Chart index

30 chart directories in the repository: 29 installable charts plus the template-chart scaffold. Counted against */Chart.yaml on 2026-10-05 rather than carried forward, because the previous number had drifted. Each page holds prerequisites, an installation walkthrough, the complete list of configurable values, and the chart's operating traps.

The table below has 31 rows, and the extra one is a known discrepancy rather than a miscount. It still lists convertx, for which there is no chart directory in this repository. Flagged here instead of being deleted: removing a page and a row is a decision about whether that chart is gone, planned or moved, and that is not a documentation fix. Whoever knows the answer should resolve it — and then this note and the row go together.

Versions are not listed here on purpose — and not on the chart pages either. Renovate moves app versions continuously; a table of numbers in a wiki is wrong within days. Read the current pair off the chart:

grep -E '^(version|appVersion):' <chart>/Chart.yaml

The "Ingress" column describes the Ingress mode only. Since the Gateway-API sweep finished (Gitea #114), every chart with a routing object also offers httpRoute.enabled as the mutually exclusive alternative — all 22 of them, with no exception. rss-bridge was the last one and read as the exception for a while, because Gitea #51 had frozen it after its install-test began failing on the runner; that freeze was lifted deliberately, the chart was converted in Gitea #124, and #114 closed with it. Measured on main rather than counted from memory: 22 charts carry an Ingress template and 22 carry an HTTPRoute template. So that column says how a chart publishes while the Ingress is the active mode; it is not a claim that the Ingress is the only mode. The Gateway shapes differ more than the column suggests — two objects for keycloak (public + admin) and matrix-synapse (homeserver + delegation), one per host entry for homeassistant, one per app or one shared for freesailarr — and what each mode costs its chart is on the chart's own page under "Routing: Ingress or Gateway API". The convention is style guide §4.

Every chart ships a NetworkPolicy, on by default (Gitea #5), so that is not listed per row either — it would be the same word thirty times. What differs per chart is which of its ports can be restricted and what its egress rule costs, and that is on each chart's own page under networkPolicy. Two shapes are worth knowing before reading any of them: a port a network probe addresses stays open inside the cluster (the kubelet probes from the worker node's IP, which no chart can know), and policyTypes names only what there is something to restrict — so valkey, homeassistant and satisfactory are Ingress-only, each for its own reason. The convention is style guide §15.

Chart	Deploys	Shape	Ingress	Notable
apache-tika	Apache Tika	Deployment + Service	no	content extraction for paperless-ngx
bentopdf	BentoPDF	Deployment + ConfigMap	yes	`config.json` always rendered, `subPath`-mounted into the web root
bulwark	Bulwark Webmail (JMAP client for stalwart)	StatefulSet + one PVC	yes, at a host root only	the volume beats the chart, for every value, silently — `admin override > env var > default`, the admin dashboard may write any key, and a `helm upgrade` can succeed and change nothing. Only three values escape it. The way out of an OIDC lockout is therefore not `helm upgrade` with `oauth.only: false` but removing the override in the dashboard — which is why `ADMIN_PASSWORD` is set. Both secrets use the file form, mounted without `subPath` so rotation needs no restart. Probes carry nothing about the mail server: with Stalwart gone the pod is green
calibre-web-automated	Calibre-Web Automated	StatefulSet + extra consume PVC	yes	keeps `readOnlyRootFilesystem: false` on purpose — see §12.4
convertx	ConvertX	StatefulSet + data PVC	yes	the only chart that overrides `command` to bypass its image entrypoint — that is what keeps the hardening baseline intact on a rootful image, at the price of re-reading the entrypoint at every app-version bump; probes use `/healthcheck` because `/` is a 302
cyberchef	CyberChef	Deployment	yes, or a Gateway-API `HTTPRoute`	stateless; the simplest chart in the repo and a good first read — and the Gateway-API pilot (Gitea #114): the first chart offering `httpRoute.enabled` as the exclusive alternative to `ingress.enabled`, `HTTPRoute` with `parentRefs` only, no Gateway and no certificate. Also the one chart whose install-test runs in Gateway mode, because that test installs one configuration per chart
freesailarr	gluetun VPN media stack, ten containers	single-pod StatefulSet	per app	the exception to many rules: no icon, no app-version-driven tags, two ingress shapes
garage	Garage (S3-compatible object store)	StatefulSet + two PVCs	off by default	one node at `replication_factor = 1` — which applies to the metadata too, so `metadata_fsync`, the metadata snapshots and a second PVC for them are mandatory rather than optional; `FROM scratch` image, so no shell and no exec probes ever; the RPC secret has to be an env var; readiness is `/health`, liveness and startup deliberately are not
gotenberg	Gotenberg	Deployment + Service	no	PDF conversion for paperless-ngx; sets every limit explicitly
homeassistant	Home Assistant	StatefulSet	upstream-style lists	the only chart with Helm tests; starts as root for s6-overlay
keycloak	Keycloak (OIDC / SAML identity provider)	Deployment, 2 replicas, two init containers, no PVC	yes, two (public + admin host) plus one per `keycloak.realmHosts` entry, empty by default	the admin hostname is not an access control — it only decides which URLs the server generates, and upstream says so; `db`/`health-enabled`/`metrics-enabled` are build options, so the stock image would rewrite its own installation at start and the two init containers are what keeps `readOnlyRootFilesystem: true`; clustered via `jdbc-ping` over the database, so two releases on one database merge; first `PodDisruptionBudget` and first `quay.io` image in the repo
matrix-synapse	Matrix Synapse	StatefulSet + nginx delegation Deployment	yes	`ingress.domain` is served in `/.well-known/matrix/*` — federation depends on it
minecraft-router	itzg/mc-router	Deployment + ConfigMap + NodePort	no (TCP)	`mappings` required; the chart behind the `checksum/config` outage
minecraft-server	itzg/minecraft-server	StatefulSet + PVC	no	only the newest Java line is maintained; `image.tagOverride` picks an older JVM
outline	Outline	StatefulSet + upload PVC	yes	external Postgres and Redis; the reference page for this wiki
paperless-ngx	Paperless-ngx	Deployment + consume CronJob	yes	largest chart; SMB connector; the one documented probes exception; optional valkey subchart, configured as a queue
patchmon	PatchMon	one Deployment, optional guacd sidecar	yes	probes must send a `Host` header or the server answers 403
rallly	Rallly	Deployment	yes	DB, OIDC and SMTP secrets
rss-bridge	RSS-Bridge	Deployment + ConfigMap	yes, list of hosts	documented ingress exception: each host may keep its own TLS secret
samba	Samba	StatefulSet	no	needs capabilities — a documented hardening deviation
satisfactory	Satisfactory game server	StatefulSet	no	excluded from the install-test; `limitFactor: 2` and `OnRootMismatch` are deliberate
searxng	SearXNG	Deployment + ConfigMap	yes	`ingress.domain` is read twice, so it stays required with the Ingress off
stalwart	Stalwart mail server (SMTP, IMAP, POP3, JMAP, ManageSieve)	one StatefulSet per node group + one NodePort Service per port	yes, WebUI/JMAP only	the chart configures almost nothing — since v0.16 Stalwart keeps its whole configuration in the data store, so listeners, stores, TLS objects and cluster roles are operator work and the first install is eight steps. The role lookup fails open (a missing `ClusterRole` enables every listener and every task, green probe included); `NET_BIND_SERVICE` is a documented deviation needed to `exec`, not to bind; `externalTrafficPolicy` must be `Cluster` and the PROXY v2 header is what restores the source address
sure	Sure (the maintained Maybe Finance fork)	StatefulSet, two containers + upload PVC	yes	web and Sidekiq worker share one RWO volume; readiness avoids Rails' `/up`, which proves only that the app booted
teamspeak-server	TeamSpeak server	StatefulSet	no	probes address the TCP port by name; the voice service is UDP and unprobeable
template-chart	—	scaffold	—	not installable; the reference implementation of every convention
urlaubsverwaltung	Urlaubsverwaltung	Deployment	yes	readiness names its health-group members explicitly after a silent outage
valkey	Valkey	StatefulSet + validating init container	no	one instance per application instead of the shared `cluster-redis`; the password is a finished config line from the vault, `maxmemory` is derived from the memory limit, and — with stalwart — one of the two charts whose NetworkPolicy predates Gitea #5, so the convention was derived from them. Still the tightest policy in the repository, because its probes are `exec` probes and 6379 can therefore be closed by source with no escape-hatch value at all
voucher-vault	VoucherVault	StatefulSet	yes	DB and OIDC secrets
ytdlp-web-player	ytdlp_web_player	Deployment	yes	the only chart with a dependency: an optional oauth2-proxy subchart, off by default
zipline	Zipline	StatefulSet	yes	liveness deliberately avoids the database — the positive example of §12.3

What every chart page contains

The same sections in the same order, so two charts can be compared by scrolling to the same place:

At a glance — workloads, storage, ingress, external dependencies, secrets, CI status
Prerequisites — what must exist before helm install, including the 1Password item fields
Installation — helm repo add / helm install with a minimal values file
Configurable values — one table per top-level section, every chart-owned key
Operating notes — the traps, each with the reason it exists
Upgrades and backup
CI — which fixtures cover the chart

Charts excluded from the install-test

Two, both with a written justification in ci/excluded-charts.txt:

satisfactory — the game-server image is multiple GB and Steam downloads 10 GB+ of game files on first start.
template-chart — a scaffold whose image is the placeholder ghcr.io/ORG/IMAGE:xxx; it is never published.

An excluded chart gets no install-test job at all, and the reason is printed into the job summary. See CI/CD.

helm-charts wiki

How we work

How it is built

How charts are written

Charts