14 Commits

Include renames

Author	SHA1	Message	Date
jklein	a9ca5302de	feat(paperless-ngx): optional valkey subchart, password from the redis item ... paperless-ngx cannot run without a Redis - PAPERLESS_REDIS is the Celery broker - so every installation needed a second Helm release whose address lived in a 1Password item and in neither chart. This adds our own published valkey chart as an optional dependency, off by default and gated on valkeySubchart.enabled (not valkey.enabled, which the subchart's strict schema rejects and which Helm would only have complained about for whoever first switched it on). Additive, default behaviour unchanged: minor, 12.1.3+up3.2.1 -> 12.2.0+up3.2.1. Configured as a QUEUE (PVC + noeviction, the subchart's defaults), unlike stalwart's cache. Read off the 3.2.1 source rather than assumed: one PAPERLESS_REDIS url serves five consumers - the Celery broker, the result backend (Redis in 3.x, the database before), the channels pub/sub layer and two Django caches. allkeys-lru would not be a trade here but actively wrong, because LRU evicts typeless across the whole keyspace and a backlog of waiting consume tasks is exactly what it reads as cold; a dropped task is a document silently never processed. The price, named in values.yaml rather than smoothed over: two of the five consumers are caches, so a full instance refuses writes - new tasks included - and the answer is memory sizing, not a policy change. All three cache-like consumers are TTL-bounded, which is what keeps that price small. The password comes from the SAME item as the Redis connection, in a third field auth-conf holding the complete line "requirepass <password>". It cannot DEFAULT to secrets.redisSecretRef, and that is a property of Helm, not an omission: a values.yaml is never templated and a parent cannot compute a subchart's value. Measured - a template expression there lands verbatim in the subchart's itemPath and fails as a YAML parse error naming neither the value nor the cause. Forgetting it is therefore caught in values.schema.json, by a conditional rule rather than a fail() in a template. Also measured, and the reason: Helm renders a subchart's templates BEFORE the parent's, so a guard in this chart loses the race to the subchart's own required(), which reports "secrets.authSecretRef" and cannot know the path belongs to the redis item. A check that cannot fire is the mistake found while testing #77, so the first draft of that guard was removed rather than shipped. The schema runs before any rendering and names /valkey/secrets/authSecretRef. One trap found while testing and closed here: "valkeySubchart: null" DELETES the key, Helm then cannot resolve the condition path and treats the dependency as ENABLED - so erasing the switch turned the subchart on with no password set. Unlike every other block in this chart (issue #99), that one is rejected by the schema instead of defaulting. The install-test now runs with the subchart ON and the throwaway redis Deployment removed: the url in the fixtures names ci-valkey-service, so the bundled Valkey is the broker the release actually uses. #65 covered this path by a render only - deliberately, since an unused Valkey would have made that test look like it covered clustering. This is the first real installation of the valkey-subchart path. Documented, not glossed: the password now sits in that item twice and a rotation has to touch both fields; with the subchart on the vault url is a mandatory step, not a hint; and a OnePasswordItem materializes every field of its item, so both Secrets carry all three keys - untidy, harmless, and written down so nobody "tidies it up". Fixes #78	2026-10-02 21:24:22 +00:00
jklein	e0b552d93e	Replace the obsolete no-dependencies rationale in every chart helper ... The doc comments on the resources and defaultedDict helpers justified the copy-per-chart with "charts in this repo deliberately have no dependencies". That rule fell with #214: a dependency is admissible now, just expensive, and it sits in the README as guideline 14, not 13. The justification still holds, but its reason is a different one - sharing the helper would mean a library chart, a second artefact to publish, version and pull for something that changes about once a year. searxng got that wording in PR #38; this carries it to 21 further charts, 40 occurrences in all. rss-bridge is deliberately left out. Its install-test fails on the Gitea runner for a reason that predates this branch, and touching the chart would keep it in the install-test matrix and the check red. Its copy of the sentence is carried by #51, which has to open the chart anyway. Comments only: every touched chart renders byte-identical against its ci/<chart>/test-values.yaml. Each published chart takes a patch bump, appVersion and +up suffix untouched; template-chart is never published and takes none, but is corrected because every new chart inherits from it. Two repo files carried the same claim at no version cost: validate-charts.yml explained the all-charts quantity render test with it, and change-app-version.yml still counted nine images for freesailarr - MediathekArr made it ten.	2026-09-27 10:27:57 +00:00
jklein	bf02dab364	paperless-ngx: NOTES.txt and the #157 render fix (12.1.0+up3.0.5) ... Two additive changes, no rendered Kubernetes object changes except the resource limits that previously aborted the render. #157 — a bare integer resource value from about 1e6 upwards aborted the render. The null-safe fallbacks pass values through fromYaml, which parses every number as float64, and Go's "%v" switches float64 to exponential notation from that size on: 1048576 became "1.048576e+06", which is not a valid Kubernetes quantity. The canonical correction from the issue is taken over verbatim: multiplyQuantity formats its input and its non-integer product through a new formatNumber helper instead of "%v". The toYaml/fromYaml round trip is not touched — it was just unified across all charts and it is not the cause. This chart has two resource paths and both were affected: paperless.resources (sfs) and smbConnection.cron.resources (consume CronJob). Measured on both before and after, plus the 65536 fallback probe, which is unchanged. #43 — NOTES.txt. Prints what an operator would otherwise read out of the templates: the rendered URL and that ingress.domain also becomes PAPERLESS_URL, the field names each 1Password item must carry (including that the database field is "server" and that "username" is used as both admin login and admin mail), and that secrets.oidcSecretRef is read by no template at all. The conditional sections cover the SMB consume strecke, scaleDown, OIDC, Tika and the barcode settings actually in effect. The traps it names are the ones this chart really has: no checksum annotation anywhere, so rotating an item's content restarts nothing; Redis failing silently while the UI stays green; the 600s startup budget against migrations and the 3.x index rebuild; the consume PVC being hardcoded to 1Gi; the CronJob moving only top-level *.pdf and having no probes (the documented exception); and a cron schedule starting with "*" aborting the render. README is deliberately left alone: the line listing the charts with a NOTES.txt is pulled up once at the end of the programme, so that parallel NOTES PRs do not collide on it. Teil von #157 Teil von #43	2026-08-29 00:22:43 +02:00
jklein	ac53555e44	paperless-ngx: strict values.schema.json and null-safe hardening ... Largest values surface of the programme, and the first chart where the null-safety covers two workloads. 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including files.barcodes, ocr (with enums for the 3.x modes), scripts, tikaGotenberg, the oidc provider block and the SMB CronJob. 2. Null-safety for hardening, probes and resources (#99), for the server AND the SMB consume-mover CronJob. It reuses the defaultedDict helper the barcodes block already introduced (#61) instead of adding a second mechanism - one merge helper, now with more callers. The server's pod context is consumed twice: as the pod securityContext and by the /run-ownership init container, which chowns /run to runAsUser:runAsGroup because s6-overlay refuses to start unless /run is owned by the runtime uid. Both reads now go through the same helper, so the chown cannot disagree with the context it has to match. Erasing that block used to abort rendering with a nil-pointer error; it now falls back to the defaults like every other chart. The CronJob has no probes (documented exception), so only its two contexts and resources are covered. files.storage stays deliberately not null-safe: an erased value yields an invalid PVC, which is the loud class #99 excludes. Rendering is byte-identical to 11.0.0, both with the CI values (which include the #61 regression guard) and with the production paperless-jk bundle values.	2026-08-23 21:59:06 +02:00
jklein	4f489b0854	paperless-ngx: an empty barcodes block falls back to the chart defaults ... A "barcodes:" key left without children (e.g. after deleting the last remaining sub-key, PAPERLESS_CONSUMER_BARCODE_SCANNER, which paperless-ngx 3.0 removed) is YAML null and replaced the whole default sub-tree on merge. Rendering then failed on the nil pointer, so the release simply stopped updating. An empty or null block now means "the chart defaults apply". The merge runs through a new paperless-ngx.defaultedDict helper: nulls never delete, nested maps merge recursively, and explicitly set values win - including false and 0, which "default" and "mergeOverwrite" would swallow. A scalar where the defaults define a map is rejected with the values path in the message. Major bump: the meaning of a values override changes. Fixes #61	2026-08-23 19:31:20 +02:00
jklein	29ac6d09c5	Paperless-ngx chart: naming scheme, secret refs, pinned init images (conventions batch 3) ... Batch-3 major PR for paperless-ngx (issue #32): - secrets.redisRef/databaseRef/paperlessRef -> redisSecretRef/ databaseSecretRef/paperlessSecretRef (consistent with the other SecretRef values in the same block); CI fixtures updated - TLS secret renamed to the standard tls-<release>-<chart>-ingress (domain no longer part of the name) - busybox init/cronjob image pinned via paperless.busybox.image values, default bumped 1.28 -> 1.38.0 - probes values-configurable (defaults unchanged, incl. the 600s startup budget); consume CronJob deliberately stays probe-less - ingress standard: ingress.className (default nginx) and ingress.annotations merge; domain/clusterIssuer stay required - additive paperless.env block rendered through tpl (value, secretKeyRef, configMapKeyRef forms) - disabled scripts ConfigMap renamed to ...-configmap; PVC names kept as documented naming-scheme exception (comments in the templates) - chart 8.0.1+up3.0.5 -> 9.0.0+up3.0.5 (breaking values changes)	2026-08-22 19:39:54 +02:00
jklein	a69542383e	Conventions batch 1: icons, template file names, cosmetics ... - Add icon: to all 17 Chart.yaml (official project icons); removes the last helm lint --strict INFO finding across the repo - Rename template files to the <app>.<kind>.yaml scheme (apache-tika, gotenberg, teamspeak-server PVC, paperless-ngx configmap) - pure git mv, no content changes - template-chart: fix missing space in {{ .Chart.Name}} and rename the ConfigMap resource -config-map -> -configmap (chart is never published) - rallly: fix typos in required messages (rallySecret -> ralllySecret, databseSecret -> databaseSecret) - README: document the deliberate PVC-name exception from the naming scheme (renames would provision new empty volumes) - Patch-bump all 16 published charts Rendered resources are byte-identical for all published charts (only helm's '# Source:' comments change for the renamed files); the only render change is the template-chart ConfigMap name. Part of #32	2026-08-22 15:21:52 +02:00
jklein	8f1329abcb	Update paperless-ngx to 3.0.5 ... Major app jump 2.20.15 -> 3.0.5. Chart major bump (7.1.1 -> 8.0.0): the paperless.files.barcodes.scanner value is removed (pyzbar and PAPERLESS_CONSUMER_BARCODE_SCANNER were removed upstream), the paperless.ocr.mode default changes from the removed "skip" to "auto", and the startup probe budget is raised to 600s for the one-time Whoosh -> Tantivy index rebuild. New optional values: paperless.ocr.archiveFileGeneration, paperless.files.deleteDuplicates, oidc.provider.tokenAuthMethod.	2026-08-22 09:28:54 +02:00
jklein	6779e49355	Add per-workload replicas values and a chart-global scaleDown flag ... Every Deployment/StatefulSet now takes its replica count from a replicas value (default 1, explicit 0 allowed) via a new per-chart <chart>.replicas helper; the helper uses a kindIs "invalid" nil check so an explicit 0 is not swallowed by Helm's default function. A chart-global scaleDown flag (default false) takes precedence: it renders every workload with replicas: 0 and suspends the paperless-ngx consume CronJob, stopping the app without uninstalling it (PVCs, Secrets, Services and Ingress remain). Defaults leave the rendered manifests byte-identical to main, so all published charts get a minor version bump; the template-chart carries the reference helper implementation and stays unversioned. Fixes #25	2026-08-22 08:12:40 +02:00
jklein	91a2fbcb05	Compute memory/ephemeral-storage limits from requests, drop default CPU limits ... Every chart now renders its container resources through a duplicated _helpers.tpl helper (reference implementation in template-chart): requests ship as chart defaults, missing memory and ephemeral-storage limits are computed as resources.limitFactor x the request (default 3, satisfactory keeps 2 to preserve its previously published 8Gi limit), an explicitly set limit always wins, and a CPU limit is only rendered when set explicitly. Fixed limit defaults are removed from all values.yaml files; teamspeak-server gains a values-driven resources block instead of hardcoded template values. Major version bump for all published charts.	2026-08-21 23:34:09 +02:00
jklein	b5eba4cbf1	Harden pod and container security contexts across all workloads ... Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem, capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads that lacked it: apache-tika, cyberchef, gotenberg, homeassistant, matrix-delegation-nginx, paperless-server, paperless-consume cronjob (plus automountServiceAccountToken false), patchmon-frontend, urlaubsverwaltung and zipline. All contexts are configurable via securityContext.pod / securityContext.container in values.yaml; writable paths are provided as emptyDirs. Image-forced deviations (Home Assistant root start for s6-overlay + NET_RAW for discovery, paperless root init container for /run ownership) are documented in the charts' values.yaml. Major version bump for every changed published chart.	2026-08-21 21:49:05 +02:00
jklein	78d78973c5	Ensure liveness, readiness and startup probes on all workloads ... Every container in every Deployment/StatefulSet now defines all three probes. The paperless-ngx consume CronJob intentionally has none (batch workload). - Add probes: apache-tika, calibre-web-automated, cyberchef, gotenberg, homeassistant, patchmon-backend, samba (tcp/445), teamspeak-server (tcp/30033), zipline (/api/healthcheck) - Fix voucher-vault null probe values with real defaults - Fix startup-probe semantics in template-chart and rallly (no initialDelaySeconds, generous failureThreshold) - Switch outline probes to its /_health endpoint - Add readiness/startup probes to satisfactory - Add startup probes to matrix-synapse, matrix-delegation-nginx, paperless-server, patchmon-frontend, urlaubsverwaltung - Major version bump for all published charts	2026-08-21 17:36:53 +02:00
jklein	b27fcddc6f	Add resource requests/limits to paperless consume cronjob ... Configurable via smbConnection.cron.resources with minimal defaults for the busybox container. Bumps chart version to 4.4.1+up2.20.13. Fixes #10	2026-08-21 17:09:37 +02:00
jklein	0d7adfd4ed	feat(paperless-ngx): initial chart	2026-03-23 17:43:12 +01:00