remove extra configuration from rabbitmq

* Update Helm release redis to v19.1.2

* update chart

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: alexlebens <alexanderlebens@gmail.com>

.github/renovate.json

@@ -7,12 +7,9 @@
     ],
     "timezone": "US/Mountain",
     "schedule": [
-        "after 10am every weekday",
+        "every weekday"
-        "before 5pm every weekday"
-    ],
-    "labels": [
-        "outside-rule"
     ],
+    "labels": [],
     "packageRules": [
         {
             "description": "Disables for non major Renovate version",
@@ -42,33 +39,72 @@
             "automerge": false
         },
         {
-            "description": "Generate image updates on Tuesdays",
+            "description": "Label service images",
             "matchPackageNames": [
-                "linuxserver/calibre",
+                "ghcr.io/alex1989hu/kubelet-serving-cert-approver",
-                "homeassistant/home-assistant",
+                "ghcr.io/cloudnative-pg/postgresql",
-                "ghcr.io/gethomepage/homepage",
+                "redis/redis-stack-server"
-                "ghcr.io/cloudnative-pg/postgresql"
             ],
             "matchDatasources": [
-                "docker",
+                "docker"
-                "gitea-releases",
-                "gitea-tags",
-                "github-releases",
-                "github-tags",
-                "gitlab-packages",
-                "gitlab-releases",
-                "gitlab-tags"
-            ],
-            "schedule": [
-                "after 10am on tuesday",
-                "before 5pm on tuesday"
             ],
             "addLabels": [
-                "upgrade",
+                "service",
-                "weekly",
                 "image"
             ],
-            "bumpVersion": "minor",
+            "automerge": false,
+            "minimumReleaseAge": "3 days"
+        },
+        {
+            "description": "Label service charts",
+            "matchPackageNames": [
+                "elasticsearch",
+                "redis"
+            ],
+            "matchDatasources": [
+                "helm"
+            ],
+            "addLabels": [
+                "serivce",
+                "chart"
+            ],
+            "automerge": false,
+            "minimumReleaseAge": "3 days"
+        },
+        {
+            "description": "Label application images",
+            "matchPackageNames": [
+                "bbilly1/tubearchivist-jf",
+                "bbilly1/tubearchivist",
+                "freshrss/freshrss",
+                "ghcr.io/gethomepage/homepage",
+                "homeassistant/home-assistant",
+                "linuxserver/calibre",
+                "linuxserver/code-server",
+                "linuxserver/cops",
+                "outlinewiki/outline",
+                "rmcrackan/libation"
+            ],
+            "matchDatasources": [
+                "docker"
+            ],
+            "addLabels": [
+                "application",
+                "image"
+            ],
+            "automerge": false,
+            "minimumReleaseAge": "3 days"
+        },
+        {
+            "description": "Label application charts",
+            "matchPackageNames": [],
+            "matchDatasources": [
+                "helm"
+            ],
+            "addLabels": [
+                "application",
+                "chart"
+            ],
             "automerge": false,
             "minimumReleaseAge": "3 days"
         }

.github/workflows/lint-test.yaml

@@ -12,7 +12,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v4
         with:
           version: v3.13.3
 

charts/calibre-server/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: calibre-server
-version: 0.0.4
+version: 0.0.6
 description: Chart for Calibre content database
 keywords:
   - media

charts/calibre-server/README.md

@@ -11,6 +11,7 @@ This chart bootstraps a [Calibre](https://github.com/home-assistant) deployment
 - Kubernetes
 - Helm
 - Traefik v2 / IngressRoute
+- Authentik / Auth
 
 ## Parameters
 

charts/calibre-server/templates/deployment.yaml

@@ -9,7 +9,6 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   revisionHistoryLimit: 3
   replicas: {{ .Values.deployment.replicas }}
@@ -28,7 +27,7 @@ spec:
       serviceAccountName: calibre-server
       automountServiceAccountToken: true
       containers:
-        - name: {{ .Release.Name }}
+        - name: calibre-server
           image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
           imagePullPolicy: {{ .Values.deployment.image.imagePullPolicy }}
           ports:

charts/calibre-server/templates/ingress-route.yaml

@@ -10,7 +10,6 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: calibre-server
-    app.kubernetes.io/managed-by: helm
 spec:
   entryPoints:
     - websecure
@@ -18,7 +17,7 @@ spec:
     - kind: Rule
       match: "Host(`{{ .Values.ingressRoute.http.host }}`)"
       middlewares:
-        - name: authentik
+        - name: "authentik-{{ .Release.Name }}"
           namespace: {{ .Release.Namespace }}
       priority: 10
       services:

charts/calibre-server/templates/middleware.yaml

@@ -2,15 +2,14 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
-  name: authentik
+  name: "authentik-{{ .Release.Name }}"
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: calibre-server
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: auth
-    app.kubernetes.io/part-of: calibre-server
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   forwardAuth:
     address: "http://{{ .Values.ingressRoute.authentik.outpost }}.authentik:{{ .Values.ingressRoute.authentik.port }}/outpost.goauthentik.io/auth/traefik"

charts/calibre-server/templates/persistant-volume-claim.yaml

@@ -9,7 +9,6 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   accessModes:
     - ReadWriteOnce

charts/calibre-server/templates/service-account.yaml

@@ -9,4 +9,3 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: calibre-server
-    app.kubernetes.io/managed-by: helm

charts/calibre-server/templates/service.yaml

@@ -2,14 +2,13 @@ apiVersion: v1
 kind: Service
 metadata:
   name: calibre-server
-  namespace: {{ .Release.Namespace }}  
+  namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: calibre-server
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   type: ClusterIP
   ports:
@@ -26,14 +25,13 @@ apiVersion: v1
 kind: Service
 metadata:
   name: calibre-server-content
-  namespace: {{ .Release.Namespace }}  
+  namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: calibre-server
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   type: ClusterIP
   ports:

charts/calibre-server/values.yaml

@@ -29,14 +29,14 @@ service:
 ingressRoute:
   enabled: true
   http:
-    host: server.calibre.alexlebens.net
+    host:
   authentik:
-    outpost: authentik-proxy-outpost
+    outpost:
     port: 9000
 persistence:
   config:
-    storageClassName: ceph-block
+    storageClassName: default
     storageSize: 5Gi
     volumeMode: Filesystem
   books:
-    claimName: calibre-server-nfs-storage
+    claimName:

charts/cops/Chart.yaml

@@ -0,0 +1,12 @@
+apiVersion: v2
+name: cops
+version: 0.0.3
+description: Chart for Calibre OPDS (and HTML) PHP Server
+keywords:
+  - calibre
+  - OPDS
+sources:
+  - https://github.com/seblucas/cops
+maintainers:
+  - name: alexlebens
+appVersion: 1.1.3

charts/cops/README.md

@@ -0,0 +1,22 @@
+## Introduction
+
+[Calibre OPDS (and HTML) PHP Server](https://github.com/seblucas/cops)
+
+COPS's main advantages are :
+
+ - No need for many dependencies.
+ - No need for a lot of CPU or RAM.
+ - Not much code.
+ - Search is available.
+ - It was fun to code.
+
+This chart bootstraps a [COPS](https://github.com/seblucas/cops) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+
+- Kubernetes
+- Helm
+
+## Parameters
+
+See the [values files](values.yaml).

charts/cops/templates/deployment.yaml

@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.deployment.replicas }}
+  strategy:
+    type: {{ .Values.deployment.strategy }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      serviceAccountName: {{ .Release.Name }}
+      containers:
+        - name: {{ .Release.Name }}
+          image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
+          imagePullPolicy: {{ .Values.deployment.image.imagePullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.http.port }}
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /config
+              name: cops-config
+            - mountPath: /books
+              name: cops-books
+          resources:
+            {{- toYaml .Values.deployment.resources | nindent 12 }}
+          env:
+          {{- range $k,$v := .Values.deployment.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+          {{- end }}
+          {{- with .Values.deployment.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}            
+          livenessProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.service.http.port }}
+            initialDelaySeconds: 0
+            failureThreshold: 5
+            timeoutSeconds: 1
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.service.http.port }}
+            initialDelaySeconds: 0
+            failureThreshold: 5
+            timeoutSeconds: 1
+            periodSeconds: 10
+          startupProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.service.http.port }}
+            initialDelaySeconds: 5
+            failureThreshold: 30
+            periodSeconds: 10
+            timeoutSeconds: 1
+      volumes:
+        - name: cops-config
+          persistentVolumeClaim:
+            claimName: cops-config
+        - name: cops-books
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.books.claimName }}

charts/cops/templates/ingress.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+      - {{ .Values.ingress.host }}
+      secretName: {{ .Release.Name }}-secret-tls
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  name: http
+{{- end }}

charts/cops/templates/persistant-volume-claim.yaml

@@ -0,0 +1,19 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: cops-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: storage
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.config.storageSize }}
+  storageClassName: {{ .Values.persistence.config.storageClassName }}
+  volumeMode: {{ .Values.persistence.config.volumeMode }}

charts/cops/templates/pod.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ .Release.Name }}-test-connection"
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    "helm.sh/hook": test-success
+spec:
+  restartPolicy: Never
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ .Release.Name }}:{{ .Values.service.http.port }}']
+      resources:
+        limits:
+          cpu: 500m
+          memory: 1Gi
+        requests:
+          cpu: 50m
+          memory: 256Mi

charts/cops/templates/service-account.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}

charts/cops/templates/service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  type: ClusterIP
+  externalTrafficPolicy:
+  ports:
+    - port: {{ .Values.service.http.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}

charts/cops/values.yaml

@@ -0,0 +1,36 @@
+deployment:
+  replicas: 1
+  strategy: Recreate
+  image:
+    repository: linuxserver/cops
+    tag: 2.3.1-ls185
+    imagePullPolicy: IfNotPresent
+  env:
+    PGID: "1000"
+    PUID: "1000"
+    TZ: UTC
+  envFrom:        
+  resources:    
+    limits:
+      cpu: 500m
+      memory: 1Gi
+    requests:
+      cpu: 50m
+      memory: 256Mi
+serviceAccount:
+  create: true
+service:
+  http:
+    port: 80
+ingress:
+  enabled: false
+  annotations:
+  className:
+  host:
+persistence:
+  config:
+    storageClassName: default
+    storageSize: 5Gi
+    volumeMode: Filesystem
+  books:
+    claimName:

charts/freshrss/Chart.yaml

@@ -0,0 +1,12 @@
+apiVersion: v2
+name: freshrss
+version: 0.0.3
+description: Chart for Freshrss
+keywords:
+  - rss
+sources:
+  - https://github.com/FreshRSS/FreshRSS
+maintainers:
+  - name: alexlebens
+icon: https://avatars.githubusercontent.com/u/9414285?s=48&v=4
+appVersion: "1.23.1"

charts/freshrss/README.md

@@ -0,0 +1,18 @@
+## Introduction
+
+[FreshRSS](https://github.com/FreshRSS/FreshRSS)
+
+FreshRSS is a self-hosted RSS feed aggregator.
+
+It is lightweight, easy to work with, powerful, and customizable.
+
+This chart bootstraps a [FreshRSS](https://github.com/FreshRSS/FreshRSS) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+
+- Kubernetes
+- Helm
+
+## Parameters
+
+See the [values files](values.yaml).

charts/freshrss/templates/deployment.yaml

@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.deployment.replicas }}
+  strategy:
+    type: {{ .Values.deployment.strategy }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      serviceAccountName: {{ .Release.Name }}
+      containers:
+        - name: {{ .Release.Name }}
+          image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
+          imagePullPolicy: {{ .Values.deployment.image.imagePullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.http.port }}
+              protocol: TCP
+          volumeMounts:
+            - name: {{ .Release.Name }}-config
+              mountPath: /config
+          resources:
+            {{- toYaml .Values.deployment.resources | nindent 12 }}
+          env:
+            - name: LISTEN
+              value: "0.0.0.0:{{ .Values.service.http.port }}"
+          {{- range $k,$v := .Values.deployment.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+          {{- end }}
+          {{- with .Values.deployment.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          livenessProbe:
+            tcpSocket:
+              port: {{ .Values.service.http.port }}
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            timeoutSeconds: 1
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: {{ .Values.service.http.port }}
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            timeoutSeconds: 1
+            periodSeconds: 10
+          startupProbe:
+            tcpSocket:
+              port: {{ .Values.service.http.port }}
+            initialDelaySeconds: 0
+            failureThreshold: 30
+            timeoutSeconds: 1
+            periodSeconds: 5
+      volumes:
+        - name: {{ .Release.Name }}-config
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-config

charts/freshrss/templates/ingress.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+      - {{ .Values.ingress.host }}
+      secretName: {{ .Release.Name }}-secret-tls
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  name: http
+{{- end }}

charts/freshrss/templates/persistant-volume-claim.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: storage
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.config.storageSize }}
+  storageClassName: {{ .Values.persistence.config.storageClassName }}
+  volumeMode: {{ .Values.persistence.config.volumeMode }}

charts/freshrss/templates/pod.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ .Release.Name }}-test-connection"
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    "helm.sh/hook": test-success
+spec:
+  restartPolicy: Never
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ .Release.Name }}:{{ .Values.service.http.port }}']
+      resources:
+        limits:
+          cpu: 500m
+          memory: 1Gi
+        requests:
+          cpu: 50m
+          memory: 256Mi

charts/freshrss/templates/service-account.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}

charts/freshrss/templates/service.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.service.http.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}

charts/freshrss/values.yaml

@@ -0,0 +1,33 @@
+deployment:
+  replicas: 1
+  strategy: Recreate
+  image:
+    repository: freshrss/freshrss
+    tag: 1.23.1
+    imagePullPolicy: IfNotPresent
+  env:
+    PGID: "568"
+    PUID: "568"
+    TZ: UTC
+    FRESHRSS_ENV: production
+  envFrom:
+  resources:
+    limits:
+      cpu: 500m
+      memory: 1Gi
+    requests:
+      cpu: 50m
+      memory: 256Mi
+service:
+  http:
+    port: 80
+ingress:
+  enabled: true
+  className:
+  annotations:
+  host:
+persistence:
+  config:
+    storageClassName: default
+    storageSize: 5Gi
+    volumeMode: Filesystem

charts/home-assistant/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: home-assistant
-version: 0.0.13
+version: 0.1.10
 description: Chart for Home Assistant
 keywords:
   - home-automation
@@ -9,4 +9,4 @@ sources:
 maintainers:
   - name: alexlebens
 icon: https://avatars.githubusercontent.com/u/13844975?s=200&v=4
-appVersion: v2024.2.5
+appVersion: v2024.4.3

charts/home-assistant/templates/deployment.yaml

@@ -4,12 +4,11 @@ metadata:
   name: home-assistant
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   revisionHistoryLimit: 3
   replicas: {{ .Values.deployment.replicas }}
@@ -17,15 +16,15 @@ spec:
     type: {{ .Values.deployment.strategy }}
   selector:
     matchLabels:
-      app.kubernetes.io/name: home-assistant
+      app.kubernetes.io/name: {{ .Release.Name }}
       app.kubernetes.io/instance: {{ .Release.Name }}
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: home-assistant
+        app.kubernetes.io/name: {{ .Release.Name }}
         app.kubernetes.io/instance: {{ .Release.Name }}
     spec:
-      serviceAccountName: home-assistant
+      serviceAccountName: {{ .Release.Name }}
       automountServiceAccountToken: true
       containers:
         - name: {{ .Release.Name }}
@@ -96,4 +95,4 @@ spec:
       volumes:
         - name: home-assistant-config
           persistentVolumeClaim:
-            claimName: home-assistant-config
+            claimName: "{{ .Release.Name }}-config"

charts/home-assistant/templates/ingress-route.yaml

@@ -2,15 +2,14 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: home-assistant
+  name: {{ .Release.Name }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: home-assistant
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   entryPoints:
     - websecure
@@ -18,12 +17,12 @@ spec:
     - kind: Rule
       match: "Host(`{{ .Values.ingressRoute.host }}`)"
       middlewares:
-        - name: authentik
+        - name: "authentik-{{ .Release.Name }}"
-          namespace: {{ .Release.Namespace }}
+          namespace: {{ .Release.Namespace }}           
       priority: 10
       services:
         - kind: Service
-          name: home-assistant
+          name: {{ .Release.Name }}
           port: {{ .Values.service.http.port }}
     - kind: Rule
       match: "Host(`{{ .Values.ingressRoute.host }}`) && PathPrefix(`/outpost.goauthentik.io/`)"
@@ -31,7 +30,7 @@ spec:
       services:
         - kind: Service
           name: {{ .Values.ingressRoute.authentik.outpost }}
-          port: {{ .Values.ingressRoute.authentik.port }}
+          port: {{ .Values.ingressRoute.authentik.port }}    
 {{- end }}
 
 ---
@@ -39,24 +38,33 @@ spec:
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: home-assistant-codeserver
+  name: "{{ .Release.Name }}-codeserver"
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: home-assistant
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   entryPoints:
     - websecure
   routes:
     - kind: Rule
       match: "Host(`{{ .Values.codeserver.ingressRoute.host }}`)"
+      middlewares:
+        - name: "authentik-{{ .Release.Name }}"
+          namespace: {{ .Release.Namespace }}      
       priority: 10
       services:
         - kind: Service
-          name: home-assistant-codeserver
+          name: "{{ .Release.Name }}-codeserver"
           port: {{ .Values.codeserver.service.http.port }}
-{{- end }}          
+    - kind: Rule
+      match: "Host(`{{ .Values.ingressRoute.host }}`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      priority: 15
+      services:
+        - kind: Service
+          name: {{ .Values.ingressRoute.authentik.outpost }}
+          port: {{ .Values.ingressRoute.authentik.port }}          
+{{- end }}

charts/home-assistant/templates/middleware.yaml

@@ -2,15 +2,14 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
-  name: authentik
+  name: "authentik-{{ .Release.Name }}"
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: auth
-    app.kubernetes.io/part-of: home-assistant
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   forwardAuth:
     address: "http://{{ .Values.ingressRoute.authentik.outpost }}.authentik:{{ .Values.ingressRoute.authentik.port }}/outpost.goauthentik.io/auth/traefik"

charts/home-assistant/templates/persistant-volume-claim.yaml

@@ -1,15 +1,14 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: home-assistant-config
+  name: "{{ .Release.Name }}-config"
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   accessModes:
     - ReadWriteOnce

charts/home-assistant/templates/prometheus-rule.yaml

@@ -2,15 +2,14 @@
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
-  name: home-assistant
+  name: {{ .Release.Name }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: home-assistant
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   groups:
     - name: {{ .Release.Name }}

charts/home-assistant/templates/service-account.yaml

@@ -1,12 +1,11 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: home-assistant
+  name: {{ .Release.Name }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: home-assistant
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm

charts/home-assistant/templates/service-monitor.yaml

@@ -2,19 +2,18 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: home-assistant
+  name: {{ .Release.Name }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: home-assistant
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   selector:
     matchLabels:
-      app.kubernetes.io/name: home-assistant
+      app.kubernetes.io/name: {{ .Release.Name }}
       app.kubernetes.io/instance: {{ .Release.Name }}
   endpoints:
     - port: http

charts/home-assistant/templates/service.yaml

@@ -1,15 +1,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: home-assistant
+  name: {{ .Release.Name }}
-  namespace: {{ .Release.Namespace }}  
+  namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   type: ClusterIP
   ports:
@@ -18,7 +17,7 @@ spec:
       protocol: TCP
       name: http
   selector:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 
 ---
@@ -26,15 +25,14 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: home-assistant-codeserver
+  name: "{{ .Release.Name }}-codeserver"
-  namespace: {{ .Release.Namespace }}  
+  namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   type: ClusterIP
   ports:
@@ -43,6 +41,6 @@ spec:
       protocol: TCP
       name: codeserver-http
   selector:
-    app.kubernetes.io/name: home-assistant
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}

charts/home-assistant/values.yaml

@@ -3,10 +3,10 @@ deployment:
   strategy: Recreate
   image:
     repository: homeassistant/home-assistant
-    tag: 2024.2.5
+    tag: 2024.4.3
     imagePullPolicy: IfNotPresent
   env:
-    TZ: US/Mountain
+    TZ: UTC
   envFrom:
   resources:
     requests:
@@ -20,9 +20,9 @@ service:
     port: 8123
 ingressRoute:
   enabled: true
-  host: homeassistant.alexlebens.net
+  host:
   authentik:
-    outpost: authentik-proxy-outpost
+    outpost:
     port: 9000
 metrics:
   enabled: false
@@ -49,17 +49,17 @@ metrics:
           severity: critical
 persistence:
   config:
-    storageClassName: ceph-block
+    storageClassName: default
     storageSize: 1Gi
     volumeMode: Filesystem
 codeserver:
-  enabled: true
+  enabled: false
   image:
     repository: linuxserver/code-server
-    tag: 4.21.1
+    tag: 4.23.1
     imagePullPolicy: IfNotPresent
   env:
-    TZ: US/Mountain
+    TZ: UTC
     PUID: 1000
     PGID: 1000
     DEFAULT_WORKSPACE: /config
@@ -70,5 +70,5 @@ codeserver:
     http:
       port: 8443
   ingressRoute:
-    enabled: true
+    enabled: false
-    host: codeserver.homeassistant.alexlebens.net
+    host:

charts/homepage/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: homepage
-version: 0.0.5
+version: 0.0.11
 description: Chart for benphelps homepage
 keywords:
   - dashboard
@@ -9,4 +9,4 @@ sources:
 maintainers:
   - name: alexlebens
 icon: https://github.com/benphelps/homepage/blob/de584eae8f12a0d257e554e9511ef19bd2a1232c/public/mstile-150x150.png
-appVersion: v0.8.8
+appVersion: v0.8.12

charts/homepage/templates/cluster-role-binding.yaml

@@ -1,19 +1,18 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: homepage
+  name: {{ .Release.Name }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: homepage
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: homepage
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: homepage
+  name: {{ .Release.Name }}
 subjects:
   - kind: ServiceAccount
     name: homepage

charts/homepage/templates/cluster-role.yaml

@@ -1,15 +1,14 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: homepage
+  name: {{ .Release.Name }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: homepage
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: homepage
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 rules:
   - apiGroups:
       - ""

charts/homepage/templates/config-map.yaml

@@ -9,7 +9,6 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: homepage
-    app.kubernetes.io/managed-by: helm
 data:
   bookmarks.yaml: {{- if .Values.config.bookmarks }} |
 {{- .Values.config.bookmarks | toYaml | nindent 4}}

charts/homepage/templates/deployment.yaml

@@ -9,7 +9,6 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: homepage
-    app.kubernetes.io/managed-by: helm
 spec:
   revisionHistoryLimit: 3
   replicas: {{ .Values.deployment.replicas }}

charts/homepage/templates/ingress-route.yaml

@@ -9,7 +9,6 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: homepage
-    app.kubernetes.io/managed-by: helm
 spec:
   entryPoints:
     - websecure
@@ -17,7 +16,7 @@ spec:
     - kind: Rule
       match: "Host(`{{ .Values.ingressRoute.host }}`)"
       middlewares:
-        - name: authentik
+        - name: "authentik-{{ .Release.Name }}"
           namespace: {{ .Release.Namespace }}
       priority: 10
       services:

charts/homepage/templates/middleware.yaml

@@ -1,15 +1,14 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
-  name: authentik
+  name: "authentik-{{ .Release.Name }}"
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: homepage
+    app.kubernetes.io/name: {{ .Release.Name }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: auth
-    app.kubernetes.io/part-of: homepage
+    app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   forwardAuth:
     address: "http://{{ .Values.ingressRoute.authentik.outpost }}.authentik:{{ .Values.ingressRoute.authentik.port }}/outpost.goauthentik.io/auth/traefik"

charts/homepage/templates/secret.yaml

@@ -10,6 +10,5 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: homepage
-    app.kubernetes.io/managed-by: helm
   annotations:
     kubernetes.io/service-account.name: homepage

charts/homepage/templates/service-account.yaml

@@ -9,6 +9,5 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: homepage
-    app.kubernetes.io/managed-by: helm
 secrets:
   - name: "{{ .Release.Name }}-sa-token"

charts/homepage/templates/service.yaml

@@ -9,7 +9,6 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: web
     app.kubernetes.io/part-of: homepage
-    app.kubernetes.io/managed-by: helm
 spec:
   type: ClusterIP
   ports:

charts/homepage/values.yaml

@@ -3,7 +3,7 @@ deployment:
   strategy: Recreate
   image:
     repository: ghcr.io/gethomepage/homepage
-    tag: v0.8.8
+    tag: v0.8.12
     imagePullPolicy: IfNotPresent
   env:
   envFrom:
@@ -13,14 +13,14 @@ deployment:
       cpu: 50m
     limits:
       memory: 512Mi
-      cpu: 500m 
+      cpu: 500m
 service:
   http:
     port: 3000
 ingressRoute:
-  host: homepage.alexlebens.net
+  host:
   authentik:
-    outpost: authentik-proxy-outpost
+    outpost:
     port: 9000
 config:
   bookmarks:

charts/kubelet-serving-cert-approver/Chart.yaml

@@ -0,0 +1,13 @@
+apiVersion: v2
+name: kubelet-serving-cert-approver
+version: 0.0.4
+description: Kubelet Serving TLS Certificate Signing Request Approver
+keywords:
+  - kubernetes
+  - certificate
+sources:
+  - https://github.com/alex1989hu/kubelet-serving-cert-approver
+  - https://github.com/alexlebens/helm-charts/charts/homepage
+maintainers:
+  - name: alexlebens
+appVersion: 0.8.1

charts/kubelet-serving-cert-approver/README.md

@@ -0,0 +1,16 @@
+## Introduction
+
+[Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver)
+
+Kubelet Serving Certificate Approver is a custom approving controller which approves kubernetes.io/kubelet-serving Certificate Signing Request that kubelet use to serve TLS endpoints.
+
+This chart bootstraps a [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+
+- Kubernetes
+- Helm
+
+## Parameters
+
+See the [values files](values.yaml).

charts/kubelet-serving-cert-approver/templates/cluster-role-binding.yaml

@@ -0,0 +1,19 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubelet-serving-cert-approver
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: "certificates:{{ .Release.Name }}"
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}

charts/kubelet-serving-cert-approver/templates/cluster-role.yaml

@@ -0,0 +1,61 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "certificates:{{ .Release.Name }}"
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+rules:
+  - apiGroups:
+      - certificates.k8s.io
+    resources:
+      - certificatesigningrequests
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - certificates.k8s.io
+    resources:
+      - certificatesigningrequests/approval
+    verbs:
+      - update
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+  - apiGroups:
+      - certificates.k8s.io
+    resourceNames:
+      - kubernetes.io/kubelet-serving
+    resources:
+      - signers
+    verbs:
+      - approve
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "events:{{ .Release.Name }}"
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: kubelet-serving-cert-approverv
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch

charts/kubelet-serving-cert-approver/templates/deployment.yaml

@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kubelet-serving-cert-approver
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.deployment.replicas }}
+  strategy:
+    type: {{ .Values.deployment.strategy }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kubelet-serving-cert-approver
+      app.kubernetes.io/instance: {{ .Release.Name }}
+
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kubelet-serving-cert-approver
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - preference:
+                matchExpressions:
+                  - key: node-role.kubernetes.io/master
+                    operator: DoesNotExist
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
+              weight: 100
+      containers:
+        - name: {{ .Release.Name }}
+          image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
+          imagePullPolicy: {{ .Values.deployment.image.imagePullPolicy }}
+          ports:
+            - containerPort: 8080
+              name: health
+            - containerPort: 9090
+              name: metrics
+          args:
+            - serve
+          env:
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          resources:
+            {{- toYaml .Values.deployment.resources | nindent 12 }}
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            initialDelaySeconds: 6
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            initialDelaySeconds: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+      priorityClassName: {{ .Values.deployment.priorityClassName }}
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65534
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: kubelet-serving-cert-approver
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+          operator: Exists

charts/kubelet-serving-cert-approver/templates/namespace.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubelet-serving-cert-approver
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/warn: restricted

charts/kubelet-serving-cert-approver/templates/role-binding.yaml

@@ -0,0 +1,19 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "events:{{ .Release.Name }}"
+  namespace: default
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: "events:{{ .Release.Name }}"
+subjects:
+  - kind: ServiceAccount
+    name: kubelet-serving-cert-approver
+    namespace: {{ .Release.Name }}

charts/kubelet-serving-cert-approver/templates/service-account.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubelet-serving-cert-approver
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver

charts/kubelet-serving-cert-approver/templates/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kubelet-serving-cert-approver
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: kubelet-serving-cert-approver
+spec:
+  ports:
+    - name: metrics
+      port: 9090
+      protocol: TCP
+      targetPort: metrics
+  selector:
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+    app.kubernetes.io/instance: {{ .Release.Name }}

charts/kubelet-serving-cert-approver/values.yaml

@@ -0,0 +1,15 @@
+deployment:
+  replicas: 1
+  strategy: Recreate
+  priorityClassName: system-cluster-critical
+  image:
+    repository: ghcr.io/alex1989hu/kubelet-serving-cert-approver
+    tag: main
+    imagePullPolicy: Always
+  resources:
+    limits:
+      cpu: 250m
+      memory: 32Mi
+    requests:
+      cpu: 10m
+      memory: 16Mi

charts/kyoo/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: kyoo
+version: 0.1.3
+description: Chart for Kyoo
+keywords:
+  - media
+sources:
+  - https://github.com/zoriya/Kyoo
+  - https://github.com/rabbitmq/rabbitmq-server
+  - https://github.com/bitnami/charts/tree/main/bitnami/rabbitmq
+  - https://github.com/meilisearch/meilisearch
+  - https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
+maintainers:
+  - name: alexlebens
+icon: https://raw.githubusercontent.com/zoriya/Kyoo/master/icons/icon-256x256.png
+dependencies:
+  - name: rabbitmq
+    version: 14.0.1
+    repository: https://charts.bitnami.com/bitnami
+  - name: meilisearch
+    version: 0.6.1
+    repository: https://meilisearch.github.io/meilisearch-kubernetes  
+appVersion: v4.4.0

charts/kyoo/README.md

@@ -0,0 +1,17 @@
+## Introduction
+
+[Kyoo](https://github.com/zoriya/Kyoo)
+
+A portable and vast media library solution.
+
+This chart bootstraps a [Kyoo](https://github.com/zoriya/Kyoo) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+
+## Prerequisites
+
+- Kubernetes
+- Helm
+
+## Parameters
+
+See the [values files](values.yaml).

charts/kyoo/templates/_helpers.tpl

@@ -0,0 +1,155 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "kyoo.name" -}}
+  {{- default .Chart.Name .Values.global.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "kyoo.fullname" -}}
+  {{- if .Values.global.fullnameOverride -}}
+    {{- .Values.global.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+  {{- else -}}
+    {{- $name := default .Chart.Name .Values.global.nameOverride -}}
+    {{- if contains $name .Release.Name -}}
+      {{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+    {{- else -}}
+      {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label
+*/}}
+{{- define "kyoo.chart" -}}
+  {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "kyoo.labels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}
+helm.sh/chart: {{ template "kyoo.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Common labels for specific components
+*/}}
+{{- define "kyoo.autosync.labels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-autosync
+helm.sh/chart: {{ template "kyoo.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+{{- define "kyoo.back.labels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-back
+helm.sh/chart: {{ template "kyoo.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+{{- define "kyoo.front.labels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-front
+helm.sh/chart: {{ template "kyoo.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+{{- define "kyoo.matcher.labels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-matcher
+helm.sh/chart: {{ template "kyoo.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+{{- define "kyoo.migrations.labels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-migrations
+helm.sh/chart: {{ template "kyoo.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+{{- define "kyoo.scanner.labels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-scanner
+helm.sh/chart: {{ template "kyoo.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+{{- define "kyoo.transcoder.labels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-transcoder
+helm.sh/chart: {{ template "kyoo.chart" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector
+*/}}
+{{- define "kyoo.matchLabels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "kyoo.autosync.matchLabels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-autosync
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "kyoo.back.matchLabels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-back
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "kyoo.front.matchLabels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-front
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "kyoo.matcher.matchLabels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-matcher
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "kyoo.migrations.matchLabels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-migrations
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "kyoo.scanner.matchLabels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-scanner
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "kyoo.transcoder.matchLabels" -}}
+app.kubernetes.io/name: {{ template "kyoo.name" . }}-transcoder
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "kyoo.serviceAccountName" -}}
+  {{- if .Values.serviceAccount.create -}}
+    {{ default (include "kyoo.fullname" .) .Values.serviceAccount.name }}
+  {{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the back persistent volume
+*/}}
+{{- define "kyoo.backVolumeName" -}}
+  {{- if .Values.persistence.back.existingClaim -}}
+    {{ .Values.persistence.back.existingClaim }}
+  {{- else -}}
+    {{ printf "%s-back" (include "kyoo.fullname" .) | trunc 63 | trimSuffix "-" }}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the metadata persistent volume
+*/}}
+{{- define "kyoo.metadataVolumeName" -}}
+  {{- if .Values.persistence.metadata.existingClaim -}}
+    {{ .Values.persistence.metadata.existingClaim }}
+  {{- else -}}
+    {{ printf "%s-metadata" (include "kyoo.fullname" .) | trunc 63 | trimSuffix "-" }}
+  {{- end -}}
+{{- end -}}

charts/kyoo/templates/deployment-autosync.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "kyoo.fullname" . }}-autosync
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.autosync.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.autosync.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "kyoo.autosync.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "kyoo.autosync.labels" . | nindent 8 }}
+        app.kubernetes.io/component: {{ template "kyoo.name" . }}-autosync
+      annotations:
+        {{- with .Values.autosync.podAnnotations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      affinity:
+        {{- with .Values.autosync.affinity }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      nodeSelector:
+        {{- with .Values.autosync.nodeSelector }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      tolerations:
+        {{- with .Values.autosync.tolerations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      serviceAccountName: {{ template "kyoo.serviceAccountName" . }}
+      securityContext:
+        {{- with .Values.autosync.securityContext }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: {{ template "kyoo.fullname" . }}-autosync
+          image: "{{ .Values.autosync.image.repository }}:{{ .Values.autosync.image.tag }}"
+          imagePullPolicy: {{ .Values.autosync.image.pullPolicy }}
+          resources:
+            {{ toYaml .Values.autosync.resources | nindent 12 }}
+          env:
+            - name: RABBITMQ_HOST
+              value: {{ template "kyoo.fullname" . }}-rabbitmq
+            - name: RABBITMQ_DEFAULT_USER
+              value: "{{ .Values.rabbitmq.auth.username }}"
+            - name: RABBITMQ_DEFAULT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.rabbitmq.auth.existingPasswordSecret }}"
+                  key: "{{ .Values.rabbitmq.auth.existingSecretPasswordKey }}"
+          {{ if .Values.config.secretAPIKey.existingSimklSecretKey }}
+            - name: OIDC_SIMKL_CLIENTID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAPIKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAPIKey.existingSimklSecretKey }}"
+          {{ end }}
+          {{- with .Values.autosync.extraVars }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}

charts/kyoo/templates/deployment-back.yaml

@@ -0,0 +1,185 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "kyoo.fullname" . }}-back
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.back.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.back.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "kyoo.back.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "kyoo.back.labels" . | nindent 8 }}
+        app.kubernetes.io/component: {{ template "kyoo.name" . }}-back
+      annotations:
+        {{- with .Values.back.podAnnotations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      affinity:
+        {{- with .Values.back.affinity }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      nodeSelector:
+        {{- with .Values.back.nodeSelector }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      tolerations:
+        {{- with .Values.back.tolerations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      serviceAccountName: {{ template "kyoo.serviceAccountName" . }}
+      securityContext:
+        {{- with .Values.back.securityContext }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: {{ template "kyoo.fullname" . }}-back
+          image: "{{ .Values.back.image.repository }}:{{ .Values.back.image.tag }}"
+          imagePullPolicy: {{ .Values.back.image.pullPolicy }}
+          resources:
+            {{ toYaml .Values.back.resources | nindent 12 }}
+          ports:
+            - name: kyoo-back
+              containerPort: {{ .Values.back.service.port }}
+              protocol: TCP
+          volumeMounts:
+            - name: kyoo-back
+              mountPath: /kyoo
+          env:
+          {{- with .Values.back.extraVars }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
+            - name: REQUIRE_ACCOUNT_VERIFICATION
+              value: "{{ .Values.config.requireAccountVerification }}"
+            - name: UNLOGGED_PERMISSIONS
+              value: "{{ .Values.config.unloggedPermissions }}"
+            - name: DEFAULT_PERMISSIONS
+              value: "{{ .Values.config.defaultPermissions }}"
+            - name: AUTHENTICATION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAuthenticationKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAuthenticationKey.existingSecretKey }}"
+            - name: KYOO_APIKEYS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAPIKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAPIKey.existingKyooSecretKey }}"
+            - name: PUBLIC_URL
+              value: "{{ .Values.config.publicUrl }}"
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.usernameKey }}"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.passwordKey }}"
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.databaseNameKey }}"
+            - name: POSTGRES_SERVER
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.hostKey }}"
+            - name: POSTGRES_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.portKey }}"
+
+          {{ if .Values.config.oidc.enabled }}
+            - name: OIDC_SERVICE_NAME
+              value: "{{ .Values.config.oidc.name }}"
+            - name: OIDC_SERVICE_LOGO
+              value: "{{ .Values.config.oidc.logo }}"
+            - name: OIDC_SERVICE_AUTHORIZATION
+              value: "{{ .Values.config.oidc.authorization }}"
+            - name: OIDC_SERVICE_TOKEN
+              value: "{{ .Values.config.oidc.token }}"
+            - name: OIDC_SERVICE_PROFILE
+              value: "{{ .Values.config.oidc.profile }}"
+            - name: OIDC_SERVICE_SCOPE
+              value: "{{ .Values.config.oidc.scope }}"
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.oidc.existingSecretName }}"
+                  key: "{{ .Values.config.oidc.clientIDKey }}"
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.oidc.existingSecretName }}"
+                  key: "{{ .Values.config.oidc.secretIDKey }}"
+          {{ end }}
+
+            - name: MEILI_HOST
+              value: http://{{ template "kyoo.fullname" . }}-meilisearch.{{ .Release.Namespace }}:{{ .Values.meilisearch.service.port }}
+            - name: MEILI_MASTER_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.meilisearch.auth.existingMasterKeySecret }}"
+                  key: MEILI_MASTER_KEY
+            - name: RABBITMQ_HOST
+              value: {{ template "kyoo.fullname" . }}-rabbitmq
+            - name: RABBITMQ_DEFAULT_USER
+              value: "{{ .Values.rabbitmq.auth.username }}"
+            - name: RABBITMQ_DEFAULT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.rabbitmq.auth.existingPasswordSecret }}"
+                  key: "{{ .Values.rabbitmq.auth.existingSecretPasswordKey }}"
+
+          {{- if .Values.back.livenessProbe.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.back.livenessProbe.path }}
+              port: {{ .Values.back.service.port }}
+            initialDelaySeconds: {{ .Values.back.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.back.livenessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.back.livenessProbe.timeoutSeconds }}
+            successThreshold: {{ .Values.back.livenessProbe.successThreshold }}
+            failureThreshold: {{ .Values.back.livenessProbe.failureThreshold }}
+          {{- end }}
+
+          {{- if .Values.back.readinessProbe.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.back.livenessProbe.path }}
+              port: {{ .Values.back.service.port }}
+            initialDelaySeconds: {{ .Values.back.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.back.readinessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.back.readinessProbe.timeoutSeconds }}
+            successThreshold: {{ .Values.back.readinessProbe.successThreshold }}
+            failureThreshold: {{ .Values.back.readinessProbe.failureThreshold }}
+          {{- end }}
+
+      volumes:
+        - name: kyoo-back
+      {{- if .Values.persistence.back.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "kyoo.backVolumeName" . }}
+      {{- else }}
+          emptyDir: {}
+      {{- end }}

charts/kyoo/templates/deployment-front.yaml

@@ -0,0 +1,90 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "kyoo.fullname" . }}-front
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.front.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.front.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "kyoo.front.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "kyoo.front.labels" . | nindent 8 }}
+        app.kubernetes.io/component: {{ template "kyoo.name" . }}-front
+      annotations:
+        {{- with .Values.front.podAnnotations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      affinity:
+        {{- with .Values.front.affinity }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      nodeSelector:
+        {{- with .Values.front.nodeSelector }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      tolerations:
+        {{- with .Values.front.tolerations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      serviceAccountName: {{ template "kyoo.serviceAccountName" . }}
+      securityContext:
+        {{- with .Values.front.securityContext }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: {{ template "kyoo.fullname" . }}-front
+          image: "{{ .Values.front.image.repository }}:{{ .Values.front.image.tag }}"
+          imagePullPolicy: {{ .Values.front.image.pullPolicy }}
+          resources:
+            {{ toYaml .Values.front.resources | nindent 12 }}
+          ports:
+            - name: kyoo-front
+              containerPort: {{ .Values.front.service.port }}
+              protocol: TCP
+          env:
+          {{- with .Values.back.extraVars }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
+            - name: KYOO_URL
+              value: http://{{ template "kyoo.fullname" . }}-back.{{ .Release.Namespace }}:{{ .Values.back.service.port }}
+
+          {{- if .Values.front.livenessProbe.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.front.livenessProbe.path }}
+              port: {{ .Values.front.service.port }}
+            initialDelaySeconds: {{ .Values.front.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.front.livenessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.front.livenessProbe.timeoutSeconds }}
+            successThreshold: {{ .Values.front.livenessProbe.successThreshold }}
+            failureThreshold: {{ .Values.front.livenessProbe.failureThreshold }}
+          {{- end }}
+
+          {{- if .Values.front.readinessProbe.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.front.livenessProbe.path }}
+              port: {{ .Values.front.service.port }}
+            initialDelaySeconds: {{ .Values.front.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.front.readinessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.front.readinessProbe.timeoutSeconds }}
+            successThreshold: {{ .Values.front.readinessProbe.successThreshold }}
+            failureThreshold: {{ .Values.front.readinessProbe.failureThreshold }}
+          {{- end }}

charts/kyoo/templates/deployment-matcher.yaml

@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "kyoo.fullname" . }}-matcher
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.matcher.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.matcher.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "kyoo.matcher.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "kyoo.matcher.labels" . | nindent 8 }}
+        app.kubernetes.io/component: {{ template "kyoo.name" . }}-matcher
+      annotations:
+        {{- with .Values.matcher.podAnnotations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      affinity:
+        {{- with .Values.matcher.affinity }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      nodeSelector:
+        {{- with .Values.matcher.nodeSelector }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      tolerations:
+        {{- with .Values.matcher.tolerations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      serviceAccountName: {{ template "kyoo.serviceAccountName" . }}
+      securityContext:
+        {{- with .Values.matcher.securityContext }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: {{ template "kyoo.fullname" . }}-matcher
+          image: "{{ .Values.matcher.image.repository }}:{{ .Values.matcher.image.tag }}"
+          imagePullPolicy: {{ .Values.matcher.image.pullPolicy }}
+          resources:
+            {{ toYaml .Values.matcher.resources | nindent 12 }}
+          command:
+            - matcher
+          env:
+          {{- with .Values.back.extraVars }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
+            - name: KYOO_URL
+              value: http://{{ template "kyoo.fullname" . }}-back.{{ .Release.Namespace }}:{{ .Values.back.service.port }}
+            - name: KYOO_APIKEYS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAPIKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAPIKey.existingKyooSecretKey }}"
+            - name: THEMOVIEDB_APIKEY
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAPIKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAPIKey.existingTMDBSecretKey }}"
+            - name: LIBRARY_LANGUAGES
+              value: "{{ .Values.config.libraryLanguages }}"
+            - name: RABBITMQ_HOST
+              value: {{ template "kyoo.fullname" . }}-rabbitmq
+            - name: RABBITMQ_DEFAULT_USER
+              value: "{{ .Values.rabbitmq.auth.username }}"
+            - name: RABBITMQ_DEFAULT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.rabbitmq.auth.existingPasswordSecret }}"
+                  key: "{{ .Values.rabbitmq.auth.existingSecretPasswordKey }}"

charts/kyoo/templates/deployment-migrations.yaml

@@ -0,0 +1,145 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "kyoo.fullname" . }}-migrations
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.migrations.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.migrations.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "kyoo.migrations.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "kyoo.migrations.labels" . | nindent 8 }}
+        app.kubernetes.io/component: {{ template "kyoo.name" . }}-migrations
+      annotations:
+        {{- with .Values.migrations.podAnnotations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      affinity:
+        {{- with .Values.migrations.affinity }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      nodeSelector:
+        {{- with .Values.migrations.nodeSelector }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      tolerations:
+        {{- with .Values.migrations.tolerations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      serviceAccountName: {{ template "kyoo.serviceAccountName" . }}
+      securityContext:
+        {{- with .Values.migrations.securityContext }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: {{ template "kyoo.fullname" . }}-migrations
+          image: "{{ .Values.migrations.image.repository }}:{{ .Values.migrations.image.tag }}"
+          imagePullPolicy: {{ .Values.migrations.image.pullPolicy }}
+          resources:
+            {{ toYaml .Values.migrations.resources | nindent 12 }}
+          env:
+          {{- with .Values.back.extraVars }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
+            - name: REQUIRE_ACCOUNT_VERIFICATION
+              value: "{{ .Values.config.requireAccountVerification }}"
+            - name: UNLOGGED_PERMISSIONS
+              value: "{{ .Values.config.unloggedPermissions }}"
+            - name: DEFAULT_PERMISSIONS
+              value: "{{ .Values.config.defaultPermissions }}"
+            - name: AUTHENTICATION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAuthenticationKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAuthenticationKey.existingSecretKey }}"
+            - name: KYOO_APIKEYS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAPIKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAPIKey.existingKyooSecretKey }}"
+            - name: PUBLIC_URL
+              value: "{{ .Values.config.publicUrl }}"
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.usernameKey }}"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.passwordKey }}"
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.databaseNameKey }}"
+            - name: POSTGRES_SERVER
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.hostKey }}"
+            - name: POSTGRES_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.postgresql.existingSecretName }}"
+                  key: "{{ .Values.config.postgresql.portKey }}"
+
+          {{ if .Values.config.oidc.enabled }}
+            - name: OIDC_SERVICE_NAME
+              value: "{{ .Values.config.oidc.name }}"
+            - name: OIDC_SERVICE_LOGO
+              value: "{{ .Values.config.oidc.logo }}"
+            - name: OIDC_SERVICE_AUTHORIZATION
+              value: "{{ .Values.config.oidc.authorization }}"
+            - name: OIDC_SERVICE_TOKEN
+              value: "{{ .Values.config.oidc.token }}"
+            - name: OIDC_SERVICE_PROFILE
+              value: "{{ .Values.config.oidc.profile }}"
+            - name: OIDC_SERVICE_SCOPE
+              value: "{{ .Values.config.oidc.scope }}"
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.oidc.existingSecretName }}"
+                  key: "{{ .Values.config.oidc.clientIDKey }}"
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.oidc.existingSecretName }}"
+                  key: "{{ .Values.config.oidc.secretIDKey }}"
+          {{ end }}
+
+            - name: MEILI_HOST
+              value: http://{{ template "kyoo.fullname" . }}-meilisearch.{{ .Release.Namespace }}:{{ .Values.meilisearch.service.port }}
+            - name: MEILI_MASTER_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.meilisearch.auth.existingMasterKeySecret }}"
+                  key: MEILI_MASTER_KEY
+            - name: RABBITMQ_HOST
+              value: {{ template "kyoo.fullname" . }}-rabbitmq
+            - name: RABBITMQ_DEFAULT_USER
+              value: "{{ .Values.rabbitmq.auth.username }}"
+            - name: RABBITMQ_DEFAULT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.rabbitmq.auth.existingPasswordSecret }}"
+                  key: "{{ .Values.rabbitmq.auth.existingSecretPasswordKey }}"

charts/kyoo/templates/deployment-scanner.yaml

@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "kyoo.fullname" . }}-scanner
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.scanner.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.scanner.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "kyoo.scanner.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "kyoo.scanner.labels" . | nindent 8 }}
+        app.kubernetes.io/component: {{ template "kyoo.name" . }}-scanner
+      annotations:
+        {{- with .Values.scanner.podAnnotations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      affinity:
+        {{- with .Values.scanner.affinity }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      nodeSelector:
+        {{- with .Values.scanner.nodeSelector }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      tolerations:
+        {{- with .Values.scanner.tolerations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      serviceAccountName: {{ template "kyoo.serviceAccountName" . }}
+      securityContext:
+        {{- with .Values.scanner.securityContext }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: {{ template "kyoo.fullname" . }}-scanner
+          image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag }}"
+          imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
+          resources:
+            {{ toYaml .Values.scanner.resources | nindent 12 }}
+          volumeMounts:
+            - name: kyoo-library
+              mountPath: "{{ .Values.persistence.library.mountPath }}"
+          command:
+            - scanner
+          env:
+          {{- with .Values.back.extraVars }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
+            - name: KYOO_URL
+              value: http://{{ template "kyoo.fullname" . }}-back.{{ .Release.Namespace }}:{{ .Values.back.service.port }}
+            - name: KYOO_APIKEYS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAPIKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAPIKey.existingKyooSecretKey }}"
+            - name: THEMOVIEDB_APIKEY
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.config.secretAPIKey.existingSecretName }}"
+                  key: "{{ .Values.config.secretAPIKey.existingTMDBSecretKey }}"
+            - name: LIBRARY_LANGUAGES
+              value: "{{ .Values.config.libraryLanguages }}"
+            - name: LIBRARY_IGNORE_PATTERN
+              value: "{{ .Values.config.libraryIgnorePattern }}"
+            - name: SCANNER_LIBRARY_ROOT
+              value: "{{ .Values.persistence.library.mountPath }}"
+            - name: RABBITMQ_HOST
+              value: {{ template "kyoo.fullname" . }}-rabbitmq
+            - name: RABBITMQ_DEFAULT_USER
+              value: "{{ .Values.rabbitmq.auth.username }}"
+            - name: RABBITMQ_DEFAULT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.rabbitmq.auth.existingPasswordSecret }}"
+                  key: "{{ .Values.rabbitmq.auth.existingSecretPasswordKey }}"
+
+      volumes:
+        - name: kyoo-library
+      {{- if .Values.persistence.library.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.library.existingClaim }}
+      {{- else }}
+          emptyDir: {}
+      {{- end }}

charts/kyoo/templates/deployment-transcoder.yaml

@@ -0,0 +1,114 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "kyoo.fullname" . }}-transcoder
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.transcoder.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.transcoder.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "kyoo.transcoder.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "kyoo.transcoder.labels" . | nindent 8 }}
+        app.kubernetes.io/component: {{ template "kyoo.name" . }}-transcoder
+      annotations:
+        {{- with .Values.transcoder.podAnnotations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      affinity:
+        {{- with .Values.transcoder.affinity }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      nodeSelector:
+        {{- with .Values.transcoder.nodeSelector }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      tolerations:
+        {{- with .Values.transcoder.tolerations }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      serviceAccountName: {{ template "kyoo.serviceAccountName" . }}
+      securityContext:
+        {{- with .Values.transcoder.securityContext }}
+        {{ toYaml . | nindent 8 }}
+        {{- end }}
+      containers:
+        - name: {{ template "kyoo.fullname" . }}-transcoder
+          image: "{{ .Values.transcoder.image.repository }}:{{ .Values.transcoder.image.tag }}"
+          imagePullPolicy: {{ .Values.transcoder.image.pullPolicy }}
+          resources:
+            {{ toYaml .Values.transcoder.resources | nindent 12 }}
+          ports:
+            - name: kyoo-transcoder
+              containerPort: {{ .Values.transcoder.service.port }}
+              protocol: TCP
+          volumeMounts:
+            - name: kyoo-metadata
+              mountPath: "{{ .Values.persistence.metadata.mountPath }}"
+            - name: kyoo-cache
+              mountPath: "{{ .Values.persistence.cache.mountPath }}"
+            - name: kyoo-library
+              mountPath: "{{ .Values.persistence.library.mountPath }}"
+          env:
+          {{- with .Values.back.extraVars }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
+          {{- if eq .Values.config.transcoderProfile "vaapi" }}
+            - name: GOCODER_HWACCEL
+              value: "vaapi"
+            - name: GOCODER_VAAPI_RENDERER
+              value: "{{ .Values.config.transcoderRenderPath }}"
+          {{- else if eq .Values.config.transcoderProfile "qsv" }}
+            - name: GOCODER_HWACCEL
+              value: "qsv"
+            - name: GOCODER_QSV_RENDERER
+              value: "{{ .Values.config.transcoderRenderPath }}"
+          {{- else if eq .Values.config.transcoderProfile "nvidia" }}
+            - name: GOCODER_HWACCEL
+              value: "nvidia"
+          {{- else }}
+            - name: GOCODER_HWACCEL
+              value: "disabled"
+          {{- end }}
+
+            - name: GOCODER_PRESET
+              value: "{{ .Values.config.transcoderPreset }}"
+            - name: GOCODER_METADATA_ROOT
+              value: "{{ .Values.persistence.metadata.mountPath }}"
+            - name: GOCODER_CACHE_ROOT
+              value: "{{ .Values.persistence.cache.mountPath }}"
+
+      volumes:
+        - name: kyoo-metadata
+      {{- if .Values.persistence.metadata.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "kyoo.metadataVolumeName" . }}
+      {{- else }}
+          emptyDir: {}
+      {{- end }}
+        - name: kyoo-cache
+          emptyDir:
+            sizeLimit: {{ .Values.persistence.cache.size }}
+        - name: kyoo-library
+      {{- if .Values.persistence.library.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.library.existingClaim }}
+      {{- else }}
+          emptyDir: {}
+      {{- end }}

charts/kyoo/templates/ingress.yaml

@@ -0,0 +1,44 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ template "kyoo.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+  labels:
+    {{- include "kyoo.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.ingress.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+      - {{ .Values.ingress.host }}
+      secretName: {{ template "kyoo.fullname" . }}-secret-tls
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            backend:
+              service:
+                name: "{{ template "kyoo.fullname" . }}-front"
+                port:
+                  name: kyoo-front
+            pathType: ImplementationSpecific
+          - path: /api
+            backend:
+              service:
+                name: "{{ template "kyoo.fullname" . }}-back"
+                port:
+                  name: kyoo-back
+            pathType: ImplementationSpecific
+{{- end }}

charts/kyoo/templates/persistent-volume-claim.yaml

@@ -0,0 +1,54 @@
+{{- if and .Values.persistence.back.enabled (not .Values.persistence.back.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ template "kyoo.backVolumeName" . }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if .Values.persistence.back.retain }}
+    helm.sh/resource-policy: keep
+    {{- end }}
+  labels:
+    {{- include "kyoo.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  storageClassName: {{ .Values.persistence.back.storageClass }}
+  accessModes:
+    - {{ .Values.persistence.back.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.back.size }}
+{{- end }}
+
+---
+{{- if and .Values.persistence.metadata.enabled (not .Values.persistence.metadata.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ template "kyoo.metadataVolumeName" . }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if .Values.persistence.metadata.retain }}
+    "helm.sh/resource-policy": keep
+    {{- end }}
+  labels:
+    {{- include "kyoo.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  storageClassName: {{ .Values.persistence.metadata.storageClass }}
+  accessModes:
+    - {{ .Values.persistence.metadata.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.metadata.size }}
+{{- end }}

charts/kyoo/templates/service-account.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "kyoo.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.serviceAccount.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.serviceAccount.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}

charts/kyoo/templates/service.yaml

@@ -0,0 +1,100 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "kyoo.fullname" . }}-back
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.back.service.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.back.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.back.service.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: {{ .Values.back.service.type }}
+  ports:
+    - port: {{ .Values.back.service.port }}
+      targetPort: kyoo-back
+      protocol: TCP
+      name: kyoo-back
+  selector:
+    {{- include "kyoo.back.matchLabels" . | nindent 4 }}
+    {{- with .Values.back.service.extraSelectorLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "kyoo.fullname" . }}-front
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.front.service.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.front.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.front.service.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: {{ .Values.front.service.type }}
+  ports:
+    - port: {{ .Values.front.service.port }}
+      targetPort: kyoo-front
+      protocol: TCP
+      name: kyoo-front
+  selector:
+    {{- include "kyoo.front.matchLabels" . | nindent 4 }}
+    {{- with .Values.front.service.extraSelectorLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: transcoder
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- with .Values.global.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.transcoder.service.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "kyoo.transcoder.labels" . | nindent 4 }}
+    {{- with .Values.global.labels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.transcoder.service.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  type: {{ .Values.transcoder.service.type }}
+  ports:
+    - port: {{ .Values.transcoder.service.port }}
+      targetPort: kyoo-transcoder
+      protocol: TCP
+      name: kyoo-transcoder
+  selector:
+    {{- include "kyoo.transcoder.matchLabels" . | nindent 4 }}
+    {{- with .Values.transcoder.service.extraSelectorLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}

charts/kyoo/values.yaml

@@ -0,0 +1,887 @@
+## Global
+##
+global:
+  # -- Set an override for the prefix of the fullname
+  nameOverride:
+
+  # -- Set the entire name definition
+  fullnameOverride:
+
+  # -- Set additional global labels. Helm templates can be used.
+  labels: {}
+
+  # -- Set additional global annotations. Helm templates can be used.
+  annotations: {}
+
+## Service Account
+##
+serviceAccount:
+  # -- Specifies whether a service account should be created
+  create: false
+
+  # -- Annotations to add to the service account
+  annotations: {}
+
+  # -- Labels to add to the service account
+  labels: {}
+
+  # -- The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+## Config options
+##
+config:
+  ## Secret key
+  ## Specificy the secret name and the key containg a strong secret key
+  ##
+  secretAuthenticationKey:
+    existingSecretName: ""
+    existingSecretKey: ""
+
+  ## API keys
+  ## Specificy the secret name and the key containg an API key for that service
+  ##
+  secretAPIKey:
+    existingSecretName: ""
+
+    # -- Kyoo
+    existingKyooSecretKey: ""
+
+    # -- The Movie Database
+    existingTMDBSecretKey: ""
+
+    # -- Simkl: https://simkl.docs.apiary.io/#
+    existingSimklSecretKey: ""
+
+  # Langauges
+  libraryLanguages: en
+
+  # A pattern (regex) to ignore video files, ie ".*/[dD]ownloads?/.*"
+  libraryIgnorePattern: ""
+
+  # If this is true, new accounts wont have any permissions before you approve them in your admin dashboard.
+  requireAccountVerification: true
+
+  # Specify permissions of guest accounts, default is no permissions,
+  # but you can allow anyone to use your instance without account by doing:
+  # UNLOGGED_PERMISSIONS=overall.read,overall.play
+  # You can specify this to allow guests users to see your collection without behing able to play videos for example:
+  # UNLOGGED_PERMISSIONS=overall.read
+  unloggedPermissions: ""
+
+  # Specify permissions of new accounts.
+  defaultPermissions: overall.read,overall.play
+
+  # Hardware transcoding (equivalent of --profile docker compose option).
+  # cpu (no hardware acceleration) or vaapi or qsv or nvidia
+  transcoderProfile: cpu
+
+  # Path to the hardware device for the specificied transcoder profile
+  transcoderRenderPath: /dev/dri/renderD128
+
+  # the preset used during transcode. faster means worst quality, you can probably use a slower preset with hwaccels
+  # warning: using vaapi hwaccel disable presets (they are not supported).
+  transcoderPreset: fast
+
+  # The url you can use to reach your kyoo instance. This is also used during oidc to redirect users to your instance.
+  publicUrl: ""
+
+  ## OIDC authentication
+  ##
+  oidc:
+    enabled: false
+
+    # Name of the OIDC provider, ie Authentik, Keycloak, Authelia, etc
+    name: ""
+
+    # URL to the an image of the provider logo
+    logo: ""
+
+    # Urls to access the provider
+    authorization: ""
+    token: ""
+    profile: ""
+
+    # Scopes space separeted
+    scope: "openid profile email"
+
+    # Generated from the provider, these are expected to be stored in a secret
+    existingSecretName: ""
+    clientIDKey: ""
+    secretIDKey: ""
+
+  ## Postgresql
+  ## All configuration is expected to be stored in a secret, reference the secret name and each key for the value
+  ##
+  postgresql:
+    existingSecretName: ""
+    usernameKey: ""
+    passwordKey: ""
+    databaseNameKey: ""
+    hostKey: ""
+    portKey: ""
+
+## Configure the ingress resource that allows you to access the
+## kyoo installation. Set up the URL
+## ref: http://kubernetes.io/docs/user-guide/ingress/
+##
+ingress:
+  # -- Enables or disables the ingress
+  enabled: false
+
+  # -- Provide additional annotations which may be required.
+  annotations: {}
+
+  # -- Provide additional labels which may be required.
+  labels: {}
+
+  # -- Set the ingressClass that is used for this ingress.
+  className: ""
+
+  ## Configure the hosts for the ingress
+  host: chart-example.local
+
+## Enable persistence using Persistent Volume Claims
+## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
+##
+persistence:
+  back:
+    # -- Enables or disables the persistence item. Defaults to true
+    enabled: true
+
+    # -- Storage Class for the config volume.
+    # If set to `-`, dynamic provisioning is disabled.
+    # If set to something else, the given storageClass is used.
+    # If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner.
+    storageClass: ""
+
+    # -- If you want to reuse an existing claim, the name of the existing PVC can be passed here.
+    existingClaim: ""
+
+    # -- AccessMode for the persistent volume.
+    # Make sure to select an access mode that is supported by your storage provider!
+    # [[ref]](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes)
+    accessMode: ReadWriteOnce
+
+    # -- The amount of storage that is requested for the persistent volume.
+    size: 5Gi
+
+    # -- Set to true to retain the PVC upon `helm uninstall`
+    retain: false
+
+  metadata:
+    # -- Enables or disables the persistence item. Defaults to true
+    enabled: true
+
+    # -- Storage Class for the config volume.
+    # If set to `-`, dynamic provisioning is disabled.
+    # If set to something else, the given storageClass is used.
+    # If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner.
+    storageClass: ""
+
+    # -- If you want to reuse an existing claim, the name of the existing PVC can be passed here.
+    existingClaim: ""
+
+    # -- AccessMode for the persistent volume.
+    # Make sure to select an access mode that is supported by your storage provider!
+    # [[ref]](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes)
+    accessMode: ReadWriteOnce
+
+    # -- The amount of storage that is requested for the persistent volume.
+    size: 5Gi
+
+    # -- Set to true to retain the PVC upon `helm uninstall`
+    retain: false
+
+    # -- Mount path inside container
+    mountPath: /metadata
+
+  cache:
+    # -- Transcoder cache will be mounted as an emptyDir, specificy a limit to the cache size
+    size: 10Gi
+
+    # -- Mount path inside container
+    mountPath: /cache
+
+  library:
+    enabled: false
+
+    # -- Provide an existing claim to you media library
+    existingClaim: ""
+
+    # -- Mount path inside container, used as the root path for the library
+    mountPath: /video
+
+## Auto Sync
+##
+autosync:
+  ## Kyoo Auto Sync image version
+  ## ref: https://hub.docker.com/r/zoriya/kyoo_autosync/tags
+  ##
+  image:
+    repository: zoriya/kyoo_autosync
+    tag: "4.4.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+
+  ## Define the number of pods the deployment will create
+  ## Do not change unless your persistent volume allows more than one writer, ie NFS
+  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
+  ##
+  replicas: 1
+
+  ## Pod annotations
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## Affinity for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Pod Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  ##
+  securityContext: {}
+
+  ## kyoo containers' resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #  cpu: 2
+    #  memory: 1Gi
+    requests: {}
+    #  cpu: 1
+    #  memory: 1Gi
+
+  ## Extra environment variables
+  ##
+  extraVars:
+  #  - name: EXAMPLE
+  #    value: "example"
+
+## Back
+##
+back:
+  ## Kyoo Back image version
+  ## ref: https://hub.docker.com/r/zoriya/kyoo_back/tags
+  ##
+  image:
+    repository: zoriya/kyoo_back
+    tag: "4.4.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+
+  ## Define the number of pods the deployment will create
+  ## Do not change unless your persistent volume allows more than one writer, ie NFS
+  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
+  ##
+  replicas: 1
+
+  ## Pod annotations
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## Affinity for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Pod Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  ##
+  securityContext: {}
+
+  ## kyoo containers' resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #  cpu: 2
+    #  memory: 1Gi
+    requests: {}
+    #  cpu: 1
+    #  memory: 1Gi
+
+  ## Configure extra options for liveness and readiness probes
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
+  ##
+  livenessProbe:
+    enabled: false
+    path: /health
+    initialDelaySeconds: 20
+    periodSeconds: 10
+    timeoutSeconds: 5
+    successThreshold: 1
+    failureThreshold: 3
+
+  readinessProbe:
+    enabled: false
+    path: /health
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 1
+    successThreshold: 1
+    failureThreshold: 3
+
+  ## Extra environment variables
+  ##
+  extraVars:
+  #  - name: EXAMPLE
+  #    value: "example"
+
+  ## Service
+  ##
+  service:
+    # -- Set the service type
+    type: ClusterIP
+
+    # -- Provide additional annotations which may be required.
+    annotations: {}
+
+    # -- Provide additional labels which may be required.
+    labels: {}
+
+    # -- Allow adding additional match labels
+    extraSelectorLabels: {}
+
+    # -- HTTP port number
+    port: 5000
+
+## Front
+##
+front:
+  ## Kyoo Front image version
+  ## ref: https://hub.docker.com/r/zoriya/kyoo_front/tags
+  ##
+  image:
+    repository: zoriya/kyoo_front
+    tag: "4.4.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+
+  ## Define the number of pods the deployment will create
+  ## Do not change unless your persistent volume allows more than one writer, ie NFS
+  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
+  ##
+  replicas: 1
+
+  ## Pod annotations
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## Affinity for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Pod Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  ##
+  securityContext: {}
+
+  ## kyoo containers' resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #  cpu: 2
+    #  memory: 1Gi
+    requests: {}
+    #  cpu: 1
+    #  memory: 1Gi
+
+  ## Configure extra options for liveness and readiness probes
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
+  ##
+  livenessProbe:
+    enabled: false
+    path: /
+    initialDelaySeconds: 20
+    periodSeconds: 10
+    timeoutSeconds: 5
+    successThreshold: 1
+    failureThreshold: 3
+
+  readinessProbe:
+    enabled: false
+    path: /
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 1
+    successThreshold: 1
+    failureThreshold: 3
+
+  ## Extra environment variables
+  ##
+  extraVars:
+  #  - name: EXAMPLE
+  #    value: "example"
+
+  ## Service
+  ##
+  service:
+    # -- Set the service type
+    type: ClusterIP
+
+    # -- Provide additional annotations which may be required.
+    annotations: {}
+
+    # -- Provide additional labels which may be required.
+    labels: {}
+
+    # -- Allow adding additional match labels
+    extraSelectorLabels: {}
+
+    # -- HTTP port number
+    port: 8901
+
+## Matcher
+##
+matcher:
+  ## Kyoo Matcher image version
+  ## ref: https://hub.docker.com/r/zoriya/kyoo_matcher/tags
+  ##
+  image:
+    repository: zoriya/kyoo_scanner
+    tag: "4.4.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+
+  ## Define the number of pods the deployment will create
+  ## Do not change unless your persistent volume allows more than one writer, ie NFS
+  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
+  ##
+  replicas: 1
+
+  ## Pod annotations
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## Affinity for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Pod Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  ##
+  securityContext: {}
+
+  ## kyoo containers' resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #  cpu: 2
+    #  memory: 1Gi
+    requests: {}
+    #  cpu: 1
+    #  memory: 1Gi
+
+  ## Extra environment variables
+  ##
+  extraVars:
+  #  - name: EXAMPLE
+  #    value: "example"
+
+## Migrations
+##
+migrations:
+  ## Kyoo Migrations image version
+  ## ref: https://hub.docker.com/r/zoriya/kyoo_migrations/tags
+  ##
+  image:
+    repository: zoriya/kyoo_migrations
+    tag: "4.4.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+
+  ## Define the number of pods the deployment will create
+  ## Do not change unless your persistent volume allows more than one writer, ie NFS
+  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
+  ##
+  replicas: 1
+
+  ## Pod annotations
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## Affinity for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Pod Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  ##
+  securityContext: {}
+
+  ## kyoo containers' resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #  cpu: 2
+    #  memory: 1Gi
+    requests: {}
+    #  cpu: 1
+    #  memory: 1Gi
+
+  ## Extra environment variables
+  ##
+  extraVars:
+  #  - name: EXAMPLE
+  #    value: "example"
+
+## Scanner
+##
+scanner:
+  ## Kyoo Scanner image version
+  ## ref: https://hub.docker.com/r/zoriya/zoriya/kyoo_scanner/tags
+  ##
+  image:
+    repository: zoriya/zoriya/kyoo_scanner
+    tag: "4.4.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+
+  ## Define the number of pods the deployment will create
+  ## Do not change unless your persistent volume allows more than one writer, ie NFS
+  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
+  ##
+  replicas: 1
+
+  ## Pod annotations
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## Affinity for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Pod Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  ##
+  securityContext: {}
+
+  ## kyoo containers' resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #  cpu: 2
+    #  memory: 1Gi
+    requests: {}
+    #  cpu: 1
+    #  memory: 1Gi
+
+  ## Extra environment variables
+  ##
+  extraVars:
+  #  - name: EXAMPLE
+  #    value: "example"
+
+## Transcoder
+##
+transcoder:
+  ## Kyoo Transcoder image version
+  ## ref: https://hub.docker.com/r/zoriya/kyoo_transcoder/tags
+  ##
+  image:
+    repository: zoriya/kyoo_transcoder
+    tag: "4.4.0"
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: IfNotPresent
+
+  ## Define the number of pods the deployment will create
+  ## Do not change unless your persistent volume allows more than one writer, ie NFS
+  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
+  ##
+  replicas: 1
+
+  ## Pod annotations
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## Affinity for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Pod Security Context
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  ##
+  securityContext: {}
+
+  ## kyoo containers' resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #  cpu: 2
+    #  memory: 1Gi
+    requests: {}
+    #  cpu: 1
+    #  memory: 1Gi
+
+  ## Extra environment variables
+  ##
+  extraVars:
+  #  - name: EXAMPLE
+  #    value: "example"
+
+  ## Service
+  ##
+  service:
+    # -- Set the service type
+    type: ClusterIP
+
+    # -- Provide additional annotations which may be required.
+    annotations: {}
+
+    # -- Provide additional labels which may be required.
+    labels: {}
+
+    # -- Allow adding additional match labels
+    extraSelectorLabels: {}
+
+    # -- HTTP port number
+    port: 7666
+
+## Rabbitmq
+## https://artifacthub.io/packages/helm/bitnami/rabbitmq?modal=values-schema
+##
+rabbitmq:
+  auth:
+    ## @param auth.username RabbitMQ application username
+    ## ref: https://github.com/bitnami/containers/tree/main/bitnami/rabbitmq#environment-variables
+    ##
+    username: kyoo
+
+    ## @param auth.existingPasswordSecret Existing secret with RabbitMQ credentials (existing secret must contain a value for `rabbitmq-password` key or override with setting auth.existingSecretPasswordKey)
+    ## e.g:
+    ## existingPasswordSecret: name-of-existing-secret
+    ##
+    existingPasswordSecret: ""
+    existingSecretPasswordKey: ""
+
+    ## @param auth.existingErlangSecret Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key or override with auth.existingSecretErlangKey)
+    ## e.g:
+    ## existingErlangSecret: name-of-existing-secret
+    ##
+    existingErlangSecret: ""
+    ## @param auth.existingSecretErlangKey [default: rabbitmq-erlang-cookie] Erlang cookie key to be retrieved from existing secret
+    ## NOTE: ignored unless `auth.existingErlangSecret` parameter is set
+    ##
+    existingSecretErlangKey: ""
+
+  ## @param configurationExistingSecret Existing secret with the configuration to use as rabbitmq.conf.
+  ## Must contain the key "rabbitmq.conf"
+  ## Takes precedence over `configuration`, so do not use both simultaneously
+  ## With providing an existingSecret, extraConfiguration and extraConfigurationExistingSecret do not take any effect
+  ##
+  configurationExistingSecret: ""
+
+  ## @param extraConfiguration [string] Configuration file content: extra configuration to be appended to RabbitMQ configuration
+  ## Use this instead of `configuration` to add more configuration
+  ## Do not use simultaneously with `extraConfigurationExistingSecret`
+  ##
+  extraConfiguration: ""
+
+## Meilisearch
+## https://github.com/meilisearch/meilisearch-kubernetes/blob/main/charts/meilisearch/values.yaml
+##
+meilisearch:
+  environment:
+
+    # -- Deactivates analytics
+    MEILI_NO_ANALYTICS: true
+
+    # -- Sets the environment. Either **production** or **development**
+    MEILI_ENV: production
+
+    # For production deployment, the environment MEILI_MASTER_KEY is required.
+    # If MEILI_ENV is set to "production" without setting MEILI_MASTER_KEY, this
+    # chart will automatically create a secure MEILI_MASTER_KEY and push it as a
+    # secret. Otherwise the below value of MEILI_MASTER_KEY will be used instead.
+    # MEILI_MASTER_KEY: ""
+
+  auth:
+    # -- Use an existing Kubernetes secret for the MEILI_MASTER_KEY
+    existingMasterKeySecret: ""
+
+  service:
+    # -- Kubernetes Service type
+    type: ClusterIP
+
+    # -- Kubernetes Service port
+    port: 7700
+
+    # -- Additional annotations for service
+    annotations: {}
+
+  persistence:
+    enabled: false
+
+    # -- PVC Access Mode
+    accessMode: ReadWriteOnce
+
+    ## Persistent Volume Storage Class
+    ## If defined, storageClassName: <storageClass>
+    ## If set to "-", storageClassName: "", which disables dynamic provisioning
+    ## If undefined (the default) or set to null, no storageClassName spec is
+    ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+    ##   GKE, AWS & OpenStack)
+    ##
+    # -- PVC Storage Class
+    storageClass: "-"
+
+    ## Data Persistent Volume existing claim name
+    ## Requires persistence.enabled: true
+    ## If defined, PVC must be created manually before volume will be bound
+    # -- Existing PVC
+    existingClaim: ""
+
+    # -- PVC Storage Request
+    size: 10Gi
+
+  resources: {}
+    # limits:
+    #  cpu: 100m
+    #  memory: 128Mi
+    # requests:
+    #  cpu: 100m
+    #  memory: 128Mi
+
+  serviceMonitor:
+    enabled: false

charts/libation/Chart.yaml

@@ -0,0 +1,13 @@
+apiVersion: v2
+name: libation
+version: 0.0.6
+description: Import library from audible
+keywords:
+  - audiobooks
+  - job
+sources:
+  - https://github.com/rmcrackan/Libation
+maintainers:
+  - name: alexlebens
+icon: https://getlibation.com/images/libation-logo.png
+appVersion: "11.1.0"

charts/libation/README.md

@@ -0,0 +1,18 @@
+## Introduction
+
+[Libation](https://github.com/rmcrackan/Libation)
+
+Libation: Liberate your Library. Import library from audible, including cover art
+
+
+This chart bootstraps a [Libation](https://github.com/benphelps/homepage) CronJob on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+
+- Kubernetes
+- Helm
+- CronJob
+
+## Parameters
+
+See the [values files](values.yaml).

charts/libation/templates/job.yaml

@@ -0,0 +1,39 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: libation
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: libation
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: job
+    app.kubernetes.io/part-of: libation
+spec:
+  schedule: {{ .Values.job.schedule }}
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: libation
+              image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+              imagePullPolicy: {{ .Values.image.pullPolicy }}
+              env:
+                - name: SLEEP_TIME
+                  value: "-1"
+              volumeMounts:
+                - name: libation-config
+                  mountPath: /config
+                - name: libation-books
+                  mountPath: /data
+          volumes:
+            - name: libation-config
+              persistentVolumeClaim:
+                claimName: libation-config
+            - name: libation-books
+              persistentVolumeClaim:
+                claimName: {{ .Values.persistence.books.claimName }}

charts/libation/templates/persistent-volume-claim.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: libation-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: libation
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: storage
+    app.kubernetes.io/part-of: libation
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.config.storageSize }}
+  storageClassName: {{ .Values.persistence.config.storageClassName }}
+  volumeMode: {{ .Values.persistence.config.volumeMode }}

charts/libation/values.yaml

@@ -0,0 +1,13 @@
+job:
+  schedule: "0 * * * *"
+image:
+  repository: rmcrackan/libation
+  tag: "11.1.0"
+  pullPolicy: IfNotPresent
+persistence:
+  config:
+    storageClassName: default
+    storageSize: 1Gi
+    volumeMode: Filesystem
+  books:
+    claimName:

charts/matrix-hookshot/Chart.yaml

@@ -0,0 +1,14 @@
+apiVersion: v2
+name: matrix-hookshot
+version: 0.1.1
+description: Chart for Matrix Hookshot
+keywords:
+  - matrix
+  - matrix-hookshot
+  - webhook
+sources:
+  - https://github.com/matrix-org/matrix-hookshot
+maintainers:
+  - name: alexlebens
+icon: https://avatars.githubusercontent.com/u/8418310?s=48&v=4
+appVersion: "5.3.0"

charts/matrix-hookshot/templates/_helpers.tpl

@@ -0,0 +1,43 @@
+{{/*
+Helper for secret name
+*/}}
+{{- define "hookshot.secretName" -}}
+{{- if .Values.hookshot.existingSecret }}
+{{- printf "%s" .Values.hookshot.existingSecret -}}
+{{- else }}
+{{- printf "matrix-hookshot-config-secret" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Helper for registration secret name
+*/}}
+{{- define "hookshot.registrationSecretName" -}}
+{{- if .Values.hookshot.existingRegistrationSecret }}
+{{- printf "%s" .Values.hookshot.existingRegistrationSecret -}}
+{{- else }}
+{{- printf "matrix-hookshot-registration-secret" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Helper for passkey secret name
+*/}}
+{{- define "hookshot.passkeySecretName" -}}
+{{- if .Values.hookshot.existingPasskeySecret }}
+{{- printf "%s" .Values.hookshot.existingPasskeySecret -}}
+{{- else }}
+{{- printf "matrix-hookshot-passkey-secret" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Helper for passkey file name
+*/}}
+{{- define "hookshot.passFile" -}}
+{{- if .Values.hookshot.config.passFile }}
+{{- printf "%s" .Values.hookshot.config.passFile -}}
+{{- else }}
+{{- printf "passkey.pem" }}
+{{- end }}
+{{- end }}

charts/matrix-hookshot/templates/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix-hookshot
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.deployment.replicas }}
+  strategy:
+    type: {{ .Values.deployment.strategy }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: matrix-hookshot
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: matrix-hookshot
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      serviceAccountName: matrix-hookshot
+      automountServiceAccountToken: true
+      containers:
+        - name: matrix-hookshot
+          image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
+          imagePullPolicy: {{ .Values.deployment.image.imagePullPolicy }}
+          ports:
+            - name: webhook
+              containerPort: {{ .Values.service.webhook.port }}
+              protocol: TCP
+            - name: metrics
+              containerPort: {{ .Values.service.metrics.port }}
+              protocol: TCP
+            - name: appservice
+              containerPort: {{ .Values.service.appservice.port }}
+              protocol: TCP
+            - name: widgets
+              containerPort: {{ .Values.service.widgets.port }}
+              protocol: TCP              
+          env:
+          {{- range $k,$v := .Values.deployment.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+          {{- end }}
+          {{- with .Values.deployment.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.deployment.resources | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /data/config.yml
+              subPath: config.yml
+              readOnly: true
+            - name: registration
+              mountPath: /data/registration.yml
+              subPath: registration.yml
+              readOnly: true
+            - name: passkey
+              mountPath: "/data/{{ template "hookshot.passFile" . }}"
+              subPath: {{ template "hookshot.passFile" . }}
+              readOnly: true
+      volumes:
+        - name: config
+          secret:
+            secretName: {{ template "hookshot.secretName" . }}
+        - name: registration
+          secret:
+            secretName: {{ template "hookshot.registrationSecretName" . }}
+        - name: passkey
+          secret:
+            secretName: {{ template "hookshot.passkeySecretName" . }}

charts/matrix-hookshot/templates/ingress.yaml

@@ -0,0 +1,100 @@
+{{- if .Values.ingress.webhook.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix-hookshot-webhook
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-webhook
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    {{- toYaml .Values.ingress.webhook.annotations | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.webhook.className }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.webhook.host }}
+      secretName: {{ .Release.Name }}-webhook-secret-tls
+  rules:
+    - host: {{ .Values.ingress.webhook.host }}
+      http:
+        paths:
+          - path: /webhook/
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  name: webhook
+{{- end }}
+
+---
+{{- if .Values.ingress.appservice.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix-hookshot-appservice
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-appservice
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    {{- toYaml .Values.ingress.appservice.annotations | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.appservice.className }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.appservice.host }}
+      secretName: {{ .Release.Name }}-appservice-secret-tls
+  rules:
+    - host: {{ .Values.ingress.appservice.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  name: appservice
+{{- end }}
+
+---
+{{- if .Values.ingress.widgets.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix-hookshot-widgets
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-widgets
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    {{- toYaml .Values.ingress.widgets.annotations | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.widgets.className }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.widgets.host }}
+      secretName: {{ .Release.Name }}-widgets-secret-tls
+  rules:
+    - host: {{ .Values.ingress.widgets.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  name: widgets
+{{- end }}

charts/matrix-hookshot/templates/pod.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: matrix-hookshot-test-connection
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-test-connection
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    "helm.sh/hook": test-success
+spec:
+  restartPolicy: Never
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['matrix-hookshot:{{ .Values.service.webhook.port }}']
+      resources:
+        limits:
+          cpu: 500m
+          memory: 1Gi
+        requests:
+          cpu: 50m
+          memory: 256Mi

charts/matrix-hookshot/templates/secret.yaml

@@ -0,0 +1,52 @@
+{{- if not .Values.hookshot.existingSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: matrix-hookshot-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-config
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+data:
+  config.yml: |
+{{ toYaml .Values.hookshot.config | indent 4 }}
+{{- end }}
+
+---
+{{- if not .Values.hookshot.existingRegistrationSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: matrix-hookshot-registration-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-registration
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+data:
+  registration.yml: |
+{{ toYaml .Values.hookshot.registration | indent 4 }}
+{{- end }}
+
+---
+{{- if not .Values.hookshot.existingPasskeySecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: matrix-hookshot-passkey-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot-passkey
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+data:
+  {{ .Values.hookshot.config.passFile }}: |
+{{ toYaml .Values.hookshot.passkey | indent 4 }}
+{{- end }}

charts/matrix-hookshot/templates/service-account.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: matrix-hookshot
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}

charts/matrix-hookshot/templates/service-monitor.yaml

@@ -0,0 +1,23 @@
+{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: matrix-hookshot
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  endpoints:
+    - port: metrics
+      interval: {{ .Values.metrics.serviceMonitor.interval }}
+      scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
+      path: /metrics
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: matrix-hookshot
+      app.kubernetes.io/instance: {{ .Release.Name }}      
+{{- end }}

charts/matrix-hookshot/templates/service.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-hookshot
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: matrix-hookshot
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.webhook.port }}
+      targetPort: webhook
+      protocol: TCP
+      name: webhook
+    - port: {{ .Values.service.metrics.port }}
+      targetPort: metrics
+      protocol: TCP
+      name: metrics
+    - port: {{ .Values.service.appservice.port }}
+      targetPort: appservice
+      protocol: TCP
+      name: appservice
+    - port: {{ .Values.service.widgets.port }}
+      targetPort: widgets
+      protocol: TCP
+      name: widgets      
+  selector:
+    app.kubernetes.io/name: matrix-hookshot
+    app.kubernetes.io/instance: {{ .Release.Name }}

charts/matrix-hookshot/values.yaml

@@ -0,0 +1,248 @@
+deployment:
+  replicas: 1
+  strategy: Recreate
+  image:
+    repository: halfshot/matrix-hookshot
+    tag: "5.3.0"
+    imagePullPolicy: IfNotPresent
+  env: {}
+  envFrom: []
+  resources:
+    limits:
+      memory: 512Mi
+      cpu: 100m
+    requests:
+      memory: 256Mi
+      cpu: 50m
+service:
+  type: ClusterIP
+  webhook:
+    port: 9000
+  metrics:
+    port: 9001
+  appservice:
+    port: 9002
+  widgets:
+    port: 9003
+ingress:
+  webhook:
+    enabled: false
+    className: ""
+    annotations: {}
+    host: ""
+  appservice:
+    enabled: false
+    className: ""
+    annotations: {}
+    host: ""
+  widgets:
+    enabled: false
+    className: ""
+    annotations: {}
+    host: ""
+metrics:
+  enabled: false
+  serviceMonitor:
+    enabled: false
+    interval: 15s
+    scrapeTimeout: 5s
+
+# Reference the following for examples
+# https://matrix-org.github.io/matrix-hookshot/latest/setup/sample-configuration.html
+hookshot:
+
+  # config.yml contents
+  existingSecret: ""
+  config:
+    bridge:
+      domain: example.com
+      url: http://localhost:8008
+      mediaUrl: https://example.com
+      port: 9993
+      bindAddress: 0.0.0.0
+    passFile: passkey.pem
+    logging:
+      level: info
+      colorize: true
+      json: false
+      timestampFormat: HH:mm:ss:SSS
+    listeners:
+      - port: 9000
+        bindAddress: 0.0.0.0
+        resources:
+          - webhooks
+      - port: 9001
+        bindAddress: 0.0.0.0
+        resources:
+          - metrics
+          - provisioning
+      - port: 9003
+        bindAddress: 0.0.0.0
+        resources:
+          - widgets
+
+    # github:
+    #  # (Optional) Configure this to enable GitHub support
+    #  auth:
+    #    # Authentication for the GitHub App.
+    #    id: 123
+    #    privateKeyFile: github-key.pem
+    #  webhook:
+    #    # Webhook settings for the GitHub app.
+    #    secret: secrettoken
+    #  oauth:
+    #    # (Optional) Settings for allowing users to sign in via OAuth.
+    #    client_id: foo
+    #    client_secret: bar
+    #    redirect_uri: https://example.com/oauth/
+    #  defaultOptions:
+    #    # (Optional) Default options for GitHub connections.
+    #    showIssueRoomLink: false
+    #    hotlinkIssues:
+    #      prefix: "#"
+    #  userIdPrefix:
+    #    # (Optional) Prefix used when creating ghost users for GitHub accounts.
+    #    _github_
+
+    # gitlab:
+    #  # (Optional) Configure this to enable GitLab support
+    #  instances:
+    #    gitlab.com:
+    #      url: https://gitlab.com
+    #  webhook:
+    #    secret: secrettoken
+    #    publicUrl: https://example.com/hookshot/
+    #  userIdPrefix:
+    #    # (Optional) Prefix used when creating ghost users for GitLab accounts.
+    #    _gitlab_
+    #  commentDebounceMs:
+    #    # (Optional) Aggregate comments by waiting this many miliseconds before posting them to Matrix. Defaults to 5000 (5 seconds)
+    #    5000
+
+    # figma:
+    #  # (Optional) Configure this to enable Figma support
+    #  publicUrl: https://example.com/hookshot/
+    #  instances:
+    #    your-instance:
+    #      teamId: your-team-id
+    #      accessToken: your-personal-access-token
+    #      passcode: your-webhook-passcode
+
+    # jira:
+    #  # (Optional) Configure this to enable Jira support. Only specify `url` if you are using a On Premise install (i.e. not atlassian.com)
+    #  webhook:
+    #    # Webhook settings for JIRA
+    #    secret: secrettoken
+    #  oauth:
+    #    # (Optional) OAuth settings for connecting users to JIRA. See documentation for more information
+    #    client_id: foo
+    #    client_secret: bar
+    #    redirect_uri: https://example.com/oauth/
+
+    # generic:
+    #  # (Optional) Support for generic webhook events.
+    #  #'allowJsTransformationFunctions' will allow users to write short transformation snippets in code, and thus is unsafe in untrusted environments
+
+    #  enabled: false
+    #  enableHttpGet: false
+    #  urlPrefix: https://example.com/webhook/
+    #  userIdPrefix: _webhooks_
+    #  allowJsTransformationFunctions: false
+    #  waitForComplete: false
+
+    # feeds:
+    #  # (Optional) Configure this to enable RSS/Atom feed support
+    #  enabled: false
+    #  pollConcurrency: 4
+    #  pollIntervalSeconds: 600
+    #  pollTimeoutSeconds: 30
+
+    # provisioning:
+    #  # (Optional) Provisioning API for integration managers
+    #  secret: "!secretToken"
+
+    # bot:
+    #  # (Optional) Define profile information for the bot user
+    #  displayname: Hookshot Bot
+    #  avatar: mxc://half-shot.uk/2876e89ccade4cb615e210c458e2a7a6883fe17d
+
+    # serviceBots:
+    #  # (Optional) Define additional bot users for specific services
+    #  - localpart: feeds
+    #    displayname: Feeds
+    #    avatar: ./assets/feeds_avatar.png
+    #    prefix: "!feeds"
+    #    service: feeds
+
+    # metrics:
+    #  # (Optional) Prometheus metrics support
+    #  enabled: true
+
+    # cache:
+    #  # (Optional) Cache options for large scale deployments.
+    #  # For encryption to work, this must be configured.
+    #  redisUri: redis://localhost:6379
+
+    # queue:
+    #  # (Optional) Message queue configuration options for large scale deployments.
+    #  # For encryption to work, this must not be configured.
+    #  redisUri: redis://localhost:6379
+
+    # widgets:
+    #  # (Optional) EXPERIMENTAL support for complimentary widgets
+    #  addToAdminRooms: false
+    #  disallowedIpRanges:
+    #    - 127.0.0.0/8
+    #    - 10.0.0.0/8
+    #    - 172.16.0.0/12
+    #    - 192.168.0.0/16
+    #    - 100.64.0.0/10
+    #    - 192.0.0.0/24
+    #    - 169.254.0.0/16
+    #    - 192.88.99.0/24
+    #    - 198.18.0.0/15
+    #    - 192.0.2.0/24
+    #    - 198.51.100.0/24
+    #    - 203.0.113.0/24
+    #    - 224.0.0.0/4
+    #    - ::1/128
+    #    - fe80::/10
+    #    - fc00::/7
+    #    - 2001:db8::/32
+    #    - ff00::/8
+    #    - fec0::/10
+    #  roomSetupWidget:
+    #    addOnInvite: false
+    #  publicUrl: https://example.com/widgetapi/v1/static/
+    #  branding:
+    #    widgetTitle: Hookshot Configuration
+
+    # sentry:
+    #  # (Optional) Configure Sentry error reporting
+    #  dsn: https://examplePublicKey@o0.ingest.sentry.io/0
+    #  environment: production
+
+    # permissions:
+    #  # (Optional) Permissions for using the bridge. See docs/setup.md#permissions for help
+    #  - actor: example.com
+    #    services:
+    #      - service: "*"
+    #        level: admin
+
+  # registration.yml contents
+  existingRegistrationSecret: ""
+  registration:
+    id: matrix-hookshot
+    as_token: ""
+    hs_token: ""
+    namespaces:
+      rooms: []
+      users: []
+    sender_localpart: hookshot
+    url: "http://example.com"
+    rate_limited: false
+
+  # A passkey used to encrypt tokens stored inside the bridge.
+  # Run openssl genpkey -out passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096 to generate
+  existingPasskeySecret: ""
+  passkey: ""

charts/mautrix-discord/Chart.yaml

@@ -0,0 +1,15 @@
+apiVersion: v2
+name: mautrix-discord
+version: 0.0.2
+description: Chart for Matrix Discord Bridge
+keywords:
+  - matrix
+  - mautrix-discord
+  - bridge
+  - discord
+sources:
+  - https://github.com/mautrix/discord
+maintainers:
+  - name: alexlebens
+icon: https://avatars.githubusercontent.com/u/88519669?s=48&v=4
+appVersion: v0.6.5

charts/mautrix-discord/templates/_helpers.tpl

@@ -0,0 +1,41 @@
+{{/*
+Helper for secret name
+*/}}
+{{- define "mautrix-discord.secretName" -}}
+{{- if .Values.mautrixDiscord.existingSecret }}
+{{- printf "%s" .Values.mautrixDiscord.existingSecret -}}
+{{- else }}
+{{- printf "mautrix-discord-config-secret" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Helper for registration secret name
+*/}}
+{{- define "mautrix-discord.registrationSecretName" -}}
+{{- if .Values.mautrixDiscord.existingRegistrationSecret }}
+{{- printf "%s" .Values.mautrixDiscord.existingRegistrationSecret -}}
+{{- else }}
+{{- printf "mautrix-discord-registration-secret" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Generate registration.yaml if not from existing secret
+*/}}
+{{- define "mautrix-discord.registration-yaml" -}}
+id: {{ .Values.mautrixDiscord.config.appservice.id | quote }}
+as_token: {{ .Values.mautrixDiscord.config.appservice.as_token | quote }}
+hs_token: {{ .Values.mautrixDiscord.config.appservice.hs_token | quote }}
+namespaces:
+  users:
+    - regex: {{ printf "^@discordbot:%s$" (replace "." "\\." .Values.mautrixDiscord.config.homeserver.domain) }}
+      exclusive: true
+    - regex: {{ printf "^@%s:%s$" (replace "{{.}}" ".*" (tpl .Values.mautrixDiscord.config.bridge.username_template .)) (replace "." "\\." .Values.mautrixDiscord.config.homeserver.domain) }}
+      exclusive: true
+url: {{ .Values.mautrixDiscord.config.appservice.address | quote }}
+sender_localpart: {{ .Values.mautrixDiscord.registration.sender_localpart | quote }}
+rate_limited: {{ .Values.mautrixDiscord.registration.rate_limited }}
+de.sorunome.msc2409.push_ephemeral: true
+push_ephemeral: true
+{{- end -}}

charts/mautrix-discord/templates/deployment.yaml

@@ -0,0 +1,96 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mautrix-discord
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.deployment.replicas }}
+  strategy:
+    type: {{ .Values.deployment.strategy }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: mautrix-discord
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: mautrix-discord
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      serviceAccountName: mautrix-discord
+      automountServiceAccountToken: true
+      containers:
+        - name: mautrix-discord
+          image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
+          imagePullPolicy: {{ .Values.deployment.image.imagePullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          env:
+          {{- range $k,$v := .Values.deployment.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+          {{- end }}
+          {{- with .Values.deployment.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /_matrix/mau/live
+              port: http
+            failureThreshold: {{ .Values.deployment.probes.liveness.failureThreshold }}
+            periodSeconds: {{ .Values.deployment.probes.liveness.periodSeconds }}
+          readinessProbe:
+            httpGet:
+              path: /_matrix/mau/ready
+              port: http
+            failureThreshold: {{ .Values.deployment.probes.readiness.failureThreshold }}
+            periodSeconds: {{ .Values.deployment.probes.readiness.periodSeconds }}
+          resources:
+            {{- toYaml .Values.deployment.resources | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /data/config.yaml
+              subPath: config.yaml
+              readOnly: true
+            - name: registration
+              mountPath: /data/registration.yaml
+              subPath: registration.yaml
+              readOnly: true
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: config
+          secret:
+            secretName: {{ template "mautrix-discord.secretName" . }}
+        - name: registration
+          secret:
+            secretName: {{ template "mautrix-discord.registrationSecretName" . }}
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default "mautrix-discord-data" }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+      {{- with .Values.deployment.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.deployment.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.deployment.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/mautrix-discord/templates/ingress.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mautrix-discord
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host }}
+      secretName: {{ .Release.Name }}-secret-tls
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: mautrix-discord
+                port:
+                  name: http
+{{- end }}

charts/mautrix-discord/templates/persistent-volume-claim.yaml

@@ -0,0 +1,26 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: mautrix-discord-data
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+  {{- if .Values.persistence.storageClass }}
+  {{- if not .Values.persistence.storageClass }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  {{- end }}
+{{- end }}

charts/mautrix-discord/templates/secret.yaml

@@ -0,0 +1,33 @@
+{{- if not .Values.mautrixDiscord.existingSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mautrix-discord-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord-config
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+data:
+  config.yaml: |
+{{ toYaml .Values.mautrixDiscord.config | indent 4 }}
+{{- end }}
+
+---
+{{- if not .Values.mautrixDiscord.existingRegistrationSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mautrix-discord-registration-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord-registration
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+data:
+  registration.yaml: {{ include "mautrix-discord.registration-yaml" . | b64enc | quote }}
+{{- end }}

charts/mautrix-discord/templates/service-account.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mautrix-discord
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end -}}

charts/mautrix-discord/templates/service.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mautrix-discord
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: mautrix-discord
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  type: {{ .Values.service.type }}
+  clusterIP: {{ .Values.service.clusterIP | quote }}
+  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
+  publishNotReadyAddresses: {{ .Values.service.publishNotReadyAddresses }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: mautrix-discord
+    app.kubernetes.io/instance: {{ .Release.Name }}

charts/mautrix-discord/values.yaml

@@ -0,0 +1,427 @@
+deployment:
+  replicas: 1
+  strategy: Recreate
+  image:
+    repository: dock.mau.dev/mautrix/discord
+    tag: v0.6.5
+    imagePullPolicy: IfNotPresent
+  env: {}
+  envFrom: []
+  resources:
+    limits:
+      memory: 128Mi
+      cpu: 200m
+    requests:
+      memory: 64Mi
+      cpu: 50m
+  probes:
+    liveness:
+      failureThreshold: 5
+      periodSeconds: 10
+    readiness:
+      failureThreshold: 5
+      periodSeconds: 10
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+serviceAccount:
+  create: true
+  annotations: {}
+service:
+  type: ClusterIP
+  clusterIP: None
+  port: 29334
+  externalTrafficPolicy: ""
+  publishNotReadyAddresses: true
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  host: ""
+persistence:
+  enabled: false
+  existingClaim: ""
+  storageClass: ""
+  accessMode: ReadWriteOnce
+  size: 500Mi
+
+
+# Reference the following for examples
+# https://github.com/mautrix/discord/blob/main/example-config.yaml
+mautrixDiscord:
+
+  # config.yml contents
+  existingSecret: ""
+  config:
+    # Homeserver details.
+    homeserver:
+        # The address that this appservice can use to connect to the homeserver.
+        address: https://matrix.example.com
+        # Publicly accessible base URL for media, used for avatars in relay mode.
+        # If not set, the connection address above will be used.
+        public_address: null
+        # The domain of the homeserver (also known as server_name, used for MXIDs, etc).
+        domain: example.com
+
+        # What software is the homeserver running?
+        # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.
+        software: standard
+        # The URL to push real-time bridge status to.
+        # If set, the bridge will make POST requests to this URL whenever a user's discord connection state changes.
+        # The bridge will use the appservice as_token to authorize requests.
+        status_endpoint: null
+        # Endpoint for reporting per-message status.
+        message_send_checkpoint_endpoint: null
+        # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?
+        async_media: false
+
+        # Should the bridge use a websocket for connecting to the homeserver?
+        # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy,
+        # mautrix-asmux (deprecated), and hungryserv (proprietary).
+        websocket: false
+        # How often should the websocket be pinged? Pinging will be disabled if this is zero.
+        ping_interval_seconds: 0
+
+    # Application service host/registration related details.
+    # Changing these values requires regeneration of the registration.
+    appservice:
+        # The address that the homeserver can use to connect to this appservice.
+        address: http://localhost:29334
+
+        # The hostname and port where this appservice should listen.
+        hostname: 0.0.0.0
+        port: 29334
+
+        # Database config.
+        database:
+            # The database type. "sqlite3-fk-wal" and "postgres" are supported.
+            type: postgres
+            # The database URI.
+            #   SQLite: A raw file path is supported, but `file:<path>?_txlock=immediate` is recommended.
+            #           https://github.com/mattn/go-sqlite3#connection-string
+            #   Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable
+            #             To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql
+            uri: postgres://user:password@host/database?sslmode=disable
+            # Maximum number of connections. Mostly relevant for Postgres.
+            max_open_conns: 20
+            max_idle_conns: 2
+            # Maximum connection idle time and lifetime before they're closed. Disabled if null.
+            # Parsed with https://pkg.go.dev/time#ParseDuration
+            max_conn_idle_time: null
+            max_conn_lifetime: null
+
+        # The unique ID of this appservice.
+        id: discord
+        # Appservice bot details.
+        bot:
+            # Username of the appservice bot.
+            username: discordbot
+            # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+            # to leave display name/avatar as-is.
+            displayname: Discord bridge bot
+            avatar: mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC
+
+        # Whether or not to receive ephemeral events via appservice transactions.
+        # Requires MSC2409 support (i.e. Synapse 1.22+).
+        ephemeral_events: true
+
+        # Should incoming events be handled asynchronously?
+        # This may be necessary for large public instances with lots of messages going through.
+        # However, messages will not be guaranteed to be bridged in the same order they were sent in.
+        async_transactions: false
+
+        # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
+        as_token: "This value is generated when generating the registration"
+        hs_token: "This value is generated when generating the registration"
+
+    # Bridge config
+    bridge:
+        # Localpart template of MXIDs for Discord users.
+        # {{.}} is replaced with the internal ID of the Discord user.
+        username_template: discord_{{.}}
+        # Displayname template for Discord users. This is also used as the room name in DMs if private_chat_portal_meta is enabled.
+        # Available variables:
+        #   .ID - Internal user ID
+        #   .Username - Legacy display/username on Discord
+        #   .GlobalName - New displayname on Discord
+        #   .Discriminator - The 4 numbers after the name on Discord
+        #   .Bot - Whether the user is a bot
+        #   .System - Whether the user is an official system user
+        #   .Webhook - Whether the user is a webhook and is not an application
+        #   .Application - Whether the user is an application
+        displayname_template: '{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}'
+        # Displayname template for Discord channels (bridged as rooms, or spaces when type=4).
+        # Available variables:
+        #   .Name - Channel name, or user displayname (pre-formatted with displayname_template) in DMs.
+        #   .ParentName - Parent channel name (used for categories).
+        #   .GuildName - Guild name.
+        #   .NSFW - Whether the channel is marked as NSFW.
+        #   .Type - Channel type (see values at https://github.com/bwmarrin/discordgo/blob/v0.25.0/structs.go#L251-L267)
+        channel_name_template: '{{if or (eq .Type 3) (eq .Type 4)}}{{.Name}}{{else}}#{{.Name}}{{end}}'
+        # Displayname template for Discord guilds (bridged as spaces).
+        # Available variables:
+        #   .Name - Guild name
+        guild_name_template: '{{.Name}}'
+        # Whether to explicitly set the avatar and room name for private chat portal rooms.
+        # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms.
+        # If set to `always`, all DM rooms will have explicit names and avatars set.
+        # If set to `never`, DM rooms will never have names and avatars set.
+        private_chat_portal_meta: default
+
+        portal_message_buffer: 128
+
+        # Number of private channel portals to create on bridge startup.
+        # Other portals will be created when receiving messages.
+        startup_private_channel_create_limit: 5
+        # Should the bridge send a read receipt from the bridge bot when a message has been sent to Discord?
+        delivery_receipts: false
+        # Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
+        message_status_events: false
+        # Whether the bridge should send error notices via m.notice events when a message fails to bridge.
+        message_error_notices: true
+        # Should the bridge use space-restricted join rules instead of invite-only for guild rooms?
+        # This can avoid unnecessary invite events in guild rooms when members are synced in.
+        restricted_rooms: true
+        # Should the bridge automatically join the user to threads on Discord when the thread is opened on Matrix?
+        # This only works with clients that support thread read receipts (MSC3771 added in Matrix v1.4).
+        autojoin_thread_on_open: true
+        # Should inline fields in Discord embeds be bridged as HTML tables to Matrix?
+        # Tables aren't supported in all clients, but are the only way to emulate the Discord inline field UI.
+        embed_fields_as_tables: true
+        # Should guild channels be muted when the portal is created? This only meant for single-user instances,
+        # it won't mute it for all users if there are multiple Matrix users in the same Discord guild.
+        mute_channels_on_create: false
+        # Should the bridge update the m.direct account data event when double puppeting is enabled.
+        # Note that updating the m.direct event is not atomic (except with mautrix-asmux)
+        # and is therefore prone to race conditions.
+        sync_direct_chat_list: false
+        # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
+        # This field will automatically be changed back to false after it, except if the config file is not writable.
+        resend_bridge_info: false
+        # Should incoming custom emoji reactions be bridged as mxc:// URIs?
+        # If set to false, custom emoji reactions will be bridged as the shortcode instead, and the image won't be available.
+        custom_emoji_reactions: true
+        # Should the bridge attempt to completely delete portal rooms when a channel is deleted on Discord?
+        # If true, the bridge will try to kick Matrix users from the room. Otherwise, the bridge only makes ghosts leave.
+        delete_portal_on_channel_delete: false
+        # Should the bridge delete all portal rooms when you leave a guild on Discord?
+        # This only applies if the guild has no other Matrix users on this bridge instance.
+        delete_guild_on_leave: true
+        # Whether or not created rooms should have federation enabled.
+        # If false, created portal rooms will never be federated.
+        federate_rooms: true
+        # Prefix messages from webhooks with the profile info? This can be used along with a custom displayname_template
+        # to better handle webhooks that change their name all the time (like ones used by bridges).
+        prefix_webhook_messages: false
+        # Bridge webhook avatars?
+        enable_webhook_avatars: true
+        # Should the bridge upload media to the Discord CDN directly before sending the message when using a user token,
+        # like the official client does? The other option is sending the media in the message send request as a form part
+        # (which is always used by bots and webhooks).
+        use_discord_cdn_upload: true
+        # Should mxc uris copied from Discord be cached?
+        # This can be `never` to never cache, `unencrypted` to only cache unencrypted mxc uris, or `always` to cache everything.
+        # If you have a media repo that generates non-unique mxc uris, you should set this to never.
+        cache_media: unencrypted
+        # Settings for converting Discord media to custom mxc:// URIs instead of reuploading.
+        # More details can be found at https://docs.mau.fi/bridges/go/discord/direct-media.html
+        direct_media:
+            # Should custom mxc:// URIs be used instead of reuploading media?
+            enabled: false
+            # The server name to use for the custom mxc:// URIs.
+            # This server name will effectively be a real Matrix server, it just won't implement anything other than media.
+            # You must either set up .well-known delegation from this domain to the bridge, or proxy the domain directly to the bridge.
+            server_name: discord-media.example.com
+            # Optionally a custom .well-known response. This defaults to `server_name:443`
+            well_known_response:
+            # The bridge supports MSC3860 media download redirects and will use them if the requester supports it.
+            # Optionally, you can force redirects and not allow proxying at all by setting this to false.
+            allow_proxy: true
+            # Matrix server signing key to make the federation tester pass, same format as synapse's .signing.key file.
+            # This key is also used to sign the mxc:// URIs to ensure only the bridge can generate them.
+            server_key: generate
+        # Settings for converting animated stickers.
+        animated_sticker:
+            # Format to which animated stickers should be converted.
+            # disable - No conversion, send as-is (lottie JSON)
+            # png - converts to non-animated png (fastest)
+            # gif - converts to animated gif
+            # webm - converts to webm video, requires ffmpeg executable with vp9 codec and webm container support
+            # webp - converts to animated webp, requires ffmpeg executable with webp codec/container support
+            target: webp
+            # Arguments for converter. All converters take width and height.
+            args:
+                width: 320
+                height: 320
+                fps: 25 # only for webm, webp and gif (2, 5, 10, 20 or 25 recommended)
+        # Servers to always allow double puppeting from
+        double_puppet_server_map:
+            example.com: https://example.com
+        # Allow using double puppeting from any server with a valid client .well-known file.
+        double_puppet_allow_discovery: false
+        # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth
+        #
+        # If set, double puppeting will be enabled automatically for local users
+        # instead of users having to find an access token and run `login-matrix`
+        # manually.
+        login_shared_secret_map:
+            example.com: foobar
+
+        # The prefix for commands. Only required in non-management rooms.
+        command_prefix: '!discord'
+        # Messages sent upon joining a management room.
+        # Markdown is supported. The defaults are listed below.
+        management_room_text:
+            # Sent when joining a room.
+            welcome: "Hello, I'm a Discord bridge bot."
+            # Sent when joining a management room and the user is already logged in.
+            welcome_connected: "Use `help` for help."
+            # Sent when joining a management room and the user is not logged in.
+            welcome_unconnected: "Use `help` for help or `login` to log in."
+            # Optional extra text sent when joining a management room.
+            additional_help: ""
+
+        # Settings for backfilling messages.
+        backfill:
+            # Limits for forward backfilling.
+            forward_limits:
+                # Initial backfill (when creating portal). 0 means backfill is disabled.
+                # A special unlimited value is not supported, you must set a limit. Initial backfill will
+                # fetch all messages first before backfilling anything, so high limits can take a lot of time.
+                initial:
+                    dm: 0
+                    channel: 0
+                    thread: 0
+                # Missed message backfill (on startup).
+                # 0 means backfill is disabled, -1 means fetch all messages since last bridged message.
+                # When using unlimited backfill (-1), messages are backfilled as they are fetched.
+                # With limits, all messages up to the limit are fetched first and backfilled afterwards.
+                missed:
+                    dm: 0
+                    channel: 0
+                    thread: 0
+            # Maximum members in a guild to enable backfilling. Set to -1 to disable limit.
+            # This can be used as a rough heuristic to disable backfilling in channels that are too active.
+            # Currently only applies to missed message backfill.
+            max_guild_members: -1
+
+        # End-to-bridge encryption support options.
+        #
+        # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
+        encryption:
+            # Allow encryption, work in group chat rooms with e2ee enabled
+            allow: false
+            # Default to encryption, force-enable encryption in all portals the bridge creates
+            # This will cause the bridge bot to be in private chats for the encryption to work properly.
+            default: false
+            # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.
+            appservice: false
+            # Require encryption, drop any unencrypted messages.
+            require: false
+            # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+            # You must use a client that supports requesting keys from other users to use this feature.
+            allow_key_sharing: false
+            # Should users mentions be in the event wire content to enable the server to send push notifications?
+            plaintext_mentions: false
+            # Options for deleting megolm sessions from the bridge.
+            delete_keys:
+                # Beeper-specific: delete outbound sessions when hungryserv confirms
+                # that the user has uploaded the key to key backup.
+                delete_outbound_on_ack: false
+                # Don't store outbound sessions in the inbound table.
+                dont_store_outbound: false
+                # Ratchet megolm sessions forward after decrypting messages.
+                ratchet_on_decrypt: false
+                # Delete fully used keys (index >= max_messages) after decrypting messages.
+                delete_fully_used_on_decrypt: false
+                # Delete previous megolm sessions from same device when receiving a new one.
+                delete_prev_on_new_session: false
+                # Delete megolm sessions received from a device when the device is deleted.
+                delete_on_device_delete: false
+                # Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
+                periodically_delete_expired: false
+                # Delete inbound megolm sessions that don't have the received_at field used for
+                # automatic ratcheting and expired session deletion. This is meant as a migration
+                # to delete old keys prior to the bridge update.
+                delete_outdated_inbound: false
+            # What level of device verification should be required from users?
+            #
+            # Valid levels:
+            #   unverified - Send keys to all device in the room.
+            #   cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
+            #   cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
+            #   cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
+            #                           Note that creating user signatures from the bridge bot is not currently possible.
+            #   verified - Require manual per-device verification
+            #              (currently only possible by modifying the `trust` column in the `crypto_device` database table).
+            verification_levels:
+                # Minimum level for which the bridge should send keys to when bridging messages from WhatsApp to Matrix.
+                receive: unverified
+                # Minimum level that the bridge should accept for incoming Matrix messages.
+                send: unverified
+                # Minimum level that the bridge should require for accepting key requests.
+                share: cross-signed-tofu
+            # Options for Megolm room key rotation. These options allow you to
+            # configure the m.room.encryption event content. See:
+            # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for
+            # more information about that event.
+            rotation:
+                # Enable custom Megolm room key rotation settings. Note that these
+                # settings will only apply to rooms created after this option is
+                # set.
+                enable_custom: false
+                # The maximum number of milliseconds a session should be used
+                # before changing it. The Matrix spec recommends 604800000 (a week)
+                # as the default.
+                milliseconds: 604800000
+                # The maximum number of messages that should be sent with a given a
+                # session before changing it. The Matrix spec recommends 100 as the
+                # default.
+                messages: 100
+
+                # Disable rotating keys when a user's devices change?
+                # You should not enable this option unless you understand all the implications.
+                disable_device_change_key_rotation: false
+
+        # Settings for provisioning API
+        provisioning:
+            # Prefix for the provisioning API paths.
+            prefix: /_matrix/provision
+            # Shared secret for authentication. If set to "generate", a random secret will be generated,
+            # or if set to "disable", the provisioning API will be disabled.
+            shared_secret: generate
+            # Enable debug API at /debug with provisioning authentication.
+            debug_endpoints: false
+
+        # Permissions for using the bridge.
+        # Permitted values:
+        #    relay - Talk through the relaybot (if enabled), no access otherwise
+        #     user - Access to use the bridge to chat with a Discord account.
+        #    admin - User level and some additional administration tools
+        # Permitted keys:
+        #        * - All Matrix users
+        #   domain - All users on that homeserver
+        #     mxid - Specific user
+        permissions:
+            "*": relay
+            "example.com": user
+            "@admin:example.com": admin
+
+    # Logging config. See https://github.com/tulir/zeroconfig for details.
+    logging:
+        min_level: debug
+        writers:
+        - type: stdout
+          format: pretty-colored
+        - type: file
+          format: json
+          filename: ./logs/mautrix-discord.log
+          max_size: 100
+          max_backups: 10
+          compress: true
+
+  # registration.yml contents
+  existingRegistrationSecret: ""
+  registration:
+    rate_limited: false
+    sender_localpart: discordbridgebot

charts/mautrix-whatsapp/Chart.yaml

@@ -0,0 +1,15 @@
+apiVersion: v2
+name: mautrix-whatsapp
+version: 0.0.3
+description: Chart for Matrix Whatsapp Bridge
+keywords:
+  - matrix
+  - mautrix-whatsapp
+  - bridge
+  - whatsapp
+sources:
+  - https://github.com/mautrix/whatsapp
+maintainers:
+  - name: alexlebens
+icon: https://avatars.githubusercontent.com/u/88519669?s=48&v=4
+appVersion: v0.10.7