13 Commits

Include renames

Author	SHA1	Message	Date
jklein	33d7cedbab	feat: Gateway-API as an alternative to the Ingress in eight charts ... Group 1 of the #114 sweep: the charts that render exactly one Ingress object and set no behaviour-bearing nginx annotation - bentopdf, garage, patchmon, rallly, searxng, sure, urlaubsverwaltung, voucher-vault. Each gets the form the pilot (cyberchef, PR #115) fixed and template-chart carries: an httpRoute block (enabled/parentRefs/hostnames, off by default), a template rendering ONLY an HTTPRoute with parentRefs - no Gateway, no gatewayClassName, no Certificate, no implementation-specific policy object - render aborts on both modes at once (naming both value paths), on an empty parentRefs and on a missing hostname, empty hostnames meaning [ingress.domain], a schema entry closed against unknown keys with an open parentRef definition, and a NOTES.txt that names the active mode and what the mode costs. Minor, additive, defaults unchanged: `helm template` with each chart's CI values is byte-identical to origin/main for seven of the eight, and for sure identical in every rendered value (the diff is two YAML comment lines). Three findings that were not in the plan, each argued in the file it changes: sure derived RAILS_ASSUME_SSL/RAILS_FORCE_SSL from ingress.enabled alone. Gateway mode sets that false by construction while TLS is still terminated at the Gateway, so both flags would have gone false: insecure cookies, no HSTS, http:// links, with a Ready pod and a working UI as the only symptom. They now read sure.publishedOverTls (ingress.enabled OR httpRoute.enabled), which is ingress.enabled while httpRoute.enabled is false - hence still Minor. garage claimed, in its Ingress template and its schema, that nothing outside that template reads ingress.domain. The HTTPRoute reads it, so the claim now holds only while both modes are off. Corrected rather than left standing. garage also depends on an upload limit it does not set: its annotations comment tells the operator to set proxy-body-size: "0" because ingress-nginx truncates S3 uploads at 1 MB. proxy-body-size has no Gateway-API counterpart, so its Gateway-mode NOTES prints that the limit is the Gateway's. README's list of affected charts named five and now names garage as a sixth. clusterIssuer needed no change in any of the eight: its only required() sits inside the Ingress template behind ingress.enabled, the same no-op the pilot found. Annotation guidance that stops applying in Gateway mode moved into the Gateway branch of NOTES.txt for bentopdf (X-Robots-Tag) and searxng (forward-auth). CI: one render overlay per chart under ci/httproute/, so the assertion is not vacuum-green - ci/run-httproute-match-test.sh goes from 4 held assertions over 2 charts to 20 over 10. The install-test fixtures stay in Ingress mode: the install runs one configuration per chart, cyberchef already pays that price against the real Gateway-API CRDs, and for garage the Ingress is the only place its Service port is referenced by NAME. Not proven, by construction: that traffic flows. No Gateway controller runs in CI. Not run locally either: k3d, Docker, Trivy. Part of #114	2026-10-12 16:06:18 +00:00
jklein	e0b552d93e	Replace the obsolete no-dependencies rationale in every chart helper ... The doc comments on the resources and defaultedDict helpers justified the copy-per-chart with "charts in this repo deliberately have no dependencies". That rule fell with #214: a dependency is admissible now, just expensive, and it sits in the README as guideline 14, not 13. The justification still holds, but its reason is a different one - sharing the helper would mean a library chart, a second artefact to publish, version and pull for something that changes about once a year. searxng got that wording in PR #38; this carries it to 21 further charts, 40 occurrences in all. rss-bridge is deliberately left out. Its install-test fails on the Gitea runner for a reason that predates this branch, and touching the chart would keep it in the install-test matrix and the check red. Its copy of the sentence is carried by #51, which has to open the chart anyway. Comments only: every touched chart renders byte-identical against its ci/<chart>/test-values.yaml. Each published chart takes a patch bump, appVersion and +up suffix untouched; template-chart is never published and takes none, but is corrected because every new chart inherits from it. Two repo files carried the same claim at no version cost: validate-charts.yml explained the all-charts quantity render test with it, and change-app-version.yml still counted nine images for freesailarr - MediathekArr made it ten.	2026-09-27 10:27:57 +00:00
jklein	8189b74f55	rallly: NOTES.txt and the #157 number formatting (8.1.0+up4.13.0) ... Two additive changes in one release. multiplyQuantity turned a bare integer resource value of about 1e6 or more into exponential notation and aborted the render with "unsupported resource quantity suffix \"e+06\"". The null-safe helpers from #99 pass values through fromYaml, which parses every number as float64, and Go's "%v" switches those to exponential form. The new rallly.formatNumber helper forces plain decimal notation on both the input and the non-integer product; it is the same wording already merged into template-chart, zipline and voucher-vault. The NOTES.txt prints what an operator would otherwise have to read out of the templates: the rendered access URL or the port-forward command, the fields each 1Password item has to carry, the OIDC redirect URI, and the traps of this chart - OIDC is the only way in because email login and registration are hard-coded off, a rotated 1Password item does not restart the pods, the probes only prove that the web process answers, and the Next.js cache emptyDir counts against the container's ephemeral-storage limit. Part of #157 Part of #43	2026-08-29 00:19:11 +02:00
jklein	fe6839265c	rallly: seccompProfile RuntimeDefault in the pod context ... Sets seccompProfile.type: RuntimeDefault in the pod security context, so the container runtime's default syscall filter applies to every container in the pod. The value lives in the pod context rather than the container context because it covers init containers and any container added later without being repeated; a container that needs a different filter can still override it under securityContext.container, which wins over the pod value. Verified in k3d against the database path rather than a static page: under the filter the app opens its connection to Postgres and Prisma applies all migrations (141 rows in _prisma_migrations, 31 tables created), and the server-rendered pages answer with HTTP 200. The kernel reports Seccomp: 2 (filter mode) inside the container. Major bump: runtime behavior changes. Refs #84	2026-08-23 23:37:42 +02:00
jklein	edb0837246	rallly: default smtp.rejectUnauthorized to true ... The deployment renders SMTP_REJECT_UNAUTHORIZED from rallly.smtp.rejectUnauthorized, but values.yaml never carried the key. With SMTP enabled the variable therefore reached the app as an empty string -- a certificate check nobody had configured either way. It now defaults to true, so the mail server's certificate is verified unless the operator switches the check off deliberately. values.yaml explains when that is needed (a mail server with a self-signed certificate), because the symptom otherwise points at the mail server rather than at this value. The env var is not rendered with "| default true": an explicit false is a zero value and default would swallow it, silently re-enabling the check the operator just switched off. A nil falls back to true instead, so the variable can no longer reach the app empty. The schema now rejects strings. Operationally inert: the rallly fleet bundle and the deployed release both have smtp.enabled: false, so the variable is not rendered at all -- the render with SMTP disabled is byte-identical to before. Major, because the runtime behaviour of mail sending changes. Fixes #109	2026-08-23 22:28:24 +02:00
jklein	37eda69fdd	rallly: strict values.schema.json, ingress gate and null-safe hardening ... Three changes, all about values that do not do what they promise: 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, so a key the chart does not read is rejected at render time instead of being silently ignored. 2. Ingress gate (#93): the Ingress template is wrapped in {{- if .Values.ingress.enabled }} and the key is added to values.yaml with default true, so behaviour is unchanged. ingress.domain is NOT a pure Ingress value here - it is also the app's public base URL (NEXT_PUBLIC_BASE_URL). Gating alone would therefore have introduced a new silent failure: with the Ingress switched off and no domain, the deployment rendered value: "https://" and every generated link would be broken. The deployment's read of the value is now required(), so that case fails loudly. Only clusterIssuer actually becomes unnecessary when the Ingress is off. 3. Null-safety for hardening, probes and resources (#99): an erased block fell back to "securityContext: null" (unhardened), a vanished probe or a container without resource accounting. Restoring the pod context matters especially here, because its fsGroup is what makes the Next.js cache emptyDir group-writable for the container. rallly.cache is deliberately NOT null-safe: cache.path is required(), so an erased block fails loudly and belongs to the loud class #99 excludes. Apart from an added comment, the rendered manifest is unchanged.	2026-08-23 20:58:52 +02:00
jklein	2de85ea30e	Mount an emptyDir for the Next.js cache in rallly (5.0.0+up4.12.3) ... The chart mounted no volumes at all while running with readOnlyRootFilesystem: true, so every Next.js write to /app/apps/web/.next/cache failed. The image optimizer's failure even surfaced as an unhandledRejection, so this was more than log noise. The cache path is now a writable emptyDir; path and an optional sizeLimit are configurable under rallly.cache. The hardening is untouched — the pod's existing fsGroup (1000) is what makes the mounted volume writable for uid 20000. Verified in a throwaway k3d cluster which paths the app actually writes: with a fully writable root filesystem and the cache mounted, the only path the container touches is the cache directory itself. /tmp, $HOME (=/app) and the rest of the root filesystem stay untouched, so no second mount is needed. Also drops the vestigial "capabilities.add: []": Trivy's AVD-KSV-0022 for rallly (#84) comes from the older chart version deployed in the cluster, which rendered a null list entry under add:. Reproduced with trivy config against both renderings; the app needs no capabilities. Major bump: runtime behavior changes, a volume is added. Fixes #60	2026-08-23 19:33:06 +02:00
jklein	bf49c744f1	Align rallly chart with repo conventions (batch 3) ... - Rename the Deployment (and its labels/selector/pod template/container) to {{ .Release.Name }}-{{ .Chart.Name }}-deployment per the naming scheme; the Service selector follows. - Move the hardcoded pod/container security contexts into values (rallly.securityContext.pod / .container), defaults unchanged; the bogus null entry under capabilities.add becomes an empty list. - Ingress standard: ingress.className value (default nginx) and ingress.annotations merged with the cert-manager annotation; domain/clusterIssuer stay required, TLS secret name already conformed. - Add the tpl-rendered rallly.env value (value/secretKeyRef/ configMapKeyRef forms), appended to the built-in env. - Major bump 3.1.2+up4.12.3 -> 4.0.0+up4.12.3 (deployment rename replaces the Deployment on upgrade: selector is immutable).	2026-08-22 16:00:02 +02:00
jklein	a69542383e	Conventions batch 1: icons, template file names, cosmetics ... - Add icon: to all 17 Chart.yaml (official project icons); removes the last helm lint --strict INFO finding across the repo - Rename template files to the <app>.<kind>.yaml scheme (apache-tika, gotenberg, teamspeak-server PVC, paperless-ngx configmap) - pure git mv, no content changes - template-chart: fix missing space in {{ .Chart.Name}} and rename the ConfigMap resource -config-map -> -configmap (chart is never published) - rallly: fix typos in required messages (rallySecret -> ralllySecret, databseSecret -> databaseSecret) - README: document the deliberate PVC-name exception from the naming scheme (renames would provision new empty volumes) - Patch-bump all 16 published charts Rendered resources are byte-identical for all published charts (only helm's '# Source:' comments change for the renamed files); the only render change is the template-chart ConfigMap name. Part of #32	2026-08-22 15:21:52 +02:00
jklein	6779e49355	Add per-workload replicas values and a chart-global scaleDown flag ... Every Deployment/StatefulSet now takes its replica count from a replicas value (default 1, explicit 0 allowed) via a new per-chart <chart>.replicas helper; the helper uses a kindIs "invalid" nil check so an explicit 0 is not swallowed by Helm's default function. A chart-global scaleDown flag (default false) takes precedence: it renders every workload with replicas: 0 and suspends the paperless-ngx consume CronJob, stopping the app without uninstalling it (PVCs, Secrets, Services and Ingress remain). Defaults leave the rendered manifests byte-identical to main, so all published charts get a minor version bump; the template-chart carries the reference helper implementation and stays unversioned. Fixes #25	2026-08-22 08:12:40 +02:00
jklein	91a2fbcb05	Compute memory/ephemeral-storage limits from requests, drop default CPU limits ... Every chart now renders its container resources through a duplicated _helpers.tpl helper (reference implementation in template-chart): requests ship as chart defaults, missing memory and ephemeral-storage limits are computed as resources.limitFactor x the request (default 3, satisfactory keeps 2 to preserve its previously published 8Gi limit), an explicitly set limit always wins, and a CPU limit is only rendered when set explicitly. Fixed limit defaults are removed from all values.yaml files; teamspeak-server gains a values-driven resources block instead of hardcoded template values. Major version bump for all published charts.	2026-08-21 23:34:09 +02:00
jklein	780d0d6b9a	feat(rallly): added missing values	2026-04-08 15:35:52 +02:00
jklein	72fe6f8408	feat(rallly): added initial chart	2026-04-08 15:05:10 +02:00