+              {{- else }}
+              value: {{ .Values.oidc.clientSecret | quote }}
+              {{- end }}
+            {{- if .Values.oidc.userGroup }}
+            - name: OIDC_USER_GROUP
+              value: {{ .Values.oidc.userGroup | quote }}
+            {{- end }}
+            {{- if .Values.oidc.adminGroup }}
+            - name: OIDC_ADMIN_GROUP
+              value: {{ .Values.oidc.adminGroup | quote }}
+            {{- end }}
+            - name: OIDC_AUTO_REDIRECT
+              value: {{ .Values.oidc.autoRedirect | quote }}
+            - name: OIDC_PROVIDER_NAME
+              value: {{ .Values.oidc.providerName | quote }}
+            - name: OIDC_REMEMBER_ME
+              value: {{ .Values.oidc.rememberMe | quote }}
+            - name: OIDC_SIGNING_ALGORITHM
+              value: {{ .Values.oidc.signingAlgorithm | quote }}
+            - name: OIDC_USER_CLAIM
+              value: {{ .Values.oidc.userClaim | quote }}
+            - name: OIDC_NAME_CLAIM
+              value: {{ .Values.oidc.nameClaim | quote }}
+            - name: OIDC_GROUPS_CLAIM
+              value: {{ .Values.oidc.groupsClaim | quote }}
+            {{- if .Values.oidc.scopesOverride }}
+            - name: OIDC_SCOPES_OVERRIDE
+              value: {{ .Values.oidc.scopesOverride | quote }}
+            {{- end }}
+            {{- if .Values.oidc.tlsCaCertFile }}
+            - name: OIDC_TLS_CACERTFILE
+              value: {{ .Values.oidc.tlsCaCertFile | quote }}
+            {{- end }}
+          {{- end }}
+          {{- if .Values.openai.enabled }}
+            {{- if .Values.openai.baseUrl }}
+            - name: OPENAI_BASE_URL
+              value: {{ .Values.openai.baseUrl | quote }}
+            {{- end }}
+            - name: OPENAI_API_KEY
+              {{- if .Values.openai.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.openai.existingSecret }}
+                  key: {{ .Values.openai.apiKeyKey }}
+              {{- else }}
+              value: {{ .Values.openai.apiKey | quote }}
+              {{- end }}
+            - name: OPENAI_MODEL
+              value: {{ .Values.openai.model | quote }}
+            {{- if .Values.openai.customHeaders }}
+            - name: OPENAI_CUSTOM_HEADERS
+              value: {{ .Values.openai.customHeaders | quote }}
+            {{- end }}
+            {{- if .Values.openai.customParams }}
+            - name: OPENAI_CUSTOM_PARAMS
+              value: {{ .Values.openai.customParams | quote }}
+            {{- end }}
+            - name: OPENAI_ENABLE_IMAGE_SERVICES
+              value: {{ .Values.openai.enableImageServices | quote }}
+            - name: OPENAI_WORKERS
+              value: {{ .Values.openai.workers | quote }}
+            - name: OPENAI_SEND_DATABASE_DATA
+              value: {{ .Values.openai.sendDatabaseData | quote }}
+            - name: OPENAI_REQUEST_TIMEOUT
+              value: {{ .Values.openai.requestTimeout | quote }}
+          {{- end }}
+          {{- if .Values.tls.enabled }}
+            {{- if .Values.tls.existingSecret }}
+            - name: TLS_CERTIFICATE_PATH
+              value: "/app/certs/{{ .Values.tls.certificateKey }}"
+            - name: TLS_PRIVATE_KEY_PATH
+              value: "/app/certs/{{ .Values.tls.privateKeyKey }}"
+            {{- else }}
+            - name: TLS_CERTIFICATE_PATH
+              value: {{ .Values.tls.certificatePath | quote }}
+            - name: TLS_PRIVATE_KEY_PATH
+              value: {{ .Values.tls.privateKeyPath | quote }}
+            {{- end }}
+          {{- end }}
+          {{- range $key, $value := .Values.theme.light }}
+            - name: THEME_LIGHT_{{ $key | upper }}
+              value: {{ $value | quote }}
+          {{- end }}
+          {{- range $key, $value := .Values.theme.dark }}
+            - name: THEME_DARK_{{ $key | upper }}
+              value: {{ $value | quote }}
+          {{- end }}
+          {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+            {{- if and .Values.tls.enabled .Values.tls.existingSecret }}
+            - name: tls-certs
+              mountPath: /app/certs
+              readOnly: true
+            {{- end }}
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "mealie.fullname" . }}-data
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- if and .Values.tls.enabled .Values.tls.existingSecret }}
+        - name: tls-certs
+          secret:
+            secretName: {{ .Values.tls.existingSecret }}
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/mealie/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "mealie.fullname" . }}
+  labels:
+    {{- include "mealie.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "mealie.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/mealie/templates/pvc.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "mealie.fullname" . }}-data
+  labels:
+    {{- include "mealie.labels" . | nindent 4 }}
+  {{- with .Values.persistence.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  {{- if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- end }}

charts/mealie/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "mealie.fullname" . }}
+  labels:
+    {{- include "mealie.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "mealie.selectorLabels" . | nindent 4 }}

charts/mealie/values.yaml

@@ -0,0 +1,259 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Image settings
+image:
+  repository: ghcr.io/mealie-recipes/mealie
+  tag: "v3.2.1"
+  pullPolicy: IfNotPresent
+  
+## Deployment settings
+replicaCount: 1
+revisionHistoryLimit: 3
+
+# Pod security settings
+podSecurityContext:
+  runAsNonRoot: false
+  runAsUser: 911
+  fsGroup: 911
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+## Pod scheduling
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+## Service settings
+service:
+  type: ClusterIP
+  port: 9000
+
+## Ingress settings
+ingress:
+  enabled: false
+  className: ""
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: mealie.domain.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - mealie.domain.com
+
+## Persistence settings
+persistence:
+  enabled: false
+  storageClass: ""
+  accessMode: ReadWriteOnce
+  size: 5Gi
+  annotations: {}
+
+## Resource limits and requests
+# resources:
+#   limits:
+#     cpu: 1000m
+#     memory: 1000Mi
+#   requests:
+#     cpu: 100m
+#     memory: 256Mi
+
+## Application health checks
+probes:
+  liveness:
+    enabled: true
+    initialDelaySeconds: 60
+    periodSeconds: 30
+    timeoutSeconds: 10
+    failureThreshold: 3
+    successThreshold: 1
+    path: /
+  readiness:
+    enabled: true
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+    path: /
+
+## Autoscaling configuration
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 3
+  targetCPUUtilizationPercentage: 80
+  targetMemoryUtilizationPercentage: 80
+
+## Environment variables
+env:
+  # General Settings
+  PUID: "911"
+  PGID: "911"
+  DEFAULT_GROUP: "Home"
+  DEFAULT_HOUSEHOLD: "Family"
+  BASE_URL: "http://localhost:9000"
+  TOKEN_TIME: "48"
+  API_PORT: "9000"
+  API_DOCS: "true"
+  TZ: "UTC"
+  ALLOW_SIGNUP: "false"
+  ALLOW_PASSWORD_LOGIN: "true"
+  LOG_LEVEL: "info"
+  DAILY_SCHEDULE_TIME: "23:45"
+  
+  # Security
+  SECURITY_MAX_LOGIN_ATTEMPTS: "5"
+  SECURITY_USER_LOCKOUT_TIME: "24"
+  
+  # Database
+  DB_ENGINE: "postgres" # postgres or sqlite
+  
+  # Webworker
+  UVICORN_WORKERS: "1"
+
+# Extra environment variables (for advanced use cases)
+extraEnv: []
+  # - name: POSTGRES_USER
+  #   value: "mealie"
+  # - name: POSTGRES_PASSWORD
+  #   value: "mealie"
+  # - name: POSTGRES_SERVER
+  #   value: "postgres"
+  # - name: POSTGRES_PORT
+  #   value: "5432"
+  # - name: POSTGRES_DB
+  #   value: "mealie"
+
+# Extra volume mounts
+extraVolumeMounts: []
+
+# Extra volumes 
+extraVolumes: []
+
+## PostgreSQL configuration (when using external database)
+postgresql:
+  enabled: false
+  # External PostgreSQL settings
+  external:
+    enabled: false
+    host: ""
+    port: 5432
+    database: "mealie"
+    user: "mealie"
+    password: ""
+    # Use existing secret for database credentials
+    existingSecret: ""
+    userKey: "username"
+    passwordKey: "password"
+
+## SMTP Email configuration
+email:
+  enabled: false
+  host: ""
+  port: 587
+  fromName: "Mealie"
+  authStrategy: "TLS"  # TLS, SSL, NONE
+  fromEmail: ""
+  user: ""
+  password: ""
+  # Use existing secret for SMTP credentials
+  existingSecret: ""
+  userKey: "smtp-user"
+  passwordKey: "smtp-password"
+
+## LDAP Authentication
+ldap:
+  enabled: false
+  serverUrl: ""
+  tlsInsecure: false
+  tlsCaCertFile: ""
+  enableStartTls: false
+  baseDn: ""
+  queryBind: ""
+  queryPassword: ""
+  userFilter: ""
+  adminFilter: ""
+  idAttribute: "uid"
+  nameAttribute: "name"
+  mailAttribute: "mail"
+  # Use existing secret for LDAP credentials
+  existingSecret: ""
+  passwordKey: "ldap-password"
+
+## OpenID Connect (OIDC)
+oidc:
+  enabled: false
+  signupEnabled: true
+  configurationUrl: ""
+  clientId: ""
+  clientSecret: ""
+  userGroup: ""
+  adminGroup: ""
+  autoRedirect: false
+  providerName: "OAuth"
+  rememberMe: false
+  signingAlgorithm: "RS256"
+  userClaim: "email"
+  nameClaim: "name"
+  groupsClaim: "groups"
+  scopesOverride: ""
+  tlsCaCertFile: ""
+  # Use existing secret for OIDC credentials
+  existingSecret: ""
+  clientIdKey: "oidc-client-id"
+  clientSecretKey: "oidc-client-secret"
+
+## OpenAI Integration
+openai:
+  enabled: false
+  baseUrl: ""
+  apiKey: ""
+  model: "gpt-4o"
+  customHeaders: ""
+  customParams: ""
+  enableImageServices: true
+  workers: 2
+  sendDatabaseData: true
+  requestTimeout: 60
+  # Use existing secret for OpenAI API key
+  existingSecret: ""
+  apiKeyKey: "openai-api-key"
+
+## TLS Configuration
+tls:
+  enabled: false
+  certificatePath: ""
+  privateKeyPath: ""
+  # Use existing secret for TLS certificates
+  existingSecret: ""
+  certificateKey: "tls.crt"
+  privateKeyKey: "tls.key"
+
+## Theming
+theme:
+  light:
+    primary: "#E58325"
+    accent: "#007A99"
+    secondary: "#973542"
+    success: "#43A047"
+    info: "#1976D2"
+    warning: "#FF6D00"
+    error: "#EF5350"
+  dark:
+    primary: "#E58325"
+    accent: "#007A99"
+    secondary: "#973542"
+    success: "#43A047"
+    info: "#1976D2"
+    warning: "#FF6D00"
+    error: "#EF5350"

charts/paperless-ngx/Chart.yaml

@@ -0,0 +1,18 @@
+apiVersion: v2
+name: paperless-ngx
+description: Paperless-ngx helm chart for Kubernetes
+type: application
+version: 0.0.1
+appVersion: "latest"
+maintainers:
+  - name: Richard Tomik
+    email: no@m.com
+keywords:
+  - productivity
+  - document-management
+  - paperless
+  - paperless-ngx
+  - ocr
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/paperless-ngx/paperless-ngx

charts/paperless-ngx/NOTES.txt

@@ -0,0 +1,92 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "paperless-ngx.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "paperless-ngx.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "paperless-ngx.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "paperless-ngx.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8000 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8000:$CONTAINER_PORT
+{{- end }}
+
+2. Application is accessible at port {{ .Values.service.port }}
+
+3. Paperless-ngx is configured with:
+   - Database: PostgreSQL (external)
+   - Redis: External service
+   - OCR Language: {{ .Values.config.ocr.language }}
+   - Time Zone: {{ .Values.config.timeZone }}
+
+4. External Dependencies Required:
+   - PostgreSQL server: {{ include "paperless-ngx.postgresql.host" . }}:{{ include "paperless-ngx.postgresql.port" . }}
+   - Redis server: {{ include "paperless-ngx.redis.host" . }}:{{ include "paperless-ngx.redis.port" . }}
+
+{{- if or .Values.persistence.data.enabled .Values.persistence.media.enabled .Values.persistence.consume.enabled .Values.persistence.export.enabled }}
+5. Persistent Storage:
+{{- if .Values.persistence.data.enabled }}
+   - Data directory: {{ include "paperless-ngx.fullname" . }}-data ({{ .Values.persistence.data.size }})
+{{- end }}
+{{- if .Values.persistence.media.enabled }}
+   - Media directory: {{ include "paperless-ngx.fullname" . }}-media ({{ .Values.persistence.media.size }})
+{{- end }}
+{{- if .Values.persistence.consume.enabled }}
+   - Consume directory: {{ include "paperless-ngx.fullname" . }}-consume ({{ .Values.persistence.consume.size }})
+{{- end }}
+{{- if .Values.persistence.export.enabled }}
+   - Export directory: {{ include "paperless-ngx.fullname" . }}-export ({{ .Values.persistence.export.size }})
+{{- end }}
+{{- else }}
+5. WARNING: No persistent storage enabled. Data will be lost when pods are restarted.
+   Enable persistence in values.yaml for production use.
+{{- end }}
+
+{{- if .Values.config.admin.user }}
+6. Admin User: {{ .Values.config.admin.user }}
+   The admin user will be created automatically on first startup.
+{{- else }}
+6. No admin user configured. You'll need to create a superuser manually:
+   kubectl exec -it deployment/{{ include "paperless-ngx.fullname" . }} -- python manage.py createsuperuser
+{{- end }}
+
+{{- if or .Values.config.secretKey.existingSecret .Values.postgresql.external.existingSecret .Values.config.admin.existingSecret }}
+7. Using external secrets for sensitive information:
+{{- if .Values.config.secretKey.existingSecret }}
+   - Secret key from: {{ .Values.config.secretKey.existingSecret }}
+{{- end }}
+{{- if .Values.postgresql.external.existingSecret }}
+   - PostgreSQL password from: {{ .Values.postgresql.external.existingSecret }}
+{{- end }}
+{{- if .Values.config.admin.existingSecret }}
+   - Admin credentials from: {{ .Values.config.admin.existingSecret }}
+{{- end }}
+{{- else }}
+7. SECURITY NOTE: For production use, it's recommended to store sensitive data in Kubernetes Secrets.
+   - Set config.secretKey.existingSecret to use an external secret for the secret key
+   - Set postgresql.external.existingSecret to use an external secret for database credentials
+   - Set config.admin.existingSecret to use an external secret for admin credentials
+{{- end }}
+
+{{- if .Values.config.consumer.barcodes.enabled }}
+8. Barcode processing is enabled with scanner: {{ .Values.config.consumer.barcodeScanner }}
+{{- end }}
+
+{{- if .Values.config.tika.enabled }}
+9. Tika integration is enabled for Office document processing
+   - Tika endpoint: {{ .Values.config.tika.endpoint }}
+   - Gotenberg endpoint: {{ .Values.config.tika.gotenbergEndpoint }}
+{{- end }}
+
+For more information about using this Helm chart and Paperless-ngx configuration,
+please refer to the README.md file and the official Paperless-ngx documentation.

charts/paperless-ngx/readme.md

@@ -0,0 +1,238 @@
+# Paperless-ngx Helm Chart
+
+A Helm chart for deploying Paperless-ngx document management system on Kubernetes.
+
+## Introduction
+
+This chart deploys [Paperless-ngx](https://github.com/paperless-ngx/paperless-ngx) on a Kubernetes cluster using the Helm package manager.
+
+Paperless-ngx is a community-supported supercharged version of paperless: scan, index and archive all your physical documents.
+
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/paperless-ngx
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.0+
+- PV provisioner support in the underlying infrastructure
+- **External PostgreSQL database** (required)
+- **External Redis server** (required)
+
+## External Dependencies
+
+This chart requires external PostgreSQL and Redis services. It does not deploy these dependencies to avoid resource conflicts on centralized servers.
+
+### PostgreSQL Setup
+Paperless-ngx requires PostgreSQL 11+ as its database backend. Ensure you have:
+- A PostgreSQL database created for Paperless-ngx
+- Database credentials configured in values.yaml or via secrets
+
+### Redis Setup
+Redis is required for background task processing. Ensure you have:
+- A Redis server accessible from the cluster
+- Connection details configured in values.yaml
+
+## Installing the Chart
+
+To install the chart with the release name `paperless-ngx`:
+
+```bash
+$ helm repo add paperless-chart https://rtomik.github.io/helm-charts
+$ helm install paperless-ngx paperless-chart/paperless-ngx
+```
+
+Or install directly from this repository:
+
+```bash
+$ git clone https://github.com/rtomik/helm-charts.git
+$ cd helm-charts/charts/paperless-ngx
+$ helm install paperless-ngx .
+```
+
+> **Tip**: List all releases using `helm list`
+
+## Configuration
+
+The following table lists the configurable parameters and their default values.
+
+### Global Parameters
+
+| Name                   | Description                                                                         | Value |
+|------------------------|-------------------------------------------------------------------------------------|-------|
+| `nameOverride`         | String to partially override the release name                                       | `""`  |
+| `fullnameOverride`     | String to fully override the release name                                           | `""`  |
+
+### Image Parameters
+
+| Name                    | Description                                                                          | Value              |
+|-------------------------|--------------------------------------------------------------------------------------|--------------------|
+| `image.repository`      | Paperless-ngx image repository                                                      | `ghcr.io/paperless-ngx/paperless-ngx` |
+| `image.tag`             | Paperless-ngx image tag                                                             | `latest`          |
+| `image.pullPolicy`      | Paperless-ngx image pull policy                                                     | `IfNotPresent`     |
+
+### External Dependencies
+
+| Name                                   | Description                                                        | Value                                     |
+|----------------------------------------|--------------------------------------------------------------------|-------------------------------------------|
+| `postgresql.external.enabled`         | Enable external PostgreSQL configuration                          | `true`                                    |
+| `postgresql.external.host`            | External PostgreSQL host                                           | `postgresql.default.svc.cluster.local`   |
+| `postgresql.external.port`            | External PostgreSQL port                                           | `5432`                                    |
+| `postgresql.external.database`        | External PostgreSQL database name                                  | `paperless`                               |
+| `postgresql.external.username`        | External PostgreSQL username                                       | `paperless`                               |
+| `postgresql.external.existingSecret`  | Existing secret with PostgreSQL credentials                        | `""`                                      |
+| `postgresql.external.passwordKey`     | Key in existing secret for PostgreSQL password                     | `postgresql-password`                     |
+| `redis.external.enabled`              | Enable external Redis configuration                                | `true`                                    |
+| `redis.external.host`                 | External Redis host                                                | `redis.default.svc.cluster.local`        |
+| `redis.external.port`                 | External Redis port                                                | `6379`                                    |
+| `redis.external.database`             | External Redis database number                                     | `0`                                       |
+
+### Security Configuration
+
+| Name                                   | Description                                                        | Value               |
+|----------------------------------------|--------------------------------------------------------------------|---------------------|
+| `config.secretKey.existingSecret`      | Name of existing secret for Django secret key                     | `""`                |
+| `config.secretKey.secretKey`           | Key in the existing secret for Django secret key                  | `secret-key`        |
+| `config.admin.user`                    | Admin username to create on startup                               | `""`                |
+| `config.admin.password`                | Admin password (use existingSecret for production)                | `""`                |
+| `config.admin.email`                   | Admin email address                                                | `root@localhost`    |
+| `config.admin.existingSecret`          | Name of existing secret for admin credentials                     | `""`                |
+
+### Application Configuration
+
+| Name                                   | Description                                                        | Value               |
+|----------------------------------------|--------------------------------------------------------------------|---------------------|
+| `config.url`                           | External URL for Paperless-ngx (e.g., https://paperless.domain.com) | `""`                |
+| `config.allowedHosts`                  | Comma-separated list of allowed hosts                             | `*`                 |
+| `config.timeZone`                      | Application timezone                                               | `UTC`               |
+| `config.ocr.language`                  | OCR language (3-letter code)                                      | `eng`               |
+| `config.ocr.mode`                      | OCR mode (skip, redo, force)                                      | `skip`              |
+| `config.consumer.recursive`            | Enable recursive consumption directory watching                     | `false`             |
+| `config.consumer.subdirsAsTags`        | Use subdirectory names as tags                                     | `false`             |
+
+### Persistence Parameters
+
+| Name                                   | Description                                                        | Value               |
+|----------------------------------------|--------------------------------------------------------------------|---------------------|
+| `persistence.data.enabled`            | Enable persistence for data directory                             | `true`              |
+| `persistence.data.size`               | Size of data PVC                                                  | `1Gi`               |
+| `persistence.media.enabled`           | Enable persistence for media directory                            | `true`              |
+| `persistence.media.size`              | Size of media PVC                                                 | `10Gi`              |
+| `persistence.consume.enabled`         | Enable persistence for consume directory                          | `true`              |
+| `persistence.consume.size`            | Size of consume PVC                                               | `5Gi`               |
+| `persistence.export.enabled`          | Enable persistence for export directory                           | `true`              |
+| `persistence.export.size`             | Size of export PVC                                                | `1Gi`               |
+
+### Service Parameters
+
+| Name                       | Description                                          | Value       |
+|----------------------------|------------------------------------------------------|-------------|
+| `service.type`             | Kubernetes Service type                              | `ClusterIP` |
+| `service.port`             | Service HTTP port                                    | `8000`      |
+
+### Ingress Parameters
+
+| Name                       | Description                                          | Value                |
+|----------------------------|------------------------------------------------------|----------------------|
+| `ingress.enabled`          | Enable ingress record generation                     | `false`              |
+| `ingress.className`        | IngressClass name                                    | `""`                 |
+| `ingress.annotations`      | Additional annotations for the Ingress resource      | See values.yaml      |
+| `ingress.hosts`            | Array of host and path objects                       | See values.yaml      |
+| `ingress.tls`              | TLS configuration                                    | See values.yaml      |
+
+## Usage Examples
+
+### Basic Installation
+
+```bash
+helm install paperless-ngx . \
+  --set postgresql.external.host=my-postgres.example.com \
+  --set postgresql.external.password=secretpassword \
+  --set redis.external.host=my-redis.example.com
+```
+
+### Production Installation with External Secrets
+
+```yaml
+# values-production.yaml
+config:
+  url: "https://paperless.example.com"
+  allowedHosts: "paperless.example.com"
+  secretKey:
+    existingSecret: "paperless-secrets"
+    secretKey: "django-secret-key"
+  admin:
+    user: "admin"
+    existingSecret: "paperless-admin-secrets"
+
+postgresql:
+  external:
+    host: "postgresql.database.svc.cluster.local"
+    existingSecret: "paperless-db-secrets"
+    passwordKey: "password"
+
+redis:
+  external:
+    host: "redis.cache.svc.cluster.local"
+
+ingress:
+  enabled: true
+  className: "nginx"
+  hosts:
+    - host: paperless.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: paperless-tls
+      hosts:
+        - paperless.example.com
+```
+
+```bash
+helm install paperless-ngx . -f values-production.yaml
+```
+
+## Security Considerations
+
+1. **Use external secrets** for production deployments to store sensitive data like database passwords and the Django secret key.
+2. **Set a proper PAPERLESS_URL** when exposing the application externally.
+3. **Configure ALLOWED_HOSTS** to restrict which hosts can access the application.
+4. **Use HTTPS** when exposing the application to the internet.
+5. **Container Security**: The container runs as root initially to allow s6-overlay to set up the runtime environment, then drops privileges to UID 1000. This is required for the Paperless-ngx Docker image to function properly.
+
+## Volumes and Data
+
+Paperless-ngx uses several directories:
+
+- **Data directory**: Contains the search index, classification model, and SQLite database (if used)
+- **Media directory**: Contains all uploaded documents and thumbnails
+- **Consume directory**: Drop documents here for automatic processing
+- **Export directory**: Used for document exports
+
+All directories can be configured with separate PVCs and storage classes.
+
+## Uninstalling the Chart
+
+To uninstall/delete the `paperless-ngx` deployment:
+
+```bash
+helm uninstall paperless-ngx
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Contributing
+
+Please feel free to contribute by opening issues or pull requests at:
+https://github.com/rtomik/helm-charts
+
+## License
+
+This Helm chart is licensed under the MIT License.
+
+## Links
+
+- [Paperless-ngx Documentation](https://docs.paperless-ngx.com/)
+- [Paperless-ngx GitHub Repository](https://github.com/paperless-ngx/paperless-ngx)
+- [Docker Hub](https://hub.docker.com/r/ghcr.io/paperless-ngx/paperless-ngx)

charts/paperless-ngx/templates/_helpers.tpl

@@ -0,0 +1,99 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "paperless-ngx.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "paperless-ngx.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "paperless-ngx.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "paperless-ngx.labels" -}}
+helm.sh/chart: {{ include "paperless-ngx.chart" . }}
+{{ include "paperless-ngx.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "paperless-ngx.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "paperless-ngx.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+PostgreSQL host
+*/}}
+{{- define "paperless-ngx.postgresql.host" -}}
+{{- if .Values.postgresql.external.enabled }}
+{{- .Values.postgresql.external.host }}
+{{- else }}
+{{- printf "%s-postgresql" (include "paperless-ngx.fullname" .) }}
+{{- end }}
+{{- end }}
+
+{{/*
+PostgreSQL port
+*/}}
+{{- define "paperless-ngx.postgresql.port" -}}
+{{- if .Values.postgresql.external.enabled }}
+{{- .Values.postgresql.external.port | toString }}
+{{- else }}
+{{- "5432" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Redis host
+*/}}
+{{- define "paperless-ngx.redis.host" -}}
+{{- if .Values.redis.external.enabled }}
+{{- .Values.redis.external.host }}
+{{- else }}
+{{- printf "%s-redis" (include "paperless-ngx.fullname" .) }}
+{{- end }}
+{{- end }}
+
+{{/*
+Redis port
+*/}}
+{{- define "paperless-ngx.redis.port" -}}
+{{- if .Values.redis.external.enabled }}
+{{- .Values.redis.external.port | toString }}
+{{- else }}
+{{- "6379" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Redis URL
+*/}}
+{{- define "paperless-ngx.redis.url" -}}
+{{- $host := include "paperless-ngx.redis.host" . }}
+{{- $port := include "paperless-ngx.redis.port" . }}
+{{- $database := .Values.redis.external.database | toString }}
+{{- printf "redis://%s:%s/%s" $host $port $database }}
+{{- end }}

charts/paperless-ngx/templates/configmap.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}-configmap
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+data:
+  # Additional configuration files can be added here if needed
+  # Most Paperless-ngx configuration is handled via environment variables
+  README.txt: |
+    This ConfigMap can be used to store additional configuration files
+    for Paperless-ngx if needed. The main configuration is handled via
+    environment variables in the deployment.

charts/paperless-ngx/templates/deployment.yaml

@@ -0,0 +1,366 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+  annotations:
+    checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+    checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "paperless-ngx.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        {{- include "paperless-ngx.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          env:
+            # Required services
+            - name: PAPERLESS_REDIS
+              value: {{ include "paperless-ngx.redis.url" . | quote }}
+            - name: PAPERLESS_DBHOST
+              value: {{ include "paperless-ngx.postgresql.host" . | quote }}
+            - name: PAPERLESS_DBPORT
+              value: {{ include "paperless-ngx.postgresql.port" . | quote }}
+            - name: PAPERLESS_DBNAME
+              value: {{ .Values.postgresql.external.database | quote }}
+            - name: PAPERLESS_DBUSER
+              value: {{ .Values.postgresql.external.username | quote }}
+
+            # Database password from secret
+            - name: PAPERLESS_DBPASS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgresql.external.existingSecret | default (printf "%s-secrets" (include "paperless-ngx.fullname" .)) }}
+                  key: {{ .Values.postgresql.external.passwordKey | default "postgresql-password" }}
+
+            # Security
+            - name: PAPERLESS_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.secretKey.existingSecret | default (printf "%s-secrets" (include "paperless-ngx.fullname" .)) }}
+                  key: {{ .Values.config.secretKey.secretKey | default "secret-key" }}
+
+            # Basic configuration
+            {{- if .Values.config.url }}
+            - name: PAPERLESS_URL
+              value: {{ .Values.config.url | quote }}
+            {{- end }}
+            - name: PAPERLESS_ALLOWED_HOSTS
+              value: {{ .Values.config.allowedHosts | quote }}
+            {{- if .Values.config.csrfTrustedOrigins }}
+            - name: PAPERLESS_CSRF_TRUSTED_ORIGINS
+              value: {{ .Values.config.csrfTrustedOrigins | quote }}
+            {{- end }}
+            - name: PAPERLESS_CORS_ALLOWED_HOSTS
+              value: {{ .Values.config.corsAllowedHosts | quote }}
+            {{- if .Values.config.forceScriptName }}
+            - name: PAPERLESS_FORCE_SCRIPT_NAME
+              value: {{ .Values.config.forceScriptName | quote }}
+            {{- end }}
+
+            # Paths
+            - name: PAPERLESS_DATA_DIR
+              value: "/usr/src/paperless/data"
+            - name: PAPERLESS_MEDIA_ROOT
+              value: "/usr/src/paperless/media"
+            - name: PAPERLESS_CONSUMPTION_DIR
+              value: "/usr/src/paperless/consume"
+
+            # Docker/User settings (s6-overlay compatible)
+            - name: USERMAP_UID
+              value: "1000"
+            - name: USERMAP_GID
+              value: "1000"
+
+            # OCR settings
+            - name: PAPERLESS_OCR_LANGUAGE
+              value: {{ .Values.config.ocr.language | quote }}
+            - name: PAPERLESS_OCR_MODE
+              value: {{ .Values.config.ocr.mode | quote }}
+            - name: PAPERLESS_OCR_SKIP_ARCHIVE_FILE
+              value: {{ .Values.config.ocr.skipArchiveFile | quote }}
+            - name: PAPERLESS_OCR_CLEAN
+              value: {{ .Values.config.ocr.clean | quote }}
+            - name: PAPERLESS_OCR_DESKEW
+              value: {{ .Values.config.ocr.deskew | quote }}
+            - name: PAPERLESS_OCR_ROTATE_PAGES
+              value: {{ .Values.config.ocr.rotatePages | quote }}
+            - name: PAPERLESS_OCR_ROTATE_PAGES_THRESHOLD
+              value: {{ .Values.config.ocr.rotatePagesThreshold | quote }}
+            - name: PAPERLESS_OCR_OUTPUT_TYPE
+              value: {{ .Values.config.ocr.outputType | quote }}
+            {{- if ne (.Values.config.ocr.pages | int) 0 }}
+            - name: PAPERLESS_OCR_PAGES
+              value: {{ .Values.config.ocr.pages | quote }}
+            {{- end }}
+            {{- if ne (.Values.config.ocr.imageDpi | int) 0 }}
+            - name: PAPERLESS_OCR_IMAGE_DPI
+              value: {{ .Values.config.ocr.imageDpi | quote }}
+            {{- end }}
+            {{- if ne (.Values.config.ocr.maxImagePixels | int) 0 }}
+            - name: PAPERLESS_OCR_MAX_IMAGE_PIXELS
+              value: {{ .Values.config.ocr.maxImagePixels | quote }}
+            {{- end }}
+            {{- if ne .Values.config.ocr.userArgs "{}" }}
+            - name: PAPERLESS_OCR_USER_ARGS
+              value: {{ .Values.config.ocr.userArgs | quote }}
+            {{- end }}
+
+            # Time and locale
+            - name: PAPERLESS_TIME_ZONE
+              value: {{ .Values.config.timeZone | quote }}
+
+            # Consumer settings
+            - name: PAPERLESS_CONSUMER_RECURSIVE
+              value: {{ .Values.config.consumer.recursive | quote }}
+            - name: PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS
+              value: {{ .Values.config.consumer.subdirsAsTags | quote }}
+            - name: PAPERLESS_CONSUMER_DELETE_DUPLICATES
+              value: {{ .Values.config.consumer.deleteDocumentDuplicates | quote }}
+            - name: PAPERLESS_CONSUMER_IGNORE_PATTERNS
+              value: {{ .Values.config.consumer.ignorePatterns | quote }}
+            - name: PAPERLESS_CONSUMER_BARCODE_SCANNER
+              value: {{ .Values.config.consumer.barcodeScanner | quote }}
+
+            # Barcode settings
+            {{- if .Values.config.consumer.barcodes.enabled }}
+            - name: PAPERLESS_CONSUMER_ENABLE_BARCODES
+              value: "true"
+            - name: PAPERLESS_CONSUMER_BARCODE_TIFF_SUPPORT
+              value: {{ .Values.config.consumer.barcodes.tiffSupport | quote }}
+            - name: PAPERLESS_CONSUMER_BARCODE_STRING
+              value: {{ .Values.config.consumer.barcodes.string | quote }}
+            - name: PAPERLESS_CONSUMER_BARCODE_RETAIN_SPLIT_PAGES
+              value: {{ .Values.config.consumer.barcodes.retainSplitPages | quote }}
+            {{- if ne (.Values.config.consumer.barcodes.upscale | float64) 0.0 }}
+            - name: PAPERLESS_CONSUMER_BARCODE_UPSCALE
+              value: {{ .Values.config.consumer.barcodes.upscale | quote }}
+            {{- end }}
+            - name: PAPERLESS_CONSUMER_BARCODE_DPI
+              value: {{ .Values.config.consumer.barcodes.dpi | quote }}
+            {{- if ne (.Values.config.consumer.barcodes.maxPages | int) 0 }}
+            - name: PAPERLESS_CONSUMER_BARCODE_MAX_PAGES
+              value: {{ .Values.config.consumer.barcodes.maxPages | quote }}
+            {{- end }}
+            {{- end }}
+
+            # ASN barcode settings
+            {{- if .Values.config.consumer.barcodes.asnEnabled }}
+            - name: PAPERLESS_CONSUMER_ENABLE_ASN_BARCODE
+              value: "true"
+            - name: PAPERLESS_CONSUMER_ASN_BARCODE_PREFIX
+              value: {{ .Values.config.consumer.barcodes.asnPrefix | quote }}
+            {{- end }}
+
+            # Tag barcode settings
+            {{- if .Values.config.consumer.barcodes.tagEnabled }}
+            - name: PAPERLESS_CONSUMER_ENABLE_TAG_BARCODE
+              value: "true"
+            - name: PAPERLESS_CONSUMER_TAG_BARCODE_MAPPING
+              value: {{ .Values.config.consumer.barcodes.tagMapping | quote }}
+            {{- end }}
+
+            # Tika settings
+            {{- if .Values.config.tika.enabled }}
+            - name: PAPERLESS_TIKA_ENABLED
+              value: "true"
+            - name: PAPERLESS_TIKA_ENDPOINT
+              value: {{ .Values.config.tika.endpoint | quote }}
+            - name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
+              value: {{ .Values.config.tika.gotenbergEndpoint | quote }}
+            {{- end }}
+
+            # Admin user
+            {{- if .Values.config.admin.user }}
+            - name: PAPERLESS_ADMIN_USER
+              value: {{ .Values.config.admin.user | quote }}
+            - name: PAPERLESS_ADMIN_MAIL
+              value: {{ .Values.config.admin.email | quote }}
+            - name: PAPERLESS_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.admin.existingSecret | default (printf "%s-secrets" (include "paperless-ngx.fullname" .)) }}
+                  key: {{ .Values.config.admin.passwordKey | default "admin-password" }}
+            {{- end }}
+
+            # Email settings
+            {{- if .Values.config.email.host }}
+            - name: PAPERLESS_EMAIL_HOST
+              value: {{ .Values.config.email.host | quote }}
+            - name: PAPERLESS_EMAIL_PORT
+              value: {{ .Values.config.email.port | quote }}
+            {{- if .Values.config.email.user }}
+            - name: PAPERLESS_EMAIL_HOST_USER
+              value: {{ .Values.config.email.user | quote }}
+            - name: PAPERLESS_EMAIL_HOST_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.email.existingSecret | default (printf "%s-secrets" (include "paperless-ngx.fullname" .)) }}
+                  key: {{ .Values.config.email.passwordKey | default "email-password" }}
+            {{- end }}
+            {{- if .Values.config.email.from }}
+            - name: PAPERLESS_EMAIL_FROM
+              value: {{ .Values.config.email.from | quote }}
+            {{- end }}
+            - name: PAPERLESS_EMAIL_USE_TLS
+              value: {{ .Values.config.email.useTls | quote }}
+            - name: PAPERLESS_EMAIL_USE_SSL
+              value: {{ .Values.config.email.useSsl | quote }}
+            {{- end }}
+
+            # Task processing
+            - name: PAPERLESS_TASK_WORKERS
+              value: {{ .Values.config.taskWorkers | quote }}
+            - name: PAPERLESS_THREADS_PER_WORKER
+              value: {{ .Values.config.threadsPerWorker | quote }}
+            - name: PAPERLESS_WORKER_TIMEOUT
+              value: {{ .Values.config.workerTimeout | quote }}
+
+            # Advanced settings
+            - name: PAPERLESS_ENABLE_NLTK
+              value: {{ .Values.config.enableNltk | quote }}
+            {{- if .Values.config.filenameFormat }}
+            - name: PAPERLESS_FILENAME_FORMAT
+              value: {{ .Values.config.filenameFormat | quote }}
+            - name: PAPERLESS_FILENAME_FORMAT_REMOVE_NONE
+              value: {{ .Values.config.filenameFormatRemoveNone | quote }}
+            {{- end }}
+            {{- if ne (.Values.config.convertMemoryLimit | int) 0 }}
+            - name: PAPERLESS_CONVERT_MEMORY_LIMIT
+              value: {{ .Values.config.convertMemoryLimit | quote }}
+            {{- end }}
+            {{- if .Values.config.convertTmpDir }}
+            - name: PAPERLESS_CONVERT_TMPDIR
+              value: {{ .Values.config.convertTmpDir | quote }}
+            {{- end }}
+            {{- if ne (.Values.config.maxImagePixels | int) 0 }}
+            - name: PAPERLESS_MAX_IMAGE_PIXELS
+              value: {{ .Values.config.maxImagePixels | quote }}
+            {{- end }}
+
+            # Custom environment variables
+            {{- range .Values.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.extraEnvFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: data
+              mountPath: /usr/src/paperless/data
+            - name: media
+              mountPath: /usr/src/paperless/media
+            - name: export
+              mountPath: /usr/src/paperless/export
+            - name: consume
+              mountPath: /usr/src/paperless/consume
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        {{- if .Values.persistence.data.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "paperless-ngx.fullname" . }}-data
+        {{- else }}
+        - name: data
+          emptyDir: {}
+        {{- end }}
+        {{- if .Values.persistence.media.enabled }}
+        - name: media
+          persistentVolumeClaim:
+            claimName: {{ include "paperless-ngx.fullname" . }}-media
+        {{- else }}
+        - name: media
+          emptyDir: {}
+        {{- end }}
+        {{- if .Values.persistence.export.enabled }}
+        - name: export
+          persistentVolumeClaim:
+            claimName: {{ include "paperless-ngx.fullname" . }}-export
+        {{- else }}
+        - name: export
+          emptyDir: {}
+        {{- end }}
+        {{- if .Values.persistence.consume.enabled }}
+        - name: consume
+          persistentVolumeClaim:
+            claimName: {{ include "paperless-ngx.fullname" . }}-consume
+        {{- else }}
+        - name: consume
+          emptyDir: {}
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/paperless-ngx/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "paperless-ngx.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/paperless-ngx/templates/pvc.yaml

@@ -0,0 +1,90 @@
+{{- if .Values.persistence.data.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}-data
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+  {{- with .Values.persistence.data.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.data.accessMode | quote }}
+  {{- if .Values.persistence.data.storageClass }}
+  storageClassName: {{ .Values.persistence.data.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.data.size | quote }}
+---
+{{- end }}
+
+{{- if .Values.persistence.media.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}-media
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+  {{- with .Values.persistence.media.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.media.accessMode | quote }}
+  {{- if .Values.persistence.media.storageClass }}
+  storageClassName: {{ .Values.persistence.media.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.media.size | quote }}
+---
+{{- end }}
+
+{{- if .Values.persistence.export.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}-export
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+  {{- with .Values.persistence.export.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.export.accessMode | quote }}
+  {{- if .Values.persistence.export.storageClass }}
+  storageClassName: {{ .Values.persistence.export.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.export.size | quote }}
+---
+{{- end }}
+
+{{- if .Values.persistence.consume.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}-consume
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+  {{- with .Values.persistence.consume.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.consume.accessMode | quote }}
+  {{- if .Values.persistence.consume.storageClass }}
+  storageClassName: {{ .Values.persistence.consume.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.consume.size | quote }}
+{{- end }}

charts/paperless-ngx/templates/secret.yaml

@@ -0,0 +1,38 @@
+{{- $needsSecret := false -}}
+{{- if not .Values.config.secretKey.existingSecret -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+{{- if not .Values.postgresql.external.existingSecret -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+{{- if and .Values.config.admin.user (not .Values.config.admin.existingSecret) -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+{{- if and .Values.config.email.host .Values.config.email.user (not .Values.config.email.existingSecret) -}}
+  {{- $needsSecret = true -}}
+{{- end -}}
+
+{{- if $needsSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}-secrets
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- if not .Values.config.secretKey.existingSecret }}
+  {{ .Values.config.secretKey.secretKey | default "secret-key" }}: {{ .Values.config.secretKey.value | default "change-me-paperless-secret-key-at-least-32-characters-long" | b64enc }}
+  {{- end }}
+  {{- if not .Values.postgresql.external.existingSecret }}
+  {{ .Values.postgresql.external.passwordKey | default "postgresql-password" }}: {{ .Values.postgresql.external.password | default "paperless" | b64enc }}
+  {{- end }}
+  {{- if and .Values.config.admin.user (not .Values.config.admin.existingSecret) }}
+  {{ .Values.config.admin.userKey | default "admin-user" }}: {{ .Values.config.admin.user | b64enc }}
+  {{ .Values.config.admin.passwordKey | default "admin-password" }}: {{ .Values.config.admin.password | default "changeme" | b64enc }}
+  {{- end }}
+  {{- if and .Values.config.email.host .Values.config.email.user (not .Values.config.email.existingSecret) }}
+  {{ .Values.config.email.userKey | default "email-user" }}: {{ .Values.config.email.user | b64enc }}
+  {{ .Values.config.email.passwordKey | default "email-password" }}: {{ .Values.config.email.password | default "" | b64enc }}
+  {{- end }}
+{{- end }}

charts/paperless-ngx/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "paperless-ngx.fullname" . }}
+  labels:
+    {{- include "paperless-ngx.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "paperless-ngx.selectorLabels" . | nindent 4 }}

charts/paperless-ngx/values.yaml

@@ -0,0 +1,289 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Image settings
+image:
+  repository: ghcr.io/paperless-ngx/paperless-ngx
+  tag: "2.18.4"
+  pullPolicy: IfNotPresent
+
+## Deployment settings
+replicaCount: 1
+revisionHistoryLimit: 3
+
+# Pod security settings
+# Note: Paperless-ngx uses s6-overlay which requires root access during initialization
+# The container will drop privileges after setup
+podSecurityContext:
+  runAsNonRoot: false
+  runAsUser: 0
+  fsGroup: 1000
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+    add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+
+## Pod scheduling
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+## Service settings
+service:
+  type: ClusterIP
+  port: 8000
+
+## Ingress settings
+ingress:
+  enabled: false
+  className: ""
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: paperless.domain.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - paperless.domain.com
+      # Optional: specify the name of an existing TLS secret
+      # secretName: "existing-tls-secret"
+
+## Persistence settings
+persistence:
+  # Paperless data directory (search index, classification model, etc.)
+  data:
+    enabled: true
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 1Gi
+    annotations: {}
+  # Paperless media directory (documents and thumbnails)
+  media:
+    enabled: true
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 10Gi
+    annotations: {}
+  # Export directory (for exporting documents)
+  export:
+    enabled: true
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 1Gi
+    annotations: {}
+  # Consume directory (for importing documents)
+  consume:
+    enabled: true
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 5Gi
+    annotations: {}
+
+# Extra volume mounts
+extraVolumeMounts: []
+
+# Extra volumes
+extraVolumes: []
+
+## Resource limits and requests
+# resources:
+#   limits:
+#     cpu: 1000m
+#     memory: 1Gi
+#   requests:
+#     cpu: 200m
+#     memory: 512Mi
+
+## Application health checks
+probes:
+  liveness:
+    enabled: true
+    initialDelaySeconds: 60
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 6
+    successThreshold: 1
+    path: /
+  readiness:
+    enabled: true
+    initialDelaySeconds: 30
+    periodSeconds: 5
+    timeoutSeconds: 3
+    failureThreshold: 3
+    successThreshold: 1
+    path: /
+
+## Autoscaling configuration
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 3
+  targetCPUUtilizationPercentage: 80
+  targetMemoryUtilizationPercentage: 80
+
+## External Dependencies Configuration
+## These should point to external PostgreSQL and Redis services
+
+# External PostgreSQL database configuration
+postgresql:
+  # External PostgreSQL connection details
+  external:
+    enabled: true
+    host: "postgresql.default.svc.cluster.local"
+    port: 5432
+    database: "paperless"
+    username: "paperless"
+    # Use existingSecret for credentials
+    existingSecret: ""
+    passwordKey: "postgresql-password"
+    # Or set password directly (not recommended for production)
+    password: ""
+
+# External Redis configuration
+redis:
+  external:
+    enabled: true
+    host: "redis.default.svc.cluster.local"
+    port: 6379
+    database: 0
+    # Use existingSecret for credentials if Redis has auth
+    existingSecret: ""
+    passwordKey: "redis-password"
+    # Or set password directly (leave empty if no auth)
+    password: ""
+
+## Paperless-ngx Configuration
+config:
+  # Basic server configuration
+  url: ""  # Set to your external URL, e.g., https://paperless.domain.com
+  allowedHosts: "*"  # Comma-separated list of allowed hosts
+  csrfTrustedOrigins: ""  # Comma-separated list of trusted origins
+  corsAllowedHosts: "http://localhost:8000"
+  forceScriptName: ""  # For hosting under subpath, e.g., /paperless
+
+  # Security settings
+  secretKey:
+    # Use existingSecret for production
+    existingSecret: ""
+    secretKey: "secret-key"
+    # Or set directly (not recommended for production)
+    value: ""
+
+  # OCR Configuration
+  ocr:
+    language: "eng"  # OCR language (3-letter code)
+    mode: "skip"  # skip, redo, or force
+    skipArchiveFile: "never"  # never, with_text, always
+    clean: "clean"  # clean, clean-final, none
+    deskew: true
+    rotatePages: true
+    rotatePagesThreshold: 12
+    outputType: "pdfa"
+    pages: 0  # 0 = all pages
+    imageDpi: 0  # 0 = auto
+    maxImagePixels: 0  # 0 = use Pillow default
+    userArgs: "{}"  # JSON string of additional OCRmyPDF arguments
+
+  # Time and locale settings
+  timeZone: "UTC"
+
+  # Consumer settings
+  consumer:
+    recursive: false
+    subdirsAsTags: false
+    deleteDocumentDuplicates: false
+    ignorePatterns: '[".DS_Store", ".DS_STORE", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini", "@eaDir/*", "Thumbs.db"]'
+    barcodeScanner: "PYZBAR"
+
+    # Barcode processing
+    barcodes:
+      enabled: false
+      tiffSupport: false
+      string: "PATCHT"
+      retainSplitPages: false
+      upscale: 0.0
+      dpi: 300
+      maxPages: 0
+
+      # ASN barcode settings
+      asnEnabled: false
+      asnPrefix: "ASN"
+
+      # Tag barcode settings
+      tagEnabled: false
+      tagMapping: '{"TAG:(.*)": "\\g<1>"}'
+
+  # Optional Tika settings (for Office documents)
+  tika:
+    enabled: false
+    endpoint: "http://tika:9998"
+    gotenbergEndpoint: "http://gotenberg:3000"
+
+  # Admin user creation (optional)
+  admin:
+    user: ""  # Set to create admin user on startup
+    password: ""  # Required if admin.user is set
+    email: "root@localhost"
+
+    # Use existingSecret for credentials
+    existingSecret: ""
+    userKey: "admin-user"
+    passwordKey: "admin-password"
+
+  # Email configuration (optional)
+  email:
+    host: ""
+    port: 25
+    user: ""
+    password: ""
+    from: ""
+    useTls: false
+    useSsl: false
+
+    # Use existingSecret for credentials
+    existingSecret: ""
+    userKey: "email-user"
+    passwordKey: "email-password"
+
+  # Logging
+  logging:
+    dir: ""  # Uses PAPERLESS_DATA_DIR/log/ if empty
+
+  # Task processing
+  taskWorkers: 1
+  threadsPerWorker: 1
+  workerTimeout: 1800
+
+  # Advanced settings
+  filenameFormat: ""
+  filenameFormatRemoveNone: false
+  enableNltk: true
+  convertMemoryLimit: 0
+  convertTmpDir: ""
+  maxImagePixels: 0
+
+# Environment variables
+env: []
+  # Example additional env vars:
+  # - name: PAPERLESS_ENABLE_HTTP_REMOTE_USER
+  #   value: "false"
+
+# Extra environment variables from secrets
+extraEnvFrom: []
+  # - secretRef:
+  #     name: paperless-extra-secrets
+
+# Extra environment variables (for advanced use cases)
+extraEnv: []

charts/qbittorrent-vpn/Chart.yaml

@@ -0,0 +1,18 @@
+apiVersion: v2
+name: qbittorrent-vpn
+description: qBittorrent with Gluetun VPN sidecar for Kubernetes
+type: application
+version: 0.0.1
+appVersion: 5.1.0
+maintainers:
+  - name: Richard Tomik
+    email: richard.tomik@proton.me
+keywords:
+  - qbittorrent
+  - vpn
+  - gluetun
+  - torrent
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/linuxserver/docker-qbittorrent
+  - https://github.com/qdm12/gluetun

charts/qbittorrent-vpn/NOTES.txt

@@ -0,0 +1,38 @@
+Thank you for installing {{ .Chart.Name }}.
+
+Your qBittorrent with VPN has been deployed successfully!
+
+1. Get the application URL:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "qbittorrent-vpn.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "qbittorrent-vpn.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "qbittorrent-vpn.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "qbittorrent-vpn.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
+  Visit http://127.0.0.1:{{ .Values.service.port }} to access qBittorrent
+{{- end }}
+
+2. VPN Status:
+   To check the VPN connection status:
+   kubectl exec -it -n {{ .Release.Namespace }} deployment/{{ include "qbittorrent-vpn.fullname" . }} -c gluetun -- curl -s http://localhost:8000/v1/vpn/status
+
+3. Public IP:
+   To check your current public IP through the VPN:
+   kubectl exec -it -n {{ .Release.Namespace }} deployment/{{ include "qbittorrent-vpn.fullname" . }} -c gluetun -- curl -s http://localhost:8000/v1/publicip/ip
+
+4. Verify qBittorrent:
+   Make sure qBittorrent is functioning by accessing the Web UI at the URL in step 1.
+
+For more information about this chart: 
+https://github.com/rtomik/helm-charts/tree/main/charts/qbittorrent-vpn

charts/qbittorrent-vpn/readme.md

@@ -0,0 +1,273 @@
+# qBittorrent with Gluetun VPN
+
+A Helm chart for deploying qBittorrent with a Gluetun VPN sidecar container on Kubernetes.
+
+## Introduction
+
+This chart deploys [qBittorrent](https://www.qbittorrent.org/) alongside [Gluetun](https://github.com/qdm12/gluetun), a VPN client/tunnel in a container, to ensure all BitTorrent traffic is routed through the VPN. The chart supports all major VPN providers and protocols through Gluetun's comprehensive compatibility.
+
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/qbittorrent-vpn
+
+Note: Currently only tested with NordVPN an OpenVPN configuration.
+
+## Features
+
+- **Multiple VPN Providers**: Support for 30+ VPN providers including NordVPN, ProtonVPN, Private Internet Access, ExpressVPN, Surfshark, Mullvad, and more
+- **Protocol Support**: Use OpenVPN or WireGuard based on your provider's capabilities
+- **Server Selection**: Choose servers by country, city, or specific hostnames with optional randomization
+- **Security**: Proper container security settings to ensure traffic only flows through the VPN
+- **Health Monitoring**: Integrated health checks for both qBittorrent and the VPN connection
+- **Persistence**: Separate volume storage for configuration and downloads
+- **Web UI**: Access qBittorrent via web interface with optional ingress support
+- **Proxy Services**: HTTP and Shadowsocks proxies for additional devices to use the VPN tunnel
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.2.0+
+- PV provisioner support in the cluster
+- A valid subscription to a VPN service
+
+## Installation
+
+### Add the Repository
+
+```bash
+helm repo add rtomik-charts https://rtomik.github.io/helm-charts
+helm repo update
+```
+
+### Create a Secret for VPN Credentials
+
+For better security, store your VPN credentials in a Kubernetes secret:
+
+```bash
+# For OpenVPN authentication
+kubectl create secret generic vpn-credentials \
+  --namespace default \
+  --from-literal=username='your-vpn-username' \
+  --from-literal=password='your-vpn-password'
+
+# For WireGuard authentication (if using WireGuard)
+kubectl create secret generic wireguard-keys \
+  --namespace default \
+  --from-literal=private_key='your-wireguard-private-key'
+```
+
+Then reference this secret in your values:
+
+```yaml
+gluetun:
+  credentials:
+    create: false
+    existingSecret: "vpn-credentials"
+    usernameKey: "username"
+    passwordKey: "password"
+```
+
+### Install the Chart
+
+```bash
+# Option 1: Installation with custom values file (recommended)
+helm install qbittorrent-vpn rtomik-charts/qbittorrent-vpn -f values.yaml -n media
+
+# Option 2: Installation with inline parameter overrides
+helm install qbittorrent-vpn rtomik-charts/qbittorrent-vpn -n media \
+  --set gluetun.vpn.provider=nordvpn \
+  --set gluetun.vpn.serverCountries=Germany \
+  --set-string gluetun.credentials.existingSecret=vpn-credentials
+```
+
+## Uninstallation
+
+```bash
+helm uninstall qbittorrent-vpn -n media
+```
+
+Note: This will not delete Persistent Volume Claims. To delete them:
+
+```bash
+kubectl delete pvc -l app.kubernetes.io/instance=qbittorrent-vpn
+```
+
+## Configuration
+
+### Key Parameters
+
+| Parameter                             | Description                                           | Default                    |
+|---------------------------------------|-------------------------------------------------------|----------------------------|
+| `qbittorrent.image.repository`        | qBittorrent image repository                          | `linuxserver/qbittorrent`  |
+| `qbittorrent.image.tag`               | qBittorrent image tag                                 | `latest`                   |
+| `gluetun.image.repository`            | Gluetun image repository                              | `qmcgaw/gluetun`           |
+| `gluetun.image.tag`                   | Gluetun image tag                                     | `v3.40.0`                  |
+| `gluetun.vpn.provider`                | VPN provider name                                     | `nordvpn`                  |
+| `gluetun.vpn.type`                    | VPN protocol (`openvpn` or `wireguard`)              | `openvpn`                  |
+| `gluetun.vpn.serverCountries`         | Countries to connect to (comma-separated)            | `Germany`                  |
+| `persistence.config.size`             | Size of PVC for qBittorrent config                    | `2Gi`                      |
+| `persistence.downloads.size`          | Size of PVC for downloads                             | `100Gi`                    |
+| `ingress.enabled`                     | Enable ingress controller resource                     | `true`                     |
+| `ingress.hosts[0].host`               | Hostname for the ingress                              | `qbittorrent.domain.com`   |
+
+For a complete list of parameters, see the [values.yaml](values.yaml) file.
+
+### Example: Using with NordVPN
+
+```yaml
+gluetun:
+  vpn:
+    provider: "nordvpn"
+    type: "openvpn"
+    serverCountries: "United States"
+    openvpn:
+      NORDVPN_CATEGORY: "P2P"  # For torrent-optimized servers
+  credentials:
+    create: true
+    username: "your-nordvpn-username"
+    password: "your-nordvpn-password"
+```
+
+### Example: Using with ProtonVPN
+
+```yaml
+gluetun:
+  vpn:
+    provider: "protonvpn"
+    type: "openvpn"
+    serverCountries: "Switzerland"
+    openvpn:
+      PROTONVPN_TIER: "2"  # 0 is free, 2 is paid (Plus/Visionary)
+      SERVER_FEATURES: "p2p"  # For torrent support
+  credentials:
+    create: true
+    username: "protonvpn-username"
+    password: "protonvpn-password"
+```
+
+### Example: Using with Private Internet Access
+
+```yaml
+gluetun:
+  vpn:
+    provider: "private internet access"
+    type: "openvpn"
+    serverCountries: "US"
+  credentials:
+    create: true
+    username: "pia-username"
+    password: "pia-password"
+  settings:
+    VPN_PORT_FORWARDING: "on"  # PIA supports port forwarding
+```
+
+## VPN Provider Support
+
+This chart supports all VPN providers compatible with Gluetun, including:
+
+- AirVPN
+- Cyberghost
+- ExpressVPN
+- FastestVPN
+- HideMyAss
+- IPVanish
+- IVPN
+- Mullvad
+- NordVPN
+- Perfect Privacy
+- Private Internet Access (PIA)
+- PrivateVPN
+- ProtonVPN
+- PureVPN
+- Surfshark
+- TorGuard
+- VyprVPN
+- WeVPN
+- Windscribe
+
+For the complete list and provider-specific options, see the [Gluetun Providers Documentation](https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers).
+
+## Additional Features
+
+### Accessing the HTTP Proxy
+
+Gluetun provides an HTTP proxy on port 8888 that can be used by other applications to route traffic through the VPN. To expose this proxy:
+
+```yaml
+service:
+  proxies:
+    enabled: true
+    httpPort: 8888
+    socksPort: 8388
+```
+
+### Firewall Settings
+
+By default, the chart enables the Gluetun firewall to prevent leaks if the VPN connection drops. You can customize this:
+
+```yaml
+gluetun:
+  settings:
+    FIREWALL: "on"
+    FIREWALL_OUTBOUND_SUBNETS: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+```
+
+### Port Forwarding
+
+For VPN providers that support port forwarding (like PIA):
+
+```yaml
+gluetun:
+  settings:
+    VPN_PORT_FORWARDING: "on"
+    STATUS_FILE: "/tmp/gluetun-status.json"
+```
+
+## Troubleshooting
+
+### VPN Connection Issues
+
+If the VPN isn't connecting properly:
+
+1. Check the Gluetun logs:
+   ```bash
+   kubectl logs deployment/qbittorrent-vpn -c gluetun
+   ```
+
+2. Verify your credentials are correct:
+   ```bash
+   kubectl describe secret vpn-credentials
+   ```
+
+3. Try setting the log level to debug for more detailed information:
+   ```yaml
+   gluetun:
+     extraEnv:
+       - name: LOG_LEVEL
+         value: "debug"
+   ```
+
+### qBittorrent Can't Create Directories
+
+If you see errors like "Could not create required directory":
+
+1. Make sure the init container is enabled and properly configured
+2. Ensure proper `fsGroup` is set in the `podSecurityContext`
+3. Check that the persistence volume allows the correct permissions
+
+### Firewall/Security Issues
+
+If you encounter iptables or network issues:
+
+1. Ensure the Gluetun container has `privileged: true`
+2. Verify the `NET_ADMIN` capability is added
+3. Check that the `/dev/net/tun` device is correctly mounted
+
+## License
+
+This chart is licensed under the MIT License.
+
+## Acknowledgements
+
+- [Gluetun](https://github.com/qdm12/gluetun) by [qdm12](https://github.com/qdm12)
+- [LinuxServer.io](https://linuxserver.io/) for the qBittorrent container
+- The qBittorrent team for the excellent torrent client

charts/qbittorrent-vpn/templates/_helpers.tpl

@@ -0,0 +1,45 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "qbittorrent-vpn.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "qbittorrent-vpn.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "qbittorrent-vpn.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "qbittorrent-vpn.labels" -}}
+helm.sh/chart: {{ include "qbittorrent-vpn.chart" . }}
+{{ include "qbittorrent-vpn.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "qbittorrent-vpn.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "qbittorrent-vpn.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

charts/qbittorrent-vpn/templates/deployment.yaml

@@ -0,0 +1,306 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "qbittorrent-vpn.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: Recreate  # Using Recreate instead of RollingUpdate for stateful pods
+  template:
+    metadata:
+      labels:
+        {{- include "qbittorrent-vpn.selectorLabels" . | nindent 8 }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      # Add hostNetwork if specified
+      {{- if .Values.hostNetwork }}
+      hostNetwork: {{ .Values.hostNetwork }}
+      {{- end }}
+      
+      # Init containers if needed for directory setup
+      {{- if .Values.initContainers }}
+      initContainers:
+      {{- toYaml .Values.initContainers | nindent 8 }}
+      {{- end }}
+      
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      
+      containers:
+        {{- if .Values.gluetun.enabled }}
+        # Gluetun VPN container
+        - name: gluetun
+          image: "{{ .Values.gluetun.image.repository }}:{{ .Values.gluetun.image.tag }}"
+          imagePullPolicy: {{ .Values.gluetun.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.gluetun.securityContext | nindent 12 }}
+          env:
+            # VPN Provider selection - Common settings for all VPN types
+            - name: VPN_SERVICE_PROVIDER
+              value: {{ .Values.gluetun.vpn.provider | quote }}
+            - name: VPN_TYPE
+              value: {{ .Values.gluetun.vpn.type | quote }}
+            - name: SERVER_COUNTRIES
+              value: {{ .Values.gluetun.vpn.serverCountries | quote }}
+            {{- if .Values.gluetun.vpn.serverNames }}
+            - name: SERVER_HOSTNAMES
+              value: {{ .Values.gluetun.vpn.serverNames | quote }}
+            {{- end }}
+            {{- if .Values.gluetun.vpn.serverCities }}
+            - name: SERVER_CITIES
+              value: {{ .Values.gluetun.vpn.serverCities | quote }}
+            {{- end }}
+            {{- if .Values.gluetun.vpn.randomize }}
+            - name: SERVER_HOSTNAMES_RANDOMIZED
+              value: {{ .Values.gluetun.vpn.randomize | quote }}
+            {{- end }}
+            
+            # OpenVPN specific configuration
+            {{- if eq .Values.gluetun.vpn.type "openvpn" }}
+            {{- if .Values.gluetun.credentials.create }}
+            - name: OPENVPN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
+                  key: {{ .Values.gluetun.credentials.usernameKey }}
+            - name: OPENVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
+                  key: {{ .Values.gluetun.credentials.passwordKey }}
+            {{- else if .Values.gluetun.credentials.existingSecret }}
+            - name: OPENVPN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.gluetun.credentials.existingSecret }}
+                  key: {{ .Values.gluetun.credentials.usernameKey }}
+            - name: OPENVPN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.gluetun.credentials.existingSecret }}
+                  key: {{ .Values.gluetun.credentials.passwordKey }}
+            {{- end }}
+            
+            # Additional OpenVPN settings
+            {{- with .Values.gluetun.vpn.openvpn }}
+            {{- range $key, $value := . }}
+            - name: {{ $key | upper }}
+              value: {{ $value | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            
+            # WireGuard specific configuration
+            {{- if eq .Values.gluetun.vpn.type "wireguard" }}
+            {{- if and .Values.gluetun.vpn.wireguard.privateKey .Values.gluetun.credentials.create }}
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
+                  key: wireguard_private_key
+            {{- else if and .Values.gluetun.vpn.wireguard.privateKeyExistingSecret .Values.gluetun.vpn.wireguard.privateKeyExistingSecretKey }}
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.gluetun.vpn.wireguard.privateKeyExistingSecret }}
+                  key: {{ .Values.gluetun.vpn.wireguard.privateKeyExistingSecretKey }}
+            {{- end }}
+            
+            # Additional WireGuard settings
+            {{- with .Values.gluetun.vpn.wireguard }}
+            {{- if .addresses }}
+            - name: WIREGUARD_ADDRESSES
+              value: {{ .addresses | quote }}
+            {{- end }}
+            {{- if .endpointIP }}
+            - name: WIREGUARD_ENDPOINT_IP
+              value: {{ .endpointIP | quote }}
+            {{- end }}
+            {{- if .endpointPort }}
+            - name: WIREGUARD_ENDPOINT_PORT
+              value: {{ .endpointPort | quote }}
+            {{- end }}
+            {{- if .publicKey }}
+            - name: WIREGUARD_PUBLIC_KEY
+              value: {{ .publicKey | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            
+            # Gluetun general settings
+            {{- with .Values.gluetun.settings }}
+            {{- range $key, $value := . }}
+            - name: {{ $key | upper }}
+              value: {{ $value | quote }}
+            {{- end }}
+            {{- end }}
+            
+            # Extra environment variables
+            {{- with .Values.gluetun.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          
+          ports:
+            - name: control
+              containerPort: 8000
+              protocol: TCP
+            - name: http-proxy
+              containerPort: 8888
+              protocol: TCP
+            - name: shadowsocks-tcp
+              containerPort: 8388
+              protocol: TCP
+            - name: shadowsocks-udp
+              containerPort: 8388
+              protocol: UDP
+            {{- with .Values.gluetun.extraPorts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          
+          volumeMounts:
+            # Mount tun device for VPN
+            - name: tun
+              mountPath: /dev/net/tun
+            {{- if .Values.gluetun.persistence.enabled }}
+            - name: gluetun-config
+              mountPath: /gluetun
+            {{- end }}
+            {{- with .Values.gluetun.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          
+          resources:
+            {{- toYaml .Values.gluetun.resources | nindent 12 }}
+          
+        {{- end }}
+          
+        # qBittorrent container
+        - name: qbittorrent
+          image: "{{ .Values.qbittorrent.image.repository }}:{{ .Values.qbittorrent.image.tag }}"
+          imagePullPolicy: {{ .Values.qbittorrent.image.pullPolicy }}
+          {{- if .Values.qbittorrent.securityContext }}
+          securityContext:
+            {{- toYaml .Values.qbittorrent.securityContext | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.qbittorrent.service.port }}
+              protocol: TCP
+            {{- if .Values.qbittorrent.bittorrentPort }}
+            - name: bittorrent-tcp
+              containerPort: {{ .Values.qbittorrent.bittorrentPort }}
+              protocol: TCP
+            - name: bittorrent-udp
+              containerPort: {{ .Values.qbittorrent.bittorrentPort }}
+              protocol: UDP
+            {{- end }}
+          
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          
+          env:
+          {{- range .Values.qbittorrent.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+          {{- end }}
+          {{- with .Values.qbittorrent.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          
+          volumeMounts:
+            {{- if .Values.qbittorrent.persistence.config.enabled }}
+            - name: config
+              mountPath: {{ .Values.qbittorrent.persistence.config.mountPath }}
+            {{- end }}
+            
+            {{- if .Values.qbittorrent.persistence.downloads.enabled }}
+            - name: downloads
+              mountPath: {{ .Values.qbittorrent.persistence.downloads.mountPath }}
+            {{- end }}
+            
+            {{- with .Values.qbittorrent.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          
+          resources:
+            {{- toYaml .Values.qbittorrent.resources | nindent 12 }}
+      
+      volumes:
+        # Create /dev/net/tun as a device
+        - name: tun
+          hostPath:
+            path: /dev/net/tun
+            type: CharDevice
+        
+        {{- if .Values.qbittorrent.persistence.config.enabled }}
+        - name: config
+          persistentVolumeClaim:
+            claimName: {{ if .Values.qbittorrent.persistence.config.existingClaim }}{{ .Values.qbittorrent.persistence.config.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-config{{ end }}
+        {{- end }}
+        
+        {{- if .Values.qbittorrent.persistence.downloads.enabled }}
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: {{ if .Values.qbittorrent.persistence.downloads.existingClaim }}{{ .Values.qbittorrent.persistence.downloads.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-downloads{{ end }}
+        {{- end }}
+        
+        {{- if and .Values.gluetun.enabled .Values.gluetun.persistence.enabled }}
+        {{- if .Values.gluetun.persistence.useEmptyDir }}
+        - name: gluetun-config
+          emptyDir: {}
+        {{- else }}
+        - name: gluetun-config
+          persistentVolumeClaim:
+            claimName: {{ if .Values.gluetun.persistence.existingClaim }}{{ .Values.gluetun.persistence.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-gluetun{{ end }}
+        {{- end }}
+        {{- end }}
+        
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/qbittorrent-vpn/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "qbittorrent-vpn.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/qbittorrent-vpn/templates/pvc.yaml

@@ -0,0 +1,55 @@
+{{- if and .Values.qbittorrent.persistence.config.enabled (not .Values.qbittorrent.persistence.config.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}-config
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.qbittorrent.persistence.config.accessMode | quote }}
+  {{- if .Values.qbittorrent.persistence.config.storageClass }}
+  storageClassName: {{ .Values.qbittorrent.persistence.config.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.qbittorrent.persistence.config.size | quote }}
+{{- end }}
+
+{{- if and .Values.qbittorrent.persistence.downloads.enabled (not .Values.qbittorrent.persistence.downloads.existingClaim) }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}-downloads
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.qbittorrent.persistence.downloads.accessMode | quote }}
+  {{- if .Values.qbittorrent.persistence.downloads.storageClass }}
+  storageClassName: {{ .Values.qbittorrent.persistence.downloads.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.qbittorrent.persistence.downloads.size | quote }}
+{{- end }}
+
+{{- if and .Values.gluetun.enabled .Values.gluetun.persistence.enabled (not .Values.gluetun.persistence.useEmptyDir) (not .Values.gluetun.persistence.existingClaim) }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}-gluetun
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.gluetun.persistence.accessMode | quote }}
+  {{- if .Values.gluetun.persistence.storageClass }}
+  storageClassName: {{ .Values.gluetun.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.gluetun.persistence.size | quote }}
+{{- end }}

charts/qbittorrent-vpn/templates/secret.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.gluetun.enabled .Values.gluetun.credentials.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- if eq .Values.gluetun.vpn.type "openvpn" }}
+  {{ .Values.gluetun.credentials.usernameKey }}: {{ .Values.gluetun.credentials.username | b64enc | quote }}
+  {{ .Values.gluetun.credentials.passwordKey }}: {{ .Values.gluetun.credentials.password | b64enc | quote }}
+  {{- end }}
+  
+  {{- if and (eq .Values.gluetun.vpn.type "wireguard") .Values.gluetun.vpn.wireguard.privateKey }}
+  wireguard_private_key: {{ .Values.gluetun.vpn.wireguard.privateKey | b64enc | quote }}
+  {{- end }}
+{{- end }}

charts/qbittorrent-vpn/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "qbittorrent-vpn.fullname" . }}
+  labels:
+    {{- include "qbittorrent-vpn.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "qbittorrent-vpn.selectorLabels" . | nindent 4 }}

charts/qbittorrent-vpn/values.yaml

@@ -0,0 +1,228 @@
+## Global settings
+nameOverride: ""
+fullnameOverride: ""
+
+## Deployment settings
+replicaCount: 1
+revisionHistoryLimit: 3
+
+## Pod security settings
+podSecurityContext:
+  runAsNonRoot: false
+  runAsUser: 0    # Run all containers as root
+  fsGroup: 0      # Use root group for volumes
+
+## qBittorrent Image settings
+qbittorrent:
+  image:
+    repository: linuxserver/qbittorrent
+    tag: 5.1.0
+    pullPolicy: IfNotPresent
+  
+  securityContext: {}
+
+  # Open port for BitTorrent traffic
+  bittorrentPort: 6881
+
+  env:
+    - name: PUID
+      value: "0"   # Run as root
+    - name: PGID
+      value: "0"   # Root group
+    - name: TZ
+      value: "UTC"
+    - name: WEBUI_PORT
+      value: "8080"
+  
+  
+  extraEnv: []
+  
+  service:
+    port: 8080
+  
+  #resources:
+  #  limits:
+  #    cpu: 1000m
+  #    memory: 2Gi
+  #  requests:
+  #    cpu: 200m
+  #    memory: 512Mi
+
+  persistence:
+    config:
+      enabled: true
+      existingClaim: ""
+      storageClass: ""
+      accessMode: ReadWriteOnce
+      size: 2Gi
+      mountPath: /config
+    
+    downloads:
+      enabled: true
+      existingClaim: ""
+      storageClass: ""
+      accessMode: ReadWriteOnce
+      size: 2Gi
+      mountPath: /downloads
+
+  # Volume mounts specific to qBittorrent
+  extraVolumeMounts: []
+  
+  # Volumes specific to qBittorrent
+  extraVolumes: []
+
+# Probes for qBittorrent
+probes:
+  liveness:
+    enabled: true
+    path: /
+    initialDelaySeconds: 0  # Startup probe handles delayed start
+    periodSeconds: 30
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+  
+  readiness:
+    enabled: true
+    path: /
+    initialDelaySeconds: 0  # Startup probe handles delayed start
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+
+## Gluetun VPN settings
+gluetun:
+  enabled: true
+  image:
+    repository: qmcgaw/gluetun
+    tag: v3.40.0  # Latest version as of this writing
+    pullPolicy: IfNotPresent
+  
+  securityContext:
+    privileged: true
+    capabilities:
+      add:
+        - NET_ADMIN
+  
+  # VPN provider configuration
+  vpn:
+    # Choose from: nordvpn, protonvpn, expressvpn, surfshark, mullvad, ivpn, private internet access, etc.
+    provider: "nordvpn"
+    
+    # Choose from: openvpn or wireguard
+    type: "openvpn"
+    
+    # Server selection (comma-separated lists)
+    serverCountries: "Netherlands"  # e.g., "Netherlands,Germany,Sweden"
+    serverCities: ""            # e.g., "Amsterdam,Frankfurt" (optional)
+    serverNames: ""             # e.g., "nl1,nl2" (optional)
+    randomize: "true"           # Randomize server selection
+    
+    # OpenVPN specific settings (when type is "openvpn")
+    openvpn:
+      # Add any OpenVPN specific settings here, they'll be converted to env vars
+      OPENVPN_PROTOCOL: "udp"
+    
+    # WireGuard specific settings (when type is "wireguard")
+    wireguard:
+      privateKey: ""  # Will be stored in Secret if provided
+      privateKeyExistingSecret: ""
+      privateKeyExistingSecretKey: ""
+      addresses: ""   # e.g., "10.64.222.21/32"
+      endpointIP: ""  # Optional: specify endpoint IP
+      endpointPort: ""  # Optional: specify endpoint port
+      publicKey: ""   # Optional: server public key
+  
+  # VPN credentials (choose one method)
+  credentials:
+    create: true # set to false if using existing secret
+    # For OpenVPN (normal credentials)
+    username: ""
+    password: ""
+    # For WireGuard, the privateKey is specified in vpn.wireguard.privateKey
+    
+    # Alternatively, reference an existing secret
+    existingSecret: ""
+    usernameKey: "username"
+    passwordKey: "password"
+  
+  # General Gluetun settings as environment variables
+  settings:
+    FIREWALL: "on"
+    FIREWALL_OUTBOUND_SUBNETS: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+    DNS_ADDRESS: "1.1.1.1"
+    HEALTH_SERVER_PORT: "8000"
+    
+    # Important: Add these settings to make networking work correctly with ingress
+    SERVER_ALLOWLIST: "qbittorrent:8080"  # Allow accessing qBittorrent container
+    FIREWALL_INPUT_PORTS: "8080"          # Allow ingress traffic to port 8080
+    FIREWALL_DEBUG: "on"                  # Enable firewall debugging (temporarily)
+    JOURNALD: "off"                       # Disable journald (not needed for debugging)
+    
+    # Optional port forwarding
+    VPN_PORT_FORWARDING: "off"
+  
+  # Extra environment variables
+  extraEnv:
+    - name: LOG_LEVEL
+      value: "info"
+  
+  # Extra ports to expose
+  extraPorts: []
+  # - name: custom-port
+  #   containerPort: 9999
+  #   protocol: TCP
+  
+  # Resources for Gluetun
+  resources:
+    limits:
+      cpu: 300m
+      memory: 256Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  
+  # Persistence for Gluetun
+  persistence:
+    enabled: true
+    existingClaim: false
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 100Mi
+    
+  # Volume mounts specific to Gluetun
+  extraVolumeMounts: []
+  
+  # Volumes specific to Gluetun
+  extraVolumes: []
+
+## Service settings
+service:
+  type: ClusterIP
+  port: 8080
+
+## Ingress settings
+ingress:
+  enabled: false
+  className: ""
+  annotations: []
+  hosts:
+    - host: qbittorrent.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - qbittorrent.example.com
+
+# Additional specifications
+nodeSelector: {}
+tolerations: []
+affinity: {}
+podAnnotations: {}
+extraVolumes: []
+
+# Temporary options for development/debugging
+hostNetwork: false
+initContainers: []

charts/recipya/Chart.yaml

@@ -0,0 +1,15 @@
+apiVersion: v2
+name: recipya
+description: Recipya helm chart for Kubernetes
+type: application
+version: 0.0.2
+appVersion: "v1.2.2"
+maintainers:
+  - name: Richard Tomik
+    email: no@m.com
+keywords:
+  - recipe-manager
+  - recipya
+home: https://github.com/rtomik/helm-charts
+sources:
+  - https://github.com/reaper47/recipya

charts/recipya/readme.md

@@ -0,0 +1,199 @@
+# Recipya Helm Chart
+
+A Helm chart for deploying [Recipya](https://github.com/reaper47/recipya) on Kubernetes.
+
+[Source Code](https://github.com/rtomik/helm-charts/tree/main/charts%2Frecipya)
+
+## Introduction
+
+This chart deploys Recipya recipe manager on a Kubernetes cluster using the Helm package manager.
+
+Source code can be found here:
+- https://github.com/rtomik/helm-charts/tree/main/charts/recipya
+
+## Prerequisites
+
+- Kubernetes 1.19+
+- Helm 3.2.0+
+- PV provisioner support in the underlying infrastructure (if persistence is needed)
+
+## Installing the Chart
+
+To install the chart with the release name `recipya`:
+
+```bash
+helm repo add recipya-chart https://rtomik.github.io/helm-charts
+helm install recipya recipya-chart/recipya -n recipya
+```
+
+The command deploys Recipya on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
+
+## Uninstalling the Chart
+
+To uninstall/delete the `recipya` deployment:
+
+```bash
+helm uninstall recipya -n recipya
+```
+
+## Important Configuration Notes
+
+### Server URL
+
+When deploying with an ingress, it's **critical** to set `config.server.url` to match your ingress URL (including https if you're using TLS). This ensures that redirects after login work correctly:
+
+```yaml
+config:
+  server:
+    url: "https://your-recipya-domain.com"
+```
+
+### Ingress Configuration
+
+This chart includes optimized ingress configurations for Traefik, with support for WebSockets and proper security headers. If you're using a different ingress controller, you may need to adjust annotations accordingly.
+
+## Parameters
+
+### Global parameters
+
+| Name                     | Description                          | Value           |
+|--------------------------|--------------------------------------|-----------------|
+| `image.repository`       | Recipya image repository             | `reaper99/recipya` |
+| `image.tag`              | Recipya image tag                    | `v1.2.2`        |
+| `image.pullPolicy`       | Recipya image pull policy            | `IfNotPresent`  |
+| `replicaCount`           | Number of Recipya replicas           | `1`             |
+| `revisionHistoryLimit`   | Number of revisions to keep          | `3`             |
+
+### Security parameters
+
+| Name                                    | Description                                      | Value     |
+|-----------------------------------------|--------------------------------------------------|-----------|
+| `podSecurityContext.fsGroup`            | Group ID for the Recipya container               | `1000`    |
+| `containerSecurityContext`              | Security context for the container               | `{}`      |
+
+### Recipya configuration parameters
+
+| Name                                    | Description                                           | Value                 |
+|-----------------------------------------|-------------------------------------------------------|---------------------|
+| `config.server.port`                    | Server port                                           | `8078`              |
+| `config.server.autologin`               | Whether to login automatically                        | `false`             |
+| `config.server.is_demo`                 | Whether the app is a demo version                     | `false`             |
+| `config.server.is_prod`                 | Whether the app is in production                      | `false`             |
+| `config.server.no_signups`              | Whether to disable user account registrations         | `false`             |
+| `config.server.url`                     | Base URL for the application                          | `http://0.0.0.0`    |
+| `config.email.address`                  | The email address for SendGrid                        | `""`                |
+| `config.email.sendgrid`                 | SendGrid API key                                      | `""`                |
+| `config.documentIntelligence.endpoint`  | Azure Document Intelligence endpoint                  | `""`                |
+| `config.documentIntelligence.key`       | Azure Document Intelligence key                       | `""`                |
+
+### Service parameters
+
+| Name                     | Description                                      | Value       |
+|--------------------------|--------------------------------------------------|-------------|
+| `service.type`           | Recipya service type                             | `ClusterIP` |
+| `service.port`           | Recipya service port                             | `8078`      |
+
+### Ingress parameters
+
+| Name                          | Description                                      | Value                  |
+|-------------------------------|--------------------------------------------------|------------------------|
+| `ingress.enabled`             | Enable ingress controller resource               | `false`                |
+| `ingress.className`           | IngressClass that will be used                   | `"traefik"`            |
+| `ingress.annotations`         | Additional ingress annotations                   | See values.yaml        |
+| `ingress.hosts[0].host`       | Default host for the ingress resource            | `chart-example.local`  |
+| `ingress.tls`                 | TLS configuration                                | `[]`                   |
+
+### Persistence parameters
+
+| Name                                 | Description                              | Value            |
+|--------------------------------------|------------------------------------------|------------------|
+| `persistence.enabled`                | Enable persistence using PVC             | `true`           |
+| `persistence.accessMode`             | PVC Access Mode                          | `ReadWriteOnce`  |
+| `persistence.size`                   | PVC Storage Request                      | `1Gi`            |
+| `persistence.storageClass`           | Storage class of backing PVC             | `""`             |
+
+### Resource parameters
+
+| Name                          | Description                              | Value     |
+|-------------------------------|------------------------------------------|-----------|
+| `resources.limits.cpu`        | CPU limit                                | `500m`    |
+| `resources.limits.memory`     | Memory limit                             | `512Mi`   |
+| `resources.requests.cpu`      | CPU request                              | `100m`    |
+| `resources.requests.memory`   | Memory request                           | `128Mi`   |
+
+### Probe parameters
+
+| Name                                 | Description                                | Value     |
+|--------------------------------------|--------------------------------------------|-----------|
+| `probes.liveness.enabled`            | Enable liveness probe                      | `true`    |
+| `probes.liveness.path`               | Path for liveness probe                    | `/`       |
+| `probes.readiness.enabled`           | Enable readiness probe                     | `true`    |
+| `probes.readiness.path`              | Path for readiness probe                   | `/`       |
+
+## Traefik Ingress Configuration
+
+The chart includes specially configured middlewares for Traefik to ensure proper functioning of Recipya:
+
+```yaml
+ingress:
+  enabled: true
+  className: "traefik"
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: recipya-recipya-headers@kubernetescrd
+    traefik.ingress.kubernetes.io/service.sticky: "true"
+    traefik.ingress.kubernetes.io/session-cookie-name: "recipya_session"
+  hosts:
+    - host: recipya.example.com
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+      - recipya.example.com
+```
+
+This configuration includes:
+
+1. Custom Content Security Policy allowing essential scripts from unpkg.com
+2. Sticky sessions for maintaining authentication
+3. Proper headers for proxy operation
+
+## Content Security Policy Configuration
+
+The chart includes a custom middleware that configures the proper Content Security Policy for Recipya. This is particularly important as the application requires access to external scripts from unpkg.com:
+
+```yaml
+contentSecurityPolicy: >-
+  default-src 'self';
+  script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://unpkg.com;
+  style-src 'self' 'unsafe-inline';
+  img-src 'self' data: blob:;
+  font-src 'self' data:;
+  connect-src 'self' ws: wss: *;
+  worker-src 'self' blob:;
+  frame-src 'self';
+  media-src 'self' blob:;
+  object-src 'none';
+  form-action 'self';
+```
+
+## Using Existing Secrets
+
+If you want to use existing secrets for sensitive data:
+
+```yaml
+config:
+  email:
+    existingSecret: "my-email-secret"
+    addressKey: "email"
+    sendgridKey: "sendgrid"
+  documentIntelligence:
+    existingSecret: "my-di-secret"
+    endpointKey: "di_endpoint"
+    keyKey: "di_key"
+```
+
+## Configuration
+
+See the [Recipya documentation](https://recipes.musicavis.ca/docs/installation/docker/#environment-variables) for details on all available configuration options.

charts/recipya/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "recipya.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "recipya.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "recipya.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "recipya.labels" -}}
+helm.sh/chart: {{ include "recipya.chart" . }}
+{{ include "recipya.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "recipya.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "recipya.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "recipya.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "recipya.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/recipya/templates/configmap-init-script.yaml

@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "recipya.fullname" . }}-init-script
+  labels:
+    {{- include "recipya.labels" . | nindent 4 }}
+data:
+  init.sh: |
+    #!/bin/sh
+    set -e
+    
+    CONFIG_DIR="/home/recipya/.config/Recipya"
+    CONFIG_FILE="$CONFIG_DIR/config.json"
+    TARGET_PORT={{ .Values.config.server.port }}
+    
+    echo "Starting initialization with port $TARGET_PORT..."
+    
+    # Create directories if they don't exist
+    mkdir -p $CONFIG_DIR/Backup
+    mkdir -p $CONFIG_DIR/Database
+    mkdir -p $CONFIG_DIR/Images
+    mkdir -p $CONFIG_DIR/Logs
+    mkdir -p $CONFIG_DIR/Videos
+    
+    echo "Directories created."
+    
+    # Create config.json if it doesn't exist or update the existing one
+    if [ -f "$CONFIG_FILE" ]; then
+      echo "Found existing config.json, updating port to $TARGET_PORT"
+      # Use jq to modify the port in the existing config file
+      TMP_FILE=$(mktemp)
+      cat $CONFIG_FILE | jq ".server.port = $TARGET_PORT" > $TMP_FILE
+      mv $TMP_FILE $CONFIG_FILE
+    else
+      echo "Creating new config.json with port $TARGET_PORT"
+      # Create a new config.json with default values and the specified port
+      cat > $CONFIG_FILE << EOF
+    {
+      "email": {
+        "from": "{{ .Values.config.email.address | default "" }}",
+        "sendGridAPIKey": "{{ .Values.config.email.sendgrid | default "" }}"
+      },
+      "integrations": {
+        "azureDocumentIntelligence": {
+          "endpoint": "{{ .Values.config.documentIntelligence.endpoint | default "" }}",
+          "key": "{{ .Values.config.documentIntelligence.key | default "" }}"
+        }
+      },
+      "server": {
+        "autologin": {{ .Values.config.server.autologin }},
+        "bypassGuide": false,
+        "isDemo": {{ .Values.config.server.is_demo }},
+        "noSignups": {{ .Values.config.server.no_signups }},
+        "isProduction": {{ .Values.config.server.is_prod }},
+        "port": $TARGET_PORT,
+        "url": "{{ .Values.config.server.url }}"
+      }
+    }
+    EOF
+    fi
+
+    # Set permissions using numeric IDs
+    echo "Setting permissions..."
+    chmod -R 755 $CONFIG_DIR
+    find $CONFIG_DIR -type f -exec chmod 644 {} \;
+    find $CONFIG_DIR -type d -exec chmod 755 {} \;
+    
+    # Change ownership by numeric ID
+    echo "Changing ownership to 1000:1000..."
+    chown -R 1000:1000 $CONFIG_DIR
+    
+    echo "Configuration completed successfully."
+    ls -la $CONFIG_DIR

charts/recipya/templates/deployment.yaml

@@ -0,0 +1,226 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "recipya.fullname" . }}
+  labels:
+    {{- include "recipya.labels" . | nindent 4 }}
+  annotations:
+    checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+    checksum/init-script: {{ include (print $.Template.BasePath "/configmap-init-script.yaml") . | sha256sum }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  selector:
+    matchLabels:
+      {{- include "recipya.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        {{- include "recipya.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      # Set security context for the pod
+      securityContext:
+        fsGroup: 1000
+      
+      # Init container to configure the application
+      initContainers:
+        - name: init-config
+          image: alpine:3.18
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              echo "Installing jq..."
+              apk add --no-cache jq
+              echo "Running initialization script..."
+              /scripts/init.sh
+          securityContext:
+            runAsUser: 0  # Run as root to modify config files
+            runAsGroup: 0
+          volumeMounts:
+            - name: data
+              mountPath: /home/recipya/.config/Recipya
+            - name: init-script
+              mountPath: /scripts
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+      
+      # Main application container
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            readOnlyRootFilesystem: false
+            capabilities:
+              drop:
+              - ALL
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.startupArgs }}
+          args:
+            {{- range .Values.startupArgs }}
+            - {{ . | quote }}
+            {{- end }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
+          env:
+            # Critical environment variables for proper directory structure
+            - name: HOME
+              value: "/home/recipya"
+            - name: RECIPYA_SERVER_URL
+              value: {{ .Values.config.server.url | quote }}
+            - name: RECIPYA_SERVER_AUTOLOGIN
+              value: {{ .Values.config.server.autologin | quote }}
+            - name: RECIPYA_SERVER_IS_DEMO
+              value: {{ .Values.config.server.is_demo | quote }}
+            - name: RECIPYA_SERVER_IS_PROD
+              value: {{ .Values.config.server.is_prod | quote }}
+            - name: RECIPYA_SERVER_NO_SIGNUPS
+              value: {{ .Values.config.server.no_signups | quote }}
+            
+            {{- if .Values.config.email.existingSecret }}
+            - name: RECIPYA_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.email.existingSecret }}
+                  key: {{ .Values.config.email.addressKey }}
+            - name: RECIPYA_EMAIL_SENDGRID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.email.existingSecret }}
+                  key: {{ .Values.config.email.sendgridKey }}
+            {{- else }}
+            {{- if .Values.config.email.address }}
+            - name: RECIPYA_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "recipya.fullname" . }}-secrets
+                  key: {{ .Values.config.email.addressKey }}
+                  optional: true
+            {{- end }}
+            {{- if .Values.config.email.sendgrid }}
+            - name: RECIPYA_EMAIL_SENDGRID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "recipya.fullname" . }}-secrets
+                  key: {{ .Values.config.email.sendgridKey }}
+                  optional: true
+            {{- end }}
+            {{- end }}
+            
+            {{- if .Values.config.documentIntelligence.existingSecret }}
+            - name: RECIPYA_DI_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.documentIntelligence.existingSecret }}
+                  key: {{ .Values.config.documentIntelligence.endpointKey }}
+            - name: RECIPYA_DI_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.documentIntelligence.existingSecret }}
+                  key: {{ .Values.config.documentIntelligence.keyKey }}
+            {{- else }}
+            {{- if .Values.config.documentIntelligence.endpoint }}
+            - name: RECIPYA_DI_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "recipya.fullname" . }}-secrets
+                  key: {{ .Values.config.documentIntelligence.endpointKey }}
+                  optional: true
+            {{- end }}
+            {{- if .Values.config.documentIntelligence.key }}
+            - name: RECIPYA_DI_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "recipya.fullname" . }}-secrets
+                  key: {{ .Values.config.documentIntelligence.keyKey }}
+                  optional: true
+            {{- end }}
+            {{- end }}
+          
+          {{- range .Values.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+          {{- end }}
+          
+          {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          
+          volumeMounts:
+            - name: data
+              mountPath: /home/recipya/.config/Recipya
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "recipya.fullname" . }}-data
+        - name: init-script
+          configMap:
+            name: {{ include "recipya.fullname" . }}-init-script
+            defaultMode: 0755
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/recipya/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "recipya.fullname" . }}
+  labels:
+    {{- include "recipya.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "recipya.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/recipya/templates/pvc.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "recipya.fullname" . }}-data
+  labels:
+    {{- include "recipya.labels" . | nindent 4 }}
+  annotations:
+    {{- if .Values.persistence.retain }}
+    "helm.sh/resource-policy": keep
+    {{- end }}
+    {{- with .Values.persistence.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  {{- if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- end }}

charts/recipya/templates/secret.yaml

@@ -0,0 +1,28 @@
+{{- $createSecret := or (and (not .Values.config.email.existingSecret) (or .Values.config.email.address .Values.config.email.sendgrid)) (and (not .Values.config.documentIntelligence.existingSecret) (or .Values.config.documentIntelligence.endpoint .Values.config.documentIntelligence.key)) -}}
+{{- if $createSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "recipya.fullname" . }}-secrets
+  labels:
+    {{- include "recipya.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- if not .Values.config.email.existingSecret }}
+  {{- if .Values.config.email.address }}
+  {{ .Values.config.email.addressKey }}: {{ .Values.config.email.address | b64enc }}
+  {{- end }}
+  {{- if .Values.config.email.sendgrid }}
+  {{ .Values.config.email.sendgridKey }}: {{ .Values.config.email.sendgrid | b64enc }}
+  {{- end }}
+  {{- end }}
+  
+  {{- if not .Values.config.documentIntelligence.existingSecret }}
+  {{- if .Values.config.documentIntelligence.endpoint }}
+  {{ .Values.config.documentIntelligence.endpointKey }}: {{ .Values.config.documentIntelligence.endpoint | b64enc }}
+  {{- end }}
+  {{- if .Values.config.documentIntelligence.key }}
+  {{ .Values.config.documentIntelligence.keyKey }}: {{ .Values.config.documentIntelligence.key | b64enc }}
+  {{- end }}
+  {{- end }}
+{{- end }}

charts/recipya/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "recipya.fullname" . }}
+  labels:
+    {{- include "recipya.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "recipya.selectorLabels" . | nindent 4 }}

charts/recipya/values.yaml

@@ -0,0 +1,133 @@
+# Default values for recipya.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+revisionHistoryLimit: 3
+
+image:
+  repository: reaper99/recipya
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: "v1.2.2"
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+# Security context for the pod
+podSecurityContext:
+  fsGroup: 1000
+
+containerSecurityContext: {}
+
+# Service configuration
+service:
+  type: ClusterIP
+  port: 8078
+
+# Recipya configuration
+config:
+  email:
+    address: ""
+    sendgrid: ""
+    existingSecret: ""
+    addressKey: "email"
+    sendgridKey: "sendgrid"
+  
+  documentIntelligence:
+    endpoint: ""
+    key: ""
+    existingSecret: ""
+    endpointKey: "di_endpoint"
+    keyKey: "di_key"
+  
+  server:
+    port: 8078
+    autologin: false
+    is_demo: false
+    is_prod: true
+    no_signups: false
+    url: "http://0.0.0.0"
+
+# Ingress configuration
+ingress:
+  enabled: false
+  className: ""
+  annotations: []
+    # traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    # traefik.ingress.kubernetes.io/router.middlewares: default-recipya-headers@kubernetescrd
+  hosts:
+    - host: recipya.<domain>
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - chart-example.local
+
+
+# Persistent volume claim
+persistence:
+  enabled: false
+  accessMode: ReadWriteOnce
+  size: 5Gi
+  storageClass: ""
+  annotations: {}
+  retain: true
+
+# Resource limits and requests
+# resources:
+#   limits:
+#     cpu: 500m
+#     memory: 512Mi
+#   requests:
+#     cpu: 100m
+#     memory: 128Mi
+
+# Node selector
+nodeSelector: {}
+
+# Tolerations
+tolerations: []
+
+# Affinity
+affinity: {}
+
+# Additional pod annotations
+podAnnotations: {}
+
+# Startup arguments
+startupArgs: []
+
+# Additional environment variables
+env: []
+
+# Extra environment variables
+extraEnv: []
+
+# Extra volume mounts
+extraVolumeMounts: []
+
+# Extra volumes
+extraVolumes: []
+
+# Probes configuration
+probes:
+  liveness:
+    enabled: true
+    path: /
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+  readiness:
+    enabled: true
+    path: /
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1