New chart: sure (we-promise) at 1.0.0+up0.7.4 #33
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: jlab-cluster/helm-charts#33
Reference in new issue
Block a user
A new chart for Sure (
we-promise/sure, the maintained Maybe-finance fork), a self-hosted personal finance app.Upstream hosting doc: https://github.com/we-promise/sure/blob/main/docs/hosting/docker.md
This body is the approved plan, so there is no separate plan comment.
Verified upstream facts
Everything below was read off the registry, the Dockerfile, the entrypoint,
compose.example.ymlandconfig/routes.rb— not from memory.ghcr.io/we-promise/sureUSER 1000:1000(rails),WORKDIR /rails,EXPOSE 30000.7.4) alongside the movingstable,latest(upstream calls it alpha) andnightly. Prereleases are-alpha.N,-rc.N,-hotfix.Nstabletoday0.7.4(sha256:391b2c52…), so a pinned version tag loses nothing./bin/rails db:prepareonly when the command is./bin/rails server— the web process migrates, the worker does notweb(Puma) andworker(bundle exec sidekiq), same image/rails/storage(Active Storage), mounted into both processes upstreamSECRET_KEY_BASE,SELF_HOSTED=true,DB_HOST,DB_PORT,POSTGRES_DB,POSTGRES_USER,POSTGRES_PASSWORD,REDIS_URLget "up" => "rails/health#show"Decisions taken (approved)
/rails/storage. Two separate workloads would need an RWX volume; the shared volume is the reason, not the style. Precedent: patchmon with its guacd sidecar.appVersion: 0.7.4, chart1.0.0+up0.7.4. The alpha channel is deliberately not tracked.OPENAI_*,EXTERNAL_ASSISTANT_*and the assistant timeouts are reachable through the additiveenvblock (includingsecretKeyReffor the token) and documented inNOTES.txtand the wiki. Noai:section, no extra schema surface.Work items
sure/fromtemplate-chart, everyxxxreplaced,icon:set/rails/storage, emptyDirs for/rails/tmpand/rails/logso the root filesystem stays read-onlyvalues.yamlOnePasswordItemCRs: app (SECRET_KEY_BASE), database (host, port, database, username, password as fields), redis (connection-url)tls-<release>-sure-ingressingress.domainstays required even wheningress.enabledis false — it is also read forRAILS_ASSUME_SSL/WEBAUTHN_RP_ID, which is the §12.1 case/up, readiness on a path that provably fails without the database, startup budget coveringdb:prepare; a probe for the sidekiq container that needs no HTTPreplicasplus the chart-globalscaleDownvalues.schema.json, null-safe fallbacks reproducing this chart's defaultsNOTES.txt: access URL, the exact 1Password fields, the migration-on-start trap,SECRET_KEY_BASErotation consequences, no real domain.github/workflows/publish-sure.ymlsureadded to thechart-namechoice list inchange-app-version.ymlci/sure/fixtures: throwaway Postgres 16 and Redis, dummy secrets,INSTALL_TIMEOUTraised for the first-start migrationrenovate.json5block withversioning: semver, so-alpha/-rc/-hotfixcount as unstable and never automerge; the moving tags stay outside the patternsure, row inCharts, entry in_Sidebar.mdOpen points that must be answered, not assumed
/upfail when Postgres is down? Rails'Rails::HealthController#showis a boot check and is widely believed to test the database; that belief is what §12.3 exists to catch. The readiness path must be one that demonstrably breaks without the database, and the chart comment must say what was measured versus read from the source.execcheck is possible with what the image ships. Booting Rails per probe is not acceptable.Acceptance
helm lint --strict sureclean, the chart renders, the PR pipeline green including the install-test, and the wiki page exists before the merge is requested.