This page covers sizing, backup, upgrades, and day-to-day operations after Phonemos is running on Kubernetes.
Sizing
Use the figures on System Requirements as a starting point. For a small production instance of about 100 users, plan roughly 6 GiB of RAM and 3 vCPU for the application, not including object storage. In-cluster PostgreSQL typically needs a 4 vCPU / 8 GiB class with 10 to 50 GiB of disk. A 1 GiB Redis volume is enough; Redis is a message bus, not the system of record. Object storage grows with uploads. The chart already runs more than one replica of the frontend, backend, and Hasura. Keep converters at one replica until load requires more.
Backup
You must be able to restore PostgreSQL, object storage, and the values and secrets used to deploy.
Backup postgres database
Enable versioning on the file bucket. You can keep a second copy with fileStorage.replica.
Store an offline copy of values.yaml, including generated secrets, and a Keycloak realm export.
You do not need to backup Redis, it only stores indexing and formatting queues
Upgrade
We send a new chart archive with image tags already set in global.versions. Install it with helm upgrade phonemos ./phonemos-<new-version>.tgz --namespace phonemos -f values.yaml
The migration Job runs again, and application pods wait for the new database version. Do not roll the Helm release back across a completed database migration; restore from backup instead. With multiple replicas, upgrades are typically zero-downtime.
Health, console, and optional features
Check pods with kubectl -n phonemos get pods. The most useful logs are backend, Hasura, and the Ingress controller. Hasura exposes /healthz on the application host. When hasura.enableConsole is true, the chart publishes console.<first site>.
On a generic Kubernetes Ingress, the console host is not protected by oauth2-proxy. Restrict it with ingress.console.ipAllowList, or set hasura.enableConsole to false if you do not need the console. oauth2-proxy is used only when ingress.traefik.enabled is true.
Leave connectors, the public site, AI search, DeepL, SCIM, and MCP disabled unless we enable them with you.