Helm values

Start from the values.yaml file inside the chart archive. Override only the settings you need. Comments in that file describe each key.

Hosts and Ingress

sites:
  - wiki.example.com
publicSites: []

ingress:
  enabled: true
  ingressClass: nginx
  annotations: {}
  traefik:
    enabled: false
  tls:
    enabled: true
    letsencrypt: true
  console:
    host: null

sites lists the DNS names for the authenticated application. The first name is the certificate common name. publicSites is optional and is used for anonymous public frontend hosts. cert-manager must provide a ClusterIssuer named letsencrypt-prod. When NetworkPolicies are enabled, the chart allows HTTP-01 solvers. The console host defaults to console.<first site> when hasura.enableConsole is true. You can override it with ingress.console.host.

Object storage

Configure fileStorage, derivedStorage, and temporaryStorage in the same way: S3 API URL, access key, secret key, bucket, and an optional subpath. useEncryptionSseC defaults to true and uses SSE-C. Set fileStorage.disableCorsUpdate to true if you manage bucket CORS yourself.

fileStorage:
  url: https://s3.example.com
  accessKey: ACCESS_KEY
  secretKey: SECRET_KEY
  bucket: phonemos-files
  useEncryptionSseC: true
  replica:
    enabled: false
derivedStorage:
  url: https://s3.example.com
  accessKey: ACCESS_KEY
  secretKey: SECRET_KEY
  bucket: phonemos-derived
temporaryStorage:
  url: https://s3.example.com
  accessKey: ACCESS_KEY
  secretKey: SECRET_KEY
  bucket: phonemos-temp

Keycloak

Point the chart at your realm. Client setup is described on the Identity provider (Keycloak) page.

keycloak:
  url: https://id.example.com/auth
  realm: phonemos
  backend:
    clientId: phonemos-backend
    clientSecret: CHANGE_ME
  frontend:
    clientId: phonemos-hasura
  frontendPublic:
    clientId: phonemos-public
    clientSecret: CHANGE_ME

PostgreSQL and Redis

The documented path uses in-cluster PostgreSQL 18 with collation en_US.utf8 and in-cluster Redis. Set a StorageClass and disk size. Generate redis.masterPassword and the Redis ACL passwords under backend.redis and converter pandoc and generic redis.

postgres-standalone:
  db:
    version: "18"
    collation: "en_US.utf8"
    persistence:
      size: 50Gi
      storageClass: STORAGE_CLASS
redis:
  masterPassword: GENERATE
  persistence:
    size: 1Gi
    storageClass: STORAGE_CLASS
backend:
  redis:
    user: backend
    password: GENERATE
converter:
  pandoc:
    redis:
      password: GENERATE
  generic:
    redis:
      password: GENERATE

Secrets you must generate

Create unique random values, for example with openssl rand -base64 32: hasura.adminSecret, hasura.actionAuthSecret, hasura.converterAuthSecret, hasura.jwtSecret, backend.fileserver.cookieEncryptionKey, backend.secretEncryptionKey, and the Redis passwords. oauth2Proxy.cookieSecret is required only if you enable Traefik IngressRoutes and the Hasura console.

NetworkPolicy and features

Set global.cluster.features.networkPolicies to true so the chart applies default-deny plus explicit allow rules. The CNI must implement NetworkPolicy. Leave features as we specify for your instance. Do not set features.enableAll. Disable our Sentry DSN unless you use your own. Leave connectors, AI, DeepL, and SCIM off until you ask support to enable them.

global:
  cluster:
    features:
      networkPolicies: true

Phonemos User Guide

Helm values