mirror of
https://github.com/rtomik/helm-charts.git
synced 2026-04-05 17:50:38 +00:00
Compare commits
30 Commits
mealie-0.0
...
gh-pages
| Author | SHA1 | Date | |
|---|---|---|---|
| 82155649e1 | |||
| efa8117c12 | |||
| a7f36dbb74 | |||
| d4f2fbd95e | |||
| 888dfc7dc5 | |||
| f09187ae63 | |||
| 16c91953d5 | |||
| 7514886332 | |||
| 4415062536 | |||
| bb917c153f | |||
| c801a51587 | |||
| d0e8bfe0a5 | |||
| 2d95ca734a | |||
| 1f77075cc4 | |||
| 3318c83804 | |||
| 8ba22f34e5 | |||
| cad349c379 | |||
| 2c9dcdeebb | |||
| e5f317b15b | |||
| aee167e953 | |||
| 391d9ca938 | |||
| a0228585cc | |||
| 5b337c8b30 | |||
| 4b48783a14 | |||
| d364e3d511 | |||
| 856449a477 | |||
| 856afc305f | |||
| 94936126d4 | |||
| 2384594425 | |||
| db8617de9f |
33
.github/workflows/release.yml
vendored
33
.github/workflows/release.yml
vendored
@ -1,33 +0,0 @@
|
||||
name: Release Charts
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
jobs:
|
||||
release:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write # Needed for chart-releaser to push to gh-pages
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Configure Git
|
||||
run: |
|
||||
git config user.name "$GITHUB_ACTOR"
|
||||
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
|
||||
|
||||
- name: Install Helm
|
||||
uses: azure/setup-helm@v3
|
||||
with:
|
||||
version: v3.12.1
|
||||
|
||||
- name: Run chart-releaser
|
||||
uses: helm/chart-releaser-action@v1.5.0
|
||||
env:
|
||||
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
CR_SKIP_EXISTING: true
|
||||
@ -1,4 +1,2 @@
|
||||
[](https://artifacthub.io/packages/search?repo=rtomik-helm-charts)
|
||||
# helm-charts
|
||||
Repo for helm charts
|
||||
Donetick Helm chart
|
||||
|
||||
@ -1,15 +1,4 @@
|
||||
# Artifact Hub repository metadata file
|
||||
#
|
||||
# Some settings like the verified publisher flag or the ignored packages won't
|
||||
# be applied until the next time the repository is processed. Please keep in
|
||||
# mind that the repository won't be processed if it has not changed since the
|
||||
# last time it was processed. Depending on the repository kind, this is checked
|
||||
# in a different way. For Helm http based repositories, we consider it has
|
||||
# changed if the `index.yaml` file changes. For git based repositories, it does
|
||||
# when the hash of the last commit in the branch you set up changes. This does
|
||||
# NOT apply to ownership claim operations, which are processed immediately.
|
||||
#
|
||||
repositoryID: 11743389-27d2-4d03-a271-1dd96844082f
|
||||
owners: # (optional, used to claim repository ownership)
|
||||
- name: rtomik
|
||||
email: n@gmail.com
|
||||
email: tomikr7@gmail.com
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
apiVersion: v2
|
||||
name: donetick
|
||||
description: Donetick helm chart for Kubernetes
|
||||
description: A Helm chart for Donetick application
|
||||
type: application
|
||||
version: 1.0.1
|
||||
appVersion: "v0.1.38"
|
||||
version: 0.1.0
|
||||
appVersion: "latest"
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: no@m.com
|
||||
|
||||
@ -6,10 +6,6 @@ A Helm chart for deploying the Donetick task management application on Kubernete
|
||||
|
||||
This chart deploys [Donetick](https://github.com/donetick/donetick) on a Kubernetes cluster using the Helm package manager.
|
||||
|
||||
Source code can be found here:
|
||||
- https://github.com/rtomik/helm-charts/tree/main/charts/donetick
|
||||
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
@ -18,21 +14,21 @@ Source code can be found here:
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `donetick`:
|
||||
To install the chart with the release name `my-donetick`:
|
||||
|
||||
```bash
|
||||
$ helm repo add donetick-chart https://rtomik.github.io/helm-charts
|
||||
$ helm install donetick donetick-chart/donetick
|
||||
$ helm install my-donetick donetick-chart/donetick
|
||||
```
|
||||
|
||||
> **Tip**: List all releases using `helm list`
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `donetick` deployment:
|
||||
To uninstall/delete the `my-donetick` deployment:
|
||||
|
||||
```bash
|
||||
$ helm uninstall donetick
|
||||
$ helm delete my-donetick
|
||||
```
|
||||
|
||||
## Parameters
|
||||
@ -111,4 +107,4 @@ $ helm uninstall donetick
|
||||
| `persistence.enabled` | Enable persistence using PVC | `true` |
|
||||
| `persistence.storageClass` | PVC Storage Class | `"longhorn"` |
|
||||
| `persistence.accessMode` | PVC Access Mode | `ReadWriteOnce` |
|
||||
| `persistence.size` |
|
||||
| `persistence.size` |
|
||||
@ -64,8 +64,7 @@ data:
|
||||
appHost: {{ .Values.config.email.appHost | default "" | quote }}
|
||||
oauth2:
|
||||
{{- if .Values.config.oauth2.existingSecret }}
|
||||
client_id: $DT_OAUTH2_CLIENT_ID
|
||||
client_secret: $DT_OAUTH2_CLIENT_SECRET
|
||||
# Client ID and Secret will be injected from Secret
|
||||
{{- else }}
|
||||
client_id: {{ .Values.config.oauth2.client_id | default "" | quote }}
|
||||
client_secret: {{ .Values.config.oauth2.client_secret | default "" | quote }}
|
||||
|
||||
@ -5,7 +5,7 @@ fullnameOverride: ""
|
||||
## Image settings
|
||||
image:
|
||||
repository: donetick/donetick
|
||||
tag: "v0.1.38"
|
||||
tag: latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## Deployment settings
|
||||
@ -41,8 +41,8 @@ service:
|
||||
|
||||
## Ingress settings
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
enabled: true
|
||||
className: "traefik"
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
hosts:
|
||||
@ -58,8 +58,8 @@ ingress:
|
||||
|
||||
## Persistence settings
|
||||
persistence:
|
||||
enabled: false
|
||||
storageClass: ""
|
||||
enabled: true
|
||||
storageClass: "longhorn"
|
||||
accessMode: ReadWriteOnce
|
||||
size: 1Gi
|
||||
annotations: {}
|
||||
@ -85,13 +85,13 @@ extraVolumeMounts: []
|
||||
extraVolumes: []
|
||||
|
||||
## Resource limits and requests
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 500m
|
||||
# memory: 512Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
## Application health checks
|
||||
probes:
|
||||
|
||||
@ -1,16 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: jellyseerr
|
||||
description: Jellyseerr helm chart for Kubernetes
|
||||
type: application
|
||||
version: 0.0.1
|
||||
appVersion: 2.5.2
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: no@m.com
|
||||
keywords:
|
||||
- jellyseerr
|
||||
- jellyfin
|
||||
- media-requests
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
sources:
|
||||
- https://github.com/fallenbagel/jellyseerr
|
||||
@ -1,32 +0,0 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "jellyseerr.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "jellyseerr.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "jellyseerr.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "jellyseerr.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
|
||||
echo "Visit http://127.0.0.1:8080 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
|
||||
2. Jellyseerr will be available at port {{ .Values.service.port }}
|
||||
|
||||
{{- if .Values.persistence.enabled }}
|
||||
3. Data is persisted using PVC: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "jellyseerr.fullname" . }}-config{{ end }}
|
||||
{{- else }}
|
||||
3. WARNING: No persistence enabled. Data will be lost when pods are restarted.
|
||||
{{- end }}
|
||||
|
||||
For more information about using this Helm chart, please refer to the README.md file.
|
||||
@ -1,145 +0,0 @@
|
||||
# Jellyseerr Helm Chart
|
||||
|
||||
A Helm chart for deploying [Jellyseerr](https://github.com/fallenbagel/jellyseerr) on Kubernetes.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart deploys Jellyseerr on a Kubernetes cluster using the Helm package manager. Jellyseerr is a fork of Overseerr for Jellyfin support.
|
||||
|
||||
Source code can be found here:
|
||||
- https://github.com/rtomik/helm-charts/tree/main/charts/jellyseerr
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.0+
|
||||
- PV provisioner support in the underlying infrastructure (if persistence is needed)
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `jellyseerr`:
|
||||
|
||||
```bash
|
||||
helm repo add rtomik-charts https://rtomik.github.io/helm-charts
|
||||
helm install jellyseerr rtomik-charts/jellyseerr
|
||||
```
|
||||
|
||||
> **Tip**: List all releases using `helm list`
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `jellyseerr` deployment:
|
||||
|
||||
```bash
|
||||
helm uninstall jellyseerr
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|------------------------|---------------------------------------------------------------|--------|
|
||||
| `nameOverride` | String to partially override the release name | `""` |
|
||||
| `fullnameOverride` | String to fully override the release name | `""` |
|
||||
|
||||
### Image parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------|--------------------------------------------------------------|--------------------------------|
|
||||
| `image.repository` | Jellyseerr image repository | `ghcr.io/fallenbagel/jellyseerr` |
|
||||
| `image.tag` | Jellyseerr image tag | `latest` |
|
||||
| `image.pullPolicy` | Jellyseerr image pull policy | `IfNotPresent` |
|
||||
| `imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
|
||||
|
||||
### Deployment parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------------------|--------------------------------------------------|-----------|
|
||||
| `replicaCount` | Number of Jellyseerr replicas | `1` |
|
||||
| `revisionHistoryLimit` | Number of revisions to retain for rollback | `3` |
|
||||
| `podSecurityContext.runAsNonRoot` | Run containers as non-root user | `true` |
|
||||
| `podSecurityContext.runAsUser` | User ID for the container | `1000` |
|
||||
| `podSecurityContext.fsGroup` | Group ID for the container filesystem | `1000` |
|
||||
| `containerSecurityContext` | Security context for the container | See values.yaml |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
|
||||
### Service parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|----------------------------|----------------------------------------------|-------------|
|
||||
| `service.type` | Kubernetes Service type | `ClusterIP` |
|
||||
| `service.port` | Service HTTP port | `5055` |
|
||||
|
||||
### Ingress parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|----------------------------|----------------------------------------------|------------------------|
|
||||
| `ingress.enabled` | Enable ingress record generation | `false` |
|
||||
| `ingress.className` | IngressClass name | `""` |
|
||||
| `ingress.annotations` | Additional annotations for the Ingress resource | `{}` |
|
||||
| `ingress.hosts` | Array of host and path objects | See values.yaml |
|
||||
| `ingress.tls` | TLS configuration | `[]` |
|
||||
|
||||
### Persistence parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------------|----------------------------------------------|-----------------|
|
||||
| `persistence.enabled` | Enable persistence using PVC | `true` |
|
||||
| `persistence.existingClaim` | Use an existing PVC | `""` |
|
||||
| `persistence.storageClass` | PVC Storage Class | `""` |
|
||||
| `persistence.accessMode` | PVC Access Mode | `ReadWriteOnce` |
|
||||
| `persistence.size` | PVC Storage Size | `1Gi` |
|
||||
| `persistence.annotations` | Additional custom annotations for the PVC | `{}` |
|
||||
|
||||
### Environment variables
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------|----------------------------------------------|-----------------|
|
||||
| `env` | Environment variables for Jellyseerr | See values.yaml |
|
||||
| `extraEnv` | Additional environment variables | `[]` |
|
||||
|
||||
### Resources parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------|----------------------------------------------|-----------------|
|
||||
| `resources.limits` | The resources limits for containers | See values.yaml |
|
||||
| `resources.requests` | The resources requests for containers | See values.yaml |
|
||||
|
||||
## Configuration
|
||||
|
||||
The following table lists the configurable parameters of the Jellyseerr chart and their default values.
|
||||
|
||||
### Environment Variables
|
||||
|
||||
You can configure Jellyseerr by setting environment variables:
|
||||
|
||||
```yaml
|
||||
env:
|
||||
- name: TZ
|
||||
value: "America/New_York"
|
||||
- name: LOG_LEVEL
|
||||
value: "info"
|
||||
- name: PORT
|
||||
value: "5055"
|
||||
```
|
||||
|
||||
### Using Persistence
|
||||
|
||||
By default, persistence is enabled with a 1Gi volume:
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 1Gi
|
||||
```
|
||||
|
||||
You can also use an existing PVC:
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: my-jellyseerr-pvc
|
||||
```
|
||||
@ -1,45 +0,0 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "jellyseerr.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
*/}}
|
||||
{{- define "jellyseerr.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "jellyseerr.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "jellyseerr.labels" -}}
|
||||
helm.sh/chart: {{ include "jellyseerr.chart" . }}
|
||||
{{ include "jellyseerr.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "jellyseerr.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "jellyseerr.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
@ -1,107 +0,0 @@
|
||||
### templates/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "jellyseerr.fullname" . }}
|
||||
labels:
|
||||
{{- include "jellyseerr.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "jellyseerr.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "jellyseerr.selectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if .Values.startupArgs }}
|
||||
args:
|
||||
{{- range .Values.startupArgs }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.port }}
|
||||
protocol: TCP
|
||||
{{- if .Values.probes.liveness.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.probes.readiness.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- range .Values.env }}
|
||||
- name: {{ .name }}
|
||||
value: {{ .value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /app/config
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "jellyseerr.fullname" . }}-config{{ end }}
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@ -1,43 +0,0 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "jellyseerr.fullname" . }}
|
||||
labels:
|
||||
{{- include "jellyseerr.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.className }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .secretName }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "jellyseerr.fullname" $ }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,21 +0,0 @@
|
||||
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "jellyseerr.fullname" . }}-config
|
||||
labels:
|
||||
{{- include "jellyseerr.labels" . | nindent 4 }}
|
||||
{{- with .Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode | quote }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- end }}
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "jellyseerr.fullname" . }}
|
||||
labels:
|
||||
{{- include "jellyseerr.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "jellyseerr.selectorLabels" . | nindent 4 }}
|
||||
@ -1,117 +0,0 @@
|
||||
## Global settings
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
## Image settings
|
||||
image:
|
||||
repository: ghcr.io/fallenbagel/jellyseerr
|
||||
tag: 2.5.2
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## Deployment settings
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
|
||||
# Optional startup arguments
|
||||
startupArgs: []
|
||||
|
||||
# Pod security settings
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
## Pod scheduling
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
## Pod annotations
|
||||
podAnnotations: {}
|
||||
|
||||
## Service settings
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 5055
|
||||
|
||||
## Ingress settings
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
hosts:
|
||||
- host: jellyseerr.domain.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
# - hosts:
|
||||
# - jellyseerr.domain.com
|
||||
# secretName: jellyseerr-tls
|
||||
|
||||
## Persistence settings
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 1Gi
|
||||
annotations: {}
|
||||
|
||||
## Environment variables
|
||||
env:
|
||||
- name: TZ
|
||||
value: "UTC"
|
||||
- name: LOG_LEVEL
|
||||
value: "info"
|
||||
- name: PORT
|
||||
value: "5055"
|
||||
|
||||
# Extra environment variables (for advanced use cases)
|
||||
extraEnv: []
|
||||
# - name: NODE_ENV
|
||||
# value: "production"
|
||||
|
||||
# Extra volume mounts
|
||||
extraVolumeMounts: []
|
||||
|
||||
# Extra volumes
|
||||
extraVolumes: []
|
||||
|
||||
## Resource limits and requests
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 500m
|
||||
# memory: 512Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## Application health checks
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
path: /api/v1/status
|
||||
readiness:
|
||||
enabled: true
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
path: /api/v1/status
|
||||
@ -1,16 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: karakeep
|
||||
description: Karakeep helm chart for Kubernetes
|
||||
type: application
|
||||
version: 0.0.1
|
||||
appVersion: "0.26.0"
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: no@m.com
|
||||
keywords:
|
||||
- bookmark-manager
|
||||
- karakeep
|
||||
- productivity
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
sources:
|
||||
- https://github.com/karakeep-app/karakeep
|
||||
@ -1,46 +0,0 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "karakeep.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "karakeep.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "karakeep.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "{{ include "karakeep.selectorLabels" . }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
|
||||
echo "Visit http://127.0.0.1:3000 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 3000:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
|
||||
2. Karakeep has been deployed with the following components:
|
||||
- Main application (Karakeep)
|
||||
- MeiliSearch for search functionality
|
||||
- Chrome browser for web scraping
|
||||
|
||||
{{- if not .Values.persistence.enabled }}
|
||||
3. WARNING: Persistence is disabled. Data will be lost when pods are restarted.
|
||||
Enable persistence by setting:
|
||||
persistence.enabled=true
|
||||
{{- end }}
|
||||
|
||||
4. IMPORTANT: Configuration for production:
|
||||
- Generate a secure 32-character random string for NEXTAUTH_SECRET
|
||||
- NEXTAUTH_URL is automatically set when ingress is enabled
|
||||
- Update secrets or environment variables as needed
|
||||
|
||||
{{- if not .Values.secrets.create }}
|
||||
{{- if not .Values.secrets.existingSecret }}
|
||||
5. Optional: Configure additional API keys via secrets:
|
||||
- OPENAI_API_KEY for AI features
|
||||
- MEILI_MASTER_KEY for MeiliSearch authentication
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,108 +0,0 @@
|
||||
# Karakeep Helm Chart
|
||||
|
||||
This Helm chart deploys [Karakeep](https://github.com/karakeep-app/karakeep), a bookmark management application, along with its required services on a Kubernetes cluster.
|
||||
|
||||
## Components
|
||||
|
||||
This chart deploys three containers in a single pod:
|
||||
|
||||
1. **Karakeep**: The main bookmark management application
|
||||
2. **Chrome**: Headless Chrome browser for web scraping and preview generation
|
||||
3. **MeiliSearch**: Search engine for fast bookmark search functionality
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.2.0+
|
||||
- PV provisioner support in the underlying infrastructure (if persistence is enabled)
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `karakeep`:
|
||||
|
||||
```bash
|
||||
helm repo add karakeep-chart https://rtomik.github.io/helm-charts
|
||||
helm install karakeep karakeep-chart/karakeep
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `karakeep` deployment:
|
||||
|
||||
```bash
|
||||
helm delete karakeep
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
The following table lists the configurable parameters and their default values.
|
||||
|
||||
### Global Settings
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `nameOverride` | Override the name of the chart | `""` |
|
||||
| `fullnameOverride` | Override the full name of the chart | `""` |
|
||||
| `replicaCount` | Number of replicas | `1` |
|
||||
|
||||
### Karakeep Configuration
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `karakeep.image.repository` | Karakeep image repository | `ghcr.io/karakeep-app/karakeep` |
|
||||
| `karakeep.image.tag` | Karakeep image tag | `"release"` |
|
||||
| `karakeep.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
|
||||
### Chrome Configuration
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `chrome.image.repository` | Chrome image repository | `gcr.io/zenika-hub/alpine-chrome` |
|
||||
| `chrome.image.tag` | Chrome image tag | `"124"` |
|
||||
|
||||
### MeiliSearch Configuration
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `meilisearch.image.repository` | MeiliSearch image repository | `getmeili/meilisearch` |
|
||||
| `meilisearch.image.tag` | MeiliSearch image tag | `"v1.13.3"` |
|
||||
|
||||
### Persistence
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `persistence.enabled` | Enable persistent storage | `true` |
|
||||
| `persistence.data.size` | Size of data volume | `5Gi` |
|
||||
| `persistence.data.storageClass` | Storage class for data volume | `""` |
|
||||
| `persistence.meilisearch.size` | Size of MeiliSearch volume | `2Gi` |
|
||||
| `persistence.meilisearch.storageClass` | Storage class for MeiliSearch volume | `""` |
|
||||
|
||||
### Ingress
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `ingress.enabled` | Enable ingress | `false` |
|
||||
| `ingress.hosts[0].host` | Hostname | `karakeep.domain.com` |
|
||||
|
||||
### Secrets
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `secrets.create` | Create secret for environment variables | `false` |
|
||||
| `secrets.existingSecret` | Use existing secret | `""` |
|
||||
| `secrets.env` | Environment variables to store in secret | `{}` |
|
||||
|
||||
**Important Configuration:**
|
||||
1. The default `NEXTAUTH_SECRET` is set to a placeholder value. For production deployments, you should either:
|
||||
- Override the value: `--set karakeep.env[3].value="your-secure-32-character-string"`
|
||||
- Use secrets: `--set secrets.create=true --set secrets.env.NEXTAUTH_SECRET="your-secure-32-character-string"`
|
||||
|
||||
2. When ingress is enabled, `NEXTAUTH_URL` is automatically set to the ingress hostname. For custom configurations:
|
||||
- Override manually: `--set karakeep.env[4].value="https://your-domain.com"`
|
||||
|
||||
## Notes
|
||||
|
||||
- This chart creates a multi-container pod with all three services running together
|
||||
- Data persistence is enabled by default with separate volumes for Karakeep data and MeiliSearch indices
|
||||
- The services communicate via localhost since they share the same pod network
|
||||
- Chrome runs with security flags for containerized environments
|
||||
@ -1,70 +0,0 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "karakeep.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
*/}}
|
||||
{{- define "karakeep.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "karakeep.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "karakeep.labels" -}}
|
||||
helm.sh/chart: {{ include "karakeep.chart" . }}
|
||||
{{ include "karakeep.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "karakeep.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "karakeep.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the secret to use
|
||||
*/}}
|
||||
{{- define "karakeep.secretName" -}}
|
||||
{{- if .Values.secrets.existingSecret }}
|
||||
{{- .Values.secrets.existingSecret }}
|
||||
{{- else }}
|
||||
{{- include "karakeep.fullname" . }}-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the data PVC
|
||||
*/}}
|
||||
{{- define "karakeep.dataPvcName" -}}
|
||||
{{- include "karakeep.fullname" . }}-data
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the meilisearch PVC
|
||||
*/}}
|
||||
{{- define "karakeep.meilisearchPvcName" -}}
|
||||
{{- include "karakeep.fullname" . }}-meilisearch
|
||||
{{- end }}
|
||||
@ -1,191 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "karakeep.fullname" . }}
|
||||
labels:
|
||||
{{- include "karakeep.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "karakeep.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "karakeep.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
# Karakeep main application
|
||||
- name: karakeep
|
||||
image: "{{ .Values.karakeep.image.repository }}:{{ .Values.karakeep.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.karakeep.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.karakeep.service.port }}
|
||||
protocol: TCP
|
||||
env:
|
||||
{{- range .Values.karakeep.env }}
|
||||
- name: {{ .name }}
|
||||
{{- if and (eq .name "NEXTAUTH_URL") $.Values.ingress.enabled }}
|
||||
{{- $host := (index $.Values.ingress.hosts 0).host }}
|
||||
{{- if $.Values.ingress.tls }}
|
||||
value: "https://{{ $host }}"
|
||||
{{- else }}
|
||||
value: "http://{{ $host }}"
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
value: {{ .value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range .Values.karakeep.extraEnv }}
|
||||
- name: {{ .name }}
|
||||
{{- if .value }}
|
||||
value: {{ .value | quote }}
|
||||
{{- else if .valueFrom }}
|
||||
valueFrom:
|
||||
{{- toYaml .valueFrom | nindent 16 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.secrets.create .Values.secrets.existingSecret }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "karakeep.secretName" . }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
{{- with .Values.karakeep.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
|
||||
# Chrome browser sidecar
|
||||
- name: chrome
|
||||
image: "{{ .Values.chrome.image.repository }}:{{ .Values.chrome.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.chrome.image.pullPolicy }}
|
||||
args:
|
||||
{{- range .Values.chrome.args }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: debug
|
||||
containerPort: {{ .Values.chrome.service.port }}
|
||||
protocol: TCP
|
||||
securityContext:
|
||||
{{- toYaml .Values.chrome.securityContext | nindent 12 }}
|
||||
{{- with .Values.chrome.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /json/version
|
||||
port: debug
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /json/version
|
||||
port: debug
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
|
||||
# MeiliSearch sidecar
|
||||
- name: meilisearch
|
||||
image: "{{ .Values.meilisearch.image.repository }}:{{ .Values.meilisearch.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.meilisearch.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.meilisearch.service.port }}
|
||||
protocol: TCP
|
||||
env:
|
||||
{{- range .Values.meilisearch.env }}
|
||||
- name: {{ .name }}
|
||||
value: {{ .value | quote }}
|
||||
{{- end }}
|
||||
{{- range .Values.meilisearch.extraEnv }}
|
||||
- name: {{ .name }}
|
||||
{{- if .value }}
|
||||
value: {{ .value | quote }}
|
||||
{{- else if .valueFrom }}
|
||||
valueFrom:
|
||||
{{- toYaml .valueFrom | nindent 16 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.secrets.create .Values.secrets.existingSecret }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "karakeep.secretName" . }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: meilisearch-data
|
||||
mountPath: /meili_data
|
||||
securityContext:
|
||||
{{- toYaml .Values.meilisearch.securityContext | nindent 12 }}
|
||||
{{- with .Values.meilisearch.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
failureThreshold: 30
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
|
||||
volumes:
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "karakeep.dataPvcName" . }}
|
||||
- name: meilisearch-data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "karakeep.meilisearchPvcName" . }}
|
||||
{{- else }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
- name: meilisearch-data
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
@ -1,41 +0,0 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "karakeep.fullname" . }}
|
||||
labels:
|
||||
{{- include "karakeep.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.className }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "karakeep.fullname" $ }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,43 +0,0 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "karakeep.dataPvcName" . }}
|
||||
labels:
|
||||
{{- include "karakeep.labels" . | nindent 4 }}
|
||||
component: data
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.data.accessMode }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.data.size }}
|
||||
{{- if .Values.persistence.data.storageClass }}
|
||||
{{- if (eq "-" .Values.persistence.data.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: {{ .Values.persistence.data.storageClass }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "karakeep.meilisearchPvcName" . }}
|
||||
labels:
|
||||
{{- include "karakeep.labels" . | nindent 4 }}
|
||||
component: meilisearch
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.meilisearch.accessMode }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.meilisearch.size }}
|
||||
{{- if .Values.persistence.meilisearch.storageClass }}
|
||||
{{- if (eq "-" .Values.persistence.meilisearch.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: {{ .Values.persistence.meilisearch.storageClass }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,13 +0,0 @@
|
||||
{{- if .Values.secrets.create }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "karakeep.secretName" . }}
|
||||
labels:
|
||||
{{- include "karakeep.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- range $key, $value := .Values.secrets.env }}
|
||||
{{ $key }}: {{ $value | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "karakeep.fullname" . }}
|
||||
labels:
|
||||
{{- include "karakeep.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "karakeep.selectorLabels" . | nindent 4 }}
|
||||
@ -1,170 +0,0 @@
|
||||
## Global settings
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
## Deployment settings
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
|
||||
# Pod security settings
|
||||
podSecurityContext:
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
fsGroup: 0
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
## Pod scheduling
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
## Karakeep Web Application
|
||||
karakeep:
|
||||
image:
|
||||
repository: ghcr.io/karakeep-app/karakeep
|
||||
tag: "0.26.0"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
securityContext: {}
|
||||
|
||||
env:
|
||||
- name: DATA_DIR
|
||||
value: "/data"
|
||||
- name: MEILI_ADDR
|
||||
value: "http://localhost:7700"
|
||||
- name: BROWSER_WEB_URL
|
||||
value: "http://localhost:9222"
|
||||
- name: NEXTAUTH_SECRET
|
||||
value: "changeme-generate-a-secure-random-string"
|
||||
- name: NEXTAUTH_URL
|
||||
value: "http://localhost:3000"
|
||||
|
||||
extraEnv: []
|
||||
# - name: OPENAI_API_KEY
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: karakeep-secrets
|
||||
# key: openai-api-key
|
||||
|
||||
service:
|
||||
port: 3000
|
||||
|
||||
#resources:
|
||||
# limits:
|
||||
# cpu: 500m
|
||||
# memory: 1Gi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 256Mi
|
||||
|
||||
## Chrome Browser Service
|
||||
chrome:
|
||||
image:
|
||||
repository: gcr.io/zenika-hub/alpine-chrome
|
||||
tag: "124"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
securityContext: {}
|
||||
|
||||
args:
|
||||
- --no-sandbox
|
||||
- --disable-gpu
|
||||
- --disable-dev-shm-usage
|
||||
- --remote-debugging-address=0.0.0.0
|
||||
- --remote-debugging-port=9222
|
||||
- --hide-scrollbars
|
||||
|
||||
service:
|
||||
port: 9222
|
||||
|
||||
#resources:
|
||||
# limits:
|
||||
# cpu: 500m
|
||||
# memory: 512Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## MeiliSearch Service
|
||||
meilisearch:
|
||||
image:
|
||||
repository: getmeili/meilisearch
|
||||
tag: "v1.13.3"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
securityContext: {}
|
||||
|
||||
env:
|
||||
- name: MEILI_NO_ANALYTICS
|
||||
value: "true"
|
||||
- name: MEILI_MAX_INDEXING_MEMORY
|
||||
value: "512MiB"
|
||||
- name: MEILI_MAX_INDEXING_THREADS
|
||||
value: "2"
|
||||
|
||||
extraEnv: []
|
||||
|
||||
service:
|
||||
port: 7700
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
|
||||
## Service settings
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3000
|
||||
|
||||
## Ingress settings
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
hosts:
|
||||
- host: karakeep.<domain.com>
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- karakeep.<domain.com>
|
||||
|
||||
## Persistence settings
|
||||
persistence:
|
||||
enabled: true
|
||||
|
||||
# Karakeep data storage
|
||||
data:
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
|
||||
# MeiliSearch data storage
|
||||
meilisearch:
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 2Gi
|
||||
|
||||
## Secret configuration
|
||||
secrets:
|
||||
# Set to true to create a secret for environment variables
|
||||
create: false
|
||||
# Name of existing secret to use
|
||||
existingSecret: ""
|
||||
# Environment variables to include in secret
|
||||
env: {}
|
||||
# NEXTAUTH_SECRET: "your-secure-random-string"
|
||||
# OPENAI_API_KEY: "your-openai-api-key"
|
||||
# MEILI_MASTER_KEY: "your-meilisearch-master-key"
|
||||
@ -1,17 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: mealie
|
||||
description: Mealie helm chart for Kubernetes - Recipe management and meal planning
|
||||
type: application
|
||||
version: 0.0.1
|
||||
appVersion: "v3.1.1"
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: no@m.com
|
||||
keywords:
|
||||
- recipe-management
|
||||
- meal-planning
|
||||
- cooking
|
||||
- mealie
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
sources:
|
||||
- https://github.com/mealie-recipes/mealie
|
||||
@ -1,84 +0,0 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "mealie.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "mealie.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "mealie.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "mealie.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
|
||||
echo "Visit http://127.0.0.1:8080 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
|
||||
2. Mealie application is configured with:
|
||||
- Database: {{ .Values.env.DB_ENGINE }}
|
||||
- User signup: {{ if eq .Values.env.ALLOW_SIGNUP "true" }}enabled{{ else }}disabled{{ end }}
|
||||
- API port: {{ .Values.env.API_PORT }}
|
||||
|
||||
{{- if .Values.persistence.enabled }}
|
||||
3. Data is persisted using PVC: {{ include "mealie.fullname" . }}-data
|
||||
{{- else }}
|
||||
3. WARNING: No persistence enabled. Data will be lost when pods are restarted.
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.postgresql.external.enabled }}
|
||||
4. Using external PostgreSQL database:
|
||||
- Host: {{ .Values.postgresql.external.host }}
|
||||
- Database: {{ .Values.postgresql.external.database }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.email.enabled .Values.ldap.enabled .Values.oidc.enabled .Values.openai.enabled }}
|
||||
5. Additional features enabled:
|
||||
{{- if .Values.email.enabled }}
|
||||
- SMTP Email notifications configured
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.enabled }}
|
||||
- LDAP authentication enabled
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.enabled }}
|
||||
- OpenID Connect (OIDC) authentication enabled
|
||||
{{- end }}
|
||||
{{- if .Values.openai.enabled }}
|
||||
- OpenAI integration enabled for AI features
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.postgresql.external.existingSecret .Values.email.existingSecret .Values.ldap.existingSecret .Values.oidc.existingSecret .Values.openai.existingSecret .Values.tls.existingSecret }}
|
||||
|
||||
6. Using external secrets for sensitive information:
|
||||
{{- if .Values.postgresql.external.existingSecret }}
|
||||
- Database credentials from: {{ .Values.postgresql.external.existingSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.email.existingSecret }}
|
||||
- SMTP credentials from: {{ .Values.email.existingSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.existingSecret }}
|
||||
- LDAP credentials from: {{ .Values.ldap.existingSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.existingSecret }}
|
||||
- OIDC credentials from: {{ .Values.oidc.existingSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.openai.existingSecret }}
|
||||
- OpenAI API key from: {{ .Values.openai.existingSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.existingSecret }}
|
||||
- TLS certificates from: {{ .Values.tls.existingSecret }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
|
||||
6. SECURITY NOTE: For production use, it's recommended to store sensitive data in Kubernetes Secrets.
|
||||
Consider using existingSecret options for database, email, LDAP, OIDC, and OpenAI configurations.
|
||||
{{- end }}
|
||||
|
||||
For more information about using this Helm chart, please refer to the readme.md file.
|
||||
@ -1,352 +0,0 @@
|
||||
# Mealie Helm Chart
|
||||
|
||||
A Helm chart for deploying Mealie recipe management and meal planning application on Kubernetes.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart deploys [Mealie](https://github.com/mealie-recipes/mealie) on a Kubernetes cluster using the Helm package manager. Mealie is a self-hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in Vue for a pleasant user experience for the whole family.
|
||||
|
||||
Source code can be found here:
|
||||
- https://github.com/rtomik/helm-charts/tree/main/charts/mealie
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.0+
|
||||
- PV provisioner support in the underlying infrastructure (if persistence is needed)
|
||||
- External Postgresql DB like https://cloudnative-pg.io/
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `mealie`:
|
||||
|
||||
```bash
|
||||
$ helm repo add mealie-chart https://rtomik.github.io/helm-charts
|
||||
$ helm install mealie mealie-chart/mealie
|
||||
```
|
||||
|
||||
> **Tip**: List all releases using `helm list`
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `mealie` deployment:
|
||||
|
||||
```bash
|
||||
$ helm uninstall mealie
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|------------------------|------------------------------------------------|-------|
|
||||
| `nameOverride` | String to partially override the release name | `""` |
|
||||
| `fullnameOverride` | String to fully override the release name | `""` |
|
||||
|
||||
### Image parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------|-----------------------------------|-----------------------------------|
|
||||
| `image.repository` | Mealie image repository | `ghcr.io/mealie-recipes/mealie` |
|
||||
| `image.tag` | Mealie image tag | `v3.1.1` |
|
||||
| `image.pullPolicy` | Mealie image pull policy | `IfNotPresent` |
|
||||
|
||||
### Deployment parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------------------|-----------------------------------------------|-----------|
|
||||
| `replicaCount` | Number of Mealie replicas | `1` |
|
||||
| `revisionHistoryLimit` | Number of revisions to retain for rollback | `3` |
|
||||
| `podSecurityContext.runAsNonRoot` | Run containers as non-root user | `false` |
|
||||
| `podSecurityContext.runAsUser` | User ID for the container | `911` |
|
||||
| `podSecurityContext.fsGroup` | Group ID for the container filesystem | `911` |
|
||||
| `containerSecurityContext` | Security context for the container | See values.yaml |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
|
||||
### Service parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|----------------|-----------------------|-------------|
|
||||
| `service.type` | Kubernetes Service type | `ClusterIP` |
|
||||
| `service.port` | Service HTTP port | `9000` |
|
||||
|
||||
### Ingress parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------|-------------------------------------------|-----------------|
|
||||
| `ingress.enabled` | Enable ingress record generation | `false` |
|
||||
| `ingress.className` | IngressClass name | `""` |
|
||||
| `ingress.annotations` | Additional annotations for the Ingress | See values.yaml |
|
||||
| `ingress.hosts` | Array of host and path objects | See values.yaml |
|
||||
| `ingress.tls` | TLS configuration | See values.yaml |
|
||||
|
||||
### Persistence parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------------|----------------------------------|-----------------|
|
||||
| `persistence.enabled` | Enable persistence using PVC | `true` |
|
||||
| `persistence.storageClass` | PVC Storage Class | `""` |
|
||||
| `persistence.accessMode` | PVC Access Mode | `ReadWriteOnce` |
|
||||
| `persistence.size` | PVC Size | `5Gi` |
|
||||
| `persistence.annotations` | Annotations for PVC | `{}` |
|
||||
|
||||
### Environment variables
|
||||
|
||||
| Name | Description | Value |
|
||||
|---------------------------------------|-----------------------------------------------|-----------------|
|
||||
| `env.PUID` | UserID permissions between host OS and container | `911` |
|
||||
| `env.PGID` | GroupID permissions between host OS and container | `911` |
|
||||
| `env.DEFAULT_GROUP` | The default group for users | `Home` |
|
||||
| `env.DEFAULT_HOUSEHOLD` | The default household for users in each group | `Family` |
|
||||
| `env.BASE_URL` | Used for Notifications | `http://localhost:9000` |
|
||||
| `env.TOKEN_TIME` | The time in hours that a login/auth token is valid | `48` |
|
||||
| `env.API_PORT` | The port exposed by backend API | `9000` |
|
||||
| `env.API_DOCS` | Turns on/off access to the API documentation | `true` |
|
||||
| `env.TZ` | Must be set to get correct date/time on the server | `UTC` |
|
||||
| `env.ALLOW_SIGNUP` | Allow user sign-up without token | `false` |
|
||||
| `env.ALLOW_PASSWORD_LOGIN` | Whether or not to display username+password input fields | `true` |
|
||||
| `env.LOG_LEVEL` | Logging level | `info` |
|
||||
| `env.DAILY_SCHEDULE_TIME` | Time to run daily server tasks (HH:MM) | `23:45` |
|
||||
|
||||
### PostgreSQL configuration
|
||||
|
||||
| Name | Description | Value |
|
||||
|----------------------------------------|-----------------------------------------------|-----------|
|
||||
| `postgresql.enabled` | Enable PostgreSQL support | `false` |
|
||||
| `postgresql.external.enabled` | Use external PostgreSQL database | `false` |
|
||||
| `postgresql.external.host` | PostgreSQL host | `""` |
|
||||
| `postgresql.external.port` | PostgreSQL port | `5432` |
|
||||
| `postgresql.external.database` | PostgreSQL database name | `mealie` |
|
||||
| `postgresql.external.user` | PostgreSQL username | `mealie` |
|
||||
| `postgresql.external.password` | PostgreSQL password | `""` |
|
||||
| `postgresql.external.existingSecret` | Name of existing secret with PostgreSQL credentials | `""` |
|
||||
| `postgresql.external.userKey` | Key in the secret for username | `username` |
|
||||
| `postgresql.external.passwordKey` | Key in the secret for password | `password` |
|
||||
|
||||
### Email (SMTP) configuration
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------|--------------------------------------|-----------|
|
||||
| `email.enabled` | Enable SMTP email support | `false` |
|
||||
| `email.host` | SMTP host | `""` |
|
||||
| `email.port` | SMTP port | `587` |
|
||||
| `email.fromName` | From name for emails | `Mealie` |
|
||||
| `email.authStrategy` | SMTP auth strategy (TLS, SSL, NONE) | `TLS` |
|
||||
| `email.fromEmail` | From email address | `""` |
|
||||
| `email.user` | SMTP username | `""` |
|
||||
| `email.password` | SMTP password | `""` |
|
||||
| `email.existingSecret` | Name of existing secret with SMTP credentials | `""` |
|
||||
| `email.userKey` | Key in the secret for SMTP username | `smtp-user` |
|
||||
| `email.passwordKey` | Key in the secret for SMTP password | `smtp-password` |
|
||||
|
||||
### LDAP Authentication
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------|--------------------------------------|-----------|
|
||||
| `ldap.enabled` | Enable LDAP authentication | `false` |
|
||||
| `ldap.serverUrl` | LDAP server URL | `""` |
|
||||
| `ldap.tlsInsecure` | Do not verify server certificate | `false` |
|
||||
| `ldap.tlsCaCertFile` | Path to CA certificate file | `""` |
|
||||
| `ldap.enableStartTls` | Use STARTTLS to connect to server | `false` |
|
||||
| `ldap.baseDn` | Starting point for user authentication | `""` |
|
||||
| `ldap.queryBind` | Optional bind user for LDAP searches | `""` |
|
||||
| `ldap.queryPassword` | Password for the bind user | `""` |
|
||||
| `ldap.userFilter` | LDAP filter to narrow down eligible users | `""` |
|
||||
| `ldap.adminFilter` | LDAP filter for admin users | `""` |
|
||||
| `ldap.idAttribute` | LDAP attribute for user ID | `uid` |
|
||||
| `ldap.nameAttribute` | LDAP attribute for user name | `name` |
|
||||
| `ldap.mailAttribute` | LDAP attribute for user email | `mail` |
|
||||
|
||||
### OpenID Connect (OIDC)
|
||||
|
||||
| Name | Description | Value |
|
||||
|------------------------------|------------------------------------------|-----------|
|
||||
| `oidc.enabled` | Enable OIDC authentication | `false` |
|
||||
| `oidc.signupEnabled` | Allow new users via OIDC | `true` |
|
||||
| `oidc.configurationUrl` | URL to OIDC configuration | `""` |
|
||||
| `oidc.clientId` | OIDC client ID | `""` |
|
||||
| `oidc.clientSecret` | OIDC client secret | `""` |
|
||||
| `oidc.userGroup` | Required OIDC user group | `""` |
|
||||
| `oidc.adminGroup` | OIDC admin group | `""` |
|
||||
| `oidc.autoRedirect` | Bypass login page and redirect to IdP | `false` |
|
||||
| `oidc.providerName` | Provider name shown in login button | `OAuth` |
|
||||
| `oidc.rememberMe` | Extend session as if "Remember Me" was checked | `false` |
|
||||
| `oidc.signingAlgorithm` | Algorithm used to sign the id token | `RS256` |
|
||||
| `oidc.userClaim` | Claim to look up existing user by | `email` |
|
||||
| `oidc.nameClaim` | Claim for user's full name | `name` |
|
||||
| `oidc.groupsClaim` | Claim for user groups | `groups` |
|
||||
|
||||
### OpenAI Integration
|
||||
|
||||
| Name | Description | Value |
|
||||
|------------------------------------|------------------------------------------|-----------|
|
||||
| `openai.enabled` | Enable OpenAI integration | `false` |
|
||||
| `openai.baseUrl` | Base URL for OpenAI API | `""` |
|
||||
| `openai.apiKey` | OpenAI API key | `""` |
|
||||
| `openai.model` | OpenAI model to use | `gpt-4o` |
|
||||
| `openai.customHeaders` | Custom HTTP headers for OpenAI requests | `""` |
|
||||
| `openai.customParams` | Custom HTTP query params for OpenAI requests | `""` |
|
||||
| `openai.enableImageServices` | Enable OpenAI image services | `true` |
|
||||
| `openai.workers` | Number of OpenAI workers per request | `2` |
|
||||
| `openai.sendDatabaseData` | Send Mealie data to OpenAI to improve accuracy | `true` |
|
||||
| `openai.requestTimeout` | Timeout for OpenAI requests in seconds | `60` |
|
||||
|
||||
### TLS Configuration
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------|--------------------------------------|-----------|
|
||||
| `tls.enabled` | Enable TLS configuration | `false` |
|
||||
| `tls.certificatePath` | Path to TLS certificate file | `""` |
|
||||
| `tls.privateKeyPath` | Path to TLS private key file | `""` |
|
||||
| `tls.existingSecret` | Name of existing secret with TLS certificates | `""` |
|
||||
| `tls.certificateKey` | Key in the secret for TLS certificate | `tls.crt` |
|
||||
| `tls.privateKeyKey` | Key in the secret for TLS private key | `tls.key` |
|
||||
|
||||
### Theme Configuration
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------------|--------------------------------|-----------|
|
||||
| `theme.light.primary` | Light theme primary color | `#E58325` |
|
||||
| `theme.light.accent` | Light theme accent color | `#007A99` |
|
||||
| `theme.light.secondary` | Light theme secondary color | `#973542` |
|
||||
| `theme.light.success` | Light theme success color | `#43A047` |
|
||||
| `theme.light.info` | Light theme info color | `#1976D2` |
|
||||
| `theme.light.warning` | Light theme warning color | `#FF6D00` |
|
||||
| `theme.light.error` | Light theme error color | `#EF5350` |
|
||||
| `theme.dark.primary` | Dark theme primary color | `#E58325` |
|
||||
| `theme.dark.accent` | Dark theme accent color | `#007A99` |
|
||||
| `theme.dark.secondary` | Dark theme secondary color | `#973542` |
|
||||
| `theme.dark.success` | Dark theme success color | `#43A047` |
|
||||
| `theme.dark.info` | Dark theme info color | `#1976D2` |
|
||||
| `theme.dark.warning` | Dark theme warning color | `#FF6D00` |
|
||||
| `theme.dark.error` | Dark theme error color | `#EF5350` |
|
||||
|
||||
### Resource Configuration
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------|--------------------------------------|-------|
|
||||
| `resources` | Resource limits and requests | `{}` |
|
||||
|
||||
### Health Checks
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------------------------|------------------------------------------|-------|
|
||||
| `probes.liveness.enabled` | Enable liveness probe | `true` |
|
||||
| `probes.liveness.initialDelaySeconds` | Initial delay for liveness probe | `60` |
|
||||
| `probes.liveness.periodSeconds` | Period for liveness probe | `30` |
|
||||
| `probes.liveness.timeoutSeconds` | Timeout for liveness probe | `10` |
|
||||
| `probes.liveness.failureThreshold` | Failure threshold for liveness probe | `3` |
|
||||
| `probes.liveness.successThreshold` | Success threshold for liveness probe | `1` |
|
||||
| `probes.liveness.path` | Path for liveness probe | `/` |
|
||||
| `probes.readiness.enabled` | Enable readiness probe | `true` |
|
||||
| `probes.readiness.initialDelaySeconds` | Initial delay for readiness probe | `30` |
|
||||
| `probes.readiness.periodSeconds` | Period for readiness probe | `10` |
|
||||
| `probes.readiness.timeoutSeconds` | Timeout for readiness probe | `5` |
|
||||
| `probes.readiness.failureThreshold` | Failure threshold for readiness probe | `3` |
|
||||
| `probes.readiness.successThreshold` | Success threshold for readiness probe | `1` |
|
||||
| `probes.readiness.path` | Path for readiness probe | `/` |
|
||||
|
||||
### Autoscaling
|
||||
|
||||
| Name | Description | Value |
|
||||
|---------------------------------------------|------------------------------------------|---------|
|
||||
| `autoscaling.enabled` | Enable horizontal pod autoscaling | `false` |
|
||||
| `autoscaling.minReplicas` | Minimum number of replicas | `1` |
|
||||
| `autoscaling.maxReplicas` | Maximum number of replicas | `3` |
|
||||
| `autoscaling.targetCPUUtilizationPercentage`| Target CPU utilization percentage | `80` |
|
||||
| `autoscaling.targetMemoryUtilizationPercentage`| Target memory utilization percentage | `80` |
|
||||
|
||||
## Configuration Examples
|
||||
|
||||
### Basic Installation with Persistence
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 10Gi
|
||||
storageClass: "fast-ssd"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- host: mealie.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- mealie.example.com
|
||||
secretName: mealie-tls
|
||||
```
|
||||
|
||||
### PostgreSQL Database Configuration
|
||||
|
||||
```yaml
|
||||
postgresql:
|
||||
external:
|
||||
enabled: true
|
||||
host: "postgresql.example.com"
|
||||
port: 5432
|
||||
database: "mealie"
|
||||
user: "mealie"
|
||||
existingSecret: "mealie-postgresql-secret"
|
||||
userKey: "username"
|
||||
passwordKey: "password"
|
||||
|
||||
env:
|
||||
DB_ENGINE: "postgres"
|
||||
```
|
||||
|
||||
### OIDC Authentication Setup
|
||||
|
||||
```yaml
|
||||
oidc:
|
||||
enabled: true
|
||||
configurationUrl: "https://auth.example.com/.well-known/openid-configuration"
|
||||
clientId: "mealie-client"
|
||||
existingSecret: "mealie-oidc-secret"
|
||||
clientIdKey: "client-id"
|
||||
clientSecretKey: "client-secret"
|
||||
autoRedirect: true
|
||||
providerName: "CompanySSO"
|
||||
```
|
||||
|
||||
### OpenAI Integration
|
||||
|
||||
```yaml
|
||||
openai:
|
||||
enabled: true
|
||||
baseUrl: "https://api.openai.com/v1"
|
||||
existingSecret: "mealie-openai-secret"
|
||||
apiKeyKey: "api-key"
|
||||
model: "gpt-4"
|
||||
enableImageServices: true
|
||||
```
|
||||
|
||||
## Security Considerations
|
||||
|
||||
For production deployments, it's recommended to:
|
||||
|
||||
1. Use external secrets for sensitive information
|
||||
2. Enable TLS/SSL for all communications
|
||||
3. Configure proper RBAC and network policies
|
||||
4. Use a dedicated database with proper access controls
|
||||
5. Enable authentication (LDAP/OIDC) and disable public signup
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
Common issues and solutions:
|
||||
|
||||
1. **Database connection issues**: Verify database credentials and network connectivity
|
||||
2. **Persistence issues**: Check StorageClass and PVC configuration
|
||||
3. **Authentication problems**: Verify LDAP/OIDC configuration and network access
|
||||
4. **Performance issues**: Adjust resource limits and consider using external database
|
||||
|
||||
For more detailed troubleshooting, check the application logs:
|
||||
|
||||
```bash
|
||||
kubectl logs -f deployment/mealie
|
||||
```
|
||||
@ -1,45 +0,0 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "mealie.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
*/}}
|
||||
{{- define "mealie.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "mealie.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "mealie.labels" -}}
|
||||
helm.sh/chart: {{ include "mealie.chart" . }}
|
||||
{{ include "mealie.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "mealie.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "mealie.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
@ -1,337 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "mealie.fullname" . }}
|
||||
labels:
|
||||
{{- include "mealie.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "mealie.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "mealie.selectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 9000
|
||||
protocol: TCP
|
||||
{{- if .Values.probes.liveness.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.probes.readiness.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- range $key, $value := .Values.env }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.postgresql.external.enabled }}
|
||||
- name: DB_ENGINE
|
||||
value: "postgres"
|
||||
- name: POSTGRES_SERVER
|
||||
value: {{ .Values.postgresql.external.host | quote }}
|
||||
- name: POSTGRES_PORT
|
||||
value: {{ .Values.postgresql.external.port | quote }}
|
||||
- name: POSTGRES_DB
|
||||
value: {{ .Values.postgresql.external.database | quote }}
|
||||
- name: POSTGRES_USER
|
||||
{{- if .Values.postgresql.external.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.postgresql.external.existingSecret }}
|
||||
key: {{ .Values.postgresql.external.userKey }}
|
||||
{{- else }}
|
||||
value: {{ .Values.postgresql.external.user | quote }}
|
||||
{{- end }}
|
||||
- name: POSTGRES_PASSWORD
|
||||
{{- if .Values.postgresql.external.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.postgresql.external.existingSecret }}
|
||||
key: {{ .Values.postgresql.external.passwordKey }}
|
||||
{{- else }}
|
||||
value: {{ .Values.postgresql.external.password | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.email.enabled }}
|
||||
- name: SMTP_HOST
|
||||
{{- if .Values.email.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.email.existingSecret }}
|
||||
key: "smtp-host"
|
||||
{{- else }}
|
||||
value: {{ .Values.email.host | quote }}
|
||||
{{- end }}
|
||||
- name: SMTP_PORT
|
||||
value: {{ .Values.email.port | quote }}
|
||||
- name: SMTP_FROM_NAME
|
||||
value: {{ .Values.email.fromName | quote }}
|
||||
- name: SMTP_AUTH_STRATEGY
|
||||
value: {{ .Values.email.authStrategy | quote }}
|
||||
- name: SMTP_FROM_EMAIL
|
||||
value: {{ .Values.email.fromEmail | quote }}
|
||||
{{- if and .Values.email.user (or (eq .Values.email.authStrategy "TLS") (eq .Values.email.authStrategy "SSL")) }}
|
||||
- name: SMTP_USER
|
||||
{{- if .Values.email.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.email.existingSecret }}
|
||||
key: {{ .Values.email.userKey }}
|
||||
{{- else }}
|
||||
value: {{ .Values.email.user | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.email.password (or (eq .Values.email.authStrategy "TLS") (eq .Values.email.authStrategy "SSL")) }}
|
||||
- name: SMTP_PASSWORD
|
||||
{{- if .Values.email.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.email.existingSecret }}
|
||||
key: {{ .Values.email.passwordKey }}
|
||||
{{- else }}
|
||||
value: {{ .Values.email.password | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.enabled }}
|
||||
- name: LDAP_AUTH_ENABLED
|
||||
value: "true"
|
||||
- name: LDAP_SERVER_URL
|
||||
value: {{ .Values.ldap.serverUrl | quote }}
|
||||
- name: LDAP_TLS_INSECURE
|
||||
value: {{ .Values.ldap.tlsInsecure | quote }}
|
||||
{{- if .Values.ldap.tlsCaCertFile }}
|
||||
- name: LDAP_TLS_CACERTFILE
|
||||
value: {{ .Values.ldap.tlsCaCertFile | quote }}
|
||||
{{- end }}
|
||||
- name: LDAP_ENABLE_STARTTLS
|
||||
value: {{ .Values.ldap.enableStartTls | quote }}
|
||||
- name: LDAP_BASE_DN
|
||||
value: {{ .Values.ldap.baseDn | quote }}
|
||||
{{- if .Values.ldap.queryBind }}
|
||||
- name: LDAP_QUERY_BIND
|
||||
value: {{ .Values.ldap.queryBind | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.queryPassword }}
|
||||
- name: LDAP_QUERY_PASSWORD
|
||||
{{- if .Values.ldap.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.ldap.existingSecret }}
|
||||
key: {{ .Values.ldap.passwordKey }}
|
||||
{{- else }}
|
||||
value: {{ .Values.ldap.queryPassword | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.userFilter }}
|
||||
- name: LDAP_USER_FILTER
|
||||
value: {{ .Values.ldap.userFilter | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.adminFilter }}
|
||||
- name: LDAP_ADMIN_FILTER
|
||||
value: {{ .Values.ldap.adminFilter | quote }}
|
||||
{{- end }}
|
||||
- name: LDAP_ID_ATTRIBUTE
|
||||
value: {{ .Values.ldap.idAttribute | quote }}
|
||||
- name: LDAP_NAME_ATTRIBUTE
|
||||
value: {{ .Values.ldap.nameAttribute | quote }}
|
||||
- name: LDAP_MAIL_ATTRIBUTE
|
||||
value: {{ .Values.ldap.mailAttribute | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.enabled }}
|
||||
- name: OIDC_AUTH_ENABLED
|
||||
value: "true"
|
||||
- name: OIDC_SIGNUP_ENABLED
|
||||
value: {{ .Values.oidc.signupEnabled | quote }}
|
||||
- name: OIDC_CONFIGURATION_URL
|
||||
value: {{ .Values.oidc.configurationUrl | quote }}
|
||||
- name: OIDC_CLIENT_ID
|
||||
{{- if .Values.oidc.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.oidc.existingSecret }}
|
||||
key: {{ .Values.oidc.clientIdKey }}
|
||||
{{- else }}
|
||||
value: {{ .Values.oidc.clientId | quote }}
|
||||
{{- end }}
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
{{- if .Values.oidc.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.oidc.existingSecret }}
|
||||
key: {{ .Values.oidc.clientSecretKey }}
|
||||
{{- else }}
|
||||
value: {{ .Values.oidc.clientSecret | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.userGroup }}
|
||||
- name: OIDC_USER_GROUP
|
||||
value: {{ .Values.oidc.userGroup | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.adminGroup }}
|
||||
- name: OIDC_ADMIN_GROUP
|
||||
value: {{ .Values.oidc.adminGroup | quote }}
|
||||
{{- end }}
|
||||
- name: OIDC_AUTO_REDIRECT
|
||||
value: {{ .Values.oidc.autoRedirect | quote }}
|
||||
- name: OIDC_PROVIDER_NAME
|
||||
value: {{ .Values.oidc.providerName | quote }}
|
||||
- name: OIDC_REMEMBER_ME
|
||||
value: {{ .Values.oidc.rememberMe | quote }}
|
||||
- name: OIDC_SIGNING_ALGORITHM
|
||||
value: {{ .Values.oidc.signingAlgorithm | quote }}
|
||||
- name: OIDC_USER_CLAIM
|
||||
value: {{ .Values.oidc.userClaim | quote }}
|
||||
- name: OIDC_NAME_CLAIM
|
||||
value: {{ .Values.oidc.nameClaim | quote }}
|
||||
- name: OIDC_GROUPS_CLAIM
|
||||
value: {{ .Values.oidc.groupsClaim | quote }}
|
||||
{{- if .Values.oidc.scopesOverride }}
|
||||
- name: OIDC_SCOPES_OVERRIDE
|
||||
value: {{ .Values.oidc.scopesOverride | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.tlsCaCertFile }}
|
||||
- name: OIDC_TLS_CACERTFILE
|
||||
value: {{ .Values.oidc.tlsCaCertFile | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openai.enabled }}
|
||||
{{- if .Values.openai.baseUrl }}
|
||||
- name: OPENAI_BASE_URL
|
||||
value: {{ .Values.openai.baseUrl | quote }}
|
||||
{{- end }}
|
||||
- name: OPENAI_API_KEY
|
||||
{{- if .Values.openai.existingSecret }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.openai.existingSecret }}
|
||||
key: {{ .Values.openai.apiKeyKey }}
|
||||
{{- else }}
|
||||
value: {{ .Values.openai.apiKey | quote }}
|
||||
{{- end }}
|
||||
- name: OPENAI_MODEL
|
||||
value: {{ .Values.openai.model | quote }}
|
||||
{{- if .Values.openai.customHeaders }}
|
||||
- name: OPENAI_CUSTOM_HEADERS
|
||||
value: {{ .Values.openai.customHeaders | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.openai.customParams }}
|
||||
- name: OPENAI_CUSTOM_PARAMS
|
||||
value: {{ .Values.openai.customParams | quote }}
|
||||
{{- end }}
|
||||
- name: OPENAI_ENABLE_IMAGE_SERVICES
|
||||
value: {{ .Values.openai.enableImageServices | quote }}
|
||||
- name: OPENAI_WORKERS
|
||||
value: {{ .Values.openai.workers | quote }}
|
||||
- name: OPENAI_SEND_DATABASE_DATA
|
||||
value: {{ .Values.openai.sendDatabaseData | quote }}
|
||||
- name: OPENAI_REQUEST_TIMEOUT
|
||||
value: {{ .Values.openai.requestTimeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
{{- if .Values.tls.existingSecret }}
|
||||
- name: TLS_CERTIFICATE_PATH
|
||||
value: "/app/certs/{{ .Values.tls.certificateKey }}"
|
||||
- name: TLS_PRIVATE_KEY_PATH
|
||||
value: "/app/certs/{{ .Values.tls.privateKeyKey }}"
|
||||
{{- else }}
|
||||
- name: TLS_CERTIFICATE_PATH
|
||||
value: {{ .Values.tls.certificatePath | quote }}
|
||||
- name: TLS_PRIVATE_KEY_PATH
|
||||
value: {{ .Values.tls.privateKeyPath | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.theme.light }}
|
||||
- name: THEME_LIGHT_{{ $key | upper }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.theme.dark }}
|
||||
- name: THEME_DARK_{{ $key | upper }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /app/data
|
||||
{{- if and .Values.tls.enabled .Values.tls.existingSecret }}
|
||||
- name: tls-certs
|
||||
mountPath: /app/certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "mealie.fullname" . }}-data
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.tls.enabled .Values.tls.existingSecret }}
|
||||
- name: tls-certs
|
||||
secret:
|
||||
secretName: {{ .Values.tls.existingSecret }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@ -1,43 +0,0 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "mealie.fullname" . }}
|
||||
labels:
|
||||
{{- include "mealie.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.className }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .secretName }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "mealie.fullname" $ }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,21 +0,0 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "mealie.fullname" . }}-data
|
||||
labels:
|
||||
{{- include "mealie.labels" . | nindent 4 }}
|
||||
{{- with .Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode | quote }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- end }}
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "mealie.fullname" . }}
|
||||
labels:
|
||||
{{- include "mealie.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "mealie.selectorLabels" . | nindent 4 }}
|
||||
@ -1,259 +0,0 @@
|
||||
## Global settings
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
## Image settings
|
||||
image:
|
||||
repository: ghcr.io/mealie-recipes/mealie
|
||||
tag: "v3.1.1"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## Deployment settings
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
|
||||
# Pod security settings
|
||||
podSecurityContext:
|
||||
runAsNonRoot: false
|
||||
runAsUser: 911
|
||||
fsGroup: 911
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
## Pod scheduling
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
## Service settings
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 9000
|
||||
|
||||
## Ingress settings
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
hosts:
|
||||
- host: mealie.domain.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- mealie.domain.com
|
||||
|
||||
## Persistence settings
|
||||
persistence:
|
||||
enabled: false
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
annotations: {}
|
||||
|
||||
## Resource limits and requests
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 1000m
|
||||
# memory: 1000Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 256Mi
|
||||
|
||||
## Application health checks
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
path: /
|
||||
readiness:
|
||||
enabled: true
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
path: /
|
||||
|
||||
## Autoscaling configuration
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 3
|
||||
targetCPUUtilizationPercentage: 80
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
## Environment variables
|
||||
env:
|
||||
# General Settings
|
||||
PUID: "911"
|
||||
PGID: "911"
|
||||
DEFAULT_GROUP: "Home"
|
||||
DEFAULT_HOUSEHOLD: "Family"
|
||||
BASE_URL: "http://localhost:9000"
|
||||
TOKEN_TIME: "48"
|
||||
API_PORT: "9000"
|
||||
API_DOCS: "true"
|
||||
TZ: "UTC"
|
||||
ALLOW_SIGNUP: "false"
|
||||
ALLOW_PASSWORD_LOGIN: "true"
|
||||
LOG_LEVEL: "info"
|
||||
DAILY_SCHEDULE_TIME: "23:45"
|
||||
|
||||
# Security
|
||||
SECURITY_MAX_LOGIN_ATTEMPTS: "5"
|
||||
SECURITY_USER_LOCKOUT_TIME: "24"
|
||||
|
||||
# Database
|
||||
DB_ENGINE: "postgres" # postgres or sqlite
|
||||
|
||||
# Webworker
|
||||
UVICORN_WORKERS: "1"
|
||||
|
||||
# Extra environment variables (for advanced use cases)
|
||||
extraEnv: []
|
||||
# - name: POSTGRES_USER
|
||||
# value: "mealie"
|
||||
# - name: POSTGRES_PASSWORD
|
||||
# value: "mealie"
|
||||
# - name: POSTGRES_SERVER
|
||||
# value: "postgres"
|
||||
# - name: POSTGRES_PORT
|
||||
# value: "5432"
|
||||
# - name: POSTGRES_DB
|
||||
# value: "mealie"
|
||||
|
||||
# Extra volume mounts
|
||||
extraVolumeMounts: []
|
||||
|
||||
# Extra volumes
|
||||
extraVolumes: []
|
||||
|
||||
## PostgreSQL configuration (when using external database)
|
||||
postgresql:
|
||||
enabled: false
|
||||
# External PostgreSQL settings
|
||||
external:
|
||||
enabled: false
|
||||
host: ""
|
||||
port: 5432
|
||||
database: "mealie"
|
||||
user: "mealie"
|
||||
password: ""
|
||||
# Use existing secret for database credentials
|
||||
existingSecret: ""
|
||||
userKey: "username"
|
||||
passwordKey: "password"
|
||||
|
||||
## SMTP Email configuration
|
||||
email:
|
||||
enabled: false
|
||||
host: ""
|
||||
port: 587
|
||||
fromName: "Mealie"
|
||||
authStrategy: "TLS" # TLS, SSL, NONE
|
||||
fromEmail: ""
|
||||
user: ""
|
||||
password: ""
|
||||
# Use existing secret for SMTP credentials
|
||||
existingSecret: ""
|
||||
userKey: "smtp-user"
|
||||
passwordKey: "smtp-password"
|
||||
|
||||
## LDAP Authentication
|
||||
ldap:
|
||||
enabled: false
|
||||
serverUrl: ""
|
||||
tlsInsecure: false
|
||||
tlsCaCertFile: ""
|
||||
enableStartTls: false
|
||||
baseDn: ""
|
||||
queryBind: ""
|
||||
queryPassword: ""
|
||||
userFilter: ""
|
||||
adminFilter: ""
|
||||
idAttribute: "uid"
|
||||
nameAttribute: "name"
|
||||
mailAttribute: "mail"
|
||||
# Use existing secret for LDAP credentials
|
||||
existingSecret: ""
|
||||
passwordKey: "ldap-password"
|
||||
|
||||
## OpenID Connect (OIDC)
|
||||
oidc:
|
||||
enabled: false
|
||||
signupEnabled: true
|
||||
configurationUrl: ""
|
||||
clientId: ""
|
||||
clientSecret: ""
|
||||
userGroup: ""
|
||||
adminGroup: ""
|
||||
autoRedirect: false
|
||||
providerName: "OAuth"
|
||||
rememberMe: false
|
||||
signingAlgorithm: "RS256"
|
||||
userClaim: "email"
|
||||
nameClaim: "name"
|
||||
groupsClaim: "groups"
|
||||
scopesOverride: ""
|
||||
tlsCaCertFile: ""
|
||||
# Use existing secret for OIDC credentials
|
||||
existingSecret: ""
|
||||
clientIdKey: "oidc-client-id"
|
||||
clientSecretKey: "oidc-client-secret"
|
||||
|
||||
## OpenAI Integration
|
||||
openai:
|
||||
enabled: false
|
||||
baseUrl: ""
|
||||
apiKey: ""
|
||||
model: "gpt-4o"
|
||||
customHeaders: ""
|
||||
customParams: ""
|
||||
enableImageServices: true
|
||||
workers: 2
|
||||
sendDatabaseData: true
|
||||
requestTimeout: 60
|
||||
# Use existing secret for OpenAI API key
|
||||
existingSecret: ""
|
||||
apiKeyKey: "openai-api-key"
|
||||
|
||||
## TLS Configuration
|
||||
tls:
|
||||
enabled: false
|
||||
certificatePath: ""
|
||||
privateKeyPath: ""
|
||||
# Use existing secret for TLS certificates
|
||||
existingSecret: ""
|
||||
certificateKey: "tls.crt"
|
||||
privateKeyKey: "tls.key"
|
||||
|
||||
## Theming
|
||||
theme:
|
||||
light:
|
||||
primary: "#E58325"
|
||||
accent: "#007A99"
|
||||
secondary: "#973542"
|
||||
success: "#43A047"
|
||||
info: "#1976D2"
|
||||
warning: "#FF6D00"
|
||||
error: "#EF5350"
|
||||
dark:
|
||||
primary: "#E58325"
|
||||
accent: "#007A99"
|
||||
secondary: "#973542"
|
||||
success: "#43A047"
|
||||
info: "#1976D2"
|
||||
warning: "#FF6D00"
|
||||
error: "#EF5350"
|
||||
@ -1,18 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: qbittorrent-vpn
|
||||
description: qBittorrent with Gluetun VPN sidecar for Kubernetes
|
||||
type: application
|
||||
version: 0.0.1
|
||||
appVersion: 5.1.0
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: richard.tomik@proton.me
|
||||
keywords:
|
||||
- qbittorrent
|
||||
- vpn
|
||||
- gluetun
|
||||
- torrent
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
sources:
|
||||
- https://github.com/linuxserver/docker-qbittorrent
|
||||
- https://github.com/qdm12/gluetun
|
||||
@ -1,38 +0,0 @@
|
||||
Thank you for installing {{ .Chart.Name }}.
|
||||
|
||||
Your qBittorrent with VPN has been deployed successfully!
|
||||
|
||||
1. Get the application URL:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "qbittorrent-vpn.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "qbittorrent-vpn.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "qbittorrent-vpn.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "qbittorrent-vpn.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
|
||||
Visit http://127.0.0.1:{{ .Values.service.port }} to access qBittorrent
|
||||
{{- end }}
|
||||
|
||||
2. VPN Status:
|
||||
To check the VPN connection status:
|
||||
kubectl exec -it -n {{ .Release.Namespace }} deployment/{{ include "qbittorrent-vpn.fullname" . }} -c gluetun -- curl -s http://localhost:8000/v1/vpn/status
|
||||
|
||||
3. Public IP:
|
||||
To check your current public IP through the VPN:
|
||||
kubectl exec -it -n {{ .Release.Namespace }} deployment/{{ include "qbittorrent-vpn.fullname" . }} -c gluetun -- curl -s http://localhost:8000/v1/publicip/ip
|
||||
|
||||
4. Verify qBittorrent:
|
||||
Make sure qBittorrent is functioning by accessing the Web UI at the URL in step 1.
|
||||
|
||||
For more information about this chart:
|
||||
https://github.com/rtomik/helm-charts/tree/main/charts/qbittorrent-vpn
|
||||
@ -1,273 +0,0 @@
|
||||
# qBittorrent with Gluetun VPN
|
||||
|
||||
A Helm chart for deploying qBittorrent with a Gluetun VPN sidecar container on Kubernetes.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart deploys [qBittorrent](https://www.qbittorrent.org/) alongside [Gluetun](https://github.com/qdm12/gluetun), a VPN client/tunnel in a container, to ensure all BitTorrent traffic is routed through the VPN. The chart supports all major VPN providers and protocols through Gluetun's comprehensive compatibility.
|
||||
|
||||
Source code can be found here:
|
||||
- https://github.com/rtomik/helm-charts/tree/main/charts/qbittorrent-vpn
|
||||
|
||||
Note: Currently only tested with NordVPN an OpenVPN configuration.
|
||||
|
||||
## Features
|
||||
|
||||
- **Multiple VPN Providers**: Support for 30+ VPN providers including NordVPN, ProtonVPN, Private Internet Access, ExpressVPN, Surfshark, Mullvad, and more
|
||||
- **Protocol Support**: Use OpenVPN or WireGuard based on your provider's capabilities
|
||||
- **Server Selection**: Choose servers by country, city, or specific hostnames with optional randomization
|
||||
- **Security**: Proper container security settings to ensure traffic only flows through the VPN
|
||||
- **Health Monitoring**: Integrated health checks for both qBittorrent and the VPN connection
|
||||
- **Persistence**: Separate volume storage for configuration and downloads
|
||||
- **Web UI**: Access qBittorrent via web interface with optional ingress support
|
||||
- **Proxy Services**: HTTP and Shadowsocks proxies for additional devices to use the VPN tunnel
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.2.0+
|
||||
- PV provisioner support in the cluster
|
||||
- A valid subscription to a VPN service
|
||||
|
||||
## Installation
|
||||
|
||||
### Add the Repository
|
||||
|
||||
```bash
|
||||
helm repo add rtomik-charts https://rtomik.github.io/helm-charts
|
||||
helm repo update
|
||||
```
|
||||
|
||||
### Create a Secret for VPN Credentials
|
||||
|
||||
For better security, store your VPN credentials in a Kubernetes secret:
|
||||
|
||||
```bash
|
||||
# For OpenVPN authentication
|
||||
kubectl create secret generic vpn-credentials \
|
||||
--namespace default \
|
||||
--from-literal=username='your-vpn-username' \
|
||||
--from-literal=password='your-vpn-password'
|
||||
|
||||
# For WireGuard authentication (if using WireGuard)
|
||||
kubectl create secret generic wireguard-keys \
|
||||
--namespace default \
|
||||
--from-literal=private_key='your-wireguard-private-key'
|
||||
```
|
||||
|
||||
Then reference this secret in your values:
|
||||
|
||||
```yaml
|
||||
gluetun:
|
||||
credentials:
|
||||
create: false
|
||||
existingSecret: "vpn-credentials"
|
||||
usernameKey: "username"
|
||||
passwordKey: "password"
|
||||
```
|
||||
|
||||
### Install the Chart
|
||||
|
||||
```bash
|
||||
# Option 1: Installation with custom values file (recommended)
|
||||
helm install qbittorrent-vpn rtomik-charts/qbittorrent-vpn -f values.yaml -n media
|
||||
|
||||
# Option 2: Installation with inline parameter overrides
|
||||
helm install qbittorrent-vpn rtomik-charts/qbittorrent-vpn -n media \
|
||||
--set gluetun.vpn.provider=nordvpn \
|
||||
--set gluetun.vpn.serverCountries=Germany \
|
||||
--set-string gluetun.credentials.existingSecret=vpn-credentials
|
||||
```
|
||||
|
||||
## Uninstallation
|
||||
|
||||
```bash
|
||||
helm uninstall qbittorrent-vpn -n media
|
||||
```
|
||||
|
||||
Note: This will not delete Persistent Volume Claims. To delete them:
|
||||
|
||||
```bash
|
||||
kubectl delete pvc -l app.kubernetes.io/instance=qbittorrent-vpn
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### Key Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|---------------------------------------|-------------------------------------------------------|----------------------------|
|
||||
| `qbittorrent.image.repository` | qBittorrent image repository | `linuxserver/qbittorrent` |
|
||||
| `qbittorrent.image.tag` | qBittorrent image tag | `latest` |
|
||||
| `gluetun.image.repository` | Gluetun image repository | `qmcgaw/gluetun` |
|
||||
| `gluetun.image.tag` | Gluetun image tag | `v3.40.0` |
|
||||
| `gluetun.vpn.provider` | VPN provider name | `nordvpn` |
|
||||
| `gluetun.vpn.type` | VPN protocol (`openvpn` or `wireguard`) | `openvpn` |
|
||||
| `gluetun.vpn.serverCountries` | Countries to connect to (comma-separated) | `Germany` |
|
||||
| `persistence.config.size` | Size of PVC for qBittorrent config | `2Gi` |
|
||||
| `persistence.downloads.size` | Size of PVC for downloads | `100Gi` |
|
||||
| `ingress.enabled` | Enable ingress controller resource | `true` |
|
||||
| `ingress.hosts[0].host` | Hostname for the ingress | `qbittorrent.domain.com` |
|
||||
|
||||
For a complete list of parameters, see the [values.yaml](values.yaml) file.
|
||||
|
||||
### Example: Using with NordVPN
|
||||
|
||||
```yaml
|
||||
gluetun:
|
||||
vpn:
|
||||
provider: "nordvpn"
|
||||
type: "openvpn"
|
||||
serverCountries: "United States"
|
||||
openvpn:
|
||||
NORDVPN_CATEGORY: "P2P" # For torrent-optimized servers
|
||||
credentials:
|
||||
create: true
|
||||
username: "your-nordvpn-username"
|
||||
password: "your-nordvpn-password"
|
||||
```
|
||||
|
||||
### Example: Using with ProtonVPN
|
||||
|
||||
```yaml
|
||||
gluetun:
|
||||
vpn:
|
||||
provider: "protonvpn"
|
||||
type: "openvpn"
|
||||
serverCountries: "Switzerland"
|
||||
openvpn:
|
||||
PROTONVPN_TIER: "2" # 0 is free, 2 is paid (Plus/Visionary)
|
||||
SERVER_FEATURES: "p2p" # For torrent support
|
||||
credentials:
|
||||
create: true
|
||||
username: "protonvpn-username"
|
||||
password: "protonvpn-password"
|
||||
```
|
||||
|
||||
### Example: Using with Private Internet Access
|
||||
|
||||
```yaml
|
||||
gluetun:
|
||||
vpn:
|
||||
provider: "private internet access"
|
||||
type: "openvpn"
|
||||
serverCountries: "US"
|
||||
credentials:
|
||||
create: true
|
||||
username: "pia-username"
|
||||
password: "pia-password"
|
||||
settings:
|
||||
VPN_PORT_FORWARDING: "on" # PIA supports port forwarding
|
||||
```
|
||||
|
||||
## VPN Provider Support
|
||||
|
||||
This chart supports all VPN providers compatible with Gluetun, including:
|
||||
|
||||
- AirVPN
|
||||
- Cyberghost
|
||||
- ExpressVPN
|
||||
- FastestVPN
|
||||
- HideMyAss
|
||||
- IPVanish
|
||||
- IVPN
|
||||
- Mullvad
|
||||
- NordVPN
|
||||
- Perfect Privacy
|
||||
- Private Internet Access (PIA)
|
||||
- PrivateVPN
|
||||
- ProtonVPN
|
||||
- PureVPN
|
||||
- Surfshark
|
||||
- TorGuard
|
||||
- VyprVPN
|
||||
- WeVPN
|
||||
- Windscribe
|
||||
|
||||
For the complete list and provider-specific options, see the [Gluetun Providers Documentation](https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers).
|
||||
|
||||
## Additional Features
|
||||
|
||||
### Accessing the HTTP Proxy
|
||||
|
||||
Gluetun provides an HTTP proxy on port 8888 that can be used by other applications to route traffic through the VPN. To expose this proxy:
|
||||
|
||||
```yaml
|
||||
service:
|
||||
proxies:
|
||||
enabled: true
|
||||
httpPort: 8888
|
||||
socksPort: 8388
|
||||
```
|
||||
|
||||
### Firewall Settings
|
||||
|
||||
By default, the chart enables the Gluetun firewall to prevent leaks if the VPN connection drops. You can customize this:
|
||||
|
||||
```yaml
|
||||
gluetun:
|
||||
settings:
|
||||
FIREWALL: "on"
|
||||
FIREWALL_OUTBOUND_SUBNETS: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
|
||||
```
|
||||
|
||||
### Port Forwarding
|
||||
|
||||
For VPN providers that support port forwarding (like PIA):
|
||||
|
||||
```yaml
|
||||
gluetun:
|
||||
settings:
|
||||
VPN_PORT_FORWARDING: "on"
|
||||
STATUS_FILE: "/tmp/gluetun-status.json"
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### VPN Connection Issues
|
||||
|
||||
If the VPN isn't connecting properly:
|
||||
|
||||
1. Check the Gluetun logs:
|
||||
```bash
|
||||
kubectl logs deployment/qbittorrent-vpn -c gluetun
|
||||
```
|
||||
|
||||
2. Verify your credentials are correct:
|
||||
```bash
|
||||
kubectl describe secret vpn-credentials
|
||||
```
|
||||
|
||||
3. Try setting the log level to debug for more detailed information:
|
||||
```yaml
|
||||
gluetun:
|
||||
extraEnv:
|
||||
- name: LOG_LEVEL
|
||||
value: "debug"
|
||||
```
|
||||
|
||||
### qBittorrent Can't Create Directories
|
||||
|
||||
If you see errors like "Could not create required directory":
|
||||
|
||||
1. Make sure the init container is enabled and properly configured
|
||||
2. Ensure proper `fsGroup` is set in the `podSecurityContext`
|
||||
3. Check that the persistence volume allows the correct permissions
|
||||
|
||||
### Firewall/Security Issues
|
||||
|
||||
If you encounter iptables or network issues:
|
||||
|
||||
1. Ensure the Gluetun container has `privileged: true`
|
||||
2. Verify the `NET_ADMIN` capability is added
|
||||
3. Check that the `/dev/net/tun` device is correctly mounted
|
||||
|
||||
## License
|
||||
|
||||
This chart is licensed under the MIT License.
|
||||
|
||||
## Acknowledgements
|
||||
|
||||
- [Gluetun](https://github.com/qdm12/gluetun) by [qdm12](https://github.com/qdm12)
|
||||
- [LinuxServer.io](https://linuxserver.io/) for the qBittorrent container
|
||||
- The qBittorrent team for the excellent torrent client
|
||||
@ -1,45 +0,0 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "qbittorrent-vpn.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
*/}}
|
||||
{{- define "qbittorrent-vpn.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- printf "%s" $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "qbittorrent-vpn.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "qbittorrent-vpn.labels" -}}
|
||||
helm.sh/chart: {{ include "qbittorrent-vpn.chart" . }}
|
||||
{{ include "qbittorrent-vpn.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "qbittorrent-vpn.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "qbittorrent-vpn.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
@ -1,306 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}
|
||||
labels:
|
||||
{{- include "qbittorrent-vpn.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "qbittorrent-vpn.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: Recreate # Using Recreate instead of RollingUpdate for stateful pods
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "qbittorrent-vpn.selectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
# Add hostNetwork if specified
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: {{ .Values.hostNetwork }}
|
||||
{{- end }}
|
||||
|
||||
# Init containers if needed for directory setup
|
||||
{{- if .Values.initContainers }}
|
||||
initContainers:
|
||||
{{- toYaml .Values.initContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
|
||||
containers:
|
||||
{{- if .Values.gluetun.enabled }}
|
||||
# Gluetun VPN container
|
||||
- name: gluetun
|
||||
image: "{{ .Values.gluetun.image.repository }}:{{ .Values.gluetun.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.gluetun.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.gluetun.securityContext | nindent 12 }}
|
||||
env:
|
||||
# VPN Provider selection - Common settings for all VPN types
|
||||
- name: VPN_SERVICE_PROVIDER
|
||||
value: {{ .Values.gluetun.vpn.provider | quote }}
|
||||
- name: VPN_TYPE
|
||||
value: {{ .Values.gluetun.vpn.type | quote }}
|
||||
- name: SERVER_COUNTRIES
|
||||
value: {{ .Values.gluetun.vpn.serverCountries | quote }}
|
||||
{{- if .Values.gluetun.vpn.serverNames }}
|
||||
- name: SERVER_HOSTNAMES
|
||||
value: {{ .Values.gluetun.vpn.serverNames | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.gluetun.vpn.serverCities }}
|
||||
- name: SERVER_CITIES
|
||||
value: {{ .Values.gluetun.vpn.serverCities | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.gluetun.vpn.randomize }}
|
||||
- name: SERVER_HOSTNAMES_RANDOMIZED
|
||||
value: {{ .Values.gluetun.vpn.randomize | quote }}
|
||||
{{- end }}
|
||||
|
||||
# OpenVPN specific configuration
|
||||
{{- if eq .Values.gluetun.vpn.type "openvpn" }}
|
||||
{{- if .Values.gluetun.credentials.create }}
|
||||
- name: OPENVPN_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
|
||||
key: {{ .Values.gluetun.credentials.usernameKey }}
|
||||
- name: OPENVPN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
|
||||
key: {{ .Values.gluetun.credentials.passwordKey }}
|
||||
{{- else if .Values.gluetun.credentials.existingSecret }}
|
||||
- name: OPENVPN_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.gluetun.credentials.existingSecret }}
|
||||
key: {{ .Values.gluetun.credentials.usernameKey }}
|
||||
- name: OPENVPN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.gluetun.credentials.existingSecret }}
|
||||
key: {{ .Values.gluetun.credentials.passwordKey }}
|
||||
{{- end }}
|
||||
|
||||
# Additional OpenVPN settings
|
||||
{{- with .Values.gluetun.vpn.openvpn }}
|
||||
{{- range $key, $value := . }}
|
||||
- name: {{ $key | upper }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
# WireGuard specific configuration
|
||||
{{- if eq .Values.gluetun.vpn.type "wireguard" }}
|
||||
{{- if and .Values.gluetun.vpn.wireguard.privateKey .Values.gluetun.credentials.create }}
|
||||
- name: WIREGUARD_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
|
||||
key: wireguard_private_key
|
||||
{{- else if and .Values.gluetun.vpn.wireguard.privateKeyExistingSecret .Values.gluetun.vpn.wireguard.privateKeyExistingSecretKey }}
|
||||
- name: WIREGUARD_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.gluetun.vpn.wireguard.privateKeyExistingSecret }}
|
||||
key: {{ .Values.gluetun.vpn.wireguard.privateKeyExistingSecretKey }}
|
||||
{{- end }}
|
||||
|
||||
# Additional WireGuard settings
|
||||
{{- with .Values.gluetun.vpn.wireguard }}
|
||||
{{- if .addresses }}
|
||||
- name: WIREGUARD_ADDRESSES
|
||||
value: {{ .addresses | quote }}
|
||||
{{- end }}
|
||||
{{- if .endpointIP }}
|
||||
- name: WIREGUARD_ENDPOINT_IP
|
||||
value: {{ .endpointIP | quote }}
|
||||
{{- end }}
|
||||
{{- if .endpointPort }}
|
||||
- name: WIREGUARD_ENDPOINT_PORT
|
||||
value: {{ .endpointPort | quote }}
|
||||
{{- end }}
|
||||
{{- if .publicKey }}
|
||||
- name: WIREGUARD_PUBLIC_KEY
|
||||
value: {{ .publicKey | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
# Gluetun general settings
|
||||
{{- with .Values.gluetun.settings }}
|
||||
{{- range $key, $value := . }}
|
||||
- name: {{ $key | upper }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
# Extra environment variables
|
||||
{{- with .Values.gluetun.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
ports:
|
||||
- name: control
|
||||
containerPort: 8000
|
||||
protocol: TCP
|
||||
- name: http-proxy
|
||||
containerPort: 8888
|
||||
protocol: TCP
|
||||
- name: shadowsocks-tcp
|
||||
containerPort: 8388
|
||||
protocol: TCP
|
||||
- name: shadowsocks-udp
|
||||
containerPort: 8388
|
||||
protocol: UDP
|
||||
{{- with .Values.gluetun.extraPorts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
volumeMounts:
|
||||
# Mount tun device for VPN
|
||||
- name: tun
|
||||
mountPath: /dev/net/tun
|
||||
{{- if .Values.gluetun.persistence.enabled }}
|
||||
- name: gluetun-config
|
||||
mountPath: /gluetun
|
||||
{{- end }}
|
||||
{{- with .Values.gluetun.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
resources:
|
||||
{{- toYaml .Values.gluetun.resources | nindent 12 }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
# qBittorrent container
|
||||
- name: qbittorrent
|
||||
image: "{{ .Values.qbittorrent.image.repository }}:{{ .Values.qbittorrent.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.qbittorrent.image.pullPolicy }}
|
||||
{{- if .Values.qbittorrent.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.qbittorrent.securityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.qbittorrent.service.port }}
|
||||
protocol: TCP
|
||||
{{- if .Values.qbittorrent.bittorrentPort }}
|
||||
- name: bittorrent-tcp
|
||||
containerPort: {{ .Values.qbittorrent.bittorrentPort }}
|
||||
protocol: TCP
|
||||
- name: bittorrent-udp
|
||||
containerPort: {{ .Values.qbittorrent.bittorrentPort }}
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.probes.liveness.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.probes.readiness.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
||||
{{- end }}
|
||||
|
||||
env:
|
||||
{{- range .Values.qbittorrent.env }}
|
||||
- name: {{ .name }}
|
||||
value: {{ .value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.qbittorrent.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
volumeMounts:
|
||||
{{- if .Values.qbittorrent.persistence.config.enabled }}
|
||||
- name: config
|
||||
mountPath: {{ .Values.qbittorrent.persistence.config.mountPath }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.qbittorrent.persistence.downloads.enabled }}
|
||||
- name: downloads
|
||||
mountPath: {{ .Values.qbittorrent.persistence.downloads.mountPath }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.qbittorrent.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
resources:
|
||||
{{- toYaml .Values.qbittorrent.resources | nindent 12 }}
|
||||
|
||||
volumes:
|
||||
# Create /dev/net/tun as a device
|
||||
- name: tun
|
||||
hostPath:
|
||||
path: /dev/net/tun
|
||||
type: CharDevice
|
||||
|
||||
{{- if .Values.qbittorrent.persistence.config.enabled }}
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if .Values.qbittorrent.persistence.config.existingClaim }}{{ .Values.qbittorrent.persistence.config.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-config{{ end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.qbittorrent.persistence.downloads.enabled }}
|
||||
- name: downloads
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if .Values.qbittorrent.persistence.downloads.existingClaim }}{{ .Values.qbittorrent.persistence.downloads.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-downloads{{ end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.gluetun.enabled .Values.gluetun.persistence.enabled }}
|
||||
{{- if .Values.gluetun.persistence.useEmptyDir }}
|
||||
- name: gluetun-config
|
||||
emptyDir: {}
|
||||
{{- else }}
|
||||
- name: gluetun-config
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if .Values.gluetun.persistence.existingClaim }}{{ .Values.gluetun.persistence.existingClaim }}{{ else }}{{ include "qbittorrent-vpn.fullname" . }}-gluetun{{ end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@ -1,43 +0,0 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}
|
||||
labels:
|
||||
{{- include "qbittorrent-vpn.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.className }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .secretName }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "qbittorrent-vpn.fullname" $ }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,55 +0,0 @@
|
||||
{{- if and .Values.qbittorrent.persistence.config.enabled (not .Values.qbittorrent.persistence.config.existingClaim) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}-config
|
||||
labels:
|
||||
{{- include "qbittorrent-vpn.labels" . | nindent 4 }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.qbittorrent.persistence.config.accessMode | quote }}
|
||||
{{- if .Values.qbittorrent.persistence.config.storageClass }}
|
||||
storageClassName: {{ .Values.qbittorrent.persistence.config.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.qbittorrent.persistence.config.size | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.qbittorrent.persistence.downloads.enabled (not .Values.qbittorrent.persistence.downloads.existingClaim) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}-downloads
|
||||
labels:
|
||||
{{- include "qbittorrent-vpn.labels" . | nindent 4 }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.qbittorrent.persistence.downloads.accessMode | quote }}
|
||||
{{- if .Values.qbittorrent.persistence.downloads.storageClass }}
|
||||
storageClassName: {{ .Values.qbittorrent.persistence.downloads.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.qbittorrent.persistence.downloads.size | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.gluetun.enabled .Values.gluetun.persistence.enabled (not .Values.gluetun.persistence.useEmptyDir) (not .Values.gluetun.persistence.existingClaim) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}-gluetun
|
||||
labels:
|
||||
{{- include "qbittorrent-vpn.labels" . | nindent 4 }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.gluetun.persistence.accessMode | quote }}
|
||||
{{- if .Values.gluetun.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.gluetun.persistence.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.gluetun.persistence.size | quote }}
|
||||
{{- end }}
|
||||
@ -1,18 +0,0 @@
|
||||
{{- if and .Values.gluetun.enabled .Values.gluetun.credentials.create }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}-vpn-credentials
|
||||
labels:
|
||||
{{- include "qbittorrent-vpn.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if eq .Values.gluetun.vpn.type "openvpn" }}
|
||||
{{ .Values.gluetun.credentials.usernameKey }}: {{ .Values.gluetun.credentials.username | b64enc | quote }}
|
||||
{{ .Values.gluetun.credentials.passwordKey }}: {{ .Values.gluetun.credentials.password | b64enc | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and (eq .Values.gluetun.vpn.type "wireguard") .Values.gluetun.vpn.wireguard.privateKey }}
|
||||
wireguard_private_key: {{ .Values.gluetun.vpn.wireguard.privateKey | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "qbittorrent-vpn.fullname" . }}
|
||||
labels:
|
||||
{{- include "qbittorrent-vpn.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "qbittorrent-vpn.selectorLabels" . | nindent 4 }}
|
||||
@ -1,228 +0,0 @@
|
||||
## Global settings
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
## Deployment settings
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
|
||||
## Pod security settings
|
||||
podSecurityContext:
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0 # Run all containers as root
|
||||
fsGroup: 0 # Use root group for volumes
|
||||
|
||||
## qBittorrent Image settings
|
||||
qbittorrent:
|
||||
image:
|
||||
repository: linuxserver/qbittorrent
|
||||
tag: 5.1.0
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
securityContext: {}
|
||||
|
||||
# Open port for BitTorrent traffic
|
||||
bittorrentPort: 6881
|
||||
|
||||
env:
|
||||
- name: PUID
|
||||
value: "0" # Run as root
|
||||
- name: PGID
|
||||
value: "0" # Root group
|
||||
- name: TZ
|
||||
value: "UTC"
|
||||
- name: WEBUI_PORT
|
||||
value: "8080"
|
||||
|
||||
|
||||
extraEnv: []
|
||||
|
||||
service:
|
||||
port: 8080
|
||||
|
||||
#resources:
|
||||
# limits:
|
||||
# cpu: 1000m
|
||||
# memory: 2Gi
|
||||
# requests:
|
||||
# cpu: 200m
|
||||
# memory: 512Mi
|
||||
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 2Gi
|
||||
mountPath: /config
|
||||
|
||||
downloads:
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 2Gi
|
||||
mountPath: /downloads
|
||||
|
||||
# Volume mounts specific to qBittorrent
|
||||
extraVolumeMounts: []
|
||||
|
||||
# Volumes specific to qBittorrent
|
||||
extraVolumes: []
|
||||
|
||||
# Probes for qBittorrent
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
path: /
|
||||
initialDelaySeconds: 0 # Startup probe handles delayed start
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
|
||||
readiness:
|
||||
enabled: true
|
||||
path: /
|
||||
initialDelaySeconds: 0 # Startup probe handles delayed start
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
|
||||
## Gluetun VPN settings
|
||||
gluetun:
|
||||
enabled: true
|
||||
image:
|
||||
repository: qmcgaw/gluetun
|
||||
tag: v3.40.0 # Latest version as of this writing
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
securityContext:
|
||||
privileged: true
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
|
||||
# VPN provider configuration
|
||||
vpn:
|
||||
# Choose from: nordvpn, protonvpn, expressvpn, surfshark, mullvad, ivpn, private internet access, etc.
|
||||
provider: "nordvpn"
|
||||
|
||||
# Choose from: openvpn or wireguard
|
||||
type: "openvpn"
|
||||
|
||||
# Server selection (comma-separated lists)
|
||||
serverCountries: "Netherlands" # e.g., "Netherlands,Germany,Sweden"
|
||||
serverCities: "" # e.g., "Amsterdam,Frankfurt" (optional)
|
||||
serverNames: "" # e.g., "nl1,nl2" (optional)
|
||||
randomize: "true" # Randomize server selection
|
||||
|
||||
# OpenVPN specific settings (when type is "openvpn")
|
||||
openvpn:
|
||||
# Add any OpenVPN specific settings here, they'll be converted to env vars
|
||||
OPENVPN_PROTOCOL: "udp"
|
||||
|
||||
# WireGuard specific settings (when type is "wireguard")
|
||||
wireguard:
|
||||
privateKey: "" # Will be stored in Secret if provided
|
||||
privateKeyExistingSecret: ""
|
||||
privateKeyExistingSecretKey: ""
|
||||
addresses: "" # e.g., "10.64.222.21/32"
|
||||
endpointIP: "" # Optional: specify endpoint IP
|
||||
endpointPort: "" # Optional: specify endpoint port
|
||||
publicKey: "" # Optional: server public key
|
||||
|
||||
# VPN credentials (choose one method)
|
||||
credentials:
|
||||
create: true # set to false if using existing secret
|
||||
# For OpenVPN (normal credentials)
|
||||
username: ""
|
||||
password: ""
|
||||
# For WireGuard, the privateKey is specified in vpn.wireguard.privateKey
|
||||
|
||||
# Alternatively, reference an existing secret
|
||||
existingSecret: ""
|
||||
usernameKey: "username"
|
||||
passwordKey: "password"
|
||||
|
||||
# General Gluetun settings as environment variables
|
||||
settings:
|
||||
FIREWALL: "on"
|
||||
FIREWALL_OUTBOUND_SUBNETS: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
|
||||
DNS_ADDRESS: "1.1.1.1"
|
||||
HEALTH_SERVER_PORT: "8000"
|
||||
|
||||
# Important: Add these settings to make networking work correctly with ingress
|
||||
SERVER_ALLOWLIST: "qbittorrent:8080" # Allow accessing qBittorrent container
|
||||
FIREWALL_INPUT_PORTS: "8080" # Allow ingress traffic to port 8080
|
||||
FIREWALL_DEBUG: "on" # Enable firewall debugging (temporarily)
|
||||
JOURNALD: "off" # Disable journald (not needed for debugging)
|
||||
|
||||
# Optional port forwarding
|
||||
VPN_PORT_FORWARDING: "off"
|
||||
|
||||
# Extra environment variables
|
||||
extraEnv:
|
||||
- name: LOG_LEVEL
|
||||
value: "info"
|
||||
|
||||
# Extra ports to expose
|
||||
extraPorts: []
|
||||
# - name: custom-port
|
||||
# containerPort: 9999
|
||||
# protocol: TCP
|
||||
|
||||
# Resources for Gluetun
|
||||
resources:
|
||||
limits:
|
||||
cpu: 300m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
# Persistence for Gluetun
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: false
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 100Mi
|
||||
|
||||
# Volume mounts specific to Gluetun
|
||||
extraVolumeMounts: []
|
||||
|
||||
# Volumes specific to Gluetun
|
||||
extraVolumes: []
|
||||
|
||||
## Service settings
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8080
|
||||
|
||||
## Ingress settings
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations: []
|
||||
hosts:
|
||||
- host: qbittorrent.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- qbittorrent.example.com
|
||||
|
||||
# Additional specifications
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
podAnnotations: {}
|
||||
extraVolumes: []
|
||||
|
||||
# Temporary options for development/debugging
|
||||
hostNetwork: false
|
||||
initContainers: []
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: recipya
|
||||
description: Recipya helm chart for Kubernetes
|
||||
type: application
|
||||
version: 0.0.2
|
||||
appVersion: "v1.2.2"
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: no@m.com
|
||||
keywords:
|
||||
- recipe-manager
|
||||
- recipya
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
sources:
|
||||
- https://github.com/reaper47/recipya
|
||||
@ -1,199 +0,0 @@
|
||||
# Recipya Helm Chart
|
||||
|
||||
A Helm chart for deploying [Recipya](https://github.com/reaper47/recipya) on Kubernetes.
|
||||
|
||||
[Source Code](https://github.com/rtomik/helm-charts/tree/main/charts%2Frecipya)
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart deploys Recipya recipe manager on a Kubernetes cluster using the Helm package manager.
|
||||
|
||||
Source code can be found here:
|
||||
- https://github.com/rtomik/helm-charts/tree/main/charts/recipya
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.2.0+
|
||||
- PV provisioner support in the underlying infrastructure (if persistence is needed)
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `recipya`:
|
||||
|
||||
```bash
|
||||
helm repo add recipya-chart https://rtomik.github.io/helm-charts
|
||||
helm install recipya recipya-chart/recipya -n recipya
|
||||
```
|
||||
|
||||
The command deploys Recipya on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `recipya` deployment:
|
||||
|
||||
```bash
|
||||
helm uninstall recipya -n recipya
|
||||
```
|
||||
|
||||
## Important Configuration Notes
|
||||
|
||||
### Server URL
|
||||
|
||||
When deploying with an ingress, it's **critical** to set `config.server.url` to match your ingress URL (including https if you're using TLS). This ensures that redirects after login work correctly:
|
||||
|
||||
```yaml
|
||||
config:
|
||||
server:
|
||||
url: "https://your-recipya-domain.com"
|
||||
```
|
||||
|
||||
### Ingress Configuration
|
||||
|
||||
This chart includes optimized ingress configurations for Traefik, with support for WebSockets and proper security headers. If you're using a different ingress controller, you may need to adjust annotations accordingly.
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------|--------------------------------------|-----------------|
|
||||
| `image.repository` | Recipya image repository | `reaper99/recipya` |
|
||||
| `image.tag` | Recipya image tag | `v1.2.2` |
|
||||
| `image.pullPolicy` | Recipya image pull policy | `IfNotPresent` |
|
||||
| `replicaCount` | Number of Recipya replicas | `1` |
|
||||
| `revisionHistoryLimit` | Number of revisions to keep | `3` |
|
||||
|
||||
### Security parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-----------------------------------------|--------------------------------------------------|-----------|
|
||||
| `podSecurityContext.fsGroup` | Group ID for the Recipya container | `1000` |
|
||||
| `containerSecurityContext` | Security context for the container | `{}` |
|
||||
|
||||
### Recipya configuration parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-----------------------------------------|-------------------------------------------------------|---------------------|
|
||||
| `config.server.port` | Server port | `8078` |
|
||||
| `config.server.autologin` | Whether to login automatically | `false` |
|
||||
| `config.server.is_demo` | Whether the app is a demo version | `false` |
|
||||
| `config.server.is_prod` | Whether the app is in production | `false` |
|
||||
| `config.server.no_signups` | Whether to disable user account registrations | `false` |
|
||||
| `config.server.url` | Base URL for the application | `http://0.0.0.0` |
|
||||
| `config.email.address` | The email address for SendGrid | `""` |
|
||||
| `config.email.sendgrid` | SendGrid API key | `""` |
|
||||
| `config.documentIntelligence.endpoint` | Azure Document Intelligence endpoint | `""` |
|
||||
| `config.documentIntelligence.key` | Azure Document Intelligence key | `""` |
|
||||
|
||||
### Service parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------|--------------------------------------------------|-------------|
|
||||
| `service.type` | Recipya service type | `ClusterIP` |
|
||||
| `service.port` | Recipya service port | `8078` |
|
||||
|
||||
### Ingress parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------------|--------------------------------------------------|------------------------|
|
||||
| `ingress.enabled` | Enable ingress controller resource | `false` |
|
||||
| `ingress.className` | IngressClass that will be used | `"traefik"` |
|
||||
| `ingress.annotations` | Additional ingress annotations | See values.yaml |
|
||||
| `ingress.hosts[0].host` | Default host for the ingress resource | `chart-example.local` |
|
||||
| `ingress.tls` | TLS configuration | `[]` |
|
||||
|
||||
### Persistence parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------------------|------------------------------------------|------------------|
|
||||
| `persistence.enabled` | Enable persistence using PVC | `true` |
|
||||
| `persistence.accessMode` | PVC Access Mode | `ReadWriteOnce` |
|
||||
| `persistence.size` | PVC Storage Request | `1Gi` |
|
||||
| `persistence.storageClass` | Storage class of backing PVC | `""` |
|
||||
|
||||
### Resource parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|-------------------------------|------------------------------------------|-----------|
|
||||
| `resources.limits.cpu` | CPU limit | `500m` |
|
||||
| `resources.limits.memory` | Memory limit | `512Mi` |
|
||||
| `resources.requests.cpu` | CPU request | `100m` |
|
||||
| `resources.requests.memory` | Memory request | `128Mi` |
|
||||
|
||||
### Probe parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
|--------------------------------------|--------------------------------------------|-----------|
|
||||
| `probes.liveness.enabled` | Enable liveness probe | `true` |
|
||||
| `probes.liveness.path` | Path for liveness probe | `/` |
|
||||
| `probes.readiness.enabled` | Enable readiness probe | `true` |
|
||||
| `probes.readiness.path` | Path for readiness probe | `/` |
|
||||
|
||||
## Traefik Ingress Configuration
|
||||
|
||||
The chart includes specially configured middlewares for Traefik to ensure proper functioning of Recipya:
|
||||
|
||||
```yaml
|
||||
ingress:
|
||||
enabled: true
|
||||
className: "traefik"
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
traefik.ingress.kubernetes.io/router.middlewares: recipya-recipya-headers@kubernetescrd
|
||||
traefik.ingress.kubernetes.io/service.sticky: "true"
|
||||
traefik.ingress.kubernetes.io/session-cookie-name: "recipya_session"
|
||||
hosts:
|
||||
- host: recipya.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- hosts:
|
||||
- recipya.example.com
|
||||
```
|
||||
|
||||
This configuration includes:
|
||||
|
||||
1. Custom Content Security Policy allowing essential scripts from unpkg.com
|
||||
2. Sticky sessions for maintaining authentication
|
||||
3. Proper headers for proxy operation
|
||||
|
||||
## Content Security Policy Configuration
|
||||
|
||||
The chart includes a custom middleware that configures the proper Content Security Policy for Recipya. This is particularly important as the application requires access to external scripts from unpkg.com:
|
||||
|
||||
```yaml
|
||||
contentSecurityPolicy: >-
|
||||
default-src 'self';
|
||||
script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://unpkg.com;
|
||||
style-src 'self' 'unsafe-inline';
|
||||
img-src 'self' data: blob:;
|
||||
font-src 'self' data:;
|
||||
connect-src 'self' ws: wss: *;
|
||||
worker-src 'self' blob:;
|
||||
frame-src 'self';
|
||||
media-src 'self' blob:;
|
||||
object-src 'none';
|
||||
form-action 'self';
|
||||
```
|
||||
|
||||
## Using Existing Secrets
|
||||
|
||||
If you want to use existing secrets for sensitive data:
|
||||
|
||||
```yaml
|
||||
config:
|
||||
email:
|
||||
existingSecret: "my-email-secret"
|
||||
addressKey: "email"
|
||||
sendgridKey: "sendgrid"
|
||||
documentIntelligence:
|
||||
existingSecret: "my-di-secret"
|
||||
endpointKey: "di_endpoint"
|
||||
keyKey: "di_key"
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
See the [Recipya documentation](https://recipes.musicavis.ca/docs/installation/docker/#environment-variables) for details on all available configuration options.
|
||||
@ -1,62 +0,0 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "recipya.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "recipya.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "recipya.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "recipya.labels" -}}
|
||||
helm.sh/chart: {{ include "recipya.chart" . }}
|
||||
{{ include "recipya.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "recipya.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "recipya.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "recipya.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "recipya.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,73 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "recipya.fullname" . }}-init-script
|
||||
labels:
|
||||
{{- include "recipya.labels" . | nindent 4 }}
|
||||
data:
|
||||
init.sh: |
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
CONFIG_DIR="/home/recipya/.config/Recipya"
|
||||
CONFIG_FILE="$CONFIG_DIR/config.json"
|
||||
TARGET_PORT={{ .Values.config.server.port }}
|
||||
|
||||
echo "Starting initialization with port $TARGET_PORT..."
|
||||
|
||||
# Create directories if they don't exist
|
||||
mkdir -p $CONFIG_DIR/Backup
|
||||
mkdir -p $CONFIG_DIR/Database
|
||||
mkdir -p $CONFIG_DIR/Images
|
||||
mkdir -p $CONFIG_DIR/Logs
|
||||
mkdir -p $CONFIG_DIR/Videos
|
||||
|
||||
echo "Directories created."
|
||||
|
||||
# Create config.json if it doesn't exist or update the existing one
|
||||
if [ -f "$CONFIG_FILE" ]; then
|
||||
echo "Found existing config.json, updating port to $TARGET_PORT"
|
||||
# Use jq to modify the port in the existing config file
|
||||
TMP_FILE=$(mktemp)
|
||||
cat $CONFIG_FILE | jq ".server.port = $TARGET_PORT" > $TMP_FILE
|
||||
mv $TMP_FILE $CONFIG_FILE
|
||||
else
|
||||
echo "Creating new config.json with port $TARGET_PORT"
|
||||
# Create a new config.json with default values and the specified port
|
||||
cat > $CONFIG_FILE << EOF
|
||||
{
|
||||
"email": {
|
||||
"from": "{{ .Values.config.email.address | default "" }}",
|
||||
"sendGridAPIKey": "{{ .Values.config.email.sendgrid | default "" }}"
|
||||
},
|
||||
"integrations": {
|
||||
"azureDocumentIntelligence": {
|
||||
"endpoint": "{{ .Values.config.documentIntelligence.endpoint | default "" }}",
|
||||
"key": "{{ .Values.config.documentIntelligence.key | default "" }}"
|
||||
}
|
||||
},
|
||||
"server": {
|
||||
"autologin": {{ .Values.config.server.autologin }},
|
||||
"bypassGuide": false,
|
||||
"isDemo": {{ .Values.config.server.is_demo }},
|
||||
"noSignups": {{ .Values.config.server.no_signups }},
|
||||
"isProduction": {{ .Values.config.server.is_prod }},
|
||||
"port": $TARGET_PORT,
|
||||
"url": "{{ .Values.config.server.url }}"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
fi
|
||||
|
||||
# Set permissions using numeric IDs
|
||||
echo "Setting permissions..."
|
||||
chmod -R 755 $CONFIG_DIR
|
||||
find $CONFIG_DIR -type f -exec chmod 644 {} \;
|
||||
find $CONFIG_DIR -type d -exec chmod 755 {} \;
|
||||
|
||||
# Change ownership by numeric ID
|
||||
echo "Changing ownership to 1000:1000..."
|
||||
chown -R 1000:1000 $CONFIG_DIR
|
||||
|
||||
echo "Configuration completed successfully."
|
||||
ls -la $CONFIG_DIR
|
||||
@ -1,226 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "recipya.fullname" . }}
|
||||
labels:
|
||||
{{- include "recipya.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
checksum/init-script: {{ include (print $.Template.BasePath "/configmap-init-script.yaml") . | sha256sum }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "recipya.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "recipya.selectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
# Set security context for the pod
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
|
||||
# Init container to configure the application
|
||||
initContainers:
|
||||
- name: init-config
|
||||
image: alpine:3.18
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
echo "Installing jq..."
|
||||
apk add --no-cache jq
|
||||
echo "Running initialization script..."
|
||||
/scripts/init.sh
|
||||
securityContext:
|
||||
runAsUser: 0 # Run as root to modify config files
|
||||
runAsGroup: 0
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /home/recipya/.config/Recipya
|
||||
- name: init-script
|
||||
mountPath: /scripts
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
# Main application container
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if .Values.startupArgs }}
|
||||
args:
|
||||
{{- range .Values.startupArgs }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.service.port }}
|
||||
protocol: TCP
|
||||
{{- if .Values.probes.liveness.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.liveness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.probes.readiness.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.probes.readiness.path }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
||||
{{- end }}
|
||||
env:
|
||||
# Critical environment variables for proper directory structure
|
||||
- name: HOME
|
||||
value: "/home/recipya"
|
||||
- name: RECIPYA_SERVER_URL
|
||||
value: {{ .Values.config.server.url | quote }}
|
||||
- name: RECIPYA_SERVER_AUTOLOGIN
|
||||
value: {{ .Values.config.server.autologin | quote }}
|
||||
- name: RECIPYA_SERVER_IS_DEMO
|
||||
value: {{ .Values.config.server.is_demo | quote }}
|
||||
- name: RECIPYA_SERVER_IS_PROD
|
||||
value: {{ .Values.config.server.is_prod | quote }}
|
||||
- name: RECIPYA_SERVER_NO_SIGNUPS
|
||||
value: {{ .Values.config.server.no_signups | quote }}
|
||||
|
||||
{{- if .Values.config.email.existingSecret }}
|
||||
- name: RECIPYA_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.config.email.existingSecret }}
|
||||
key: {{ .Values.config.email.addressKey }}
|
||||
- name: RECIPYA_EMAIL_SENDGRID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.config.email.existingSecret }}
|
||||
key: {{ .Values.config.email.sendgridKey }}
|
||||
{{- else }}
|
||||
{{- if .Values.config.email.address }}
|
||||
- name: RECIPYA_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "recipya.fullname" . }}-secrets
|
||||
key: {{ .Values.config.email.addressKey }}
|
||||
optional: true
|
||||
{{- end }}
|
||||
{{- if .Values.config.email.sendgrid }}
|
||||
- name: RECIPYA_EMAIL_SENDGRID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "recipya.fullname" . }}-secrets
|
||||
key: {{ .Values.config.email.sendgridKey }}
|
||||
optional: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.config.documentIntelligence.existingSecret }}
|
||||
- name: RECIPYA_DI_ENDPOINT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.config.documentIntelligence.existingSecret }}
|
||||
key: {{ .Values.config.documentIntelligence.endpointKey }}
|
||||
- name: RECIPYA_DI_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.config.documentIntelligence.existingSecret }}
|
||||
key: {{ .Values.config.documentIntelligence.keyKey }}
|
||||
{{- else }}
|
||||
{{- if .Values.config.documentIntelligence.endpoint }}
|
||||
- name: RECIPYA_DI_ENDPOINT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "recipya.fullname" . }}-secrets
|
||||
key: {{ .Values.config.documentIntelligence.endpointKey }}
|
||||
optional: true
|
||||
{{- end }}
|
||||
{{- if .Values.config.documentIntelligence.key }}
|
||||
- name: RECIPYA_DI_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "recipya.fullname" . }}-secrets
|
||||
key: {{ .Values.config.documentIntelligence.keyKey }}
|
||||
optional: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- range .Values.env }}
|
||||
- name: {{ .name }}
|
||||
value: {{ .value | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /home/recipya/.config/Recipya
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "recipya.fullname" . }}-data
|
||||
- name: init-script
|
||||
configMap:
|
||||
name: {{ include "recipya.fullname" . }}-init-script
|
||||
defaultMode: 0755
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@ -1,43 +0,0 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "recipya.fullname" . }}
|
||||
labels:
|
||||
{{- include "recipya.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.className }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .secretName }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "recipya.fullname" $ }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,24 +0,0 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "recipya.fullname" . }}-data
|
||||
labels:
|
||||
{{- include "recipya.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- if .Values.persistence.retain }}
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode | quote }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- end }}
|
||||
@ -1,28 +0,0 @@
|
||||
{{- $createSecret := or (and (not .Values.config.email.existingSecret) (or .Values.config.email.address .Values.config.email.sendgrid)) (and (not .Values.config.documentIntelligence.existingSecret) (or .Values.config.documentIntelligence.endpoint .Values.config.documentIntelligence.key)) -}}
|
||||
{{- if $createSecret }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "recipya.fullname" . }}-secrets
|
||||
labels:
|
||||
{{- include "recipya.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if not .Values.config.email.existingSecret }}
|
||||
{{- if .Values.config.email.address }}
|
||||
{{ .Values.config.email.addressKey }}: {{ .Values.config.email.address | b64enc }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.email.sendgrid }}
|
||||
{{ .Values.config.email.sendgridKey }}: {{ .Values.config.email.sendgrid | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.config.documentIntelligence.existingSecret }}
|
||||
{{- if .Values.config.documentIntelligence.endpoint }}
|
||||
{{ .Values.config.documentIntelligence.endpointKey }}: {{ .Values.config.documentIntelligence.endpoint | b64enc }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.documentIntelligence.key }}
|
||||
{{ .Values.config.documentIntelligence.keyKey }}: {{ .Values.config.documentIntelligence.key | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "recipya.fullname" . }}
|
||||
labels:
|
||||
{{- include "recipya.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "recipya.selectorLabels" . | nindent 4 }}
|
||||
@ -1,133 +0,0 @@
|
||||
# Default values for recipya.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
|
||||
image:
|
||||
repository: reaper99/recipya
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
tag: "v1.2.2"
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
# Security context for the pod
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
|
||||
containerSecurityContext: {}
|
||||
|
||||
# Service configuration
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8078
|
||||
|
||||
# Recipya configuration
|
||||
config:
|
||||
email:
|
||||
address: ""
|
||||
sendgrid: ""
|
||||
existingSecret: ""
|
||||
addressKey: "email"
|
||||
sendgridKey: "sendgrid"
|
||||
|
||||
documentIntelligence:
|
||||
endpoint: ""
|
||||
key: ""
|
||||
existingSecret: ""
|
||||
endpointKey: "di_endpoint"
|
||||
keyKey: "di_key"
|
||||
|
||||
server:
|
||||
port: 8078
|
||||
autologin: false
|
||||
is_demo: false
|
||||
is_prod: true
|
||||
no_signups: false
|
||||
url: "http://0.0.0.0"
|
||||
|
||||
# Ingress configuration
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations: []
|
||||
# traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
# traefik.ingress.kubernetes.io/router.middlewares: default-recipya-headers@kubernetescrd
|
||||
hosts:
|
||||
- host: recipya.<domain>
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
|
||||
# Persistent volume claim
|
||||
persistence:
|
||||
enabled: false
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
storageClass: ""
|
||||
annotations: {}
|
||||
retain: true
|
||||
|
||||
# Resource limits and requests
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 500m
|
||||
# memory: 512Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
# Node selector
|
||||
nodeSelector: {}
|
||||
|
||||
# Tolerations
|
||||
tolerations: []
|
||||
|
||||
# Affinity
|
||||
affinity: {}
|
||||
|
||||
# Additional pod annotations
|
||||
podAnnotations: {}
|
||||
|
||||
# Startup arguments
|
||||
startupArgs: []
|
||||
|
||||
# Additional environment variables
|
||||
env: []
|
||||
|
||||
# Extra environment variables
|
||||
extraEnv: []
|
||||
|
||||
# Extra volume mounts
|
||||
extraVolumeMounts: []
|
||||
|
||||
# Extra volumes
|
||||
extraVolumes: []
|
||||
|
||||
# Probes configuration
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
path: /
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
readiness:
|
||||
enabled: true
|
||||
path: /
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
603
index.yaml
Normal file
603
index.yaml
Normal file
@ -0,0 +1,603 @@
|
||||
apiVersion: v1
|
||||
entries:
|
||||
donetick:
|
||||
- apiVersion: v2
|
||||
appVersion: v0.1.60
|
||||
created: "2025-12-19T08:04:26.061195717Z"
|
||||
description: Donetick helm chart for Kubernetes
|
||||
digest: db8335722a16bee17008af24490ddfb1ab1495a08bb71366eefbab0360cfffce
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- task-management
|
||||
- donetick
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: donetick
|
||||
sources:
|
||||
- https://github.com/donetick/donetick
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/donetick-1.0.6/donetick-1.0.6.tgz
|
||||
version: 1.0.6
|
||||
- apiVersion: v2
|
||||
appVersion: v0.1.60
|
||||
created: "2025-12-19T08:00:40.907754382Z"
|
||||
description: Donetick helm chart for Kubernetes
|
||||
digest: 80dac9a72b49189c3142edc96c6da6777f11442b8bdeafd12c9bdd03c9175e94
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- task-management
|
||||
- donetick
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: donetick
|
||||
sources:
|
||||
- https://github.com/donetick/donetick
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/donetick-1.0.5/donetick-1.0.5.tgz
|
||||
version: 1.0.5
|
||||
- apiVersion: v2
|
||||
appVersion: v0.1.60
|
||||
created: "2025-10-11T12:29:42.89240886Z"
|
||||
description: Donetick helm chart for Kubernetes
|
||||
digest: 3fe3acaa51e3032e07461fee7908e9fc49bfa5d5cf345dc30fac0b3dc9ad9861
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- task-management
|
||||
- donetick
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: donetick
|
||||
sources:
|
||||
- https://github.com/donetick/donetick
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/donetick-1.0.4/donetick-1.0.4.tgz
|
||||
version: 1.0.4
|
||||
- apiVersion: v2
|
||||
appVersion: v0.1.60
|
||||
created: "2025-09-22T07:20:10.01319231Z"
|
||||
description: Donetick helm chart for Kubernetes
|
||||
digest: dd2236355c8ae50c58d16ebb24d3ebb2b5c0603db506a66ddef1ad0eca743f5c
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- task-management
|
||||
- donetick
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: donetick
|
||||
sources:
|
||||
- https://github.com/donetick/donetick
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/donetick-1.0.3/donetick-1.0.3.tgz
|
||||
version: 1.0.3
|
||||
- apiVersion: v2
|
||||
appVersion: v0.1.60
|
||||
created: "2025-09-21T16:31:19.924543112Z"
|
||||
description: Donetick helm chart for Kubernetes
|
||||
digest: fc7ccc426e35c53262a2b43f2f0c55dd4b8e973eac0f05fdee8e1ded410e02d3
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- task-management
|
||||
- donetick
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: donetick
|
||||
sources:
|
||||
- https://github.com/donetick/donetick
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/donetick-1.0.2/donetick-1.0.2.tgz
|
||||
version: 1.0.2
|
||||
- apiVersion: v2
|
||||
appVersion: latest
|
||||
created: "2025-03-23T19:40:46.687161338Z"
|
||||
description: A Helm chart for Donetick application
|
||||
digest: c329ed38e81d0d9ae58bfc538f874c138aff0765aee95974d5ee55153c5a349d
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- task-management
|
||||
- donetick
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: donetick
|
||||
sources:
|
||||
- https://github.com/donetick/donetick
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/donetick-1.0.1/donetick-1.0.1.tgz
|
||||
version: 1.0.1
|
||||
- apiVersion: v2
|
||||
appVersion: latest
|
||||
created: "2025-03-23T16:33:06.71881941Z"
|
||||
description: A Helm chart for Donetick application
|
||||
digest: a1efd17c56b4c7bc4560799a2752c41b379fdd7d57799cd9e764ff83baf00a9f
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- task-management
|
||||
- donetick
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: donetick
|
||||
sources:
|
||||
- https://github.com/donetick/donetick
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/donetick-1.0.0/donetick-1.0.0.tgz
|
||||
version: 1.0.0
|
||||
jellyseerr:
|
||||
- apiVersion: v2
|
||||
appVersion: 2.5.2
|
||||
created: "2025-04-23T14:10:23.282104137Z"
|
||||
description: A Helm chart for Jellyseerr - A fork of Overseerr for Jellyfin support
|
||||
digest: aa76f1e2218c366bf982829b1214adb960e13d75afbf2bb5d724d85e3cd5ffbe
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- jellyseerr
|
||||
- jellyfin
|
||||
- media-requests
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: jellyseerr
|
||||
sources:
|
||||
- https://github.com/fallenbagel/jellyseerr
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/jellyseerr-0.0.1/jellyseerr-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
joplin-server:
|
||||
- apiVersion: v2
|
||||
appVersion: 3.4.2
|
||||
created: "2025-08-25T07:08:49.836391167Z"
|
||||
description: Joplin Server helm chart for Kubernetes - Note-taking and synchronization
|
||||
server
|
||||
digest: ddda74db0e8932e9b8b99f36750247d32023f28f08b629a3f436e96e3fab176d
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- notes
|
||||
- synchronization
|
||||
- joplin
|
||||
- productivity
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: joplin-server
|
||||
sources:
|
||||
- https://github.com/laurent22/joplin
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/joplin-server-0.0.2/joplin-server-0.0.2.tgz
|
||||
version: 0.0.2
|
||||
- apiVersion: v2
|
||||
appVersion: 3.4.2
|
||||
created: "2025-08-24T19:47:44.388111779Z"
|
||||
description: Joplin Server helm chart for Kubernetes - Note-taking and synchronization
|
||||
server
|
||||
digest: ff23c9010e0525801a896dd675062bd211a37b939fba2b064ec36557e57e2afd
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- notes
|
||||
- synchronization
|
||||
- joplin
|
||||
- productivity
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: joplin-server
|
||||
sources:
|
||||
- https://github.com/laurent22/joplin
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/joplin-server-0.0.1/joplin-server-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
karakeep:
|
||||
- apiVersion: v2
|
||||
appVersion: 0.26.0
|
||||
created: "2025-08-11T09:26:46.502241589Z"
|
||||
description: Karakeep helm chart for Kubernetes
|
||||
digest: 33f33c0b06a6dcd78a368f1efd0de0f513695e1bca3a7c44de44a9dc44bc7f31
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- bookmark-manager
|
||||
- karakeep
|
||||
- productivity
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: karakeep
|
||||
sources:
|
||||
- https://github.com/karakeep-app/karakeep
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/karakeep-0.0.1/karakeep-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
mealie:
|
||||
- apiVersion: v2
|
||||
appVersion: v3.2.1
|
||||
created: "2025-09-20T17:32:03.081655195Z"
|
||||
description: Mealie helm chart for Kubernetes - Recipe management and meal planning
|
||||
digest: 5ecd223cdb9698fbfde993aa651a349b18354dbdd7103baa6dc900cb76c5daeb
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe-management
|
||||
- meal-planning
|
||||
- cooking
|
||||
- mealie
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: mealie
|
||||
sources:
|
||||
- https://github.com/mealie-recipes/mealie
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/mealie-0.0.2/mealie-0.0.2.tgz
|
||||
version: 0.0.2
|
||||
- apiVersion: v2
|
||||
appVersion: v3.1.1
|
||||
created: "2025-08-24T13:45:44.332587789Z"
|
||||
description: Mealie helm chart for Kubernetes - Recipe management and meal planning
|
||||
digest: 3902f00396fc48249d6d73be6850736418683ea87f0e64f14ac97ed77df97223
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe-management
|
||||
- meal-planning
|
||||
- cooking
|
||||
- mealie
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: mealie
|
||||
sources:
|
||||
- https://github.com/mealie-recipes/mealie
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/mealie-0.0.1/mealie-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
norish:
|
||||
- apiVersion: v2
|
||||
appVersion: v0.15.4-beta
|
||||
created: "2026-02-03T18:42:43.545257531Z"
|
||||
description: Norish helm chart for Kubernetes - A recipe management and meal planning
|
||||
application
|
||||
digest: ecdb4c612a2a2a1c48a4ead9eb1884b58b02e667138283c14e118464986ce790
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe
|
||||
- meal-planning
|
||||
- food
|
||||
- norish
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: norish
|
||||
sources:
|
||||
- https://github.com/norishapp/norish
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/norish-0.0.5/norish-0.0.5.tgz
|
||||
version: 0.0.5
|
||||
- apiVersion: v2
|
||||
appVersion: v0.14.1-beta
|
||||
created: "2025-12-22T11:28:20.190188003Z"
|
||||
description: Norish helm chart for Kubernetes - A recipe management and meal planning
|
||||
application
|
||||
digest: 5d337d3d59d317ff8f3f3bd2399908bea7156ddc6dce9c2e2fa0ea917f7a00e6
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe
|
||||
- meal-planning
|
||||
- food
|
||||
- norish
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: norish
|
||||
sources:
|
||||
- https://github.com/norishapp/norish
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/norish-0.0.4/norish-0.0.4.tgz
|
||||
version: 0.0.4
|
||||
- apiVersion: v2
|
||||
appVersion: v0.13.6-beta
|
||||
created: "2025-12-11T12:05:26.600624557Z"
|
||||
description: Norish helm chart for Kubernetes - A recipe management and meal planning
|
||||
application
|
||||
digest: 09c826419132f07967dcaf636880f2052c642c00a3242258cc5e168625fb7deb
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe
|
||||
- meal-planning
|
||||
- food
|
||||
- norish
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: norish
|
||||
sources:
|
||||
- https://github.com/norishapp/norish
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/norish-0.0.3/norish-0.0.3.tgz
|
||||
version: 0.0.3
|
||||
- apiVersion: v2
|
||||
appVersion: v0.13.6-beta
|
||||
created: "2025-12-11T11:40:33.166127926Z"
|
||||
description: Norish helm chart for Kubernetes - A recipe management and meal planning
|
||||
application
|
||||
digest: 825e537d9d3bf8002fb6404c0635d42abf7ef5b4fc295a2e7e89f6d028f95380
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe
|
||||
- meal-planning
|
||||
- food
|
||||
- norish
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: norish
|
||||
sources:
|
||||
- https://github.com/norishapp/norish
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/norish-0.0.2/norish-0.0.2.tgz
|
||||
version: 0.0.2
|
||||
- apiVersion: v2
|
||||
appVersion: v0.13.6-beta
|
||||
created: "2025-12-08T16:03:08.591776383Z"
|
||||
description: Norish helm chart for Kubernetes - A recipe management and meal planning
|
||||
application
|
||||
digest: 46e868403af3139834d5c8b604ca664b7afb00c592e8fafd2fd883e04249e2ad
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe
|
||||
- meal-planning
|
||||
- food
|
||||
- norish
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: norish
|
||||
sources:
|
||||
- https://github.com/norishapp/norish
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/norish-0.0.1/norish-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
paperless-ngx:
|
||||
- apiVersion: v2
|
||||
appVersion: 2.20.3
|
||||
created: "2025-12-19T09:39:18.023881864Z"
|
||||
description: Paperless-ngx helm chart for Kubernetes
|
||||
digest: 13bbf443911cd452eec242202b2417548feec4705c2f82d16bdf868cd095e84d
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- document-management
|
||||
- paperless
|
||||
- paperless-ngx
|
||||
- ocr
|
||||
maintainers:
|
||||
- email: richard.tomik@proton.me
|
||||
name: Richard Tomik
|
||||
name: paperless-ngx
|
||||
sources:
|
||||
- https://github.com/paperless-ngx/paperless-ngx
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/paperless-ngx-0.0.5/paperless-ngx-0.0.5.tgz
|
||||
version: 0.0.5
|
||||
- apiVersion: v2
|
||||
appVersion: 2.20.3
|
||||
created: "2025-12-19T08:00:41.057848966Z"
|
||||
description: Paperless-ngx helm chart for Kubernetes
|
||||
digest: badf4e22d33f2033f4051208ec977b2d90fb85d494833c193774837ea4665c6d
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- document-management
|
||||
- paperless
|
||||
- paperless-ngx
|
||||
- ocr
|
||||
maintainers:
|
||||
- email: richard.tomik@proton.me
|
||||
name: Richard Tomik
|
||||
name: paperless-ngx
|
||||
sources:
|
||||
- https://github.com/paperless-ngx/paperless-ngx
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/paperless-ngx-0.0.4/paperless-ngx-0.0.4.tgz
|
||||
version: 0.0.4
|
||||
- apiVersion: v2
|
||||
appVersion: latest
|
||||
created: "2025-12-17T15:14:19.979561503Z"
|
||||
description: Paperless-ngx helm chart for Kubernetes
|
||||
digest: 128cef6e4a4c33355428c59176c359796a83c3501c9f15e810179e0308f4455d
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- document-management
|
||||
- paperless
|
||||
- paperless-ngx
|
||||
- ocr
|
||||
maintainers:
|
||||
- email: richard.tomik@proton.me
|
||||
name: Richard Tomik
|
||||
name: paperless-ngx
|
||||
sources:
|
||||
- https://github.com/paperless-ngx/paperless-ngx
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/paperless-ngx-0.0.3/paperless-ngx-0.0.3.tgz
|
||||
version: 0.0.3
|
||||
- apiVersion: v2
|
||||
appVersion: latest
|
||||
created: "2025-10-26T17:28:45.582847258Z"
|
||||
description: Paperless-ngx helm chart for Kubernetes
|
||||
digest: 90a453be0cd5d51c6046a8a1b18b4adaff4f3625f074b34baa4693a53feccee3
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- document-management
|
||||
- paperless
|
||||
- paperless-ngx
|
||||
- ocr
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: paperless-ngx
|
||||
sources:
|
||||
- https://github.com/paperless-ngx/paperless-ngx
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/paperless-ngx-0.0.2/paperless-ngx-0.0.2.tgz
|
||||
version: 0.0.2
|
||||
- apiVersion: v2
|
||||
appVersion: latest
|
||||
created: "2025-09-14T15:37:38.315542356Z"
|
||||
description: Paperless-ngx helm chart for Kubernetes
|
||||
digest: b643e87a7ae994a26476233489b3259375aef04925ff914c9038bd2ba38758a6
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- productivity
|
||||
- document-management
|
||||
- paperless
|
||||
- paperless-ngx
|
||||
- ocr
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: paperless-ngx
|
||||
sources:
|
||||
- https://github.com/paperless-ngx/paperless-ngx
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/paperless-ngx-0.0.1/paperless-ngx-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
qbittorrent-vpn:
|
||||
- apiVersion: v2
|
||||
appVersion: 5.1.0
|
||||
created: "2025-12-17T15:00:03.267114143Z"
|
||||
description: qBittorrent with Gluetun VPN sidecar for Kubernetes
|
||||
digest: 92c931f41791bef6dc879f73606096d7286c3fbe6f7f3b8df2700116e65c0db7
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- qbittorrent
|
||||
- vpn
|
||||
- gluetun
|
||||
- torrent
|
||||
maintainers:
|
||||
- email: richard.tomik@proton.me
|
||||
name: Richard Tomik
|
||||
name: qbittorrent-vpn
|
||||
sources:
|
||||
- https://github.com/linuxserver/docker-qbittorrent
|
||||
- https://github.com/qdm12/gluetun
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/qbittorrent-vpn-0.0.2/qbittorrent-vpn-0.0.2.tgz
|
||||
version: 0.0.2
|
||||
- apiVersion: v2
|
||||
appVersion: 5.1.0
|
||||
created: "2025-05-13T20:13:31.370418675Z"
|
||||
description: qBittorrent with Gluetun VPN sidecar for Kubernetes
|
||||
digest: 9736b2f3dcce5d32f39225138d78a621b3e2528e3283b36ef12bf2a91aa66c12
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- qbittorrent
|
||||
- vpn
|
||||
- gluetun
|
||||
- torrent
|
||||
maintainers:
|
||||
- email: richard.tomik@proton.me
|
||||
name: Richard Tomik
|
||||
name: qbittorrent-vpn
|
||||
sources:
|
||||
- https://github.com/linuxserver/docker-qbittorrent
|
||||
- https://github.com/qdm12/gluetun
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/qbittorrent-vpn-0.0.1/qbittorrent-vpn-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
recipya:
|
||||
- apiVersion: v2
|
||||
appVersion: v1.2.2
|
||||
created: "2025-04-05T20:58:53.611303005Z"
|
||||
description: A Helm chart for Recipya recipe manager application
|
||||
digest: 1ba5f92cd205cc226d1894d194287ab8576c18717f2318642af22a88d5d6a930
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe-manager
|
||||
- recipya
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: recipya
|
||||
sources:
|
||||
- https://github.com/reaper47/recipya
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/recipya-0.0.2/recipya-0.0.2.tgz
|
||||
version: 0.0.2
|
||||
- apiVersion: v2
|
||||
appVersion: v1.2.2
|
||||
created: "2025-04-05T16:38:37.863551239Z"
|
||||
description: A Helm chart for Recipya recipe manager application
|
||||
digest: fb46f78e7036f5d76f88f405caf49108547110374f1cebea7ab91c75add46e9d
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipe-manager
|
||||
- recipya
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: recipya
|
||||
sources:
|
||||
- https://github.com/reaper47/recipya
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/recipya-0.0.1/recipya-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
tandoor:
|
||||
- apiVersion: v2
|
||||
appVersion: 2.3.5
|
||||
created: "2025-12-08T16:03:08.770752883Z"
|
||||
description: Tandoor Recipes - A recipe management application for Kubernetes
|
||||
digest: be976d7d0721821bdc34635aefd6492bb417a2726a90fa4f858c2e4b248a4105
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
keywords:
|
||||
- recipes
|
||||
- cooking
|
||||
- meal-planning
|
||||
- tandoor
|
||||
- food
|
||||
maintainers:
|
||||
- email: no@m.com
|
||||
name: Richard Tomik
|
||||
name: tandoor
|
||||
sources:
|
||||
- https://github.com/TandoorRecipes/recipes
|
||||
type: application
|
||||
urls:
|
||||
- https://github.com/rtomik/helm-charts/releases/download/tandoor-0.0.1/tandoor-0.0.1.tgz
|
||||
version: 0.0.1
|
||||
generated: "2026-02-03T18:42:43.545311992Z"
|
||||
57
values.yaml
57
values.yaml
@ -1,57 +0,0 @@
|
||||
ingress:
|
||||
enabled: true
|
||||
className: "traefik"
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
hosts:
|
||||
- host: mealie.tomik.lat
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- mealie.tomik.lat
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: "longhorn"
|
||||
accessMode: ReadWriteOnce
|
||||
size: 3Gi
|
||||
|
||||
postgresql:
|
||||
enabled: true
|
||||
# External PostgreSQL settings
|
||||
external:
|
||||
enabled: true
|
||||
host: "postgres-cluster-pooler.dbs.svc.cluster.local"
|
||||
port: 5432
|
||||
database: "mealie"
|
||||
user: "mealie_user"
|
||||
password: "7OemzeEtwYF1y7FyqRi6"
|
||||
|
||||
## Environment variables
|
||||
env:
|
||||
# General Settings
|
||||
PUID: "911"
|
||||
PGID: "911"
|
||||
DEFAULT_GROUP: "Home"
|
||||
DEFAULT_HOUSEHOLD: "Family"
|
||||
BASE_URL: "http://localhost:9000"
|
||||
TOKEN_TIME: "48"
|
||||
API_PORT: "9000"
|
||||
API_DOCS: "true"
|
||||
TZ: "UTC"
|
||||
ALLOW_SIGNUP: "false"
|
||||
ALLOW_PASSWORD_LOGIN: "true"
|
||||
LOG_LEVEL: "info"
|
||||
DAILY_SCHEDULE_TIME: "23:45"
|
||||
|
||||
# Security
|
||||
SECURITY_MAX_LOGIN_ATTEMPTS: "5"
|
||||
SECURITY_USER_LOCKOUT_TIME: "24"
|
||||
|
||||
# Database
|
||||
DB_ENGINE: "postgres"
|
||||
|
||||
# Webworker
|
||||
UVICORN_WORKERS: "1"
|
||||
Reference in New Issue
Block a user