13 Commits

Include renames

Author	SHA1	Message	Date
jklein	e0b552d93e	Replace the obsolete no-dependencies rationale in every chart helper ... The doc comments on the resources and defaultedDict helpers justified the copy-per-chart with "charts in this repo deliberately have no dependencies". That rule fell with #214: a dependency is admissible now, just expensive, and it sits in the README as guideline 14, not 13. The justification still holds, but its reason is a different one - sharing the helper would mean a library chart, a second artefact to publish, version and pull for something that changes about once a year. searxng got that wording in PR #38; this carries it to 21 further charts, 40 occurrences in all. rss-bridge is deliberately left out. Its install-test fails on the Gitea runner for a reason that predates this branch, and touching the chart would keep it in the install-test matrix and the check red. Its copy of the sentence is carried by #51, which has to open the chart anyway. Comments only: every touched chart renders byte-identical against its ci/<chart>/test-values.yaml. Each published chart takes a patch bump, appVersion and +up suffix untouched; template-chart is never published and takes none, but is corrected because every new chart inherits from it. Two repo files carried the same claim at no version cost: validate-charts.yml explained the all-charts quantity render test with it, and change-app-version.yml still counted nine images for freesailarr - MediathekArr made it ten.	2026-09-27 10:27:57 +00:00
jklein	5ff6e401c7	satisfactory: dev and server fall back instead of aborting (7.0.1) ... --set dev=null aborted the render at .Values.dev.debug and --set server=null at .Values.server.replicas, while the third block, game, has fallen back to the chart defaults since 7.0.0. Half-safe is the worse state of the two: whoever sees game=null work assumes server=null does too. Both blocks now run through satisfactory.defaultedDict like game, via two new helpers next to it. server.resources is deliberately NOT re-defaulted there - it already runs through satisfactory.effectiveResources, which carries those defaults and is null-safe on its own, and a second copy of limitFactor: 2 / 4Gi / 1 / 5Gi would be a third place for them to drift. server is read in four files, not one, and the fourth is NOTES.txt, which helm template never renders - a fix confined to the manifests would have looked green and still aborted on a real helm install. All four go through the helpers. The single erased key was the quieter half of the bug and is fixed with it: a nulled server.gamePort rendered "port:" and "nodePort:" empty into the Service and an empty containerPort into the StatefulSet, and a nulled server.storage a PVC asking for no size - manifests rejected by nothing until the API server saw them. server.storage was documented in values.schema.json as deliberately not null-safe; that reasoning does not survive the block-level case, because it made "server: null" render a sizeless PVC instead of falling back like everything else. The schema note is replaced rather than left lying. Rendered output for valid values is unchanged: helm template against the chart defaults and against a full override set is byte-identical to 7.0.0, and so is NOTES.txt. Hence a patch bump, appVersion untouched. Fixes #16	2026-09-23 20:45:24 +00:00
jklein	485f4fa52b	satisfactory: game.enableSeasonalEvents says what it does (7.0.0+upv1.9.10) ... game.seasonalEvents was handed to the container unchanged, into the image's DISABLESEASONALEVENTS. Its default true therefore wrote DISABLESEASONALEVENTS=true: the seasonal events were OFF in every install this chart has ever produced, while values.schema.json described the very same key as "true means events are enabled" (#215). Of the two ways out, this is the loud one. Inverting the template under the old key would have flipped the behaviour of every existing release in silence - the same class of mistake that created the issue. Renaming the key cannot be missed: game.seasonalEvents no longer exists, additionalProperties is false on the game block, and a values file that still carries it fails schema validation on upgrade instead of quietly meaning the opposite. The new key is positive (enableSeasonalEvents) to avoid a double negative, so the chart negates it on the way into the env var. Go's "not" cannot do that: it reads every non-empty string as true, and the schema deliberately accepts the string form of booleans, so "false" would have flipped the wrong way. The helper compares explicitly and fails on anything that is neither true nor false rather than filing it under "off". The default is enableSeasonalEvents: false, which renders the DISABLESEASONALEVENTS this chart has always rendered. At chart defaults the 6.1.0 and 7.0.0 manifests are identical, so upgrading alone moves no server; switching the events on is now a deliberate act with a key that means it. Separate finding from the same issue, fixed here because it lives in the block being touched: "--set game=null" - or a leftover "game:" whose sub-keys were deleted - aborted the render with a nil pointer at .Values.game.maxPlayers. The game block never got the null-safe treatment of #99 that probes, security contexts and resources have. It now falls back to the documented defaults, and the schema accepts the null accordingly. The same gap remains in the dev and server blocks; it is reported, not fixed here. Major bump: a values key is removed, and the schema rejects it.	2026-09-02 13:42:39 +02:00
jklein	a915c5da5d	satisfactory: exponential-notation fix and NOTES.txt (6.1.0+upv1.9.10) ... Teil von #157 und Teil von #43. #157: multiplyQuantity turned a bare byte count into exponential notation. The null-safe fallback helpers pass values through fromYaml, which parses every number as float64, and Go's "%v" switches float64 to exponential notation from about 1e6 upwards. A request of 1048576 became "1.048576e+06" and the render aborted on the suffix check. Both printf "%v" sites are replaced by the canonical satisfactory.formatNumber helper: the input of multiplyQuantity and the output of a non-integer product. The second one never reached the suffix check, so it did not abort - it rendered a silently invalid quantity that only the API server would reject. #43: adds templates/NOTES.txt. The chart has no Ingress and no secrets, so the notes cover what an operator would otherwise read out of the templates: the NodePort a player actually dials and the pinned-port collision between two releases, the 20-minute Steam download budget and that SKIPUPDATE is false on every start, what a green pod does and does not prove (no probe ever touches the UDP game port), that saves and game files share one PVC on a hardcoded longhorn class which helm uninstall deletes, the emptyDirs counting against the ephemeral-storage limit, the deliberate limitFactor 2 and fsGroupChangePolicy OnRootMismatch, and that game.seasonalEvents is passed through to DISABLESEASONALEVENTS uninverted. No rendered Kubernetes object changes, so the bump is minor; appVersion stays v1.9.10.	2026-08-29 00:51:50 +02:00
jklein	6c73ef874b	Eight charts: seccompProfile RuntimeDefault and qualified images ... Sets seccompProfile.type: RuntimeDefault in the pod security context of minecraft-router, outline, urlaubsverwaltung, zipline, voucher-vault, satisfactory, patchmon and calibre-web-automated, so the container runtime's default syscall filter applies to every container in the pod. The value lives in the pod context rather than the container context because it covers init containers and any container added later without being repeated; a container that needs a different filter can still override it under securityContext.container, which wins over the pod value. Five of the eight also get the docker.io/ prefix on their previously unqualified image references, so the pull no longer depends on the runtime's default-registry setting: itzg/mc-router, outlinewiki/outline, urlaubsverwaltung/urlaubsverwaltung, l4rm4nd/vouchervault (twice, app and init container) and guacamole/guacd:1.6.0. zipline, satisfactory and calibre-web-automated were already qualified with ghcr.io. Verified in a throwaway k3d cluster against real application work, not just a Running pod, and with Seccomp: 2 (filter mode) read from /proc/<pid>/status inside each container: - minecraft-router: a Minecraft handshake for a mapped domain travels through the router to a backend and the backend's status payload comes back to the client. - outline: all migrations apply (45 tables), OIDC discovery succeeds and the server-rendered page answers 200 with <title>Outline</title>. - urlaubsverwaltung: Liquibase applies 79 changesets (35 tables), the app seeds its settings and vacation types, /login answers 200. - zipline: 27 migrations applied, then a full round trip - first user created, login, token, upload, and the file downloaded back byte-exact from the PVC. - voucher-vault: the init container's collectstatic output is served (200, 22 KB), Django has its 22 tables and uWSGI answers 200 with <title>VoucherVault</title>. - satisfactory: application behavior is NOT proven - the image is multiple GB and pulls 10 GB+ of game files on first start, which is why the chart sits in ci/excluded-charts.txt. What is proven is that the rendered pod securityContext is accepted server-side and yields Seccomp: 2 with uid/gid 1000 on a substitute image. - patchmon: both containers run under the pod profile and both report Seccomp: 2. The server applies 47 migrations (44 tables), connects to Postgres and Redis and serves its dashboard; guacd answers a real Guacamole "select rdp" instruction with its full args list, over the same 127.0.0.1:4822 path the chart wires up. - calibre-web-automated: the readOnlyRootFilesystem: false deviation is unaffected - id abc is still uid 1000 (not the 911 the image falls back to in read-only mode), /config and the Calibre metadata.db are owned by 1000, and both the root s6 init and the uid-1000 application report Seccomp: 2. calibredb 9.1 runs and adds a book. Its IPC worker prints a traceback while doing so, but an unconfined control pod on the same image prints the same class of traceback, so it is not the filter. trivy config now reports "0 to act on" for all eight; the untouched samba still shows KSV-0104 and KSV-0030, which confirms these charts are what closed the findings. No values.schema.json needed changing: in all eight schemas securityContext.pod is type ["object", "null"] with no property restrictions, so the new key validates as it stands. The #99 null paths still hold - nulling securityContext or securityContext.pod falls back to the defaults including the new one. Renovate resolves the prefixed guacd reference: a local dry-run lookup (renovate 44.40.1, --platform=local --dry-run=lookup) reports depName docker.io/guacamole/guacd against registryUrl https://index.docker.io with lookupName guacamole/guacd, currentVersion 1.6.0 and its real release timestamp, with no warnings. The other four prefixed references live in templates, which Renovate never reads - they are tracked by the customManagers via appVersion in Chart.yaml with a depName hardcoded in renovate.json5, so they are unaffected. Major bump for all eight: runtime behavior changes. Refs #84	2026-08-24 13:17:14 +02:00
jklein	290c69cc7d	satisfactory: strict values.schema.json and null-safe hardening ... No ingress gate: this chart has no Ingress at all (game and messaging ports are exposed via NodePort), and ingress.domain appears neither in its templates nor in its values. 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level. Like teamspeak-server, this chart keeps env, probes and securityContext at the TOP level, and the schema mirrors that shape. 2. Null-safety for hardening, probes and resources (#99). What a rebuilt default must not lose here: - liveness and startup run the image's own healthcheck script via exec. It queries the server's HTTPS API on SERVERGAMEPORT, so it survives a port override, which a tcpSocket default could not. - readiness keeps the named "api" port. - the resources default keeps limitFactor 2 rather than the repo-wide 3, which is what holds the memory limit at the published 8Gi. - the pod context keeps fsGroupChangePolicy OnRootMismatch, which is what avoids a recursive chown of multi-GB game files on every start. server.storage stays deliberately not null-safe: an erased value yields an invalid PVC, which is the loud class #99 excludes. This chart is excluded from the CI install-test, so the local proof is the only one. Rendering is byte-identical to 4.0.0 with default values and with the production bundle values, and the rendered manifests were additionally validated by the cluster's API server via a server-side dry-run.	2026-08-23 21:28:52 +02:00
jklein	247c01bce1	satisfactory chart: naming scheme, security hardening, configurable probes ... All audit findings from #32 for the satisfactory chart in one major PR: - StatefulSet renamed to {{ .Release.Name }}-{{ .Chart.Name }}-sfs, service to ...-service (standard scheme); template file satisfactory-server.sfs.yaml renamed to satisfactory.sfs.yaml. The PVC keeps its historical -vc name (documented naming exception; renaming would orphan the data). - Hardened, values-configurable security contexts (securityContext.pod / securityContext.container): runAsNonRoot with the image's steam user (uid/gid 1000), readOnlyRootFilesystem, all capabilities dropped. emptyDirs mounted at /tmp and the steam user's ~/.steam, ~/.config and ~/.local make the read-only root filesystem work; all other writes go to the PVC. - Probes are now values (livenessProbe/readinessProbe/startupProbe), defaults exactly the previously hardcoded values. - Additive env value rendered through tpl with value/secretKeyRef/ configMapKeyRef forms (template-chart pattern). Chart 3.1.1+upv1.9.10 -> 4.0.0+upv1.9.10 (major: resource renames + hardening); appVersion unchanged.	2026-08-22 16:00:33 +02:00
jklein	a69542383e	Conventions batch 1: icons, template file names, cosmetics ... - Add icon: to all 17 Chart.yaml (official project icons); removes the last helm lint --strict INFO finding across the repo - Rename template files to the <app>.<kind>.yaml scheme (apache-tika, gotenberg, teamspeak-server PVC, paperless-ngx configmap) - pure git mv, no content changes - template-chart: fix missing space in {{ .Chart.Name}} and rename the ConfigMap resource -config-map -> -configmap (chart is never published) - rallly: fix typos in required messages (rallySecret -> ralllySecret, databseSecret -> databaseSecret) - README: document the deliberate PVC-name exception from the naming scheme (renames would provision new empty volumes) - Patch-bump all 16 published charts Rendered resources are byte-identical for all published charts (only helm's '# Source:' comments change for the renamed files); the only render change is the template-chart ConfigMap name. Part of #32	2026-08-22 15:21:52 +02:00
jklein	6779e49355	Add per-workload replicas values and a chart-global scaleDown flag ... Every Deployment/StatefulSet now takes its replica count from a replicas value (default 1, explicit 0 allowed) via a new per-chart <chart>.replicas helper; the helper uses a kindIs "invalid" nil check so an explicit 0 is not swallowed by Helm's default function. A chart-global scaleDown flag (default false) takes precedence: it renders every workload with replicas: 0 and suspends the paperless-ngx consume CronJob, stopping the app without uninstalling it (PVCs, Secrets, Services and Ingress remain). Defaults leave the rendered manifests byte-identical to main, so all published charts get a minor version bump; the template-chart carries the reference helper implementation and stays unversioned. Fixes #25	2026-08-22 08:12:40 +02:00
jklein	91a2fbcb05	Compute memory/ephemeral-storage limits from requests, drop default CPU limits ... Every chart now renders its container resources through a duplicated _helpers.tpl helper (reference implementation in template-chart): requests ship as chart defaults, missing memory and ephemeral-storage limits are computed as resources.limitFactor x the request (default 3, satisfactory keeps 2 to preserve its previously published 8Gi limit), an explicitly set limit always wins, and a CPU limit is only rendered when set explicitly. Fixed limit defaults are removed from all values.yaml files; teamspeak-server gains a values-driven resources block instead of hardcoded template values. Major version bump for all published charts.	2026-08-21 23:34:09 +02:00
jklein	78d78973c5	Ensure liveness, readiness and startup probes on all workloads ... Every container in every Deployment/StatefulSet now defines all three probes. The paperless-ngx consume CronJob intentionally has none (batch workload). - Add probes: apache-tika, calibre-web-automated, cyberchef, gotenberg, homeassistant, patchmon-backend, samba (tcp/445), teamspeak-server (tcp/30033), zipline (/api/healthcheck) - Fix voucher-vault null probe values with real defaults - Fix startup-probe semantics in template-chart and rallly (no initialDelaySeconds, generous failureThreshold) - Switch outline probes to its /_health endpoint - Add readiness/startup probes to satisfactory - Add startup probes to matrix-synapse, matrix-delegation-nginx, paperless-server, patchmon-frontend, urlaubsverwaltung - Major version bump for all published charts	2026-08-21 17:36:53 +02:00
jklein	5e25711447	feat(satisfactory): allowed customization of resource requests and limits	2026-04-05 16:24:23 +02:00
jklein	367d9e3900	feat(satisfactory): added chart	2026-03-16 21:21:07 +01:00