diff --git a/enterprise/authelia/20.0.5/CHANGELOG.md b/enterprise/authelia/20.0.5/CHANGELOG.md new file mode 100644 index 0000000000..d927aa517e --- /dev/null +++ b/enterprise/authelia/20.0.5/CHANGELOG.md @@ -0,0 +1,99 @@ +**Important:** +*for the complete changelog, please refer to the website* + + + + +## [authelia-20.0.5](https://github.com/truecharts/charts/compare/authelia-20.0.4...authelia-20.0.5) (2023-12-21) + +### Chore + +- require ingress for certain charts + + + + +## [authelia-20.0.4](https://github.com/truecharts/charts/compare/authelia-20.0.3...authelia-20.0.4) (2023-12-21) + + + + +## [authelia-20.0.3](https://github.com/truecharts/charts/compare/authelia-20.0.2...authelia-20.0.3) (2023-12-21) + +### Chore + +- bump everything to ensure patches are applied globally + + ### Fix + +- ensure the cnpg GUI is included on CNPG apps + + + + +## [authelia-20.0.2](https://github.com/truecharts/charts/compare/authelia-20.0.1...authelia-20.0.2) (2023-12-21) + +### Chore + +- update helm general non-major by renovate ([#16341](https://github.com/truecharts/charts/issues/16341)) + + + + +## [authelia-20.0.1](https://github.com/truecharts/charts/compare/authelia-20.0.0...authelia-20.0.1) (2023-12-20) + +### Chore + +- bump patch versions on all charts for new GUI release + + + + +## [authelia-20.0.0](https://github.com/truecharts/charts/compare/authelia-19.0.17...authelia-20.0.0) (2023-12-20) + +### Chore + +- update helm general major by renovate (major) ([#14631](https://github.com/truecharts/charts/issues/14631)) + + + + +## [authelia-19.0.17](https://github.com/truecharts/charts/compare/authelia-19.0.16...authelia-19.0.17) (2023-12-20) + +### Chore + +- Bump everything to force min/max scale version update + + + + +## [authelia-19.0.16](https://github.com/truecharts/charts/compare/authelia-19.0.14...authelia-19.0.16) (2023-12-16) + +### Chore + +- fix move mistake and cleanup metadata + - update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784)) + + + + +## [authelia-19.0.16](https://github.com/truecharts/charts/compare/authelia-19.0.14...authelia-19.0.16) (2023-12-16) + +### Chore + +- fix move mistake and cleanup metadata + - update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784)) + + + + +## [authelia-19.0.15](https://github.com/truecharts/charts/compare/authelia-19.0.14...authelia-19.0.15) (2023-12-16) + +### Chore + +- fix move mistake and cleanup metadata + + + + +## [authelia-19.0.14](https://github.com/truecharts/charts/compare/authelia-19.0.13...authelia-19.0.14) (2023-12-03) diff --git a/enterprise/authelia/20.0.5/Chart.yaml b/enterprise/authelia/20.0.5/Chart.yaml new file mode 100644 index 0000000000..52057c8e98 --- /dev/null +++ b/enterprise/authelia/20.0.5/Chart.yaml @@ -0,0 +1,54 @@ +kubeVersion: ">=1.24.0-0" +apiVersion: v2 +name: authelia +version: 20.0.5 +appVersion: 4.37.5 +description: Authelia is a Single Sign-On Multi-Factor portal for web apps +home: https://truecharts.org/charts/enterprise/authelia +icon: https://truecharts.org/img/hotlink-ok/chart-icons/authelia.png +deprecated: false +sources: + - https://github.com/authelia/chartrepo + - https://github.com/authelia/authelia + - https://github.com/truecharts/charts/tree/master/charts/enterprise/authelia + - https://ghcr.io/authelia/authelia +maintainers: + - name: TrueCharts + email: info@truecharts.org + url: https://truecharts.org +keywords: + - authelia + - authentication + - login + - SSO + - Authentication + - Security + - Two-Factor + - U2F + - YubiKey + - Push Notifications + - LDAP +dependencies: + - name: common + version: 16.2.9 + repository: https://library-charts.truecharts.org + condition: "" + alias: "" + tags: [] + import-values: [] + - name: redis + version: 10.0.4 + repository: https://deps.truecharts.org + condition: redis.enabled + alias: "" + tags: [] + import-values: [] +annotations: + max_scale_version: 23.10.2 + min_scale_version: 23.10.0 + truecharts.org/SCALE-support: "true" + truecharts.org/category: security + truecharts.org/max_helm_version: "3.13" + truecharts.org/min_helm_version: "3.12" + truecharts.org/train: enterprise +type: application diff --git a/enterprise/authelia/20.0.5/LICENSE b/enterprise/authelia/20.0.5/LICENSE new file mode 100644 index 0000000000..80e4ab93f9 --- /dev/null +++ b/enterprise/authelia/20.0.5/LICENSE @@ -0,0 +1,106 @@ +Business Source License 1.1 + +Parameters + +Licensor: The TrueCharts Project, it's owner and it's contributors +Licensed Work: The TrueCharts "Cert-Manager" Helm Chart +Additional Use Grant: You may use the licensed work in production, as long + as it is directly sourced from a TrueCharts provided + official repository, catalog or source. You may also make private + modification to the directly sourced licenced work, + when used in production. + + The following cases are, due to their nature, also + defined as 'production use' and explicitly prohibited: + - Bundling, including or displaying the licensed work + with(in) another work intended for production use, + with the apparent intend of facilitating and/or + promoting production use by third parties in + violation of this license. + +Change Date: 2050-01-01 + +Change License: 3-clause BSD license + +For information about alternative licensing arrangements for the Software, +please contact: legal@truecharts.org + +Notice + +The Business Source License (this document, or the “License”) is not an Open +Source license. However, the Licensed Work will eventually be made available +under an Open Source License, as stated in this License. + +License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved. +“Business Source License” is a trademark of MariaDB Corporation Ab. + +----------------------------------------------------------------------------- + +Business Source License 1.1 + +Terms + +The Licensor hereby grants you the right to copy, modify, create derivative +works, redistribute, and make non-production use of the Licensed Work. The +Licensor may make an Additional Use Grant, above, permitting limited +production use. + +Effective on the Change Date, or the fourth anniversary of the first publicly +available distribution of a specific version of the Licensed Work under this +License, whichever comes first, the Licensor hereby grants you rights under +the terms of the Change License, and the rights granted in the paragraph +above terminate. + +If your use of the Licensed Work does not comply with the requirements +currently in effect as described in this License, you must purchase a +commercial license from the Licensor, its affiliated entities, or authorized +resellers, or you must refrain from using the Licensed Work. + +All copies of the original and modified Licensed Work, and derivative works +of the Licensed Work, are subject to this License. This License applies +separately for each version of the Licensed Work and the Change Date may vary +for each version of the Licensed Work released by Licensor. + +You must conspicuously display this License on each original or modified copy +of the Licensed Work. If you receive the Licensed Work in original or +modified form from a third party, the terms and conditions set forth in this +License apply to your use of that work. + +Any use of the Licensed Work in violation of this License will automatically +terminate your rights under this License for the current and all other +versions of the Licensed Work. + +This License does not grant you any right in any trademark or logo of +Licensor or its affiliates (provided that you may use a trademark or logo of +Licensor as expressly required by this License). + +TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON +AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, +EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND +TITLE. + +MariaDB hereby grants you permission to use this License’s text to license +your works, and to refer to it using the trademark “Business Source License”, +as long as you comply with the Covenants of Licensor below. + +Covenants of Licensor + +In consideration of the right to use this License’s text and the “Business +Source License” name and trademark, Licensor covenants to MariaDB, and to all +other recipients of the licensed work to be provided by Licensor: + +1. To specify as the Change License the GPL Version 2.0 or any later version, + or a license that is compatible with GPL Version 2.0 or a later version, + where “compatible” means that software provided under the Change License can + be included in a program with software provided under GPL Version 2.0 or a + later version. Licensor may specify additional Change Licenses without + limitation. + +2. To either: (a) specify an additional grant of rights to use that does not + impose any additional restriction on the right granted in this License, as + the Additional Use Grant; or (b) insert the text “None”. + +3. To specify a Change Date. + +4. Not to modify this License in any other way. diff --git a/enterprise/authelia/20.0.5/README.md b/enterprise/authelia/20.0.5/README.md new file mode 100644 index 0000000000..8c17210264 --- /dev/null +++ b/enterprise/authelia/20.0.5/README.md @@ -0,0 +1,27 @@ +# README + +## General Info + +TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE. +However only installations using the TrueNAS SCALE Apps system are supported. + +For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/authelia) + +**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)** + + +## Support + +- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro). +- See the [Website](https://truecharts.org) +- Check our [Discord](https://discord.gg/tVsPTHWTtr) +- Open a [issue](https://github.com/truecharts/charts/issues/new/choose) + +--- + +## Sponsor TrueCharts + +TrueCharts can only exist due to the incredible effort of our staff. +Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! + +*All Rights Reserved - The TrueCharts Project* diff --git a/enterprise/authelia/20.0.5/app-changelog.md b/enterprise/authelia/20.0.5/app-changelog.md new file mode 100644 index 0000000000..1e2ea41a39 --- /dev/null +++ b/enterprise/authelia/20.0.5/app-changelog.md @@ -0,0 +1,9 @@ + + +## [authelia-20.0.5](https://github.com/truecharts/charts/compare/authelia-20.0.4...authelia-20.0.5) (2023-12-21) + +### Chore + +- require ingress for certain charts + + \ No newline at end of file diff --git a/enterprise/authelia/20.0.5/app-readme.md b/enterprise/authelia/20.0.5/app-readme.md new file mode 100644 index 0000000000..9417c0c13d --- /dev/null +++ b/enterprise/authelia/20.0.5/app-readme.md @@ -0,0 +1,8 @@ +Authelia is a Single Sign-On Multi-Factor portal for web apps + +This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/enterprise/authelia](https://truecharts.org/charts/enterprise/authelia) + +--- + +TrueCharts can only exist due to the incredible effort of our staff. +Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! diff --git a/enterprise/authelia/20.0.5/charts/common-16.2.9.tgz b/enterprise/authelia/20.0.5/charts/common-16.2.9.tgz new file mode 100644 index 0000000000..c1db66f452 Binary files /dev/null and b/enterprise/authelia/20.0.5/charts/common-16.2.9.tgz differ diff --git a/enterprise/authelia/20.0.5/charts/redis-10.0.4.tgz b/enterprise/authelia/20.0.5/charts/redis-10.0.4.tgz new file mode 100644 index 0000000000..09d05b543f Binary files /dev/null and b/enterprise/authelia/20.0.5/charts/redis-10.0.4.tgz differ diff --git a/enterprise/authelia/20.0.5/ix_values.yaml b/enterprise/authelia/20.0.5/ix_values.yaml new file mode 100644 index 0000000000..be2421983c --- /dev/null +++ b/enterprise/authelia/20.0.5/ix_values.yaml @@ -0,0 +1,582 @@ +image: + repository: ghcr.io/authelia/authelia + pullPolicy: IfNotPresent + tag: 4.37.5@sha256:25fc5423238b6f3a1fc967fda3f6a9212846aeb4a720327ef61c8ccff52dbbe2 +manifestManager: + enabled: true +workload: + main: + replicas: 2 + strategy: RollingUpdate + podSpec: + containers: + main: + command: + - authelia + args: + - --config=/configuration.yaml + envFrom: + - configMapRef: + name: authelia-paths + probes: + liveness: + type: http + path: "/api/health" + readiness: + type: http + path: "/api/health" + startup: + type: http + path: "/api/health" +service: + main: + ports: + main: + port: 9091 + targetPort: 9091 +persistence: + config: + enabled: true + mountPath: "/config" +cnpg: + main: + enabled: true + user: authelia + database: authelia +# Enabled redis +# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis +redis: + enabled: true +domain: example.com +## +## Server Configuration +## +server: + ## + ## Port sets the configured port for the daemon, service, and the probes. + ## Default is 9091 and should not need to be changed. + ## + port: 9091 + ## Buffers usually should be configured to be the same value. + ## Explanation at https://www.authelia.com/docs/configuration/server.html + ## Read buffer size adjusts the server's max incoming request size in bytes. + ## Write buffer size does the same for outgoing responses. + read_buffer_size: 4096 + write_buffer_size: 4096 + ## Set the single level path Authelia listens on. + ## Must be alphanumeric chars and should not contain any slashes. + path: "" +log: + ## Level of verbosity for logs: info, debug, trace. + level: trace + ## Format the logs are written as: json, text. + format: text + ## TODO: Statefulness check should check if this is set, and the configMap should enable it. + ## File path where the logs will be written. If not set logs are written to stdout. + # file_path: /config/authelia.log +## Default redirection URL +## +## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end +## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use +## in such a case. +## +## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. +## Default is https://www. (value at the top of the values.yaml). +default_redirection_url: "" +# default_redirection_url: https://example.com + +theme: light +## +## TOTP Configuration +## +## Parameters used for TOTP generation +totp: + ## The issuer name displayed in the Authenticator application of your choice + ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names + ## Defaults to . + issuer: "" + ## The period in seconds a one-time password is current for. Changing this will require all users to register + ## their TOTP applications again. Warning: before changing period read the docs link below. + period: 30 + ## The skew controls number of one-time passwords either side of the current one that are valid. + ## Warning: before changing skew read the docs link below. + ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation. + skew: 1 +## +## Password Policy Config +## +## Parameters used for Password Policies +password_policy: + ## See: https://www.authelia.com/configuration/security/password-policy/ + standard: + enabled: false + min_length: 8 + max_length: 0 + require_uppercase: false + require_lowercase: false + require_number: false + require_special: false + zxcvbn: + ## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info + enabled: false + min_score: 3 +## +## Duo Push API Configuration +## +## Parameters used to contact the Duo API. Those are generated when you protect an application of type +## "Partner Auth API" in the management panel. +duo_api: + enabled: false + hostname: api-123456789.example.com + integration_key: ABCDEF + plain_api_key: "" +## NTP settings +ntp: + address: "time.cloudflare.com:123" + version: 4 + max_desync: 3s + disable_startup_check: false + disable_failure: true +## +## Authentication Backend Provider Configuration +## +## Used for verifying user passwords and retrieve information such as email address and groups users belong to. +## +## The available providers are: `file`, `ldap`. You must use one and only one of these providers. +authentication_backend: + ## Disable both the HTML element and the API for reset password functionality + disable_reset_password: false + ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. + ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will + ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. + ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. + ## See the below documentation for more information. + ## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval + refresh_interval: 5m + ## LDAP backend configuration. + ## + ## This backend allows Authelia to be scaled to more + ## than one instance and therefore is recommended for + ## production. + ldap: + ## Enable LDAP Backend. + enabled: false + ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. + ## Acceptable options are as follows: + ## - 'activedirectory' - For Microsoft Active Directory. + ## - 'custom' - For custom specifications of attributes and filters. + ## This currently defaults to 'custom' to maintain existing behaviour. + ## + ## Depending on the option here certain other values in this section have a default value, notably all of the + ## attribute mappings have a default value that this config overrides, you can read more about these default values + ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults + implementation: activedirectory + ## The url to the ldap server. Format: ://
[:]. + ## Scheme can be ldap or ldaps in the format (port optional). + url: ldap://openldap.default.svc.cluster.local + ## Connection Timeout. + timeout: 5s + ## Use StartTLS with the LDAP connection. + start_tls: false + tls: + ## Server Name for certificate validation (in case it's not set correctly in the URL). + server_name: "" + ## Skip verifying the server certificate (to allow a self-signed certificate). + ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + skip_verify: false + ## Minimum TLS version for either Secure LDAP or LDAP StartTLS. + minimum_version: TLS1.2 + ## The base dn for every LDAP query. + base_dn: DC=example,DC=com + ## The attribute holding the username of the user. This attribute is used to populate the username in the session + ## information. It was introduced due to #561 to handle case insensitive search queries. For you information, + ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this + ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database. + ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user + ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also + ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above + ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt. + username_attribute: "uid" + ## An additional dn to define the scope to all users. + additional_users_dn: OU=Users + ## The users filter used in search queries to find the user profile based on input filled in login form. + ## Various placeholders are available in the user filter: + ## - {input} is a placeholder replaced by what the user inputs in the login form. + ## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`. + ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`. + ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later + ## versions, so please don't use it. + ## + ## Recommended settings are as follows: + ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) + ## - OpenLDAP: + ## - (&({username_attribute}={input})(objectClass=person)) + ## - (&({username_attribute}={input})(objectClass=inetOrgPerson)) + ## + ## To allow sign in both with username and email, one can use a filter like + ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) + users_filter: "" + ## An additional dn to define the scope of groups. + additional_groups_dn: OU=Groups + ## The groups filter used in search queries to find the groups of the user. + ## - {input} is a placeholder replaced by what the user inputs in the login form. + ## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`). + ## - {dn} is a matcher replaced by the user distinguished name, aka, user DN. + ## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`. + ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`. + ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later + ## versions, so please don't use it. + ## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in + ## later version, so please don't use it. + ## + ## If your groups use the `groupOfUniqueNames` structure use this instead: + ## (&(uniquemember={dn})(objectclass=groupOfUniqueNames)) + groups_filter: "" + ## The attribute holding the name of the group + group_name_attribute: "cn" + ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the + ## first one returned by the LDAP server is used. + mail_attribute: "mail" + ## The attribute holding the display name of the user. This will be used to greet an authenticated user. + display_name_attribute: "displayname" + ## The username of the admin user. + user: CN=admin,DC=example,DC=com + plain_password: "" + ## + ## File (Authentication Provider) + ## + ## With this backend, the users database is stored in a file which is updated when users reset their passwords. + ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia + ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security + ## implications it is highly recommended you leave the default values. Before considering changing these settings + ## please read the docs page below: + ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + file: + enabled: true + path: /config/users_database.yml + password: + algorithm: argon2id + iterations: 1 + key_length: 32 + salt_length: 16 + memory: 1024 + parallelism: 8 +## +## Access Control Configuration +## +## Access control is a list of rules defining the authorizations applied for one resource to users or group of users. +## +## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed +## to anyone. Otherwise restrictions follow the rules defined. +## +## Note: One can use the wildcard * to match any subdomain. +## It must stand at the beginning of the pattern. (example: *.mydomain.com) +## +## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct. +## +## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'. +## +## - 'domain' defines which domain or set of domains the rule applies to. +## +## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not +## provided. If provided, the parameter represents either a user or a group. It should be of the form +## 'user:' or 'group:'. +## +## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'. +## +## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter +## is optional and matches any resource if not provided. +## +## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies. +access_control: + ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any + ## resource if there is no policy to be applied to the user. + default_policy: deny + networks: [] + # networks: + # - name: private + # networks: + # - 10.0.0.0/8 + # - 172.16.0.0/12 + # - 192.168.0.0/16 + # - name: vpn + # networks: + # - 10.9.0.0/16 + + rules: [] + # rules: + # - domain: public.example.com + # policy: bypass + # - domain: "*.example.com" + # policy: bypass + # methods: + # - OPTIONS + # - domain: secure.example.com + # policy: one_factor + # networks: + # - private + # - vpn + # - 192.168.1.0/24 + # - 10.0.0.1 + # - domain: + # - secure.example.com + # - private.example.com + # policy: two_factor + # - domain: singlefactor.example.com + # policy: one_factor + # - domain: "mx2.mail.example.com" + # subject: "group:admins" + # policy: deny + # - domain: "*.example.com" + # subject: + # - "group:admins" + # - "group:moderators" + # policy: two_factor + # - domain: dev.example.com + # resources: + # - "^/groups/dev/.*$" + # subject: "group:dev" + # policy: two_factor + # - domain: dev.example.com + # resources: + # - "^/users/john/.*$" + # subject: + # - ["group:dev", "user:john"] + # - "group:admins" + # policy: two_factor + # - domain: "{user}.example.com" + # policy: bypass +## +## Session Provider Configuration +## +## The session cookies identify the user once logged in. +## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined. +session: + ## The name of the session cookie. (default: authelia_session). + name: authelia_session + ## Sets the Cookie SameSite value. Possible options are none, lax, or strict. + ## Please read https://www.authelia.com/docs/configuration/session.html#same_site + same_site: lax + ## The time in seconds before the cookie expires and session is reset. + expiration: 1h + ## The inactivity time in seconds before the session is reset. + inactivity: 5m + ## The remember me duration. + ## Value is in seconds, or duration notation. Value of 0 disables remember me. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to + ## spy or attack. Currently the default is 1M or 1 month. + remember_me_duration: 1M +## +## Redis Provider +## +## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html +## +## The redis connection details +redisProvider: + port: 6379 + ## Optional username to be used with authentication. + # username: authelia + username: "" + ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). + database_index: 0 + ## The maximum number of concurrent active connections to Redis. + maximum_active_connections: 8 + ## The target number of idle connections to have open ready for work. Useful when opening connections is slow. + minimum_idle_connections: 0 + ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s). + tls: + enabled: false + ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). + server_name: "" + ## Skip verifying the server certificate (to allow a self-signed certificate). + ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + skip_verify: false + ## Minimum TLS version for the connection. + minimum_version: TLS1.2 + ## The Redis HA configuration options. + ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). + high_availability: + enabled: false + enabledSecret: false + ## Sentinel Name / Master Name + sentinel_name: mysentinel + ## The additional nodes to pre-seed the redis provider with (for sentinel). + ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. + ## For high availability to be used you must have either defined; the host above or at least one node below. + nodes: [] + # nodes: + # - host: sentinel-0.databases.svc.cluster.local + # port: 26379 + # - host: sentinel-1.databases.svc.cluster.local + # port: 26379 + + ## Choose the host with the lowest latency. + route_by_latency: false + ## Choose the host randomly. + route_randomly: false +## +## Regulation Configuration +## +## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done +## in a short period of time. +regulation: + ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. + max_retries: 3 + ## The time range during which the user can attempt login before being banned. The user is banned if the + ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + find_time: 2m + ## The length of time before a banned user can login again. Ban Time accepts duration notation. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ban_time: 5m +## +## Storage Provider Configuration +## +## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers. +storage: + ## + ## PostgreSQL (Storage Provider) + ## + postgres: + port: 5432 + database: authelia + username: authelia + sslmode: disable + timeout: 5s +## +## Notification Provider +## +## +## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration. +## The available providers are: filesystem, smtp. You must use one and only one of these providers. +notifier: + ## You can disable the notifier startup check by setting this to true. + disable_startup_check: false + ## + ## File System (Notification Provider) + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + filesystem: + enabled: true + filename: /config/notification.txt + ## + ## SMTP (Notification Provider) + ## + ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate. + ## [Security] By default Authelia will: + ## - force all SMTP connections over TLS including unauthenticated connections + ## - use the disable_require_tls boolean value to disable this requirement + ## (only works for unauthenticated connections) + ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates + ## (configure in tls section) + smtp: + enabled: false + enabledSecret: false + host: smtp.mail.svc.cluster.local + port: 25 + timeout: 5s + username: test + plain_password: test + sender: admin@example.com + ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. + identifier: localhost + ## Subject configuration of the emails sent. + ## {title} is replaced by the text from the notifier + subject: "[Authelia] {title}" + ## This address is used during the startup check to verify the email configuration is correct. + ## It's not important what it is except if your email server only allows local delivery. + startup_check_address: test@authelia.com + disable_require_tls: false + disable_html_emails: false + tls: + ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). + server_name: "" + ## Skip verifying the server certificate (to allow a self-signed certificate). + ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + skip_verify: false + ## Minimum TLS version for either StartTLS or SMTPS. + minimum_version: TLS1.2 +identity_providers: + oidc: + ## Enables this in the config map. Currently in beta stage. + ## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap + enabled: false + access_token_lifespan: 1h + authorize_code_lifespan: 1m + id_token_lifespan: 1h + refresh_token_lifespan: 90m + enable_client_debug_messages: false + ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for + ## security reasons. + minimum_parameter_entropy: 8 + clients: [] + # clients: + # - + ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. + # id: myapp +## The description to show to users when they end up on the consent screen. Defaults to the ID above. +# description: My Application + +## The client secret is a shared secret between Authelia and the consumer of this client. +# secret: apple123 + +## Sets the client to public. This should typically not be set, please see the documentation for usage. +# public: false + +## The policy to require for this client; one_factor or two_factor. +# authorization_policy: two_factor + +## Configures the consent mode; auto, explicit or implicit +# consent_mode: auto + +## Audience this client is allowed to request. +# audience: [] + +## Scopes this client is allowed to request. +# scopes: +# - openid +# - profile +# - email +# - groups + +## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. +# redirect_uris: +# - https://oidc.example.com/oauth2/callback + +## Grant Types configures which grants this client can obtain. +## It's not recommended to configure this unless you know what you're doing. +# grant_types: +# - refresh_token +# - authorization_code + +## Response Types configures which responses this client can be sent. +## It's not recommended to configure this unless you know what you're doing. +# response_types: +# - code + +## Response Modes configures which response modes this client supports. +## It's not recommended to configure this unless you know what you're doing. +# response_modes: +# - form_post +# - query +# - fragment + +## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. +# userinfo_signing_algorithm: none + +portal: + open: + enabled: true + +ingress: + main: + required: true diff --git a/enterprise/authelia/20.0.5/questions.yaml b/enterprise/authelia/20.0.5/questions.yaml new file mode 100644 index 0000000000..00e0f412b1 --- /dev/null +++ b/enterprise/authelia/20.0.5/questions.yaml @@ -0,0 +1,4201 @@ +groups: + - name: Container Image + description: Image to be used for container + - name: General Settings + description: General Deployment Settings + - name: Workload Settings + description: Workload Settings + - name: App Configuration + description: App Specific Config Options + - name: Networking and Services + description: Configure Network and Services for Container + - name: Storage and Persistence + description: Persist and Share Data that is Separate from the Container + - name: Ingress + description: Ingress Configuration + - name: Security and Permissions + description: Configure Security Context and Permissions + - name: Resources and Devices + description: "Specify Resources/Devices to be Allocated to Workload" + - name: Middlewares + description: Traefik Middlewares + - name: Metrics + description: Metrics + - name: Addons + description: Addon Configuration + - name: Advanced + description: Advanced Configuration + - name: Postgresql + description: Postgresql + - name: Documentation + description: Documentation +portals: + open: + protocols: + - "$kubernetes-resource_configmap_tcportal-open_protocol" + host: + - "$kubernetes-resource_configmap_tcportal-open_host" + ports: + - "$kubernetes-resource_configmap_tcportal-open_port" +questions: + - variable: global + group: General Settings + label: "Global Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: stopAll + label: Stop All + description: "Stops All Running pods and hibernates cnpg" + schema: + type: boolean + default: false + - variable: workload + group: "Workload Settings" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type (Advanced) + schema: + type: string + default: Deployment + enum: + - value: Deployment + description: Deployment + - value: DaemonSet + description: DaemonSet + - variable: replicas + label: Replicas (Advanced) + description: Set the number of Replicas + schema: + type: int + show_if: [["type", "!=", "DaemonSet"]] + default: 2 + - variable: podSpec + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: containers + label: Containers + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Container + schema: + additional_attrs: true + type: dict + attrs: + - variable: envList + label: Extra Environment Variables + description: "Please be aware that some variables are set in the background, adding duplicates here might cause issues or prevent the app from starting..." + schema: + type: list + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + - variable: value + label: Value + schema: + type: string + - variable: extraArgs + label: Extra Args + schema: + type: list + default: [] + items: + - variable: arg + label: Arg + schema: + type: string + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: command + label: Command + schema: + type: list + default: [] + items: + - variable: param + label: Param + schema: + type: string + - variable: TZ + label: Timezone + group: "General Settings" + schema: + type: string + default: "Etc/UTC" + $ref: + - "definitions/timezone" + - variable: podOptions + group: "General Settings" + label: "Global Pod Options (Advanced)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: expertPodOpts + label: "Expert - Pod Options" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostNetwork + label: "Host Networking" + schema: + type: boolean + default: false + - variable: dnsConfig + label: "DNS Configuration" + schema: + type: dict + additional_attrs: true + attrs: + - variable: options + label: "Options" + schema: + type: list + default: [{"name": "ndots", "value": "1"}] + items: + - variable: optionsEntry + label: "Option Entry" + schema: + type: dict + additional_attrs: true + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: value + label: "Value" + schema: + type: string + - variable: nameservers + label: "Nameservers" + schema: + type: list + default: [] + items: + - variable: nsEntry + label: "Nameserver Entry" + schema: + type: string + required: true + - variable: searches + label: "Searches" + schema: + type: list + default: [] + items: + - variable: searchEntry + label: "Search Entry" + schema: + type: string + required: true + + - variable: imagePullSecretList + group: "General Settings" + label: "Image Pull Secrets" + schema: + type: list + default: [] + items: + - variable: pullsecretentry + label: "Pull Secret" + schema: + type: dict + additional_attrs: true + attrs: + - variable: registry + label: "Registry" + schema: + type: string + required: true + default: "https://index.docker.io/v1/" + - variable: username + label: "Username" + schema: + type: string + required: true + default: "" + - variable: password + label: "Password" + schema: + type: string + required: true + default: "" + - variable: email + label: "Email" + schema: + type: string + required: true + default: "" + - variable: domain + group: "App Configuration" + label: "Domain" + description: "The highest domain level possible, for example: domain.com when using app.domain.com" + schema: + type: string + default: "" + required: true + - variable: default_redirection_url + group: "App Configuration" + label: "Default Redirection URL" + description: "If user tries to authenticate without any referrer, this is used" + schema: + type: string + default: "" + valid_chars: '^https?:\/\/(.*)' + - variable: theme + group: "App Configuration" + label: "Theme" + schema: + type: string + default: "auto" + enum: + - value: "auto" + description: "auto" + - value: "light" + description: "light" + - value: "grey" + description: "grey" + - value: "dark" + description: "dark" + - variable: log + group: "App Configuration" + label: "Log Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: level + label: "Log Level" + schema: + type: string + default: "info" + enum: + - value: "info" + description: "info" + - value: "debug" + description: "debug" + - value: "trace" + description: "trace" + - variable: format + label: "Log Format" + schema: + type: string + default: "text" + enum: + - value: "json" + description: "json" + - value: "text" + description: "text" + - variable: totp + group: "App Configuration" + label: "TOTP Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: issuer + label: "Issuer" + description: "The issuer name displayed in the Authenticator application of your choice" + schema: + type: string + default: "" + - variable: period + label: "Period" + description: "The period in seconds a one-time password is current for" + schema: + type: int + default: 30 + - variable: skew + label: "skew" + description: "Controls number of one-time passwords either side of the current one that are valid." + schema: + type: int + default: 1 + - variable: password_policy + group: "App Configuration" + label: "Password Policy Configuration" + description: "Authelia allows administrators to configure an enforced password policy." + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: standard + label: Standard + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + - variable: min_length + label: "Minimum Password Length" + description: "Minimum Password Length" + schema: + type: int + required: true + show_if: [["enabled", "=", true]] + default: 8 + - variable: max_length + label: "Max Passsword Length" + description: "Max Password Length" + schema: + type: int + required: true + show_if: [["enabled", "=", true]] + default: 0 + - variable: require_uppercase + label: "Require Upppercase" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + required: true + - variable: require_lowercase + label: "Require Lowercase" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + required: true + - variable: require_number + label: "Require Numbers" + description: "Require Numbers in the password" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + required: true + - variable: require_special + label: "Require Special Characters" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: zxcvbn + label: zxcvbn + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + required: true + - variable: min_score + label: "Min Score" + schema: + type: int + required: true + show_if: [["enabled", "=", true]] + default: 3 + - variable: duo_api + group: "App Configuration" + label: "DUO API Configuration" + description: "Parameters used to contact the Duo API." + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostname + label: "Hostname" + schema: + type: string + required: true + default: "" + - variable: integration_key + label: "integration_key" + schema: + type: string + default: "" + required: true + - variable: plain_api_key + label: "plain_api_key" + schema: + type: string + default: "" + required: true + - variable: session + group: "App Configuration" + label: "Session Provider" + description: "The session cookies identify the user once logged in." + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Cookie Name" + description: | + The name of the session cookie. By default this is set to authelia_session. + It’s mostly useful to change this if you are doing development or running multiple instances of Authelia. + schema: + type: string + required: true + default: "authelia_session" + - variable: same_site + label: "SameSite Value" + description: | + You can read about the SameSite cookie in detail on the MDN. In short setting SameSite to Lax is generally + the most desirable option for Authelia. None is not recommended unless you absolutely know what you’re doing + and trust all the protected apps. Strict is not going to work in many use cases and we have not tested it in + this state but it’s available as an option anyway. + schema: + type: string + default: "lax" + enum: + - value: "lax" + description: "lax" + - value: "strict" + description: "strict" + - variable: expiration + label: "Expiration Time" + description: | + The period of time before the cookie expires and the session is destroyed. This is overriden by + remember_me_duration when the remember me box is checked. + schema: + type: string + default: "1h" + required: true + - variable: inactivity + label: "Inactivity Time" + description: | + The period of time the user can be inactive for until the session is destroyed when the remember me box is + not checked or is otherwise disabled. Useful if you want long session timers but don’t want unused devices to be vulnerable. + schema: + type: string + default: "5m" + required: true + - variable: remember_me_duration + label: "Remember-Me duration" + description: | + The period of time before the cookie expires and the session is destroyed when the remember me box is checked, a user + selecting this option negates the inactivity timeout. Setting this to -1 disables this feature entirely. + schema: + type: string + default: "5M" + required: true + - variable: regulation + group: "App Configuration" + label: "Regulation Configuration" + description: "This mechanism prevents attackers from brute forcing the first factor." + schema: + additional_attrs: true + type: dict + attrs: + - variable: max_retries + label: "Maximum Retries" + description: "The number of failed login attempts before user is banned. Set it to 0 to disable regulation." + schema: + type: int + default: 3 + - variable: find_time + label: "Find Time" + description: | + The period of time analyzed for failed attempts. For example if you set max_retries to 3 and find_time to + 2m this means the user must have 3 failed logins in 2 minutes. + schema: + type: string + default: "2m" + required: true + - variable: ban_time + label: "Ban Duration" + description: | + The period of time the user is banned for after meeting the max_retries and find_time configuration. + After this duration the account will be able to login again. + schema: + type: string + default: "5m" + required: true + - variable: authentication_backend + group: "App Configuration" + label: "Authentication Backend Provider" + description: | + Used for verifying user passwords and retrieve information such as email + address and groups users belong to. + schema: + additional_attrs: true + type: dict + attrs: + - variable: disable_reset_password + label: "Disable Reset Password" + description: "Disable both the HTML element and the API for reset password functionality" + schema: + type: boolean + default: false + - variable: refresh_interval + label: "Reset Interval" + description: "The amount of time to wait before we refresh data from the authentication backend" + schema: + type: string + default: "5m" + required: true + - variable: ldap + label: "LDAP backend configuration" + description: "Used for verifying user passwords and retrieve information such as email address and groups users belong to" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: implementation + label: "Implementation" + description: "The LDAP implementation, this affects elements like the attribute utilized for resetting a password" + schema: + type: string + default: "custom" + enum: + - value: "activedirectory" + description: "Active Directory" + - value: "custom" + description: "Custom" + - variable: url + label: "URL" + description: "The url to the ldap server. Format: ://
[:]" + schema: + type: string + default: "ldap://openldap.default.svc.cluster.local" + required: true + - variable: timeout + label: "Connection Timeout" + schema: + type: string + default: "5s" + required: true + - variable: start_tls + label: "Start TLS" + description: "Use StartTLS with the LDAP connection" + schema: + type: boolean + default: false + - variable: tls + label: "TLS Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: server_name + label: "Server Name" + description: "Server Name for certificate validation (in case it's not set correctly in the URL)." + schema: + type: string + default: "" + - variable: skip_verify + label: "Skip Certificate Verification" + description: "Skip verifying the server certificate (to allow a self-signed certificate)" + schema: + type: boolean + default: false + - variable: minimum_version + label: "Minimum TLS version" + description: "Minimum TLS version for either Secure LDAP or LDAP StartTLS." + schema: + type: string + default: "TLS1.2" + enum: + - value: "TLS1.0" + description: "TLS1.0" + - value: "TLS1.1" + description: "TLS1.1" + - value: "TLS1.2" + description: "TLS1.2" + - value: "TLS1.3" + description: "TLS1.3" + - variable: base_dn + label: "Base DN" + description: "The base dn for every LDAP query." + schema: + type: string + default: "DC=example,DC=com" + required: true + - variable: username_attribute + label: "Username Attribute" + description: "The attribute holding the username of the user" + schema: + type: string + default: "uid" + required: true + - variable: additional_users_dn + label: "Additional Users DN" + description: "An additional dn to define the scope to all users." + schema: + type: string + default: "OU=people" + required: true + - variable: users_filter + label: "Users Filter" + description: "The groups filter used in search queries to find the groups of the user." + schema: + type: string + default: "" + required: true + - variable: additional_groups_dn + label: "Additional Groups DN" + description: "An additional dn to define the scope of groups." + schema: + type: string + default: "OU=Groups" + required: true + - variable: groups_filter + label: "Groups Filter" + description: "The groups filter used in search queries to find the groups of the user." + schema: + type: string + default: "" + required: true + - variable: group_name_attribute + label: "Group name Attribute" + description: "The attribute holding the name of the group" + schema: + type: string + default: "cn" + required: true + - variable: mail_attribute + label: "Mail Attribute" + description: "The attribute holding the primary mail address of the user" + schema: + type: string + default: "mail" + required: true + - variable: display_name_attribute + label: "Display Name Attribute" + description: "he attribute holding the display name of the user. This will be used to greet an authenticated user." + schema: + type: string + default: "displayName" + - variable: user + label: "Admin User" + description: "The username of the admin user used to connect to LDAP." + schema: + type: string + default: "CN=admin,ou=people,DC=example,DC=com" + required: true + - variable: plain_password + label: "Password" + schema: + type: string + default: "" + required: true + - variable: file + label: "File backend configuration" + description: "With this backend, the users database is stored in a file which is updated when users reset their passwords." + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: path + label: "Path" + schema: + type: string + default: "/config/users_database.yml" + required: true + - variable: password + label: "Password Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: algorithm + label: "Algorithm" + schema: + type: string + default: "argon2id" + enum: + - value: "argon2id" + description: "argon2id" + - value: "sha512" + description: "sha512" + - variable: iterations + label: "Iterations" + schema: + type: int + default: 1 + required: true + - variable: key_length + label: "Key Length" + schema: + type: int + default: 32 + required: true + - variable: salt_length + label: "Salt Length" + schema: + type: int + default: 16 + required: true + - variable: memory + label: "Memory" + schema: + type: int + default: 1024 + required: true + - variable: parallelism + label: "Parallelism" + schema: + type: int + default: 8 + required: true + - variable: notifier + group: "App Configuration" + label: "Notifier Configuration" + description: "Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration." + schema: + additional_attrs: true + type: dict + attrs: + - variable: disable_startup_check + label: "Disable Startup Check" + schema: + type: boolean + default: false + - variable: filesystem + label: "Filesystem Provider" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: filename + label: "File Path" + schema: + type: string + default: "/config/notification.txt" + required: true + - variable: smtp + label: "SMTP Provider" + description: "Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate." + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: true + show_subquestions_if: true + subquestions: + - variable: host + label: "Host" + schema: + type: string + default: "smtp.mail.svc.cluster.local" + required: true + - variable: port + label: "Port" + schema: + type: int + default: 25 + required: true + - variable: timeout + label: "Timeout" + schema: + type: string + default: "5s" + required: true + - variable: username + label: "Username" + schema: + type: string + default: "" + - variable: plain_password + label: "Password" + schema: + type: string + default: "" + - variable: sender + label: "Sender" + schema: + type: string + default: "" + required: true + - variable: identifier + label: "Identifier" + description: "HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost." + schema: + type: string + default: "localhost" + required: true + - variable: subject + label: "Subject" + description: "Subject configuration of the emails sent, {title} is replaced by the text from the notifier" + schema: + type: string + default: "[Authelia] {title}" + required: true + - variable: startup_check_address + label: "Startup Check Address" + description: "This address is used during the startup check to verify the email configuration is correct." + schema: + type: string + default: "test@authelia.com" + required: true + - variable: disable_require_tls + label: "Disable Require TLS" + schema: + type: boolean + default: false + - variable: disable_html_emails + label: "Disable HTML emails" + schema: + type: boolean + default: false + - variable: tls + label: "TLS Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: server_name + label: "Server Name" + description: "Server Name for certificate validation (in case it's not set correctly in the URL)." + schema: + type: string + default: "" + - variable: skip_verify + label: "Skip Certificate Verification" + description: "Skip verifying the server certificate (to allow a self-signed certificate)" + schema: + type: boolean + default: false + - variable: minimum_version + label: "Minimum TLS version" + description: "Minimum TLS version for either Secure LDAP or LDAP StartTLS." + schema: + type: string + default: "TLS1.2" + enum: + - value: "TLS1.0" + description: "TLS1.0" + - value: "TLS1.1" + description: "TLS1.1" + - value: "TLS1.2" + description: "TLS1.2" + - value: "TLS1.3" + description: "TLS1.3" + - variable: access_control + group: "App Configuration" + label: "Access Control Configuration" + description: "Access control is a list of rules defining the authorizations applied for one resource to users or group of users." + schema: + additional_attrs: true + type: dict + attrs: + - variable: default_policy + label: "Default Policy" + description: | + The default policy defines the policy applied if no rules section apply to the information known about the request. + It is recommended that this is configured to deny for security reasons. Sites which you do not wish to secure at all + with Authelia should not be configured in your reverse proxy to perform authentication with Authelia at all for performance reasons. + schema: + type: string + default: "deny" + enum: + - value: "bypass" + description: "bypass" + - value: "one_factor" + description: "one_factor" + - value: "two_factor" + description: "two_factor" + - value: "deny" + description: "deny" + - variable: networks + label: "Networks" + schema: + type: list + default: [] + items: + - variable: networkItem + label: "Network Item" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + default: "" + required: true + - variable: networks + label: "Networks" + schema: + type: list + default: [] + items: + - variable: network + label: "network" + schema: + type: string + default: "" + required: true + - variable: rules + label: "Rules" + schema: + type: list + default: [] + items: + - variable: rulesItem + label: "Rule" + schema: + additional_attrs: true + type: dict + attrs: + - variable: domain + label: "Domains" + description: "Defines which domain or set of domains the rule applies to." + schema: + type: list + default: [] + items: + - variable: domainEntry + label: "Domain" + schema: + type: string + default: "" + required: true + - variable: policy + label: "Policy" + description: | + The specific policy to apply to the selected rule. This is not criteria for a match, this is the + action to take when a match is made. + schema: + type: string + default: "two_factor" + enum: + - value: "bypass" + description: "bypass" + - value: "one_factor" + description: "one_factor" + - value: "two_factor" + description: "two_factor" + - value: "deny" + description: "deny" + - variable: subject + label: "Subject" + description: | + This criteria matches identifying characteristics about the subject. Currently this is either + user or groups the user belongs to. This allows you to effectively control exactly what each user is + authorized to access or to specifically require two-factor authentication to specific users. Subjects + are prefixed with either user: or group: to identify which part of the identity to check. + schema: + type: list + default: [] + items: + - variable: subjectitem + label: "Subject" + schema: + type: string + default: "" + required: true + - variable: networks + label: "Networks" + schema: + type: list + default: [] + items: + - variable: network + label: "Network" + schema: + type: string + default: "" + required: true + - variable: resources + label: "Resources" + description: "is a list of regular expressions that matches a set of resources to apply the policy to" + schema: + type: list + default: [] + items: + - variable: resource + label: "Resource" + schema: + type: string + default: "" + required: true + - variable: service + group: Networking and Services + label: Configure Service(s) + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Service + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 9091 + required: true + - variable: serviceexpert + group: Networking and Services + label: Show Expert Config + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: scaleExternalInterface + description: Add External Interfaces + label: Add external Interfaces + group: Networking + schema: + type: list + items: + - variable: interfaceConfiguration + description: Interface Configuration + label: Interface Configuration + schema: + additional_attrs: true + type: dict + $ref: + - "normalize/interfaceConfiguration" + attrs: + - variable: hostInterface + description: Please Specify Host Interface + label: Host Interface + schema: + type: string + required: true + $ref: + - "definitions/interface" + - variable: ipam + description: Define how IP Address will be managed + label: IP Address Management + schema: + additional_attrs: true + type: dict + required: true + attrs: + - variable: type + description: Specify type for IPAM + label: IPAM Type + schema: + type: string + required: true + enum: + - value: dhcp + description: Use DHCP + - value: static + description: Use Static IP + - variable: staticIPConfigurations + label: Static IP Addresses + schema: + type: list + show_if: [["type", "=", "static"]] + items: + - variable: staticIP + label: Static IP + schema: + type: ipaddr + cidr: true + - variable: staticRoutes + label: Static Routes + schema: + type: list + show_if: [["type", "=", "static"]] + items: + - variable: staticRouteConfiguration + label: Static Route Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: destination + label: Destination + schema: + type: ipaddr + cidr: true + required: true + - variable: gateway + label: Gateway + schema: + type: ipaddr + cidr: false + required: true + - variable: serviceList + label: Add Manual Custom Services + group: Networking and Services + schema: + type: list + default: [] + items: + - variable: serviceListEntry + label: Custom Service + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the service + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Name + schema: + type: string + default: "" + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - value: Simple + description: Deprecated CHANGE THIS + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: advancedsvcset + label: Show Advanced Service Settings + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: externalIPs + label: "External IP's" + description: "External IP's" + schema: + type: list + default: [] + items: + - variable: externalIP + label: External IP + schema: + type: string + - variable: ipFamilyPolicy + label: IP Family Policy + description: Specify the IP Policy + schema: + type: string + default: SingleStack + enum: + - value: SingleStack + description: SingleStack + - value: PreferDualStack + description: PreferDualStack + - value: RequireDualStack + description: RequireDualStack + - variable: ipFamilies + label: IP Families + description: (Advanced) The IP Families that should be used + schema: + type: list + default: [] + items: + - variable: ipFamily + label: IP Family + schema: + type: string + - variable: portsList + label: Additional Service Ports + schema: + type: list + default: [] + items: + - variable: portsListEntry + label: Custom ports + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Port + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Port Name + schema: + type: string + default: "" + - variable: protocol + label: Port Type + schema: + type: string + default: tcp + enum: + - value: http + description: HTTP + - value: https + description: HTTPS + - value: tcp + description: TCP + - value: udp + description: UDP + - variable: targetPort + label: Target Port + description: This port exposes the container port on the service + schema: + type: int + required: true + - variable: port + label: Container Port + schema: + type: int + required: true + - variable: persistence + label: Integrated Persistent Storage + description: Integrated Persistent Storage + group: Storage and Persistence + schema: + additional_attrs: true + type: dict + attrs: + - variable: config + label: "App Config Storage" + description: "Stores the Application Configuration." + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: persistenceList + label: Additional App Storage + group: Storage and Persistence + schema: + type: list + default: [] + items: + - variable: persistenceListEntry + label: Custom Storage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the storage + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: hostPath + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: mountPath + label: Mount Path + description: Path inside the container the storage is mounted + schema: + type: string + default: "" + required: true + valid_chars: '^\/([a-zA-Z0-9._-]+(\s?[a-zA-Z0-9._-]+|\/?))+$' + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size Quotum of Storage + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: "disabled" + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: ingress + label: "" + group: Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + + + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: ingressList + label: Add Manual Custom Ingresses + group: Ingress + schema: + type: list + default: [] + items: + - variable: ingressListEntry + label: Custom Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Name + schema: + type: string + default: "" + - variable: ingressClassName + label: IngressClass Name + schema: + type: string + default: "" + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + - variable: service + label: Linked Service + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Service Name + schema: + type: string + default: "" + - variable: port + label: Service Port + schema: + type: int + - variable: tls + label: TLS-Settings + schema: + type: list + default: [] + show_if: [["certificateIssuer", "=", ""]] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your Cert-Manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: scaleCert + label: Use TrueNAS SCALE Certificate (Deprecated) + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: Use Custom Secret (Advanced) + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: middleware + label: Middleware + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: securityContext + group: Security and Permissions + label: Security Context + schema: + additional_attrs: true + type: dict + attrs: + - variable: container + label: Container + schema: + additional_attrs: true + type: dict + attrs: + # Settings from questions.yaml get appended here on a per-app basis + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 568 + - variable: runAsGroup + label: "runAsGroup" + description: "The groupID of the user running the application" + schema: + type: int + default: 568 + # Settings from questions.yaml get appended here on a per-app basis + - variable: PUID + label: Process User ID - PUID + description: When supported by the container, this sets the User ID running the Application Process. Not supported by all Apps + schema: + type: int + show_if: [["runAsUser", "=", 0]] + default: 568 + - variable: UMASK + label: UMASK + description: When supported by the container, this sets the UMASK for the App. Not supported by all Apps + schema: + type: string + default: "0022" + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: true + - variable: pod + label: Pod + schema: + additional_attrs: true + type: dict + attrs: + - variable: fsGroupChangePolicy + label: "When should we take ownership?" + schema: + type: string + default: OnRootMismatch + enum: + - value: OnRootMismatch + description: OnRootMismatch + - value: Always + description: Always + - variable: supplementalGroups + label: Supplemental Groups + schema: + type: list + default: [] + items: + - variable: supplementalGroupsEntry + label: Supplemental Group + schema: + type: int + # Settings from questions.yaml get appended here on a per-app basis + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 + - variable: resources + group: Resources and Devices + label: "Resource Limits" + schema: + additional_attrs: true + type: dict + attrs: + - variable: limits + label: Advanced Limit Resource Consumption + schema: + additional_attrs: true + type: dict + attrs: + - variable: cpu + label: CPU + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 4000m + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: RAM + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 8Gi + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: requests + label: "Minimum Resources Required (request)" + schema: + additional_attrs: true + type: dict + hidden: true + attrs: + - variable: cpu + label: CPU + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 10m + hidden: true + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: "RAM" + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 50Mi + hidden: true + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: deviceList + label: Mount USB Devices + group: Resources and Devices + schema: + type: list + default: [] + items: + - variable: deviceListEntry + label: Device + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Storage + schema: + type: boolean + default: true + - variable: type + label: (Advanced) Type of Storage + description: Sets the persistence type + schema: + type: string + default: device + hidden: true + - variable: readOnly + label: readOnly + schema: + type: boolean + default: false + - variable: hostPath + label: Host Device Path + description: Path to the device on the host system + schema: + type: path + - variable: mountPath + label: Container Device Path + description: Path inside the container the device is mounted + schema: + type: string + default: "/dev/ttyACM0" + - variable: scaleGPU + label: GPU Configuration + group: Resources and Devices + schema: + type: list + default: [] + items: + - variable: scaleGPUEntry + label: GPU + schema: + additional_attrs: true + type: dict + attrs: + # Specify GPU configuration + - variable: gpu + label: Select GPU + schema: + additional_attrs: true + type: dict + $ref: + - "definitions/gpuConfiguration" + attrs: [] + - variable: workaround + label: "Workaround" + schema: + type: string + default: workaround + hidden: true + - variable: cnpg + group: Postgresql + label: "CloudNative-PG (CNPG)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Postgresql Database" + schema: + additional_attrs: true + type: dict + attrs: + - variable: hibernate + label: Hibernate + description: "enable to safely hibernate and shutdown the postgresql cluster" + schema: + type: boolean + default: false + - variable: cluster + label: "Cluster Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: instances + label: Instances + schema: + type: int + default: 1 + - variable: singleNode + label: singleNode + schema: + type: boolean + default: true + hidden: true + - variable: storage + label: "Storage" + schema: + additional_attrs: true + type: dict + attrs: + - variable: size + label: Size + schema: + type: string + default: "256Gi" + - variable: walStorage + label: "WAL Storage" + schema: + additional_attrs: true + type: dict + attrs: + - variable: size + label: Size + schema: + type: string + default: "256Gi" + - variable: monitoring + label: "Monitoring Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enablePodMonitor + label: "enablePodMonitor" + schema: + type: boolean + default: true + - variable: disableDefaultQueries + label: "disableDefaultQueries" + schema: + type: boolean + default: false + - variable: pooler + label: "Pooler Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: instances + label: Instances + schema: + type: int + default: 1 + - variable: createRO + label: "Create ReadOnly Instance" + schema: + type: boolean + default: false + - variable: recovery + label: "Recovery Settings (Experimental)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + - variable: endpointURL + label: "endpointURL" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: method + label: "method" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "object_store" + - variable: backupName + label: "backupName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: provider + label: "provider" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "s3" + - variable: s3 + label: "s3" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "s3"], ["enabled", "=", true]] + attrs: + - variable: region + label: "region" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: accessKey + label: "accessKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: secretKey + label: "secretKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: azure + label: "azure (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "azure"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: connectionString + label: "connectionString" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageAccount + label: "storageAccount" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageKey + label: "storageKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageSasToken + label: "storageSasToken" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: containerName + label: "containerName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: serviceName + label: "serviceName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "blob" + - variable: inheritFromAzureAD + label: "inheritFromAzureAD" + schema: + type: boolean + show_if: [["enabled", "=", true]] + default: false + - variable: google + label: "google (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "google"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: gkeEnvironment + label: "gkeEnvironment" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: applicationCredentials + label: "applicationCredentials" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: backups + label: "Backup Settings (Experimental)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + - variable: endpointURL + label: "endpointURL" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: destinationPath + label: "destinationPath" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: retentionPolicy + label: "retentionPolicy" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "30d" + - variable: provider + label: "provider" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "s3" + - variable: s3 + label: "s3" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "s3"], ["enabled", "=", true]] + attrs: + - variable: region + label: "region" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: accessKey + label: "accessKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: secretKey + label: "secretKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: azure + label: "azure (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "azure"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: connectionString + label: "connectionString" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageAccount + label: "storageAccount" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageKey + label: "storageKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageSasToken + label: "storageSasToken" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: containerName + label: "containerName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: serviceName + label: "serviceName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "blob" + - variable: inheritFromAzureAD + label: "inheritFromAzureAD" + schema: + type: boolean + show_if: [["enabled", "=", true]] + default: false + - variable: google + label: "google (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "google"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: gkeEnvironment + label: "gkeEnvironment" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: applicationCredentials + label: "applicationCredentials" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: scheduledBackups + label: ScheduledBackups + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: backupschedule + label: BackupSchedule + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "daily-backup" + required: true + - variable: schedule + label: schedule + schema: + type: string + required: true + default: "0 0 0 * * *" + - variable: backupOwnerReference + label: backupOwnerReference + schema: + type: string + required: true + default: "self" + - variable: immediate + label: immediate + schema: + type: boolean + default: false + - variable: suspend + label: suspend + schema: + type: boolean + default: false + - variable: manualBackups + label: manualBackups + schema: + type: list + default: [] + items: + - variable: backup + label: Backup + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "" + required: true +# - variable: horizontalPodAutoscaler +# group: Advanced +# label: (Advanced) Horizontal Pod Autoscaler +# schema: +# type: list +# default: [] +# items: +# - variable: hpaEntry +# label: HPA Entry +# schema: +# additional_attrs: true +# type: dict +# attrs: +# - variable: name +# label: Name +# schema: +# type: string +# required: true +# default: "" +# - variable: enabled +# label: Enabled +# schema: +# type: boolean +# default: false +# show_subquestions_if: true +# subquestions: +# - variable: target +# label: Target +# description: Deployment name, Defaults to Main Deployment +# schema: +# type: string +# default: "" +# - variable: minReplicas +# label: Minimum Replicas +# schema: +# type: int +# default: 1 +# - variable: maxReplicas +# label: Maximum Replicas +# schema: +# type: int +# default: 5 +# - variable: targetCPUUtilizationPercentage +# label: Target CPU Utilization Percentage +# schema: +# type: int +# default: 80 +# - variable: targetMemoryUtilizationPercentage +# label: Target Memory Utilization Percentage +# schema: +# type: int +# default: 80 + - variable: networkPolicy + group: Advanced + label: (Advanced) Network Policy + schema: + type: list + default: [] + items: + - variable: netPolicyEntry + label: Network Policy Entry + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + default: "" + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: policyType + label: Policy Type + schema: + type: string + default: "" + enum: + - value: "" + description: Default + - value: ingress + description: Ingress + - value: egress + description: Egress + - value: ingress-egress + description: Ingress and Egress + - variable: egress + label: Egress + schema: + type: list + default: [] + items: + - variable: egressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: to + label: To + schema: + type: list + default: [] + items: + - variable: toEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: IP Block + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: CIDR + schema: + type: string + default: "" + - variable: except + label: Except + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: string + - variable: namespaceSelector + label: Namespace Selector + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: Ports + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + - variable: endPort + label: End Port + schema: + type: int + - variable: protocol + label: Protocol + schema: + type: string + default: TCP + enum: + - value: TCP + description: TCP + - value: UDP + description: UDP + - value: SCTP + description: SCTP + - variable: ingress + label: Ingress + schema: + type: list + default: [] + items: + - variable: ingressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: from + label: From + schema: + type: list + default: [] + items: + - variable: fromEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: IP Block + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: CIDR + schema: + type: string + default: "" + - variable: except + label: Except + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: string + - variable: namespaceSelector + label: Namespace Selector + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: Ports + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + - variable: endPort + label: End Port + schema: + type: int + - variable: protocol + label: Protocol + schema: + type: string + default: TCP + enum: + - value: TCP + description: TCP + - value: UDP + description: UDP + - value: SCTP + description: SCTP + - variable: identity_providers + group: "Advanced" + label: "Authelia Identity Providers (BETA)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: oidc + label: "OpenID Connect(BETA)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enabled" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: access_token_lifespan + label: "Access Token Lifespan" + schema: + type: string + default: "1h" + required: true + - variable: authorize_code_lifespan + label: "Authorize Code Lifespan" + schema: + type: string + default: "1m" + required: true + - variable: id_token_lifespan + label: "ID Token Lifespan" + schema: + type: string + default: "1h" + required: true + - variable: refresh_token_lifespan + label: "Refresh Token Lifespan" + schema: + type: string + default: "90m" + required: true + - variable: enable_client_debug_messages + label: "Enable Client Debug Messages" + schema: + type: boolean + default: false + - variable: clients + label: "Clients" + schema: + type: list + default: [] + items: + - variable: clientEntry + label: "Client" + schema: + additional_attrs: true + type: dict + attrs: + - variable: id + label: "ID/Name" + description: "The ID is the OpenID Connect ClientID which is used to link an application to a configuration." + schema: + type: string + default: "myapp" + required: true + - variable: description + label: "Description" + description: "The description to show to users when they end up on the consent screen. Defaults to the ID above." + schema: + type: string + default: "My Application" + required: true + - variable: secret + label: "Secret" + description: "The client secret is a shared secret between Authelia and the consumer of this client." + schema: + type: string + default: "" + required: true + - variable: public + label: "public" + description: "Sets the client to public. This should typically not be set, please see the documentation for usage." + schema: + type: boolean + default: false + - variable: authorization_policy + label: "Authorization Policy" + description: "The policy to require for this client; one_factor or two_factor." + schema: + type: string + default: "two_factor" + enum: + - value: "one_factor" + description: "one_factor" + - value: "two_factor" + description: "two_factor" + - variable: consent_mode + label: "Consent Mode" + description: | + Configures the consent mode. This can be set to auto (default), explicit (consent required every time) or + implicit (automatically assumes consent for every authorization, never asking the user if they wish to give consent.) + schema: + type: string + default: "auto" + enum: + - value: "auto" + description: "auto" + - value: "explicit" + description: "explicit" + - value: "implicit" + description: "implicit" + - variable: userinfo_signing_algorithm + label: "Userinfo Signing Algorithm" + description: "The algorithm used to sign userinfo endpoint responses for this client, either none or RS256." + schema: + type: string + default: "none" + enum: + - value: "none" + description: "none" + - value: "RS256" + description: "RS256" + - variable: audience + label: "Audience" + description: "Audience this client is allowed to request." + schema: + type: list + default: [] + items: + - variable: audienceEntry + label: "" + schema: + type: string + default: "" + required: true + - variable: scopes + label: "Scopes" + description: "Scopes this client is allowed to request." + schema: + type: list + default: [] + items: + - variable: ScopeEntry + label: "Scope" + schema: + type: string + default: "openid" + required: true + - variable: redirect_uris + label: "redirect_uris" + description: "Redirect URI's specifies a list of valid case-sensitive callbacks for this client." + schema: + type: list + default: [] + items: + - variable: uriEntry + label: "Url" + schema: + type: string + default: "https://oidc.example.com/oauth2/callback" + required: true + - variable: grant_types + description: "Grant Types configures which grants this client can obtain." + label: "grant_types" + schema: + type: list + default: [] + items: + - variable: grantEntry + label: "Grant" + schema: + type: string + default: "refresh_token" + required: true + - variable: response_types + description: "Response Types configures which responses this client can be sent." + label: "response_types" + schema: + type: list + default: [] + items: + - variable: responseEntry + label: "type" + schema: + type: string + default: "code" + required: true + - variable: response_modes + description: "Response Modes configures which response modes this client supports." + label: "response_modes" + schema: + type: list + default: [] + items: + - variable: modeEntry + label: "Mode" + schema: + type: string + default: "form_post" + required: true + - variable: addons + group: Addons + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: Codeserver + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: service + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: NodePort + description: Deprecated CHANGE THIS + - value: ClusterIP + description: ClusterIP + - value: LoadBalancer + description: LoadBalancer + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + default: 36107 + - variable: ingress + label: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + - variable: certificateIssuer + label: Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates. Cannot be used combined with tls option below' + schema: + type: string + default: "" + - variable: middlewares + label: Traefik Middlewares + description: Add previously created Traefik Middlewares to this Ingress + schema: + type: list + default: [] + items: + - variable: name + label: Name + schema: + type: string + default: "" + required: true + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: entrypoint + label: (Advanced) Traefik Entrypoint + description: Entrypoint used by Traefik when using Traefik as Ingress Provider + schema: + type: string + default: websecure + show_if: [["advanced", "=", true]] + required: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + show_if: [["advanced", "=", true]] + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: envList + label: Codeserver Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + - variable: vpn + label: VPN + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type + schema: + type: string + default: disabled + enum: + - value: disabled + description: disabled + - value: gluetun + description: Gluetun + - value: tailscale + description: Tailscale + - value: openvpn + description: OpenVPN (Deprecated) + - value: wireguard + description: Wireguard (Deprecated) + - variable: openvpn + label: OpenVPN Settings + schema: + additional_attrs: true + type: dict + show_if: [["type", "=", "openvpn"]] + attrs: + - variable: username + label: Authentication Username (Optional) + description: Authentication Username, Optional + schema: + type: string + default: "" + - variable: password + label: Authentication Password + description: Authentication Credentials + schema: + type: string + show_if: [["username", "!=", ""]] + default: "" + required: true + - variable: tailscale + label: Tailscale Settings + schema: + additional_attrs: true + type: dict + show_if: [["type", "=", "tailscale"]] + attrs: + - variable: authkey + label: Authentication Key + description: Provide an auth key to automatically authenticate the node as your user account. + schema: + type: string + private: true + default: "" + - variable: auth_once + label: Auth Once + description: Only attempt to log in if not already logged in. + schema: + type: boolean + default: true + - variable: accept_dns + label: Accept DNS + description: Accept DNS configuration from the admin console. + schema: + type: boolean + default: false + - variable: userspace + label: Userspace + description: Userspace Networking mode allows running Tailscale where you do not have access to create a VPN tunnel device. + schema: + type: boolean + default: false + - variable: routes + label: Routes + description: Expose physical subnet routes to your entire Tailscale network. + schema: + type: string + default: "" + - variable: dest_ip + label: Destination IP + description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched. + schema: + type: string + default: "" + - variable: sock5_server + label: Sock5 Server + description: The address on which to listen for SOCKS5 proxying into the tailscale net. + schema: + type: string + default: "" + - variable: outbound_http_proxy_listen + label: Outbound HTTP Proxy Listen + description: The address on which to listen for HTTP proxying into the tailscale net. + schema: + type: string + default: "" + - variable: extra_args + label: Extra Args + description: Extra Args + schema: + type: string + default: "" + - variable: daemon_extra_args + label: Tailscale Daemon Extra Args + description: Tailscale Daemon Extra Args + schema: + type: string + default: "" + - variable: killSwitch + label: Enable Killswitch + schema: + type: boolean + show_if: [["type", "!=", "disabled"]] + default: true + - variable: excludedNetworks_IPv4 + label: Killswitch Excluded IPv4 networks + description: List of Killswitch Excluded IPv4 Addresses + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv4 + label: IPv4 Network + schema: + type: string + required: true + - variable: excludedNetworks_IPv6 + label: Killswitch Excluded IPv6 networks + description: "List of Killswitch Excluded IPv6 Addresses" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv6 + label: IPv6 Network + schema: + type: string + required: true + - variable: configFile + label: VPN Config File Location + schema: + type: string + show_if: [["type", "!=", "disabled"]] + default: "" + + - variable: envList + label: VPN Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + max_length: 10240 + - variable: netshoot + label: Netshoot + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: envList + label: Netshoot Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + - variable: docs + group: Documentation + label: Please read the documentation at https://truecharts.org + description: Please read the documentation at +
https://truecharts.org + schema: + additional_attrs: true + type: dict + attrs: + - variable: confirmDocs + label: I have checked the documentation + schema: + type: boolean + default: true + - variable: donateNag + group: Documentation + label: Please consider supporting TrueCharts, see https://truecharts.org/sponsor + description: Please consider supporting TrueCharts, see +
https://truecharts.org/sponsor + schema: + additional_attrs: true + type: dict + attrs: + - variable: confirmDonate + label: I have considered donating + schema: + type: boolean + default: true + hidden: true diff --git a/enterprise/authelia/20.0.5/templates/NOTES.txt b/enterprise/authelia/20.0.5/templates/NOTES.txt new file mode 100644 index 0000000000..efcb74cb77 --- /dev/null +++ b/enterprise/authelia/20.0.5/templates/NOTES.txt @@ -0,0 +1 @@ +{{- include "tc.v1.common.lib.chart.notes" $ -}} diff --git a/enterprise/authelia/20.0.5/templates/_configmap.tpl b/enterprise/authelia/20.0.5/templates/_configmap.tpl new file mode 100644 index 0000000000..92fcd45a4a --- /dev/null +++ b/enterprise/authelia/20.0.5/templates/_configmap.tpl @@ -0,0 +1,363 @@ +{{/* Define the configmap */}} +{{- define "authelia.configmap.paths" -}} +enabled: true +data: + AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true" + AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN" + AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY" + AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/ENCRYPTION_KEY" + AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD" + {{- if .Values.authentication_backend.ldap.enabled }} + AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD" + {{- end }} + {{- if .Values.notifier.smtp.enabled }} + AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD" + {{- end }} + AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD" + {{- if .Values.redisProvider.high_availability.enabled }} + AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD" + {{- end }} + {{- if .Values.duo_api.enabled }} + AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY" + {{- end }} + {{- if .Values.identity_providers.oidc.enabled }} + AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET" + AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY" + {{- end }} + +{{- end -}} + +{{- define "authelia.configmap.configfile" -}} +enabled: true +data: + configuration.yaml: | + --- + theme: {{ .Values.theme | default "light" }} + default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }} + ntp: + address: {{ .Values.ntp.address | default "time.cloudflare.com:123" }} + version: {{ .Values.ntp.version | default 4 }} + max_desync: {{ .Values.ntp.max_desync | default "3s" }} + disable_startup_check: {{ .Values.ntp.disable_startup_check | default false }} + disable_failure: {{ .Values.ntp.disable_failure | default true }} + server: + host: 0.0.0.0 + port: {{ .Values.server.port | default 9091 }} + {{- if ne "" (.Values.server.path | default "") }} + path: {{ .Values.server.path }} + {{- end }} + buffers: + write: {{ .Values.server.write_buffer_size | default 4096 }} + read: {{ .Values.server.read_buffer_size | default 4096 }} + enable_pprof: {{ .Values.server.enable_pprof | default false }} + enable_expvars: {{ .Values.server.enable_expvars | default false }} + log: + level: {{ .Values.log.level | default "info" }} + format: {{ .Values.log.format | default "text" }} + {{- if ne "" (.Values.log.file_path | default "") }} + file_path: {{ .Values.log.file_path }} + keep_stdout: true + {{- end }} + totp: + issuer: {{ .Values.totp.issuer | default .Values.domain }} + period: {{ .Values.totp.period | default 30 }} + skew: {{ .Values.totp.skew | default 1 }} + {{- if .Values.password_policy.enabled }} + password_policy: + standard: + enabled: {{ .Values.password_policy.standard.enabled | default false }} + min_length: {{ .Values.password_policy.standard.min_length | default 8 }} + max_length: {{ .Values.password_policy.standard.max_length | default 0 }} + require_uppercase: {{ .Values.password_policy.standard.require_uppercase | default false }} + require_lowercase: {{ .Values.password_policy.standard.require_lowercase | default false }} + require_number: {{ .Values.password_policy.standard.require_number | default false }} + require_special: {{ .Values.password_policy.standard.require_special | default false }} + zxcvbn: + enabled: {{ .Values.password_policy.zxcvbn.enabled | default false }} + min_score: {{ .Values.password_policy.zxcvbn.min_score | default 3 }} + {{- end -}} + {{- if .Values.duo_api.enabled }} + duo_api: + hostname: {{ .Values.duo_api.hostname }} + integration_key: {{ .Values.duo_api.integration_key }} + {{- end -}} + {{- with $auth := .Values.authentication_backend }} + authentication_backend: + password_reset: + disable: {{ $auth.disable_reset_password }} + {{- if $auth.file.enabled }} + file: + path: {{ $auth.file.path }} + password: + {{- $p := $auth.file.password -}} + {{- if $p.algorithm }} + algorithm: {{ $p.algorithm }} + {{- end -}} + {{- if $p.iterations }} + iterations: {{ $p.iterations }} + {{- end -}} + {{- if $p.key_length }} + key_length: {{ $p.key_length }} + {{- end -}} + {{- if $p.salt_length }} + salt_length: {{ $p.salt_length }} + {{- end -}} + {{- if $p.memory }} + memory: {{ $p.memory }} + {{- end -}} + {{- if $p.parallelism }} + parallelism: {{ $p.parallelism }} + {{- end -}} + {{- end -}} + {{- if $auth.ldap.enabled }} + ldap: + implementation: {{ $auth.ldap.implementation | default "custom" }} + url: {{ $auth.ldap.url }} + timeout: {{ $auth.ldap.timeout | default "5s" }} + start_tls: {{ $auth.ldap.start_tls }} + tls: + {{- if hasKey $auth.ldap.tls "server_name" }} + server_name: {{ $auth.ldap.tls.server_name | default $auth.ldap.host }} + {{- end }} + minimum_version: {{ $auth.ldap.tls.minimum_version | default "TLS1.2" }} + skip_verify: {{ $auth.ldap.tls.skip_verify | default false }} + {{- if $auth.ldap.base_dn }} + base_dn: {{ $auth.ldap.base_dn }} + {{- end -}} + {{- if $auth.ldap.username_attribute }} + username_attribute: {{ $auth.ldap.username_attribute }} + {{- end -}} + {{- if $auth.ldap.additional_users_dn }} + additional_users_dn: {{ $auth.ldap.additional_users_dn }} + {{- end -}} + {{- if $auth.ldap.users_filter }} + users_filter: {{ $auth.ldap.users_filter }} + {{- end -}} + {{- if $auth.ldap.additional_groups_dn }} + additional_groups_dn: {{ $auth.ldap.additional_groups_dn }} + {{- end -}} + {{- if $auth.ldap.groups_filter }} + groups_filter: {{ $auth.ldap.groups_filter }} + {{- end -}} + {{- if $auth.ldap.group_name_attribute }} + group_name_attribute: {{ $auth.ldap.group_name_attribute }} + {{- end -}} + {{- if $auth.ldap.mail_attribute }} + mail_attribute: {{ $auth.ldap.mail_attribute }} + {{- end -}} + {{- if $auth.ldap.display_name_attribute }} + display_name_attribute: {{ $auth.ldap.display_name_attribute }} + {{- end }} + user: {{ $auth.ldap.user }} + {{- end -}} + {{- end -}} + {{- with $session := .Values.session }} + session: + name: {{ $session.name | default "authelia_session" }} + domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }} + same_site: {{ $session.same_site | default "lax" }} + expiration: {{ $session.expiration | default "1M" }} + inactivity: {{ $session.inactivity | default "5m" }} + remember_me_duration: {{ $session.remember_me_duration | default "1M" }} + {{- end }} + redis: + host: {{ .Values.redis.creds.plain }} + {{- with $redis := .Values.redisProvider }} + port: {{ $redis.port | default 6379 }} + {{- if not (eq $redis.username "") }} + username: {{ $redis.username }} + {{- end }} + maximum_active_connections: {{ $redis.maximum_active_connections | default 8 }} + minimum_idle_connections: {{ $redis.minimum_idle_connections | default 0 }} + {{- if $redis.tls.enabled }} + tls: + server_name: {{ $redis.tls.server_name }} + minimum_version: {{ $redis.tls.minimum_version | default "TLS1.2" }} + skip_verify: {{ $redis.tls.skip_verify }} + {{- end }} + {{- if $redis.high_availability.enabled }} + high_availability: + sentinel_name: {{ $redis.high_availability.sentinel_name }} + {{- if $redis.high_availability.nodes }} + nodes: + {{- range $node := $redis.high_availability.nodes }} + - host: {{ $node.host }} + port: {{ $node.port | default 26379 }} + {{- end -}} + {{- end }} + route_by_latency: {{ $redis.high_availability.route_by_latency }} + route_randomly: {{ $redis.high_availability.route_randomly }} + {{- end }} + {{- end }} + regulation: + max_retries: {{ .Values.regulation.max_retries | default 3 }} + find_time: {{ .Values.regulation.find_time | default "1m" }} + ban_time: {{ .Values.regulation.ban_time | default "5m" }} + storage: + postgres: + host: {{ $.Values.cnpg.main.creds.host }} + {{- with $storage := .Values.storage }} + port: {{ $storage.postgres.port | default 5432 }} + database: {{ $storage.postgres.database | default "authelia" }} + username: {{ $storage.postgres.username | default "authelia" }} + timeout: {{ $storage.postgres.timeout | default "5s" }} + ssl: + mode: {{ $storage.postgres.sslmode | default "disable" }} + {{- end }} + {{- with $notifier := .Values.notifier }} + notifier: + disable_startup_check: {{ $.Values.notifier.disable_startup_check }} + {{- if $notifier.filesystem.enabled }} + filesystem: + filename: {{ $notifier.filesystem.filename }} + {{- end }} + {{- if $notifier.smtp.enabled }} + smtp: + host: {{ $notifier.smtp.host }} + port: {{ $notifier.smtp.port | default 25 }} + timeout: {{ $notifier.smtp.timeout | default "5s" }} + {{- with $notifier.smtp.username }} + username: {{ . }} + {{- end }} + sender: {{ $notifier.smtp.sender | quote }} + identifier: {{ $notifier.smtp.identifier | quote }} + subject: {{ $notifier.smtp.subject | quote }} + startup_check_address: {{ $notifier.smtp.startup_check_address | quote }} + disable_require_tls: {{ $notifier.smtp.disable_require_tls }} + disable_html_emails: {{ $notifier.smtp.disable_html_emails }} + tls: + server_name: {{ $notifier.smtp.tls.server_name | default $notifier.smtp.host }} + minimum_version: {{ $notifier.smtp.tls.minimum_version | default "TLS1.2" }} + skip_verify: {{ $notifier.smtp.tls.skip_verify | default false }} + {{- end }} + {{- end }} + {{- if .Values.identity_providers.oidc.enabled }} + identity_providers: + oidc: + access_token_lifespan: {{ .Values.identity_providers.oidc.access_token_lifespan | default "1h" }} + authorize_code_lifespan: {{ .Values.identity_providers.oidc.authorize_code_lifespan | default "1m" }} + id_token_lifespan: {{ .Values.identity_providers.oidc.id_token_lifespan | default "1h" }} + refresh_token_lifespan: {{ .Values.identity_providers.oidc.refresh_token_lifespan | default "90m" }} + enable_client_debug_messages: {{ .Values.identity_providers.oidc.enable_client_debug_messages | default false }} + minimum_parameter_entropy: {{ .Values.identity_providers.oidc.minimum_parameter_entropy | default 8 }} + {{- if .Values.identity_providers.oidc.clients }} + clients: + {{- range $client := .Values.identity_providers.oidc.clients }} + - id: {{ $client.id }} + description: {{ $client.description | default $client.id }} + secret: {{ $client.secret | default (randAlphaNum 128) }} + {{- if $client.public }} + public: {{ $client.public }} + {{- end }} + authorization_policy: {{ $client.authorization_policy | default "two_factor" }} + consent_mode: {{ $client.consent_mode | default "auto" }} + redirect_uris: + {{- range $client.redirect_uris }} + - {{ . }} + {{- end }} + {{- if $client.audience }} + audience: + {{- range $client.audience }} + - {{ . }} + {{- end }} + {{- end }} + scopes: + {{- range ($client.scopes | default (list "openid" "profile" "email" "groups")) }} + - {{ . }} + {{- end }} + grant_types: + {{- range ($client.grant_types | default (list "refresh_token" "authorization_code")) }} + - {{ . }} + {{- end }} + response_types: + {{- range ($client.response_types | default (list "code")) }} + - {{ . }} + {{- end }} + {{- if $client.response_modes }} + response_modes: + {{- range $client.response_modes }} + - {{ . }} + {{- end }} + {{- end }} + userinfo_signing_algorithm: {{ $client.userinfo_signing_algorithm | default "none" }} + {{- end }} + {{- end }} + {{- end }} + access_control: + {{- if not .Values.access_control.rules }} + {{- if (eq .Values.access_control.default_policy "bypass") }} + default_policy: one_factor + {{- else if (eq .Values.access_control.default_policy "deny") }} + default_policy: two_factor + {{- else }} + default_policy: {{ .Values.access_control.default_policy }} + {{- end }} + {{- else }} + default_policy: {{ .Values.access_control.default_policy }} + {{- end }} + + {{- if not .Values.access_control.networks }} + networks: [] + {{- else }} + networks: + {{- range $net := .Values.access_control.networks }} + - name: {{ $net.name }} + networks: + {{- range $net.networks }} + - {{ . | squote }} + {{- end }} + {{- end }} + {{- end }} + + {{- if not .Values.access_control.rules }} + rules: [] + {{- else }} + rules: + {{- range $rule := .Values.access_control.rules }} + {{- if $rule.domain }} + - domain: + {{- if kindIs "string" $rule.domain }} + - {{ $rule.domain | squote }} + {{- else -}} + {{- range $rule.domain }} + - {{ . | squote }} + {{- end }} + {{- end }} + {{- end -}} + {{- with $rule.policy }} + policy: {{ . }} + {{- end -}} + {{- if $rule.networks }} + networks: + {{- if kindIs "string" $rule.networks }} + - {{ $rule.networks | squote }} + {{- else -}} + {{- range $rule.networks }} + - {{ . | squote }} + {{- end }} + {{- end }} + {{- end }} + {{- if $rule.subject }} + subject: + {{- if kindIs "string" $rule.subject }} + - {{ $rule.subject | squote }} + {{- else -}} + {{- range $rule.subject }} + - {{ . | squote }} + {{- end }} + {{- end }} + {{- end }} + {{- if $rule.resources }} + resources: + {{- if kindIs "string" $rule.resources }} + - {{ $rule.resources | squote }} + {{- else -}} + {{- range $rule.resources }} + - {{ . | squote }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + ... +{{- end -}} diff --git a/enterprise/authelia/20.0.5/templates/_secrets.tpl b/enterprise/authelia/20.0.5/templates/_secrets.tpl new file mode 100644 index 0000000000..14ed88d973 --- /dev/null +++ b/enterprise/authelia/20.0.5/templates/_secrets.tpl @@ -0,0 +1,53 @@ +{{/* Define the secrets */}} +{{- define "authelia.secrets" -}} +{{- $basename := include "tc.v1.common.lib.chart.names.fullname" $ -}} +{{- $fetchname := printf "%s-authelia-secrets" $basename -}} + +{{/* Initialize all keys */}} +{{- $oidckey := genPrivateKey "rsa" }} +{{- $oidcsecret := randAlphaNum 32 }} +{{- $jwtsecret := randAlphaNum 50 }} +{{- $sessionsecret := randAlphaNum 50 }} +{{- $encryptionkey := randAlphaNum 100 }} + +enabled: true +data: + {{ with (lookup "v1" "Secret" .Release.Namespace $fetchname) }} + {{/* Get previous values and decode */}} + {{ $sessionsecret = (index .data "SESSION_ENCRYPTION_KEY") | b64dec }} + {{ $jwtsecret = (index .data "JWT_TOKEN") | b64dec }} + {{ $encryptionkey = (index .data "ENCRYPTION_KEY") | b64dec }} + + {{/* Check if those keys ever existed. as OIDC is optional */}} + {{ if and (hasKey .data "OIDC_PRIVATE_KEY") (hasKey .data "OIDC_HMAC_SECRET") }} + {{ $oidckey = (index .data "OIDC_PRIVATE_KEY") | b64dec }} + {{ $oidcsecret = (index .data "OIDC_HMAC_SECRET") | b64dec }} + {{ end }} + {{ end }} + SESSION_ENCRYPTION_KEY: {{ $sessionsecret }} + JWT_TOKEN: {{ $jwtsecret }} + ENCRYPTION_KEY: {{ $encryptionkey }} + + {{- if .Values.authentication_backend.ldap.enabled }} + LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password }} + {{- end }} + + {{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }} + SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password }} + {{- end }} + + {{- if .Values.duo_api.enabled }} + DUO_API_KEY: {{ .Values.duo_api.plain_api_key }} + {{- end }} + + STORAGE_PASSWORD: {{ $.Values.cnpg.main.creds.password | trimAll "\"" }} + + REDIS_PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }} + {{- if .Values.redisProvider.high_availability.enabled }} + REDIS_SENTINEL_PASSWORD: {{ .Values.redis.sentinelPassword | trimAll "\"" }} + {{- end }} + + OIDC_PRIVATE_KEY: | + {{- $oidckey | nindent 4 }} + OIDC_HMAC_SECRET: {{ $oidcsecret }} +{{- end -}} diff --git a/enterprise/authelia/20.0.5/templates/common.yaml b/enterprise/authelia/20.0.5/templates/common.yaml new file mode 100644 index 0000000000..54e288e852 --- /dev/null +++ b/enterprise/authelia/20.0.5/templates/common.yaml @@ -0,0 +1,77 @@ +{{/* Make sure all variables are set properly */}} +{{- include "tc.v1.common.loader.init" . }} + +{{/* Render configmap for authelia */}} +{{- $configmapPaths := include "authelia.configmap.paths" . | fromYaml -}} +{{- if $configmapPaths -}} + {{- $_ := set .Values.configmap "authelia-paths" $configmapPaths -}} +{{- end -}} + +{{- $configmapFile := include "authelia.configmap.configfile" . | fromYaml -}} +{{- if $configmapFile -}} + {{- $_ := set .Values.configmap "authelia-configfile" $configmapFile -}} +{{- end -}} + +{{/* Render secrets for authelia */}} +{{- $secret := include "authelia.secrets" . | fromYaml -}} +{{- if $secret -}} + {{- $_ := set .Values.secret "authelia-secrets" $secret -}} +{{- end -}} + +{{/* Append the general configMap volume to the volumes */}} +{{- define "authelia.configmapVolume" -}} +enabled: true +mountPath: /configuration.yaml +subPath: configuration.yaml +readOnly: true +type: "configmap" +objectName: authelia-configfile +{{- end -}} + +{{/* Append the general secret volumes to the volumes */}} +{{- define "authelia.secretVolumes" -}} +enabled: true +mountPath: "/secrets" +readOnly: true +type: "secret" +objectName: authelia-secrets +items: + - key: "JWT_TOKEN" + path: JWT_TOKEN + - key: "SESSION_ENCRYPTION_KEY" + path: SESSION_ENCRYPTION_KEY + - key: "ENCRYPTION_KEY" + path: ENCRYPTION_KEY + - key: "STORAGE_PASSWORD" + path: STORAGE_PASSWORD + {{- if .Values.authentication_backend.ldap.enabled }} + - key: "LDAP_PASSWORD" + path: LDAP_PASSWORD + {{- end }} + {{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }} + - key: "SMTP_PASSWORD" + path: SMTP_PASSWORD + {{- end }} + - key: "REDIS_PASSWORD" + path: REDIS_PASSWORD + {{- if .Values.redisProvider.high_availability.enabled}} + - key: "REDIS_SENTINEL_PASSWORD" + path: REDIS_SENTINEL_PASSWORD + {{- end }} + {{- if .Values.duo_api.enabled }} + - key: "DUO_API_KEY" + path: DUO_API_KEY + {{- end }} + {{- if .Values.identity_providers.oidc.enabled }} + - key: "OIDC_PRIVATE_KEY" + path: OIDC_PRIVATE_KEY + - key: "OIDC_HMAC_SECRET" + path: OIDC_HMAC_SECRET + {{- end }} +{{- end -}} + +{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}} +{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}} + +{{/* Render the templates */}} +{{ include "tc.v1.common.loader.apply" . }} diff --git a/enterprise/authelia/20.0.5/values.yaml b/enterprise/authelia/20.0.5/values.yaml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/enterprise/vaultwarden/24.0.5/CHANGELOG.md b/enterprise/vaultwarden/24.0.5/CHANGELOG.md new file mode 100644 index 0000000000..fb58029f26 --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/CHANGELOG.md @@ -0,0 +1,99 @@ +**Important:** +*for the complete changelog, please refer to the website* + + + + +## [vaultwarden-24.0.5](https://github.com/truecharts/charts/compare/vaultwarden-24.0.4...vaultwarden-24.0.5) (2023-12-21) + +### Chore + +- require ingress for certain charts + + + + +## [vaultwarden-24.0.4](https://github.com/truecharts/charts/compare/vaultwarden-24.0.3...vaultwarden-24.0.4) (2023-12-21) + + + + +## [vaultwarden-24.0.3](https://github.com/truecharts/charts/compare/vaultwarden-24.0.2...vaultwarden-24.0.3) (2023-12-21) + +### Chore + +- bump everything to ensure patches are applied globally + + ### Fix + +- ensure the cnpg GUI is included on CNPG apps + + + + +## [vaultwarden-24.0.2](https://github.com/truecharts/charts/compare/vaultwarden-24.0.1...vaultwarden-24.0.2) (2023-12-21) + +### Chore + +- update helm general non-major by renovate ([#16341](https://github.com/truecharts/charts/issues/16341)) + + + + +## [vaultwarden-24.0.1](https://github.com/truecharts/charts/compare/vaultwarden-24.0.0...vaultwarden-24.0.1) (2023-12-20) + +### Chore + +- bump patch versions on all charts for new GUI release + + + + +## [vaultwarden-24.0.0](https://github.com/truecharts/charts/compare/vaultwarden-23.0.15...vaultwarden-24.0.0) (2023-12-20) + +### Chore + +- update helm general major by renovate (major) ([#14631](https://github.com/truecharts/charts/issues/14631)) + + + + +## [vaultwarden-23.0.15](https://github.com/truecharts/charts/compare/vaultwarden-23.0.14...vaultwarden-23.0.15) (2023-12-20) + +### Chore + +- Bump everything to force min/max scale version update + + + + +## [vaultwarden-23.0.14](https://github.com/truecharts/charts/compare/vaultwarden-23.0.12...vaultwarden-23.0.14) (2023-12-16) + +### Chore + +- fix move mistake and cleanup metadata + - update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784)) + + + + +## [vaultwarden-23.0.14](https://github.com/truecharts/charts/compare/vaultwarden-23.0.12...vaultwarden-23.0.14) (2023-12-16) + +### Chore + +- fix move mistake and cleanup metadata + - update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784)) + + + + +## [vaultwarden-23.0.13](https://github.com/truecharts/charts/compare/vaultwarden-23.0.12...vaultwarden-23.0.13) (2023-12-16) + +### Chore + +- fix move mistake and cleanup metadata + + + + +## [vaultwarden-23.0.12](https://github.com/truecharts/charts/compare/vaultwarden-23.0.11...vaultwarden-23.0.12) (2023-12-03) diff --git a/enterprise/vaultwarden/24.0.5/Chart.yaml b/enterprise/vaultwarden/24.0.5/Chart.yaml new file mode 100644 index 0000000000..e6d1e13952 --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/Chart.yaml @@ -0,0 +1,41 @@ +kubeVersion: ">=1.24.0-0" +apiVersion: v2 +name: vaultwarden +version: 24.0.5 +appVersion: 1.30.1 +description: Unofficial Bitwarden compatible server written in Rust +home: https://truecharts.org/charts/enterprise/vaultwarden +icon: https://truecharts.org/img/hotlink-ok/chart-icons/vaultwarden.png +deprecated: false +sources: + - https://github.com/dani-garcia/vaultwarden + - https://github.com/truecharts/charts/tree/master/charts/enterprise/vaultwarden + - https://hub.docker.com/r/vaultwarden/server +maintainers: + - name: TrueCharts + email: info@truecharts.org + url: https://truecharts.org +keywords: + - bitwarden + - bitwardenrs + - bitwarden_rs + - vaultwarden + - password + - rust +dependencies: + - name: common + version: 16.2.9 + repository: https://library-charts.truecharts.org + condition: "" + alias: "" + tags: [] + import-values: [] +annotations: + max_scale_version: 23.10.2 + min_scale_version: 23.10.0 + truecharts.org/SCALE-support: "true" + truecharts.org/category: security + truecharts.org/max_helm_version: "3.13" + truecharts.org/min_helm_version: "3.12" + truecharts.org/train: enterprise +type: application diff --git a/enterprise/vaultwarden/24.0.5/LICENSE b/enterprise/vaultwarden/24.0.5/LICENSE new file mode 100644 index 0000000000..80e4ab93f9 --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/LICENSE @@ -0,0 +1,106 @@ +Business Source License 1.1 + +Parameters + +Licensor: The TrueCharts Project, it's owner and it's contributors +Licensed Work: The TrueCharts "Cert-Manager" Helm Chart +Additional Use Grant: You may use the licensed work in production, as long + as it is directly sourced from a TrueCharts provided + official repository, catalog or source. You may also make private + modification to the directly sourced licenced work, + when used in production. + + The following cases are, due to their nature, also + defined as 'production use' and explicitly prohibited: + - Bundling, including or displaying the licensed work + with(in) another work intended for production use, + with the apparent intend of facilitating and/or + promoting production use by third parties in + violation of this license. + +Change Date: 2050-01-01 + +Change License: 3-clause BSD license + +For information about alternative licensing arrangements for the Software, +please contact: legal@truecharts.org + +Notice + +The Business Source License (this document, or the “License”) is not an Open +Source license. However, the Licensed Work will eventually be made available +under an Open Source License, as stated in this License. + +License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved. +“Business Source License” is a trademark of MariaDB Corporation Ab. + +----------------------------------------------------------------------------- + +Business Source License 1.1 + +Terms + +The Licensor hereby grants you the right to copy, modify, create derivative +works, redistribute, and make non-production use of the Licensed Work. The +Licensor may make an Additional Use Grant, above, permitting limited +production use. + +Effective on the Change Date, or the fourth anniversary of the first publicly +available distribution of a specific version of the Licensed Work under this +License, whichever comes first, the Licensor hereby grants you rights under +the terms of the Change License, and the rights granted in the paragraph +above terminate. + +If your use of the Licensed Work does not comply with the requirements +currently in effect as described in this License, you must purchase a +commercial license from the Licensor, its affiliated entities, or authorized +resellers, or you must refrain from using the Licensed Work. + +All copies of the original and modified Licensed Work, and derivative works +of the Licensed Work, are subject to this License. This License applies +separately for each version of the Licensed Work and the Change Date may vary +for each version of the Licensed Work released by Licensor. + +You must conspicuously display this License on each original or modified copy +of the Licensed Work. If you receive the Licensed Work in original or +modified form from a third party, the terms and conditions set forth in this +License apply to your use of that work. + +Any use of the Licensed Work in violation of this License will automatically +terminate your rights under this License for the current and all other +versions of the Licensed Work. + +This License does not grant you any right in any trademark or logo of +Licensor or its affiliates (provided that you may use a trademark or logo of +Licensor as expressly required by this License). + +TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON +AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, +EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND +TITLE. + +MariaDB hereby grants you permission to use this License’s text to license +your works, and to refer to it using the trademark “Business Source License”, +as long as you comply with the Covenants of Licensor below. + +Covenants of Licensor + +In consideration of the right to use this License’s text and the “Business +Source License” name and trademark, Licensor covenants to MariaDB, and to all +other recipients of the licensed work to be provided by Licensor: + +1. To specify as the Change License the GPL Version 2.0 or any later version, + or a license that is compatible with GPL Version 2.0 or a later version, + where “compatible” means that software provided under the Change License can + be included in a program with software provided under GPL Version 2.0 or a + later version. Licensor may specify additional Change Licenses without + limitation. + +2. To either: (a) specify an additional grant of rights to use that does not + impose any additional restriction on the right granted in this License, as + the Additional Use Grant; or (b) insert the text “None”. + +3. To specify a Change Date. + +4. Not to modify this License in any other way. diff --git a/enterprise/vaultwarden/24.0.5/README.md b/enterprise/vaultwarden/24.0.5/README.md new file mode 100644 index 0000000000..a072fb415e --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/README.md @@ -0,0 +1,27 @@ +# README + +## General Info + +TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE. +However only installations using the TrueNAS SCALE Apps system are supported. + +For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/vaultwarden) + +**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)** + + +## Support + +- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro). +- See the [Website](https://truecharts.org) +- Check our [Discord](https://discord.gg/tVsPTHWTtr) +- Open a [issue](https://github.com/truecharts/charts/issues/new/choose) + +--- + +## Sponsor TrueCharts + +TrueCharts can only exist due to the incredible effort of our staff. +Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! + +*All Rights Reserved - The TrueCharts Project* diff --git a/enterprise/vaultwarden/24.0.5/app-changelog.md b/enterprise/vaultwarden/24.0.5/app-changelog.md new file mode 100644 index 0000000000..b9d163f306 --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/app-changelog.md @@ -0,0 +1,9 @@ + + +## [vaultwarden-24.0.5](https://github.com/truecharts/charts/compare/vaultwarden-24.0.4...vaultwarden-24.0.5) (2023-12-21) + +### Chore + +- require ingress for certain charts + + \ No newline at end of file diff --git a/enterprise/vaultwarden/24.0.5/app-readme.md b/enterprise/vaultwarden/24.0.5/app-readme.md new file mode 100644 index 0000000000..08d9cc8b1d --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/app-readme.md @@ -0,0 +1,8 @@ +Unofficial Bitwarden compatible server written in Rust + +This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/enterprise/vaultwarden](https://truecharts.org/charts/enterprise/vaultwarden) + +--- + +TrueCharts can only exist due to the incredible effort of our staff. +Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! diff --git a/enterprise/vaultwarden/24.0.5/charts/common-16.2.9.tgz b/enterprise/vaultwarden/24.0.5/charts/common-16.2.9.tgz new file mode 100644 index 0000000000..c1db66f452 Binary files /dev/null and b/enterprise/vaultwarden/24.0.5/charts/common-16.2.9.tgz differ diff --git a/enterprise/vaultwarden/24.0.5/ix_values.yaml b/enterprise/vaultwarden/24.0.5/ix_values.yaml new file mode 100644 index 0000000000..849e008bf0 --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/ix_values.yaml @@ -0,0 +1,152 @@ +image: + repository: docker.io/vaultwarden/server + pullPolicy: IfNotPresent + tag: 1.30.1@sha256:ab9fe547277245533a28d8e0a0c4a1e1120daf469f983fd683fc13556927d4fe +manifestManager: + enabled: true +service: + main: + ports: + main: + port: 10102 + targetPort: 8080 +workload: + main: + podSpec: + containers: + main: + env: + DOMAIN: "https://{{ if .Values.ingress }}{{ if .Values.ingress.main.enabled }}{{ ( index .Values.ingress.main.hosts 0 ).host }}{{ else }}placeholder.com{{ end }}{{ else }}placeholder.com{{ end }}" + DATABASE_URL: + secretKeyRef: + name: cnpg-main-urls + key: std + envFrom: + - configMapRef: + name: vaultwardenconfig + - secretRef: + name: vaultwardensecret +database: + # -- Database type, + # must be one of: 'sqlite', 'mysql' or 'postgresql'. + type: postgresql + # -- Enable DB Write-Ahead-Log for SQLite, + # disabled for other databases. https://github.com/dani-garcia/bitwarden_rs/wiki/Running-without-WAL-enabled + wal: true + ## URL for external databases (mysql://user:pass@host:port or postgresql://user:pass@host:port). + # url: "" + ## Set the size of the database connection pool. + # maxConnections: 10 + ## Connection retries during startup, 0 for infinite. 1 second between retries. + # retries: 15 +# Set Bitwarden_rs application variables +vaultwarden: + # -- Allow any user to sign-up + # see: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-registration-of-new-users + allowSignups: true + ## Whitelist domains allowed to sign-up. 'allowSignups' is ignored if set. + # signupDomains: + # - domain.tld + # -- Verify e-mail before login is enabled. + # SMTP must be enabled. + verifySignup: false + # When a user logs in an email is required to be sent. If sending the email fails the login attempt will fail. SMTP must be enabled. + requireEmail: false + ## Maximum attempts before an email token is reset and a new email will need to be sent. + # emailAttempts: 3 + ## Email token validity in seconds. + # emailTokenExpiration: 600 + # Allow invited users to sign-up even feature is disabled: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-invitations + allowInvitation: true + # Show password hints: https://github.com/dani-garcia/bitwarden_rs/wiki/Password-hint-display + ## Default organization name in invitation e-mails that are not coming from a specific organization. + # defaultInviteName: "" + showPasswordHint: true + # Enable Web Vault (static content). https://github.com/dani-garcia/bitwarden_rs/wiki/Disabling-or-overriding-the-Vault-interface-hosting + enableWebVault: true + # Restrict creation of orgs. Options are: 'all', 'none' or a comma-separated list of users. + orgCreationUsers: all + ## Limit attachment disk usage per organization. + # attachmentLimitOrg: + ## Limit attachment disk usage per user. + # attachmentLimitUser: + ## HaveIBeenPwned API Key. Can be purchased at https://haveibeenpwned.com/API/Key. + # hibpApiKey: + + admin: + # Enable admin portal. + enabled: false + # Disabling the admin token will make the admin portal accessible to anyone, use carefully: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-admin-token + disableAdminToken: false + ## Token for admin login, will be generated if not defined. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-admin-page + # token: + # Enable SMTP. https://github.com/dani-garcia/bitwarden_rs/wiki/SMTP-configuration + smtp: + enabled: false + # SMTP hostname, required if SMTP is enabled. + host: "" + # SMTP sender e-mail address, required if SMTP is enabled. + from: "" + ## SMTP sender name, defaults to 'Bitwarden_RS'. + # fromName: "" + ## Enable SSL connection. + # security: starttls + ## SMTP port. Defaults to 587 with STARTTLS, 465 with FORCE_TLS, and 25 without SSL. + # port: 587 + ## SMTP Authentication Mechanisms. Comma-separated options: 'Plain', 'Login' and 'Xoauth2'. Defaults to 'Plain'. + # authMechanism: Plain + ## Hostname to be sent for SMTP HELO. Defaults to pod name. + # heloName: "" + ## SMTP timeout. + # timeout: 15 + ## Accept SSL session if certificate is valid but hostname doesn't match. DANGEROUS, vulnerable to men-in-the-middle attacks! + # invalidHostname: false + ## Accept invalid certificates. DANGEROUS, vulnerable to men-in-the-middle attacks! + # invalidCertificate: false + ## SMTP username. + # user: "" + ## SMTP password. Required is user is specified, ignored if no user provided. + # password: "" + ## Enable Yubico OTP authentication. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-Yubikey-OTP-authentication + yubico: + enabled: false + ## Yubico server. Defaults to YubiCloud. + # server: + ## Yubico ID and Secret Key. + # clientId: + # secretKey: + ## Enable Mobile Push Notifications. You must obtain and ID and Key here: https://bitwarden.com/host + push: + enabled: false + # installationId: + # installationKey: + ## Logging options. https://github.com/dani-garcia/bitwarden_rs/wiki/Logging + log: + # Log to file. + file: "" + # Log level. Options are "trace", "debug", "info", "warn", "error" or "off". + level: "trace" + ## Log timestamp format. See https://docs.rs/chrono/0.4.15/chrono/format/strftime/index.html. Defaults to time in milliseconds. + # timeFormat: "" + icons: + # Disables download of external icons. Setting to true will still serve icons from cache (/data/icon_cache). TTL will default to zero. + disableDownload: false + ## Cache time-to-live for icons fetched. 0 means no purging. + # cache: 2592000 + ## Cache time-to-live for icons that were not available. 0 means no purging. + # cacheFailed: 259200 +persistence: + data: + enabled: true + mountPath: "/data" +cnpg: + main: + enabled: true + user: vaultwarden + database: vaultwarden +portal: + open: + enabled: true +ingress: + main: + required: true diff --git a/enterprise/vaultwarden/24.0.5/questions.yaml b/enterprise/vaultwarden/24.0.5/questions.yaml new file mode 100644 index 0000000000..43ce0fc536 --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/questions.yaml @@ -0,0 +1,3508 @@ +groups: + - name: Container Image + description: Image to be used for container + - name: General Settings + description: General Deployment Settings + - name: Workload Settings + description: Workload Settings + - name: App Configuration + description: App Specific Config Options + - name: Networking and Services + description: Configure Network and Services for Container + - name: Storage and Persistence + description: Persist and Share Data that is Separate from the Container + - name: Ingress + description: Ingress Configuration + - name: Security and Permissions + description: Configure Security Context and Permissions + - name: Resources and Devices + description: "Specify Resources/Devices to be Allocated to Workload" + - name: Middlewares + description: Traefik Middlewares + - name: Metrics + description: Metrics + - name: Addons + description: Addon Configuration + - name: Advanced + description: Advanced Configuration + - name: Postgresql + description: Postgresql + - name: Documentation + description: Documentation +portals: + open: + protocols: + - "$kubernetes-resource_configmap_tcportal-open_protocol" + host: + - "$kubernetes-resource_configmap_tcportal-open_host" + ports: + - "$kubernetes-resource_configmap_tcportal-open_port" + admin: + protocols: + - "$kubernetes-resource_configmap_tcportal-open_protocol" + host: + - "$kubernetes-resource_configmap_tcportal-open_host" + ports: + - "$kubernetes-resource_configmap_tcportal-open_port" + path: "/admin/" +questions: + - variable: global + group: General Settings + label: "Global Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: stopAll + label: Stop All + description: "Stops All Running pods and hibernates cnpg" + schema: + type: boolean + default: false + - variable: workload + group: "Workload Settings" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type (Advanced) + schema: + type: string + default: Deployment + enum: + - value: Deployment + description: Deployment + - value: DaemonSet + description: DaemonSet + - variable: replicas + label: Replicas (Advanced) + description: Set the number of Replicas + schema: + type: int + show_if: [["type", "!=", "DaemonSet"]] + default: 1 + - variable: podSpec + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: containers + label: Containers + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Container + schema: + additional_attrs: true + type: dict + attrs: + - variable: envList + label: Extra Environment Variables + description: "Please be aware that some variables are set in the background, adding duplicates here might cause issues or prevent the app from starting..." + schema: + type: list + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + - variable: value + label: Value + schema: + type: string + - variable: extraArgs + label: Extra Args + schema: + type: list + default: [] + items: + - variable: arg + label: Arg + schema: + type: string + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: command + label: Command + schema: + type: list + default: [] + items: + - variable: param + label: Param + schema: + type: string + - variable: TZ + label: Timezone + group: "General Settings" + schema: + type: string + default: "Etc/UTC" + $ref: + - "definitions/timezone" + - variable: podOptions + group: "General Settings" + label: "Global Pod Options (Advanced)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: expertPodOpts + label: "Expert - Pod Options" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostNetwork + label: "Host Networking" + schema: + type: boolean + default: false + - variable: dnsConfig + label: "DNS Configuration" + schema: + type: dict + additional_attrs: true + attrs: + - variable: options + label: "Options" + schema: + type: list + default: [{"name": "ndots", "value": "1"}] + items: + - variable: optionsEntry + label: "Option Entry" + schema: + type: dict + additional_attrs: true + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: value + label: "Value" + schema: + type: string + - variable: nameservers + label: "Nameservers" + schema: + type: list + default: [] + items: + - variable: nsEntry + label: "Nameserver Entry" + schema: + type: string + required: true + - variable: searches + label: "Searches" + schema: + type: list + default: [] + items: + - variable: searchEntry + label: "Search Entry" + schema: + type: string + required: true + + - variable: imagePullSecretList + group: "General Settings" + label: "Image Pull Secrets" + schema: + type: list + default: [] + items: + - variable: pullsecretentry + label: "Pull Secret" + schema: + type: dict + additional_attrs: true + attrs: + - variable: registry + label: "Registry" + schema: + type: string + required: true + default: "https://index.docker.io/v1/" + - variable: username + label: "Username" + schema: + type: string + required: true + default: "" + - variable: password + label: "Password" + schema: + type: string + required: true + default: "" + - variable: email + label: "Email" + schema: + type: string + required: true + default: "" + - variable: vaultwarden + label: "" + group: "App Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: yubico + label: "Yubico OTP authentication" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable Yubico OTP authentication" + description: "Please refer to the manual at: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-Yubikey-OTP-authentication" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: server + label: "Yubico server" + description: "Defaults to YubiCloud" + schema: + type: string + default: "" + - variable: clientId + label: "Yubico ID" + schema: + type: string + default: "" + - variable: secretKey + label: "Yubico Secret Key" + schema: + type: string + default: "" + - variable: push + label: "Mobile Push Notifications" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable Mobile Push Notifications" + description: "You must obtain and ID and Key here: https://bitwarden.com/host" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: installationId + label: "Installation ID" + schema: + type: string + default: "" + required: true + - variable: installationKey + label: "Installation Key" + schema: + type: string + default: "" + required: true + - variable: admin + label: "Admin Portal" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable Admin Portal" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: disableAdminToken + label: "Make Accessible Without Password/Token" + schema: + type: boolean + default: false + - variable: token + label: "Admin Portal Password/Token" + description: "Will be automatically generated if not defined" + schema: + type: string + default: "" + - variable: icons + label: "Icon Download Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: disableDownload + label: "Disable Icon Download" + description: "Disables download of external icons. Setting to true will still serve icons from cache (/data/icon_cache)" + schema: + type: boolean + default: false + - variable: cache + label: "Cache time-to-live" + description: "Cache time-to-live for icons fetched. 0 means no purging" + schema: + type: int + default: 2592000 + - variable: token + label: "Failed Downloads Cache time-to-live" + description: "Cache time-to-live for icons that were not available. 0 means no purging." + schema: + type: int + default: 2592000 + - variable: log + label: "Logging" + schema: + additional_attrs: true + type: dict + attrs: + - variable: level + label: "Log level" + schema: + type: string + default: "info" + required: true + enum: + - value: "trace" + description: "trace" + - value: "debug" + description: "debug" + - value: "info" + description: "info" + - value: "warn" + description: "warn" + - value: "error" + description: "error" + - value: "off" + description: "off" + - variable: file + label: "Log-File Location" + schema: + type: string + default: "" + - variable: smtp + label: "SMTP Settings (Email)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable SMTP Support" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: host + label: "SMTP hostname" + schema: + type: string + required: true + default: "" + - variable: from + label: "SMTP sender e-mail address" + schema: + type: string + required: true + default: "" + - variable: fromName + label: "SMTP sender name" + schema: + type: string + required: true + default: "" + - variable: user + label: "SMTP username" + schema: + type: string + required: true + default: "" + - variable: password + label: "SMTP password" + description: "Required is user is specified, ignored if no user provided" + schema: + type: string + default: "" + - variable: security + label: "Enable SSL connection" + schema: + type: string + default: "starttls" + enum: + - value: "starttls" + description: "STARTTLS (587)" + - value: "force_tls" + description: "FORCE_TLS (465)" + - value: "off" + description: "OFF (25)" + - variable: port + label: "SMTP port" + description: "Usually: 587 with STARTTLS, 465 with FORCE_TLS, and 25 without SSL" + schema: + type: int + default: 587 + - variable: authMechanism + label: "SMTP Authentication Mechanisms" + description: "Comma-separated options: Plain, Login and Xoauth2" + schema: + type: string + default: "Plain" + - variable: heloName + label: "SMTP HELO - Hostname" + description: "Hostname to be sent for SMTP HELO. Defaults to pod name" + schema: + type: string + default: "" + - variable: timeout + label: "SMTP timeout" + schema: + type: int + default: 15 + - variable: invalidHostname + label: "Accept Invalid Hostname" + description: "Accept SSL session if certificate is valid but hostname doesn't match. DANGEROUS, vulnerable to men-in-the-middle attacks!" + schema: + type: boolean + default: false + - variable: invalidCertificate + label: "Accept Invalid Certificate" + description: "Accept invalid certificates. DANGEROUS, vulnerable to men-in-the-middle attacks!" + schema: + type: boolean + default: false + - variable: allowSignups + label: "Allow Signup" + description: "Allow any user to sign-up: https://github.com/dani-garcia/vaultwarden/wiki/Disable-registration-of-new-users" + schema: + type: boolean + default: true + - variable: allowInvitation + label: "Always allow Invitation" + description: "Allow invited users to sign-up even feature is disabled: https://github.com/dani-garcia/vaultwarden/wiki/Disable-invitations" + schema: + type: boolean + default: true + - variable: defaultInviteName + label: "Default Invite Organisation Name" + description: "Default organization name in invitation e-mails that are not coming from a specific organization." + schema: + type: string + default: "" + - variable: showPasswordHint + label: "Show password hints" + description: "https://github.com/dani-garcia/vaultwarden/wiki/Password-hint-display" + schema: + type: boolean + default: true + - variable: signupwhitelistenable + label: "Enable Signup Whitelist" + description: "allowSignups is ignored if set" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: signupDomains + label: "Signup Whitelist Domains" + schema: + type: list + default: [] + items: + - variable: domain + label: "Domain" + schema: + type: string + default: "" + - variable: verifySignup + label: "Verifiy Signup" + description: "Verify e-mail before login is enabled. SMTP must be enabled" + schema: + type: boolean + default: false + - variable: requireEmail + label: "Block Login if email fails" + description: "When a user logs in an email is required to be sent. If sending the email fails the login attempt will fail. SMTP must be enabled" + schema: + type: boolean + default: false + - variable: emailAttempts + label: "Email token reset attempts" + description: "Maximum attempts before an email token is reset and a new email will need to be sent" + schema: + type: int + default: 3 + - variable: emailTokenExpiration + label: "Email token validity in seconds" + schema: + type: int + default: 600 + - variable: enableWebVault + label: "Enable Webvault" + description: "Enable Web Vault (static content). https://github.com/dani-garcia/vaultwarden/wiki/Disabling-or-overriding-the-Vault-interface-hosting" + schema: + type: boolean + default: true + - variable: orgCreationUsers + label: "Limit Organisation Creation to (users)" + description: "Restrict creation of orgs. Options are: 'all', 'none' or a comma-separated list of users." + schema: + type: string + default: "all" + - variable: attachmentLimitOrg + label: "Limit Attachment Disk Usage per Organisation" + schema: + type: string + default: "" + - variable: attachmentLimitUser + label: "Limit Attachment Disk Usage per User" + schema: + type: string + default: "" + - variable: hibpApiKey + label: "HaveIBeenPwned API Key" + description: "Can be purchased at https://haveibeenpwned.com/API/Key" + schema: + type: string + default: "" + - variable: service + group: Networking and Services + label: Configure Service(s) + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Service + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 10102 + required: true + - variable: serviceexpert + group: Networking and Services + label: Show Expert Config + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: scaleExternalInterface + description: Add External Interfaces + label: Add external Interfaces + group: Networking + schema: + type: list + items: + - variable: interfaceConfiguration + description: Interface Configuration + label: Interface Configuration + schema: + additional_attrs: true + type: dict + $ref: + - "normalize/interfaceConfiguration" + attrs: + - variable: hostInterface + description: Please Specify Host Interface + label: Host Interface + schema: + type: string + required: true + $ref: + - "definitions/interface" + - variable: ipam + description: Define how IP Address will be managed + label: IP Address Management + schema: + additional_attrs: true + type: dict + required: true + attrs: + - variable: type + description: Specify type for IPAM + label: IPAM Type + schema: + type: string + required: true + enum: + - value: dhcp + description: Use DHCP + - value: static + description: Use Static IP + - variable: staticIPConfigurations + label: Static IP Addresses + schema: + type: list + show_if: [["type", "=", "static"]] + items: + - variable: staticIP + label: Static IP + schema: + type: ipaddr + cidr: true + - variable: staticRoutes + label: Static Routes + schema: + type: list + show_if: [["type", "=", "static"]] + items: + - variable: staticRouteConfiguration + label: Static Route Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: destination + label: Destination + schema: + type: ipaddr + cidr: true + required: true + - variable: gateway + label: Gateway + schema: + type: ipaddr + cidr: false + required: true + - variable: serviceList + label: Add Manual Custom Services + group: Networking and Services + schema: + type: list + default: [] + items: + - variable: serviceListEntry + label: Custom Service + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the service + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Name + schema: + type: string + default: "" + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - value: Simple + description: Deprecated CHANGE THIS + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: advancedsvcset + label: Show Advanced Service Settings + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: externalIPs + label: "External IP's" + description: "External IP's" + schema: + type: list + default: [] + items: + - variable: externalIP + label: External IP + schema: + type: string + - variable: ipFamilyPolicy + label: IP Family Policy + description: Specify the IP Policy + schema: + type: string + default: SingleStack + enum: + - value: SingleStack + description: SingleStack + - value: PreferDualStack + description: PreferDualStack + - value: RequireDualStack + description: RequireDualStack + - variable: ipFamilies + label: IP Families + description: (Advanced) The IP Families that should be used + schema: + type: list + default: [] + items: + - variable: ipFamily + label: IP Family + schema: + type: string + - variable: portsList + label: Additional Service Ports + schema: + type: list + default: [] + items: + - variable: portsListEntry + label: Custom ports + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Port + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Port Name + schema: + type: string + default: "" + - variable: protocol + label: Port Type + schema: + type: string + default: tcp + enum: + - value: http + description: HTTP + - value: https + description: HTTPS + - value: tcp + description: TCP + - value: udp + description: UDP + - variable: targetPort + label: Target Port + description: This port exposes the container port on the service + schema: + type: int + required: true + - variable: port + label: Container Port + schema: + type: int + required: true + - variable: persistence + label: Integrated Persistent Storage + description: Integrated Persistent Storage + group: Storage and Persistence + schema: + additional_attrs: true + type: dict + attrs: + - variable: data + label: "App Config Storage" + description: "Stores the Application Configuration." + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: persistenceList + label: Additional App Storage + group: Storage and Persistence + schema: + type: list + default: [] + items: + - variable: persistenceListEntry + label: Custom Storage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the storage + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: hostPath + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: mountPath + label: Mount Path + description: Path inside the container the storage is mounted + schema: + type: string + default: "" + required: true + valid_chars: '^\/([a-zA-Z0-9._-]+(\s?[a-zA-Z0-9._-]+|\/?))+$' + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size Quotum of Storage + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: "disabled" + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: ingress + label: "" + group: Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + + + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: ingressList + label: Add Manual Custom Ingresses + group: Ingress + schema: + type: list + default: [] + items: + - variable: ingressListEntry + label: Custom Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Name + schema: + type: string + default: "" + - variable: ingressClassName + label: IngressClass Name + schema: + type: string + default: "" + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + - variable: service + label: Linked Service + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Service Name + schema: + type: string + default: "" + - variable: port + label: Service Port + schema: + type: int + - variable: tls + label: TLS-Settings + schema: + type: list + default: [] + show_if: [["certificateIssuer", "=", ""]] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your Cert-Manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: scaleCert + label: Use TrueNAS SCALE Certificate (Deprecated) + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: Use Custom Secret (Advanced) + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: middleware + label: Middleware + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: securityContext + group: Security and Permissions + label: Security Context + schema: + additional_attrs: true + type: dict + attrs: + - variable: container + label: Container + schema: + additional_attrs: true + type: dict + attrs: + # Settings from questions.yaml get appended here on a per-app basis + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 568 + - variable: runAsGroup + label: "runAsGroup" + description: "The groupID of the user running the application" + schema: + type: int + default: 568 + # Settings from questions.yaml get appended here on a per-app basis + - variable: PUID + label: Process User ID - PUID + description: When supported by the container, this sets the User ID running the Application Process. Not supported by all Apps + schema: + type: int + show_if: [["runAsUser", "=", 0]] + default: 568 + - variable: UMASK + label: UMASK + description: When supported by the container, this sets the UMASK for the App. Not supported by all Apps + schema: + type: string + default: "0022" + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: true + - variable: pod + label: Pod + schema: + additional_attrs: true + type: dict + attrs: + - variable: fsGroupChangePolicy + label: "When should we take ownership?" + schema: + type: string + default: OnRootMismatch + enum: + - value: OnRootMismatch + description: OnRootMismatch + - value: Always + description: Always + - variable: supplementalGroups + label: Supplemental Groups + schema: + type: list + default: [] + items: + - variable: supplementalGroupsEntry + label: Supplemental Group + schema: + type: int + # Settings from questions.yaml get appended here on a per-app basis + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 + - variable: resources + group: Resources and Devices + label: "Resource Limits" + schema: + additional_attrs: true + type: dict + attrs: + - variable: limits + label: Advanced Limit Resource Consumption + schema: + additional_attrs: true + type: dict + attrs: + - variable: cpu + label: CPU + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 4000m + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: RAM + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 8Gi + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: requests + label: "Minimum Resources Required (request)" + schema: + additional_attrs: true + type: dict + hidden: true + attrs: + - variable: cpu + label: CPU + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 10m + hidden: true + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: "RAM" + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 50Mi + hidden: true + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: deviceList + label: Mount USB Devices + group: Resources and Devices + schema: + type: list + default: [] + items: + - variable: deviceListEntry + label: Device + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Storage + schema: + type: boolean + default: true + - variable: type + label: (Advanced) Type of Storage + description: Sets the persistence type + schema: + type: string + default: device + hidden: true + - variable: readOnly + label: readOnly + schema: + type: boolean + default: false + - variable: hostPath + label: Host Device Path + description: Path to the device on the host system + schema: + type: path + - variable: mountPath + label: Container Device Path + description: Path inside the container the device is mounted + schema: + type: string + default: "/dev/ttyACM0" + - variable: scaleGPU + label: GPU Configuration + group: Resources and Devices + schema: + type: list + default: [] + items: + - variable: scaleGPUEntry + label: GPU + schema: + additional_attrs: true + type: dict + attrs: + # Specify GPU configuration + - variable: gpu + label: Select GPU + schema: + additional_attrs: true + type: dict + $ref: + - "definitions/gpuConfiguration" + attrs: [] + - variable: workaround + label: "Workaround" + schema: + type: string + default: workaround + hidden: true + - variable: cnpg + group: Postgresql + label: "CloudNative-PG (CNPG)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Postgresql Database" + schema: + additional_attrs: true + type: dict + attrs: + - variable: hibernate + label: Hibernate + description: "enable to safely hibernate and shutdown the postgresql cluster" + schema: + type: boolean + default: false + - variable: cluster + label: "Cluster Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: instances + label: Instances + schema: + type: int + default: 1 + - variable: singleNode + label: singleNode + schema: + type: boolean + default: true + hidden: true + - variable: storage + label: "Storage" + schema: + additional_attrs: true + type: dict + attrs: + - variable: size + label: Size + schema: + type: string + default: "256Gi" + - variable: walStorage + label: "WAL Storage" + schema: + additional_attrs: true + type: dict + attrs: + - variable: size + label: Size + schema: + type: string + default: "256Gi" + - variable: monitoring + label: "Monitoring Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enablePodMonitor + label: "enablePodMonitor" + schema: + type: boolean + default: true + - variable: disableDefaultQueries + label: "disableDefaultQueries" + schema: + type: boolean + default: false + - variable: pooler + label: "Pooler Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: instances + label: Instances + schema: + type: int + default: 1 + - variable: createRO + label: "Create ReadOnly Instance" + schema: + type: boolean + default: false + - variable: recovery + label: "Recovery Settings (Experimental)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + - variable: endpointURL + label: "endpointURL" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: method + label: "method" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "object_store" + - variable: backupName + label: "backupName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: provider + label: "provider" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "s3" + - variable: s3 + label: "s3" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "s3"], ["enabled", "=", true]] + attrs: + - variable: region + label: "region" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: accessKey + label: "accessKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: secretKey + label: "secretKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: azure + label: "azure (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "azure"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: connectionString + label: "connectionString" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageAccount + label: "storageAccount" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageKey + label: "storageKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageSasToken + label: "storageSasToken" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: containerName + label: "containerName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: serviceName + label: "serviceName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "blob" + - variable: inheritFromAzureAD + label: "inheritFromAzureAD" + schema: + type: boolean + show_if: [["enabled", "=", true]] + default: false + - variable: google + label: "google (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "google"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: gkeEnvironment + label: "gkeEnvironment" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: applicationCredentials + label: "applicationCredentials" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: backups + label: "Backup Settings (Experimental)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + - variable: endpointURL + label: "endpointURL" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: destinationPath + label: "destinationPath" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: retentionPolicy + label: "retentionPolicy" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "30d" + - variable: provider + label: "provider" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "s3" + - variable: s3 + label: "s3" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "s3"], ["enabled", "=", true]] + attrs: + - variable: region + label: "region" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: accessKey + label: "accessKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: secretKey + label: "secretKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: azure + label: "azure (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "azure"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: connectionString + label: "connectionString" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageAccount + label: "storageAccount" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageKey + label: "storageKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageSasToken + label: "storageSasToken" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: containerName + label: "containerName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: serviceName + label: "serviceName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "blob" + - variable: inheritFromAzureAD + label: "inheritFromAzureAD" + schema: + type: boolean + show_if: [["enabled", "=", true]] + default: false + - variable: google + label: "google (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "google"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: gkeEnvironment + label: "gkeEnvironment" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: applicationCredentials + label: "applicationCredentials" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: scheduledBackups + label: ScheduledBackups + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: backupschedule + label: BackupSchedule + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "daily-backup" + required: true + - variable: schedule + label: schedule + schema: + type: string + required: true + default: "0 0 0 * * *" + - variable: backupOwnerReference + label: backupOwnerReference + schema: + type: string + required: true + default: "self" + - variable: immediate + label: immediate + schema: + type: boolean + default: false + - variable: suspend + label: suspend + schema: + type: boolean + default: false + - variable: manualBackups + label: manualBackups + schema: + type: list + default: [] + items: + - variable: backup + label: Backup + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "" + required: true +# - variable: horizontalPodAutoscaler +# group: Advanced +# label: (Advanced) Horizontal Pod Autoscaler +# schema: +# type: list +# default: [] +# items: +# - variable: hpaEntry +# label: HPA Entry +# schema: +# additional_attrs: true +# type: dict +# attrs: +# - variable: name +# label: Name +# schema: +# type: string +# required: true +# default: "" +# - variable: enabled +# label: Enabled +# schema: +# type: boolean +# default: false +# show_subquestions_if: true +# subquestions: +# - variable: target +# label: Target +# description: Deployment name, Defaults to Main Deployment +# schema: +# type: string +# default: "" +# - variable: minReplicas +# label: Minimum Replicas +# schema: +# type: int +# default: 1 +# - variable: maxReplicas +# label: Maximum Replicas +# schema: +# type: int +# default: 5 +# - variable: targetCPUUtilizationPercentage +# label: Target CPU Utilization Percentage +# schema: +# type: int +# default: 80 +# - variable: targetMemoryUtilizationPercentage +# label: Target Memory Utilization Percentage +# schema: +# type: int +# default: 80 + - variable: networkPolicy + group: Advanced + label: (Advanced) Network Policy + schema: + type: list + default: [] + items: + - variable: netPolicyEntry + label: Network Policy Entry + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + default: "" + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: policyType + label: Policy Type + schema: + type: string + default: "" + enum: + - value: "" + description: Default + - value: ingress + description: Ingress + - value: egress + description: Egress + - value: ingress-egress + description: Ingress and Egress + - variable: egress + label: Egress + schema: + type: list + default: [] + items: + - variable: egressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: to + label: To + schema: + type: list + default: [] + items: + - variable: toEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: IP Block + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: CIDR + schema: + type: string + default: "" + - variable: except + label: Except + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: string + - variable: namespaceSelector + label: Namespace Selector + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: Ports + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + - variable: endPort + label: End Port + schema: + type: int + - variable: protocol + label: Protocol + schema: + type: string + default: TCP + enum: + - value: TCP + description: TCP + - value: UDP + description: UDP + - value: SCTP + description: SCTP + - variable: ingress + label: Ingress + schema: + type: list + default: [] + items: + - variable: ingressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: from + label: From + schema: + type: list + default: [] + items: + - variable: fromEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: IP Block + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: CIDR + schema: + type: string + default: "" + - variable: except + label: Except + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: string + - variable: namespaceSelector + label: Namespace Selector + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: Ports + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + - variable: endPort + label: End Port + schema: + type: int + - variable: protocol + label: Protocol + schema: + type: string + default: TCP + enum: + - value: TCP + description: TCP + - value: UDP + description: UDP + - value: SCTP + description: SCTP + - variable: addons + group: Addons + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: Codeserver + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: service + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: NodePort + description: Deprecated CHANGE THIS + - value: ClusterIP + description: ClusterIP + - value: LoadBalancer + description: LoadBalancer + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + default: 36107 + - variable: ingress + label: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + - variable: certificateIssuer + label: Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates. Cannot be used combined with tls option below' + schema: + type: string + default: "" + - variable: middlewares + label: Traefik Middlewares + description: Add previously created Traefik Middlewares to this Ingress + schema: + type: list + default: [] + items: + - variable: name + label: Name + schema: + type: string + default: "" + required: true + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: entrypoint + label: (Advanced) Traefik Entrypoint + description: Entrypoint used by Traefik when using Traefik as Ingress Provider + schema: + type: string + default: websecure + show_if: [["advanced", "=", true]] + required: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + show_if: [["advanced", "=", true]] + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: envList + label: Codeserver Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + - variable: vpn + label: VPN + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type + schema: + type: string + default: disabled + enum: + - value: disabled + description: disabled + - value: gluetun + description: Gluetun + - value: tailscale + description: Tailscale + - value: openvpn + description: OpenVPN (Deprecated) + - value: wireguard + description: Wireguard (Deprecated) + - variable: openvpn + label: OpenVPN Settings + schema: + additional_attrs: true + type: dict + show_if: [["type", "=", "openvpn"]] + attrs: + - variable: username + label: Authentication Username (Optional) + description: Authentication Username, Optional + schema: + type: string + default: "" + - variable: password + label: Authentication Password + description: Authentication Credentials + schema: + type: string + show_if: [["username", "!=", ""]] + default: "" + required: true + - variable: tailscale + label: Tailscale Settings + schema: + additional_attrs: true + type: dict + show_if: [["type", "=", "tailscale"]] + attrs: + - variable: authkey + label: Authentication Key + description: Provide an auth key to automatically authenticate the node as your user account. + schema: + type: string + private: true + default: "" + - variable: auth_once + label: Auth Once + description: Only attempt to log in if not already logged in. + schema: + type: boolean + default: true + - variable: accept_dns + label: Accept DNS + description: Accept DNS configuration from the admin console. + schema: + type: boolean + default: false + - variable: userspace + label: Userspace + description: Userspace Networking mode allows running Tailscale where you do not have access to create a VPN tunnel device. + schema: + type: boolean + default: false + - variable: routes + label: Routes + description: Expose physical subnet routes to your entire Tailscale network. + schema: + type: string + default: "" + - variable: dest_ip + label: Destination IP + description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched. + schema: + type: string + default: "" + - variable: sock5_server + label: Sock5 Server + description: The address on which to listen for SOCKS5 proxying into the tailscale net. + schema: + type: string + default: "" + - variable: outbound_http_proxy_listen + label: Outbound HTTP Proxy Listen + description: The address on which to listen for HTTP proxying into the tailscale net. + schema: + type: string + default: "" + - variable: extra_args + label: Extra Args + description: Extra Args + schema: + type: string + default: "" + - variable: daemon_extra_args + label: Tailscale Daemon Extra Args + description: Tailscale Daemon Extra Args + schema: + type: string + default: "" + - variable: killSwitch + label: Enable Killswitch + schema: + type: boolean + show_if: [["type", "!=", "disabled"]] + default: true + - variable: excludedNetworks_IPv4 + label: Killswitch Excluded IPv4 networks + description: List of Killswitch Excluded IPv4 Addresses + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv4 + label: IPv4 Network + schema: + type: string + required: true + - variable: excludedNetworks_IPv6 + label: Killswitch Excluded IPv6 networks + description: "List of Killswitch Excluded IPv6 Addresses" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv6 + label: IPv6 Network + schema: + type: string + required: true + - variable: configFile + label: VPN Config File Location + schema: + type: string + show_if: [["type", "!=", "disabled"]] + default: "" + + - variable: envList + label: VPN Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + max_length: 10240 + - variable: netshoot + label: Netshoot + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: envList + label: Netshoot Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + - variable: docs + group: Documentation + label: Please read the documentation at https://truecharts.org + description: Please read the documentation at +
https://truecharts.org + schema: + additional_attrs: true + type: dict + attrs: + - variable: confirmDocs + label: I have checked the documentation + schema: + type: boolean + default: true + - variable: donateNag + group: Documentation + label: Please consider supporting TrueCharts, see https://truecharts.org/sponsor + description: Please consider supporting TrueCharts, see +
https://truecharts.org/sponsor + schema: + additional_attrs: true + type: dict + attrs: + - variable: confirmDonate + label: I have considered donating + schema: + type: boolean + default: true + hidden: true diff --git a/enterprise/vaultwarden/24.0.5/templates/NOTES.txt b/enterprise/vaultwarden/24.0.5/templates/NOTES.txt new file mode 100644 index 0000000000..efcb74cb77 --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/templates/NOTES.txt @@ -0,0 +1 @@ +{{- include "tc.v1.common.lib.chart.notes" $ -}} diff --git a/enterprise/vaultwarden/24.0.5/templates/_configmap.tpl b/enterprise/vaultwarden/24.0.5/templates/_configmap.tpl new file mode 100644 index 0000000000..7cc26147b0 --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/templates/_configmap.tpl @@ -0,0 +1,111 @@ +{{/* Define the configmap */}} +{{- define "vaultwarden.configmap" -}} +enabled: true +data: + ROCKET_PORT: "8080" + SIGNUPS_ALLOWED: {{ .Values.vaultwarden.allowSignups | quote }} + {{- if .Values.vaultwarden.signupDomains }} + SIGNUPS_DOMAINS_WHITELIST: {{ join "," .Values.vaultwarden.signupDomains | quote }} + {{- end }} + {{- if and (eq .Values.vaultwarden.verifySignup true) (eq .Values.vaultwarden.smtp.enabled false) }}{{ required "Signup verification requires SMTP to be enabled" nil}}{{end}} + SIGNUPS_VERIFY: {{ .Values.vaultwarden.verifySignup | quote }} + {{- if and (eq .Values.vaultwarden.requireEmail true) (eq .Values.vaultwarden.smtp.enabled false) }}{{ required "Requiring emails for login depends on SMTP" nil}}{{end}} + REQUIRE_DEVICE_EMAIL: {{ .Values.vaultwarden.requireEmail | quote }} + {{- if .Values.vaultwarden.emailAttempts }} + EMAIL_ATTEMPTS_LIMIT: {{ .Values.vaultwarden.emailAttempts | quote }} + {{- end }} + {{- if .Values.vaultwarden.emailTokenExpiration }} + EMAIL_EXPIRATION_TIME: {{ .Values.vaultwarden.emailTokenExpiration | quote }} + {{- end }} + INVITATIONS_ALLOWED: {{ .Values.vaultwarden.allowInvitation | quote }} + {{- if .Values.vaultwarden.defaultInviteName }} + INVITATION_ORG_NAME: {{ .Values.vaultwarden.defaultInviteName | quote }} + {{- end }} + SHOW_PASSWORD_HINT: {{ .Values.vaultwarden.showPasswordHint | quote }} + WEB_VAULT_ENABLED: {{ .Values.vaultwarden.enableWebVault | quote }} + ORG_CREATION_USERS: {{ .Values.vaultwarden.orgCreationUsers | quote }} + {{- if .Values.vaultwarden.attachmentLimitOrg }} + ORG_ATTACHMENT_LIMIT: {{ .Values.vaultwarden.attachmentLimitOrg | quote }} + {{- end }} + {{- if .Values.vaultwarden.attachmentLimitUser }} + USER_ATTACHMENT_LIMIT: {{ .Values.vaultwarden.attachmentLimitUser | quote }} + {{- end }} + {{- if .Values.vaultwarden.hibpApiKey }} + HIBP_API_KEY: {{ .Values.vaultwarden.hibpApiKey | quote }} + {{- end }} + {{- include "vaultwarden.dbTypeValid" . }} + {{- if .Values.database.retries }} + DB_CONNECTION_RETRIES: {{ .Values.database.retries | quote }} + {{- end }} + {{- if .Values.database.maxConnections }} + DATABASE_MAX_CONNS: {{ .Values.database.maxConnections | quote }} + {{- end }} + {{- if eq .Values.vaultwarden.smtp.enabled true }} + SMTP_HOST: {{ required "SMTP host is required to enable SMTP" .Values.vaultwarden.smtp.host | quote }} + SMTP_FROM: {{ required "SMTP sender address ('from') is required to enable SMTP" .Values.vaultwarden.smtp.from | quote }} + {{- if .Values.vaultwarden.smtp.fromName }} + SMTP_FROM_NAME: {{ .Values.vaultwarden.smtp.fromName | quote }} + {{- end }} + {{- if .Values.vaultwarden.smtp.ssl }} + SMTP_SECURITY: {{ .Values.vaultwarden.smtp.security | quote }} + {{- end }} + {{- if .Values.vaultwarden.smtp.port }} + SMTP_PORT: {{ .Values.vaultwarden.smtp.port | quote }} + {{- end }} + {{- if .Values.vaultwarden.smtp.authMechanism }} + SMTP_AUTH_MECHANISM: {{ .Values.vaultwarden.smtp.authMechanism | quote }} + {{- end }} + {{- if .Values.vaultwarden.smtp.heloName }} + HELO_NAME: {{ .Values.vaultwarden.smtp.heloName | quote }} + {{- end }} + {{- if .Values.vaultwarden.smtp.timeout }} + SMTP_TIMEOUT: {{ .Values.vaultwarden.smtp.timeout | quote }} + {{- end }} + {{- if .Values.vaultwarden.smtp.invalidHostname }} + SMTP_ACCEPT_INVALID_HOSTNAMES: {{ .Values.vaultwarden.smtp.invalidHostname | quote }} + {{- end }} + {{- if .Values.vaultwarden.smtp.invalidCertificate }} + SMTP_ACCEPT_INVALID_CERTS: {{ .Values.vaultwarden.smtp.invalidCertificate | quote }} + {{- end }} + {{- end }} + {{- if .Values.vaultwarden.log.file }} + LOG_FILE: {{ .Values.vaultwarden.log.file | quote }} + {{- end }} + {{- if or .Values.vaultwarden.log.level .Values.vaultwarden.log.timeFormat }} + EXTENDED_LOGGING: "true" + {{- end }} + {{- if .Values.vaultwarden.log.level }} + {{- include "vaultwarden.logLevelValid" . }} + LOG_LEVEL: {{ .Values.vaultwarden.log.level | quote }} + {{- end }} + {{- if .Values.vaultwarden.log.timeFormat }} + LOG_TIMESTAMP_FORMAT: {{ .Values.vaultwarden.log.timeFormat | quote }} + {{- end }} + {{- if .Values.vaultwarden.icons.disableDownload }} + DISABLE_ICON_DOWNLOAD: {{ .Values.vaultwarden.icons.disableDownload | quote }} + {{- if and (not .Values.vaultwarden.icons.cache) (eq .Values.vaultwarden.icons.disableDownload "true") }} + ICON_CACHE_TTL: "0" + {{- end }} + {{- end }} + {{- if .Values.vaultwarden.icons.cache }} + ICON_CACHE_TTL: {{ .Values.vaultwarden.icons.cache | quote }} + {{- end }} + {{- if .Values.vaultwarden.icons.cacheFailed }} + ICON_CACHE_NEGTTL: {{ .Values.vaultwarden.icons.cacheFailed | quote }} + {{- end }} + {{- if eq .Values.vaultwarden.admin.enabled true }} + {{- if eq .Values.vaultwarden.admin.disableAdminToken true }} + DISABLE_ADMIN_TOKEN: "true" + {{- end }} + {{- end }} + {{- if eq .Values.vaultwarden.yubico.enabled true }} + {{- if .Values.vaultwarden.yubico.server }} + YUBICO_SERVER: {{ .Values.vaultwarden.yubico.server | quote }} + {{- end }} + {{- end }} + {{- if eq .Values.database.type "sqlite" }} + ENABLE_DB_WAL: {{ .Values.database.wal | quote }} + {{- else }} + ENABLE_DB_WAL: "false" + {{- end }} +{{- end -}} diff --git a/enterprise/vaultwarden/24.0.5/templates/_secrets.tpl b/enterprise/vaultwarden/24.0.5/templates/_secrets.tpl new file mode 100644 index 0000000000..262fcffa1b --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/templates/_secrets.tpl @@ -0,0 +1,37 @@ +{{/* Define the secrets */}} +{{- define "vaultwarden.secrets" -}} + +{{- $adminToken := "" }} +{{- if eq .Values.vaultwarden.admin.enabled true }} +{{- $adminToken = .Values.vaultwarden.admin.token | default (randAlphaNum 48) | quote }} +{{- end -}} + +{{- $smtpUser := "" }} +{{- if and (eq .Values.vaultwarden.smtp.enabled true ) (.Values.vaultwarden.smtp.user) }} +{{- $smtpUser = .Values.vaultwarden.smtp.user | quote }} +{{- end -}} + +{{- $yubicoClientId := "" }} +{{- if eq .Values.vaultwarden.yubico.enabled true }} +{{- $yubicoClientId = required "Yubico Client ID required" .Values.vaultwarden.yubico.clientId | toString | quote }} +{{- end -}} +enabled: true +data: + placeholder: placeholdervalue + {{- if ne $adminToken "" }} + ADMIN_TOKEN: {{ $adminToken }} + {{- end }} + {{- if ne $smtpUser "" }} + SMTP_USERNAME: {{ $smtpUser }} + SMTP_PASSWORD: {{ required "Must specify SMTP password" .Values.vaultwarden.smtp.password | quote }} + {{- end }} + {{- if ne $yubicoClientId "" }} + YUBICO_CLIENT_ID: {{ $yubicoClientId }} + YUBICO_SECRET_KEY: {{ required "Yubico Secret Key required" .Values.vaultwarden.yubico.secretKey | quote }} + {{- end }} + {{- if .Values.vaultwarden.push.enabled }} + PUSH_ENABLED: {{ .Values.vaultwarden.push.enabled | quote }} + PUSH_INSTALLATION_ID: {{ required "Installation ID required" .Values.vaultwarden.push.installationId | quote }} + PUSH_INSTALLATION_KEY: {{ required "Installation Key required" .Values.vaultwarden.push.installationKey | quote }} + {{- end }} +{{- end -}} diff --git a/enterprise/vaultwarden/24.0.5/templates/_validate.tpl b/enterprise/vaultwarden/24.0.5/templates/_validate.tpl new file mode 100644 index 0000000000..e4832c2f6e --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/templates/_validate.tpl @@ -0,0 +1,17 @@ +{{/* +Ensure valid DB type is select, defaults to SQLite +*/}} +{{- define "vaultwarden.dbTypeValid" -}} +{{- if not (or (eq .Values.database.type "postgresql") (eq .Values.database.type "mysql") (eq .Values.database.type "sqlite")) }} +{{- required "Invalid database type" nil }} +{{- end -}} +{{- end -}} + +{{/* +Ensure log type is valid +*/}} +{{- define "vaultwarden.logLevelValid" -}} +{{- if not (or (eq .Values.vaultwarden.log.level "trace") (eq .Values.vaultwarden.log.level "debug") (eq .Values.vaultwarden.log.level "info") (eq .Values.vaultwarden.log.level "warn") (eq .Values.vaultwarden.log.level "error") (eq .Values.vaultwarden.log.level "off")) }} +{{- required "Invalid log level" nil }} +{{- end }} +{{- end }} diff --git a/enterprise/vaultwarden/24.0.5/templates/common.yaml b/enterprise/vaultwarden/24.0.5/templates/common.yaml new file mode 100644 index 0000000000..66c6adab5d --- /dev/null +++ b/enterprise/vaultwarden/24.0.5/templates/common.yaml @@ -0,0 +1,17 @@ +{{/* Make sure all variables are set properly */}} +{{- include "tc.v1.common.loader.init" . }} + +{{/* Render configmap for vaultwarden */}} +{{- $configmapFile := include "vaultwarden.configmap" . | fromYaml -}} +{{- if $configmapFile -}} + {{- $_ := set .Values.configmap "vaultwardenconfig" $configmapFile -}} +{{- end -}} + +{{/* Render secrets for vaultwarden */}} +{{- $secret := include "vaultwarden.secrets" . | fromYaml -}} +{{- if $secret -}} + {{- $_ := set .Values.secret "vaultwardensecret" $secret -}} +{{- end -}} + +{{/* Render the templates */}} +{{ include "tc.v1.common.loader.apply" . }} diff --git a/enterprise/vaultwarden/24.0.5/values.yaml b/enterprise/vaultwarden/24.0.5/values.yaml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/stable/authentik/17.0.4/CHANGELOG.md b/stable/authentik/17.0.4/CHANGELOG.md new file mode 100644 index 0000000000..f7eba09c6e --- /dev/null +++ b/stable/authentik/17.0.4/CHANGELOG.md @@ -0,0 +1,99 @@ +**Important:** +*for the complete changelog, please refer to the website* + + + + +## [authentik-17.0.4](https://github.com/truecharts/charts/compare/authentik-17.0.3...authentik-17.0.4) (2023-12-21) + +### Chore + +- require ingress for certain charts + + + + +## [authentik-17.0.3](https://github.com/truecharts/charts/compare/authentik-17.0.2...authentik-17.0.3) (2023-12-21) + +### Chore + +- bump everything to ensure patches are applied globally + + ### Fix + +- ensure the cnpg GUI is included on CNPG apps + + + + +## [authentik-17.0.2](https://github.com/truecharts/charts/compare/authentik-17.0.1...authentik-17.0.2) (2023-12-21) + +### Chore + +- update helm general non-major by renovate ([#16341](https://github.com/truecharts/charts/issues/16341)) + + + + +## [authentik-17.0.1](https://github.com/truecharts/charts/compare/authentik-17.0.0...authentik-17.0.1) (2023-12-20) + +### Chore + +- bump patch versions on all charts for new GUI release + + + + +## [authentik-17.0.0](https://github.com/truecharts/charts/compare/authentik-16.0.0...authentik-17.0.0) (2023-12-20) + +### Chore + +- update helm general major by renovate (major) ([#14631](https://github.com/truecharts/charts/issues/14631)) + + + + +## [authentik-16.0.0](https://github.com/truecharts/charts/compare/authentik-15.0.27...authentik-16.0.0) (2023-12-20) + + + + +## [authentik-15.0.27](https://github.com/truecharts/charts/compare/authentik-15.0.26...authentik-15.0.27) (2023-12-20) + +### Chore + +- Bump everything to force min/max scale version update + + + + +## [authentik-15.0.26](https://github.com/truecharts/charts/compare/authentik-15.0.25...authentik-15.0.26) (2023-12-16) + +### Chore + +- update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784)) + + + + +## [authentik-15.0.26](https://github.com/truecharts/charts/compare/authentik-15.0.25...authentik-15.0.26) (2023-12-16) + +### Chore + +- update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784)) + + + + +## [authentik-15.0.25](https://github.com/truecharts/charts/compare/authentik-15.0.24...authentik-15.0.25) (2023-12-03) + +### Chore + +- bump everything to ensure catalog has latest versions + - fix annotations again + - update annotations + - cleanup chart.yaml and add min-max scale version + + + + diff --git a/stable/authentik/17.0.4/Chart.yaml b/stable/authentik/17.0.4/Chart.yaml new file mode 100644 index 0000000000..a7f744b571 --- /dev/null +++ b/stable/authentik/17.0.4/Chart.yaml @@ -0,0 +1,44 @@ +kubeVersion: ">=1.24.0-0" +apiVersion: v2 +name: authentik +version: 17.0.4 +appVersion: 2023.10.4 +description: Authentik is an open-source Identity Provider focused on flexibility and versatility. +home: https://truecharts.org/charts/stable/authentik +icon: https://truecharts.org/img/hotlink-ok/chart-icons/authentik.png +deprecated: false +sources: + - https://goauthentik.io/docs/ + - https://github.com/truecharts/charts/tree/master/charts/stable/authentik + - https://ghcr.io/maxmind/geoipupdate + - https://github.com/goauthentik/authentik +maintainers: + - name: TrueCharts + email: info@truecharts.org + url: https://truecharts.org +keywords: + - authentik +dependencies: + - name: common + version: 16.2.9 + repository: https://library-charts.truecharts.org + condition: "" + alias: "" + tags: [] + import-values: [] + - name: redis + version: 10.0.4 + repository: https://deps.truecharts.org + condition: redis.enabled + alias: "" + tags: [] + import-values: [] +annotations: + max_scale_version: 23.10.2 + min_scale_version: 23.10.0 + truecharts.org/SCALE-support: "true" + truecharts.org/category: authentication + truecharts.org/max_helm_version: "3.13" + truecharts.org/min_helm_version: "3.12" + truecharts.org/train: stable +type: application diff --git a/stable/authentik/17.0.4/LICENSE b/stable/authentik/17.0.4/LICENSE new file mode 100644 index 0000000000..33a8cbb23f --- /dev/null +++ b/stable/authentik/17.0.4/LICENSE @@ -0,0 +1,106 @@ +Business Source License 1.1 + +Parameters + +Licensor: The TrueCharts Project, it's owner and it's contributors +Licensed Work: The TrueCharts "Blocky" Helm Chart +Additional Use Grant: You may use the licensed work in production, as long + as it is directly sourced from a TrueCharts provided + official repository, catalog or source. You may also make private + modification to the directly sourced licenced work, + when used in production. + + The following cases are, due to their nature, also + defined as 'production use' and explicitly prohibited: + - Bundling, including or displaying the licensed work + with(in) another work intended for production use, + with the apparent intend of facilitating and/or + promoting production use by third parties in + violation of this license. + +Change Date: 2050-01-01 + +Change License: 3-clause BSD license + +For information about alternative licensing arrangements for the Software, +please contact: legal@truecharts.org + +Notice + +The Business Source License (this document, or the “License”) is not an Open +Source license. However, the Licensed Work will eventually be made available +under an Open Source License, as stated in this License. + +License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved. +“Business Source License” is a trademark of MariaDB Corporation Ab. + +----------------------------------------------------------------------------- + +Business Source License 1.1 + +Terms + +The Licensor hereby grants you the right to copy, modify, create derivative +works, redistribute, and make non-production use of the Licensed Work. The +Licensor may make an Additional Use Grant, above, permitting limited +production use. + +Effective on the Change Date, or the fourth anniversary of the first publicly +available distribution of a specific version of the Licensed Work under this +License, whichever comes first, the Licensor hereby grants you rights under +the terms of the Change License, and the rights granted in the paragraph +above terminate. + +If your use of the Licensed Work does not comply with the requirements +currently in effect as described in this License, you must purchase a +commercial license from the Licensor, its affiliated entities, or authorized +resellers, or you must refrain from using the Licensed Work. + +All copies of the original and modified Licensed Work, and derivative works +of the Licensed Work, are subject to this License. This License applies +separately for each version of the Licensed Work and the Change Date may vary +for each version of the Licensed Work released by Licensor. + +You must conspicuously display this License on each original or modified copy +of the Licensed Work. If you receive the Licensed Work in original or +modified form from a third party, the terms and conditions set forth in this +License apply to your use of that work. + +Any use of the Licensed Work in violation of this License will automatically +terminate your rights under this License for the current and all other +versions of the Licensed Work. + +This License does not grant you any right in any trademark or logo of +Licensor or its affiliates (provided that you may use a trademark or logo of +Licensor as expressly required by this License). + +TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON +AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, +EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND +TITLE. + +MariaDB hereby grants you permission to use this License’s text to license +your works, and to refer to it using the trademark “Business Source License”, +as long as you comply with the Covenants of Licensor below. + +Covenants of Licensor + +In consideration of the right to use this License’s text and the “Business +Source License” name and trademark, Licensor covenants to MariaDB, and to all +other recipients of the licensed work to be provided by Licensor: + +1. To specify as the Change License the GPL Version 2.0 or any later version, + or a license that is compatible with GPL Version 2.0 or a later version, + where “compatible” means that software provided under the Change License can + be included in a program with software provided under GPL Version 2.0 or a + later version. Licensor may specify additional Change Licenses without + limitation. + +2. To either: (a) specify an additional grant of rights to use that does not + impose any additional restriction on the right granted in this License, as + the Additional Use Grant; or (b) insert the text “None”. + +3. To specify a Change Date. + +4. Not to modify this License in any other way. diff --git a/stable/authentik/17.0.4/README.md b/stable/authentik/17.0.4/README.md new file mode 100644 index 0000000000..97da9b371c --- /dev/null +++ b/stable/authentik/17.0.4/README.md @@ -0,0 +1,27 @@ +# README + +## General Info + +TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE. +However only installations using the TrueNAS SCALE Apps system are supported. + +For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/authentik) + +**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)** + + +## Support + +- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro). +- See the [Website](https://truecharts.org) +- Check our [Discord](https://discord.gg/tVsPTHWTtr) +- Open a [issue](https://github.com/truecharts/charts/issues/new/choose) + +--- + +## Sponsor TrueCharts + +TrueCharts can only exist due to the incredible effort of our staff. +Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! + +*All Rights Reserved - The TrueCharts Project* diff --git a/stable/authentik/17.0.4/app-changelog.md b/stable/authentik/17.0.4/app-changelog.md new file mode 100644 index 0000000000..6717dd1746 --- /dev/null +++ b/stable/authentik/17.0.4/app-changelog.md @@ -0,0 +1,9 @@ + + +## [authentik-17.0.4](https://github.com/truecharts/charts/compare/authentik-17.0.3...authentik-17.0.4) (2023-12-21) + +### Chore + +- require ingress for certain charts + + \ No newline at end of file diff --git a/stable/authentik/17.0.4/app-readme.md b/stable/authentik/17.0.4/app-readme.md new file mode 100644 index 0000000000..fe4c2e580a --- /dev/null +++ b/stable/authentik/17.0.4/app-readme.md @@ -0,0 +1,8 @@ +Authentik is an open-source Identity Provider focused on flexibility and versatility. + +This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/stable/authentik](https://truecharts.org/charts/stable/authentik) + +--- + +TrueCharts can only exist due to the incredible effort of our staff. +Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! diff --git a/stable/authentik/17.0.4/charts/common-16.2.9.tgz b/stable/authentik/17.0.4/charts/common-16.2.9.tgz new file mode 100644 index 0000000000..c1db66f452 Binary files /dev/null and b/stable/authentik/17.0.4/charts/common-16.2.9.tgz differ diff --git a/stable/authentik/17.0.4/charts/redis-10.0.4.tgz b/stable/authentik/17.0.4/charts/redis-10.0.4.tgz new file mode 100644 index 0000000000..09d05b543f Binary files /dev/null and b/stable/authentik/17.0.4/charts/redis-10.0.4.tgz differ diff --git a/stable/authentik/17.0.4/ix_values.yaml b/stable/authentik/17.0.4/ix_values.yaml new file mode 100644 index 0000000000..ccd10cc4c4 --- /dev/null +++ b/stable/authentik/17.0.4/ix_values.yaml @@ -0,0 +1,502 @@ +image: + repository: ghcr.io/goauthentik/server + tag: 2023.10.4@sha256:f201d0515461ef5ec2afd37ead691247f09dfef231fdaa494fd48105b65913ca + pullPolicy: IfNotPresent +geoipImage: + repository: ghcr.io/maxmind/geoipupdate + tag: v6.0.0@sha256:e0d5c1dee7379d360e0f355557542d9672c616215dfdd5aaf917382de84cb84c + pullPolicy: IfNotPresent +ldapImage: + repository: ghcr.io/goauthentik/ldap + tag: 2023.10.4@sha256:e16028e4e6312dcb0fb35a9b537829efd9f7c0c3c1bbe966150fca5734211c6d + pullPolicy: IfNotPresent +radiusImage: + repository: ghcr.io/goauthentik/radius + tag: 2023.10.4@sha256:a5d36976190e4ccacb8caf315814534e75b983f789dc422bc327c4999a60cdab + pullPolicy: IfNotPresent +proxyImage: + repository: ghcr.io/goauthentik/proxy + tag: 2023.10.4@sha256:35217928c215f5221685289e09a076ad38767b17485b102661fad5aca184b8b1 + pullPolicy: IfNotPresent +authentik: + credentials: + # Only works on initial install + email: my-mail@example.com + password: my-password + # Optional, only set if you want to use it + bootstrapToken: "" + general: + disableUpdateCheck: false + disableStartupAnalytics: true + allowUserChangeName: true + allowUserChangeEmail: true + allowUserChangeUsername: true + overwriteDefaultBlueprints: false + gdprCompliance: true + tokenLength: 128 + impersonation: true + avatars: + - gravatar + - initials + footerLinks: + - name: Authentik + href: https://goauthentik.io + email: + host: "" + port: 587 + username: + password: + useTLS: true + useSSL: false + timeout: 10 + from: "" + ldap: + tlsCiphers: "null" + taskTimeoutHours: 2 + logging: + # info, debug, warning, error, trace + logLevel: info + errorReporting: + enabled: false + sendPII: false + environment: customer + sentryDSN: "" + geoip: + enabled: false + # Ignored if enabled is true + # If enabled is false, and this is true, the + # built-in GeoIP database will be wiped + wipeBuiltInDb: false + editionID: GeoLite2-City + frequency: 8 + accountID: "" + licenseKey: "" + outposts: + proxy: + enabled: false + token: "" + radius: + enabled: false + token: "" + ldap: + enabled: false + token: "" +# ===== DO NOT EDIT BELOW THIS LINE ===== +workload: + # ===== Server ===== + main: + enabled: true + type: Deployment + podSpec: + containers: + main: + enabled: true + primary: true + imageSelector: image + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + # readOnlyRootFilesystem: false + envFrom: + - configMapRef: + name: server + - secretRef: + name: server-worker + - configMapRef: + name: server-worker + args: + - server + probes: + liveness: + enabled: true + type: exec + command: + - /lifecycle/ak + - healthcheck + readiness: + enabled: true + type: exec + command: + - /lifecycle/ak + - healthcheck + startup: + enabled: true + type: exec + command: + - /lifecycle/ak + - healthcheck + # ===== Worker ===== + worker: + enabled: true + type: Deployment + podSpec: + containers: + worker: + enabled: true + primary: true + imageSelector: image + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + # readOnlyRootFilesystem: false + envFrom: + - secretRef: + name: server-worker + - configMapRef: + name: server-worker + args: + - worker + probes: + liveness: + enabled: true + type: exec + command: + - /lifecycle/ak + - healthcheck + readiness: + enabled: true + type: exec + command: + - /lifecycle/ak + - healthcheck + startup: + enabled: true + type: exec + command: + - /lifecycle/ak + - healthcheck + # ===== PROXY ===== + proxy: + enabled: true + type: Deployment + podSpec: + containers: + proxy: + enabled: true + primary: true + imageSelector: proxyImage + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + envFrom: + - configMapRef: + name: proxy + - secretRef: + name: proxy + probes: + liveness: + enabled: true + type: exec + command: + - /proxy + - healthcheck + readiness: + enabled: true + type: exec + command: + - /proxy + - healthcheck + startup: + enabled: true + type: exec + command: + - /proxy + - healthcheck + # ===== RADIUS ===== + radius: + enabled: true + type: Deployment + podSpec: + containers: + radius: + enabled: true + primary: true + imageSelector: radiusImage + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + envFrom: + - configMapRef: + name: radius + - secretRef: + name: radius + probes: + liveness: + enabled: true + type: exec + command: + - /radius + - healthcheck + readiness: + enabled: true + type: exec + command: + - /radius + - healthcheck + startup: + enabled: true + type: exec + command: + - /radius + - healthcheck + # ===== LDAP ===== + ldap: + enabled: true + type: Deployment + podSpec: + containers: + ldap: + enabled: true + primary: true + imageSelector: ldapImage + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + envFrom: + - configMapRef: + name: ldap + - secretRef: + name: ldap + probes: + liveness: + enabled: true + type: exec + command: + - /ldap + - healthcheck + readiness: + enabled: true + type: exec + command: + - /ldap + - healthcheck + startup: + enabled: true + type: exec + command: + - /ldap + - healthcheck + # ===== GeoIP Updater ===== + geoip: + enabled: true + type: Deployment + podSpec: + containers: + geoip: + enabled: true + primary: true + imageSelector: geoipImage + securityContext: + runAsUser: 0 + runAsGroup: 0 + capabilities: + disableS6Caps: true + envFrom: + - configMapRef: + name: geoip + - secretRef: + name: geoip + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false +service: + # Server HTTPS + main: + ports: + main: + protocol: https + port: 10229 + # Server HTTP + http: + enabled: true + type: ClusterIP + ports: + http: + enabled: true + protocol: http + port: 10230 + # Proxy + proxy: + enabled: true + targetSelector: proxy + ports: + http: + enabled: true + protocol: http + port: 10227 + targetSelector: proxy + https: + enabled: true + protocol: https + port: 10228 + targetSelector: proxy + # Radius + radius: + enabled: true + targetSelector: radius + ports: + radius: + enabled: true + protocol: udp + targetSelector: radius + port: 1812 + # LDAP + ldap: + enabled: true + targetSelector: ldap + ports: + ldap: + enabled: true + port: 389 + targetSelector: ldap + # LDAPS + ldaps: + enabled: true + targetSelector: ldap + ports: + ldaps: + enabled: true + port: 636 + targetSelector: ldap + # Server Metrics + servermetrics: + enabled: true + type: ClusterIP + ports: + servermetrics: + enabled: true + protocol: http + port: 10231 + # Radius Metrics + radiusmetrics: + enabled: true + type: ClusterIP + targetSelector: radius + ports: + radiusmetrics: + enabled: true + protocol: http + port: 10232 + targetSelector: radius + # LDAP Metrics + ldapmetrics: + enabled: true + type: ClusterIP + targetSelector: ldap + ports: + ldapmetrics: + enabled: true + protocol: http + port: 10233 + targetSelector: ldap + # Proxy Metrics + proxymetrics: + enabled: true + type: ClusterIP + targetSelector: proxy + ports: + proxymetrics: + enabled: true + protocol: http + port: 10234 + targetSelector: proxy +persistence: + media: + enabled: true + targetSelector: + main: + main: + mountPath: /media + worker: + worker: + mountPath: /media + templates: + enabled: true + targetSelector: + main: + main: + mountPath: /templates + worker: + worker: + mountPath: /templates + blueprints: + enabled: true + targetSelector: + worker: + worker: + # This will automatically change to `/blueprints` + # if `overwriteDefaultBlueprints` is set to `true + # Otherwise it will respect the value specified here + mountPath: /blueprints/custom + certs: + enabled: true + mountPath: /certs + targetSelector: + worker: + worker: + mountPath: /certs + geoip: + enabled: true + targetSelector: + main: + main: + mountPath: /geoip + worker: + worker: + mountPath: /geoip + geoip: + geoip: + mountPath: /usr/share/GeoIP +cnpg: + main: + enabled: true + user: authentik + database: authentik +redis: + enabled: true +portal: + open: + enabled: true +metrics: + # FIXME: Metrics do not work yet + servermetrics: + enabled: true + type: servicemonitor + endpoints: + - port: "{{ .Values.service.servermetrics.ports.servermetrics.port }}" + path: /metrics + prometheusRule: + enabled: false + radiusmetrics: + enabled: true + type: servicemonitor + endpoints: + - port: "{{ .Values.service.radiusmetrics.ports.radiusmetrics.port }}" + path: /metrics + prometheusRule: + enabled: false + ldapmetrics: + enabled: true + type: servicemonitor + endpoints: + - port: "{{ .Values.service.ldapmetrics.ports.ldapmetrics.port }}" + path: /metrics + prometheusRule: + enabled: false + proxymetrics: + enabled: true + type: servicemonitor + endpoints: + - port: "{{ .Values.service.proxymetrics.ports.proxymetrics.port }}" + path: /metrics + prometheusRule: + enabled: false +updated: true + +ingress: + main: + required: true diff --git a/stable/authentik/17.0.4/questions.yaml b/stable/authentik/17.0.4/questions.yaml new file mode 100644 index 0000000000..3a0461d509 --- /dev/null +++ b/stable/authentik/17.0.4/questions.yaml @@ -0,0 +1,5165 @@ +groups: + - name: Container Image + description: Image to be used for container + - name: General Settings + description: General Deployment Settings + - name: Workload Settings + description: Workload Settings + - name: App Configuration + description: App Specific Config Options + - name: Networking and Services + description: Configure Network and Services for Container + - name: Storage and Persistence + description: Persist and Share Data that is Separate from the Container + - name: Ingress + description: Ingress Configuration + - name: Security and Permissions + description: Configure Security Context and Permissions + - name: Resources and Devices + description: "Specify Resources/Devices to be Allocated to Workload" + - name: Middlewares + description: Traefik Middlewares + - name: Metrics + description: Metrics + - name: Addons + description: Addon Configuration + - name: Advanced + description: Advanced Configuration + - name: Postgresql + description: Postgresql + - name: Documentation + description: Documentation +portals: + open: + protocols: + - "$kubernetes-resource_configmap_tcportal-open_protocol" + host: + - "$kubernetes-resource_configmap_tcportal-open_host" + ports: + - "$kubernetes-resource_configmap_tcportal-open_port" +questions: + - variable: global + group: General Settings + label: "Global Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: stopAll + label: Stop All + description: "Stops All Running pods and hibernates cnpg" + schema: + type: boolean + default: false + - variable: workload + group: "Workload Settings" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type (Advanced) + schema: + type: string + default: Deployment + enum: + - value: Deployment + description: Deployment + - value: DaemonSet + description: DaemonSet + - variable: replicas + label: Replicas (Advanced) + description: Set the number of Replicas + schema: + type: int + show_if: [["type", "!=", "DaemonSet"]] + default: 1 + - variable: podSpec + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: containers + label: Containers + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Container + schema: + additional_attrs: true + type: dict + attrs: + - variable: envList + label: Extra Environment Variables + description: "Please be aware that some variables are set in the background, adding duplicates here might cause issues or prevent the app from starting..." + schema: + type: list + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + - variable: value + label: Value + schema: + type: string + - variable: extraArgs + label: Extra Args + schema: + type: list + default: [] + items: + - variable: arg + label: Arg + schema: + type: string + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: command + label: Command + schema: + type: list + default: [] + items: + - variable: param + label: Param + schema: + type: string + - variable: authentik + group: App Configuration + label: Authentik Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: credentials + label: Credentials + schema: + additional_attrs: true + type: dict + attrs: + - variable: email + label: Email + description: | + Set the default email address for the akadmin user.
+ Only read on initial install, changing this will have no effect. + schema: + type: string + required: true + immutable: true + default: "" + - variable: password + label: Password + description: | + Set the default password for the akadmin user.
+ Only read on initial install, changing this will have no effect. + schema: + type: string + private: true + required: true + immutable: true + default: "" + - variable: bootstrapToken + label: (Optional) Bootstrap Token + description: | + Set the bootstrap token for the authentik server.
+ Only read on initial install, changing this will have no effect.
+ Only set this token if you plan to use the API right after installation. + schema: + type: string + private: true + immutable: true + default: "" + - variable: general + label: General + schema: + additional_attrs: true + type: dict + attrs: + - variable: disableUpdateCheck + label: Disable Update Check + description: Disable the inbuilt update-checker + schema: + type: boolean + default: false + - variable: disableStartupAnalytics + label: Disable Startup Analytics + description: Disable startup analytics + schema: + type: boolean + default: true + - variable: allowUserChangeName + label: Allow User Change Name + description: Enable the ability for users to change their Name + schema: + type: boolean + default: true + - variable: allowUserChangeEmail + label: Allow User Change Mail + description: Enable the ability for users to change their Email address + schema: + type: boolean + default: true + - variable: allowUserChangeUsername + label: Allow User Change Username + description: Enable the ability for users to change their Usernames + schema: + type: boolean + default: true + - variable: gdprCompliance + label: GDPR Compliance + description: When enabled, all the events caused by a user will be deleted upon the user's deletion + schema: + type: boolean + default: true + - variable: overwriteDefaultBlueprints + label: Overwrite Default Blueprints + description: | + When enabled, all the default blueprints will be overwritten
+ True: mountPath: /blueprints
+ False: mountPath: /blueprints/custom + schema: + type: boolean + default: false + - variable: tokenLength + label: Token Length + description: Configure the length of generated tokens + schema: + type: int + min: 60 + default: 128 + - variable: impersonation + label: Impersonation + description: Globally enable / disable impersonation + schema: + type: boolean + default: true + - variable: avatars + label: Avatars + description: Configure how authentik should show avatars for users + schema: + type: list + default: + - gravatar + - initials + items: + - variable: avatar + label: Avatar + description: Avatar type + schema: + type: string + default: "" + required: true + - variable: footerLinks + label: Footer Links + description: This option configures the footer links on the flow executor pages + schema: + type: list + default: + - name: Authentik + href: https://goauthentik.io + items: + - variable: footerLink + label: Footer Link + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: Name of the link + schema: + type: string + default: "" + required: true + - variable: href + label: Href + description: URL of the link + schema: + type: string + default: "" + required: true + - variable: email + label: Email + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: Mail Server Host + description: Sets host of mail server + schema: + type: string + default: "" + - variable: port + label: Mail Server Port + description: Sets port of mail server + schema: + type: int + default: 587 + - variable: username + label: Username + description: Sets username of mail server + schema: + type: string + default: "" + - variable: password + label: Password + description: Sets password of mail server + schema: + type: string + private: true + default: "" + - variable: useTLS + label: Use TLS for authentication + description: Sets TLS for mail server authentication + schema: + type: boolean + default: true + - variable: useSSL + label: Use SSL for authentication + description: Sets SSL for mail server authentication + schema: + type: boolean + default: false + - variable: timeout + label: Timeout of authentication + description: Sets timeout for mail server authentication + schema: + type: int + default: 10 + - variable: from + label: From Address + description: Email address authentik will send from + schema: + type: string + default: "" + - variable: ldap + label: LDAP + schema: + additional_attrs: true + type: dict + attrs: + - variable: tls_ciphers + label: TLS Ciphers + description: | + Allows configuration of TLS Ciphers for LDAP connections used by LDAP sources.
+ Setting applies to all sources + schema: + type: string + default: "null" + - variable: taskTimeoutHours + label: Task Timeout Hours + description: Timeout in hours for LDAP synchronization tasks + schema: + type: int + default: 2 + - variable: logging + label: Logging + schema: + additional_attrs: true + type: dict + attrs: + - variable: log_level + label: Log Level + description: Log level for the server and worker containers + schema: + type: string + default: info + enum: + - value: trace + description: trace + - value: debug + description: debug + - value: info + description: info + - value: warning + description: warning + - value: error + description: error + - variable: error_reporting + label: Error Reporting + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Reporting + description: Enables error reporting + schema: + type: boolean + default: false + show_subquestions_if: + subquestions: + - variable: sendPII + label: Send Personal Data + description: Whether or not to send personal data, like usernames + schema: + type: boolean + default: false + - variable: environment + label: Environment + description: The environment tag associated with all data sent to Sentry + schema: + type: string + default: customer + - variable: sentryDSN + label: Sentry DSN + description: Sets the DSN for the Sentry API endpoint. + schema: + type: string + private: true + default: "" + - variable: geoip + label: GeoIP + schema: + additional_attrs: true + type: dict + attrs: + - variable: wipeBuiltInDb + label: Wipe Built-In GeoIP DB + description: | + Wipes the built-in GeoIP database.
+ With this set to false, and disabled GeoIP container,
+ It will use the built-in database. + schema: + type: boolean + show_if: [["enabled", "=", false]] + default: false + - variable: enabled + label: Enabled + description: | + Enables and configures the GeoIP container.
+ This will deploy the GeoIP container. + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: editionID + label: Edition ID + description: | + The edition ID of the database to download.
+ Only one seems to be supported by Authentik. + schema: + type: string + default: GeoLite2-City + - variable: frequency + label: Frequency + description: The number of hours between geoipupdate runs. + schema: + type: int + min: 1 + default: 8 + - variable: accountID + label: Account ID + description: Your MaxMind account ID + schema: + type: string + private: true + required: true + default: "" + - variable: licenseKey + label: License Key + description: Your MaxMind license key + schema: + type: string + private: true + required: true + default: "" + - variable: outposts + label: Outposts + schema: + additional_attrs: true + type: dict + attrs: + - variable: proxy + label: Proxy + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + description: | + Enables and configures the Proxy container.
+ This will deploy the Proxy container. + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: token + label: Token + description: | + The token used to authenticate with the authentik server. + schema: + type: string + private: true + required: true + default: "" + - variable: radius + label: Radius + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + description: | + Enables and configures the Radius container.
+ This will deploy the Radius container. + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: token + label: Token + description: | + The token used to authenticate with the authentik server. + schema: + type: string + private: true + required: true + default: "" + - variable: ldap + label: LDAP + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + description: | + Enables and configures the LDAP container.
+ This will deploy the LDAP container. + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: token + label: Token + description: | + The token used to authenticate with the authentik server. + schema: + type: string + private: true + required: true + default: "" + - variable: TZ + label: Timezone + group: "General Settings" + schema: + type: string + default: "Etc/UTC" + $ref: + - "definitions/timezone" + - variable: podOptions + group: "General Settings" + label: "Global Pod Options (Advanced)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: expertPodOpts + label: "Expert - Pod Options" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostNetwork + label: "Host Networking" + schema: + type: boolean + default: false + - variable: dnsConfig + label: "DNS Configuration" + schema: + type: dict + additional_attrs: true + attrs: + - variable: options + label: "Options" + schema: + type: list + default: [{"name": "ndots", "value": "1"}] + items: + - variable: optionsEntry + label: "Option Entry" + schema: + type: dict + additional_attrs: true + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: value + label: "Value" + schema: + type: string + - variable: nameservers + label: "Nameservers" + schema: + type: list + default: [] + items: + - variable: nsEntry + label: "Nameserver Entry" + schema: + type: string + required: true + - variable: searches + label: "Searches" + schema: + type: list + default: [] + items: + - variable: searchEntry + label: "Search Entry" + schema: + type: string + required: true + + - variable: imagePullSecretList + group: "General Settings" + label: "Image Pull Secrets" + schema: + type: list + default: [] + items: + - variable: pullsecretentry + label: "Pull Secret" + schema: + type: dict + additional_attrs: true + attrs: + - variable: registry + label: "Registry" + schema: + type: string + required: true + default: "https://index.docker.io/v1/" + - variable: username + label: "Username" + schema: + type: string + required: true + default: "" + - variable: password + label: "Password" + schema: + type: string + required: true + default: "" + - variable: email + label: "Email" + schema: + type: string + required: true + default: "" + - variable: service + group: Networking and Services + label: Configure Service(s) + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Service + description: The Primary service on which the healthcheck runs, often the webUI + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Service + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 10229 + required: true + - variable: proxy + label: Proxy Service + description: The Proxy service. + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Service + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: http + label: HTTP Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 10227 + required: true + - variable: https + label: HTTPS Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 10228 + required: true + - variable: radius + label: RADIUS Service + description: The RADIUS service. + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Service + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: radius + label: RADIUS Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 1812 + required: true + - variable: ldap + label: LDAP Service + description: The LDAP service. + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Service + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ldap + label: LDAP Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 389 + required: true + - variable: ldaps + label: LDAPS Service + description: The LDAPS service. + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Service + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ldaps + label: LDAPS Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 636 + required: true + - variable: serviceexpert + group: Networking and Services + label: Show Expert Config + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: scaleExternalInterface + description: Add External Interfaces + label: Add external Interfaces + group: Networking + schema: + type: list + items: + - variable: interfaceConfiguration + description: Interface Configuration + label: Interface Configuration + schema: + additional_attrs: true + type: dict + $ref: + - "normalize/interfaceConfiguration" + attrs: + - variable: hostInterface + description: Please Specify Host Interface + label: Host Interface + schema: + type: string + required: true + $ref: + - "definitions/interface" + - variable: ipam + description: Define how IP Address will be managed + label: IP Address Management + schema: + additional_attrs: true + type: dict + required: true + attrs: + - variable: type + description: Specify type for IPAM + label: IPAM Type + schema: + type: string + required: true + enum: + - value: dhcp + description: Use DHCP + - value: static + description: Use Static IP + - variable: staticIPConfigurations + label: Static IP Addresses + schema: + type: list + show_if: [["type", "=", "static"]] + items: + - variable: staticIP + label: Static IP + schema: + type: ipaddr + cidr: true + - variable: staticRoutes + label: Static Routes + schema: + type: list + show_if: [["type", "=", "static"]] + items: + - variable: staticRouteConfiguration + label: Static Route Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: destination + label: Destination + schema: + type: ipaddr + cidr: true + required: true + - variable: gateway + label: Gateway + schema: + type: ipaddr + cidr: false + required: true + - variable: serviceList + label: Add Manual Custom Services + group: Networking and Services + schema: + type: list + default: [] + items: + - variable: serviceListEntry + label: Custom Service + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the service + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Name + schema: + type: string + default: "" + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - value: Simple + description: Deprecated CHANGE THIS + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: advancedsvcset + label: Show Advanced Service Settings + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: externalIPs + label: "External IP's" + description: "External IP's" + schema: + type: list + default: [] + items: + - variable: externalIP + label: External IP + schema: + type: string + - variable: ipFamilyPolicy + label: IP Family Policy + description: Specify the IP Policy + schema: + type: string + default: SingleStack + enum: + - value: SingleStack + description: SingleStack + - value: PreferDualStack + description: PreferDualStack + - value: RequireDualStack + description: RequireDualStack + - variable: ipFamilies + label: IP Families + description: (Advanced) The IP Families that should be used + schema: + type: list + default: [] + items: + - variable: ipFamily + label: IP Family + schema: + type: string + - variable: portsList + label: Additional Service Ports + schema: + type: list + default: [] + items: + - variable: portsListEntry + label: Custom ports + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Port + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Port Name + schema: + type: string + default: "" + - variable: protocol + label: Port Type + schema: + type: string + default: tcp + enum: + - value: http + description: HTTP + - value: https + description: HTTPS + - value: tcp + description: TCP + - value: udp + description: UDP + - variable: targetPort + label: Target Port + description: This port exposes the container port on the service + schema: + type: int + required: true + - variable: port + label: Container Port + schema: + type: int + required: true + - variable: persistence + label: Integrated Persistent Storage + description: Integrated Persistent Storage + group: Storage and Persistence + schema: + additional_attrs: true + type: dict + attrs: + - variable: media + label: App Media Storage + description: Stores the Application Media. + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: templates + label: App Templates Storage + description: Stores the Application Templates. + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: blueprints + label: App Blueprints Storage + description: Stores the Application Blueprints. + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: certs + label: App Certs Storage + description: Stores the Application Certs. + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: geoip + label: App GeoIP Storage + description: Stores the Application GeoIP. + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: persistenceList + label: Additional App Storage + group: Storage and Persistence + schema: + type: list + default: [] + items: + - variable: persistenceListEntry + label: Custom Storage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the storage + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: hostPath + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: mountPath + label: Mount Path + description: Path inside the container the storage is mounted + schema: + type: string + default: "" + required: true + valid_chars: '^\/([a-zA-Z0-9._-]+(\s?[a-zA-Z0-9._-]+|\/?))+$' + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size Quotum of Storage + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: "disabled" + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: ingress + label: "" + group: Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main (HTTPS) Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + + + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: proxy + label: Proxy (HTTPS) Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + + + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: ingressList + label: Add Manual Custom Ingresses + group: Ingress + schema: + type: list + default: [] + items: + - variable: ingressListEntry + label: Custom Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Name + schema: + type: string + default: "" + - variable: ingressClassName + label: IngressClass Name + schema: + type: string + default: "" + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + - variable: service + label: Linked Service + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Service Name + schema: + type: string + default: "" + - variable: port + label: Service Port + schema: + type: int + - variable: tls + label: TLS-Settings + schema: + type: list + default: [] + show_if: [["certificateIssuer", "=", ""]] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your Cert-Manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: scaleCert + label: Use TrueNAS SCALE Certificate (Deprecated) + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: Use Custom Secret (Advanced) + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: middleware + label: Middleware + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: securityContext + group: Security and Permissions + label: Security Context + schema: + additional_attrs: true + type: dict + attrs: + - variable: container + label: Container + schema: + additional_attrs: true + type: dict + attrs: + # Settings from questions.yaml get appended here on a per-app basis + - variable: runAsUser + label: runAsUser + description: The UserID of the user running the application + schema: + type: int + default: 1000 + - variable: runAsGroup + label: runAsGroup + description: The groupID of the user running the application + schema: + type: int + default: 1000 + # Settings from questions.yaml get appended here on a per-app basis + - variable: PUID + label: Process User ID - PUID + description: When supported by the container, this sets the User ID running the Application Process. Not supported by all Apps + schema: + type: int + show_if: [["runAsUser", "=", 0]] + default: 568 + - variable: UMASK + label: UMASK + description: When supported by the container, this sets the UMASK for the App. Not supported by all Apps + schema: + type: string + default: "0022" + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: true + - variable: pod + label: Pod + schema: + additional_attrs: true + type: dict + attrs: + - variable: fsGroupChangePolicy + label: "When should we take ownership?" + schema: + type: string + default: OnRootMismatch + enum: + - value: OnRootMismatch + description: OnRootMismatch + - value: Always + description: Always + - variable: supplementalGroups + label: Supplemental Groups + schema: + type: list + default: [] + items: + - variable: supplementalGroupsEntry + label: Supplemental Group + schema: + type: int + # Settings from questions.yaml get appended here on a per-app basis + - variable: fsGroup + label: fsGroup + description: The group that should own ALL storage. + schema: + type: int + default: 568 + - variable: resources + group: Resources and Devices + label: "Resource Limits" + schema: + additional_attrs: true + type: dict + attrs: + - variable: limits + label: Advanced Limit Resource Consumption + schema: + additional_attrs: true + type: dict + attrs: + - variable: cpu + label: CPU + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 4000m + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: RAM + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 8Gi + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: requests + label: "Minimum Resources Required (request)" + schema: + additional_attrs: true + type: dict + hidden: true + attrs: + - variable: cpu + label: CPU + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 10m + hidden: true + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: "RAM" + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 50Mi + hidden: true + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: deviceList + label: Mount USB Devices + group: Resources and Devices + schema: + type: list + default: [] + items: + - variable: deviceListEntry + label: Device + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Storage + schema: + type: boolean + default: true + - variable: type + label: (Advanced) Type of Storage + description: Sets the persistence type + schema: + type: string + default: device + hidden: true + - variable: readOnly + label: readOnly + schema: + type: boolean + default: false + - variable: hostPath + label: Host Device Path + description: Path to the device on the host system + schema: + type: path + - variable: mountPath + label: Container Device Path + description: Path inside the container the device is mounted + schema: + type: string + default: "/dev/ttyACM0" + - variable: scaleGPU + label: GPU Configuration + group: Resources and Devices + schema: + type: list + default: [] + items: + - variable: scaleGPUEntry + label: GPU + schema: + additional_attrs: true + type: dict + attrs: + # Specify GPU configuration + - variable: gpu + label: Select GPU + schema: + additional_attrs: true + type: dict + $ref: + - "definitions/gpuConfiguration" + attrs: [] + - variable: workaround + label: "Workaround" + schema: + type: string + default: workaround + hidden: true + - variable: cnpg + group: Postgresql + label: "CloudNative-PG (CNPG)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Postgresql Database" + schema: + additional_attrs: true + type: dict + attrs: + - variable: hibernate + label: Hibernate + description: "enable to safely hibernate and shutdown the postgresql cluster" + schema: + type: boolean + default: false + - variable: cluster + label: "Cluster Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: instances + label: Instances + schema: + type: int + default: 1 + - variable: singleNode + label: singleNode + schema: + type: boolean + default: true + hidden: true + - variable: storage + label: "Storage" + schema: + additional_attrs: true + type: dict + attrs: + - variable: size + label: Size + schema: + type: string + default: "256Gi" + - variable: walStorage + label: "WAL Storage" + schema: + additional_attrs: true + type: dict + attrs: + - variable: size + label: Size + schema: + type: string + default: "256Gi" + - variable: monitoring + label: "Monitoring Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enablePodMonitor + label: "enablePodMonitor" + schema: + type: boolean + default: true + - variable: disableDefaultQueries + label: "disableDefaultQueries" + schema: + type: boolean + default: false + - variable: pooler + label: "Pooler Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: instances + label: Instances + schema: + type: int + default: 1 + - variable: createRO + label: "Create ReadOnly Instance" + schema: + type: boolean + default: false + - variable: recovery + label: "Recovery Settings (Experimental)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + - variable: endpointURL + label: "endpointURL" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: method + label: "method" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "object_store" + - variable: backupName + label: "backupName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: provider + label: "provider" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "s3" + - variable: s3 + label: "s3" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "s3"], ["enabled", "=", true]] + attrs: + - variable: region + label: "region" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: accessKey + label: "accessKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: secretKey + label: "secretKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: azure + label: "azure (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "azure"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: connectionString + label: "connectionString" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageAccount + label: "storageAccount" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageKey + label: "storageKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageSasToken + label: "storageSasToken" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: containerName + label: "containerName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: serviceName + label: "serviceName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "blob" + - variable: inheritFromAzureAD + label: "inheritFromAzureAD" + schema: + type: boolean + show_if: [["enabled", "=", true]] + default: false + - variable: google + label: "google (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "google"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: gkeEnvironment + label: "gkeEnvironment" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: applicationCredentials + label: "applicationCredentials" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: backups + label: "Backup Settings (Experimental)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + - variable: endpointURL + label: "endpointURL" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: destinationPath + label: "destinationPath" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: retentionPolicy + label: "retentionPolicy" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "30d" + - variable: provider + label: "provider" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "s3" + - variable: s3 + label: "s3" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "s3"], ["enabled", "=", true]] + attrs: + - variable: region + label: "region" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: accessKey + label: "accessKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: secretKey + label: "secretKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: azure + label: "azure (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "azure"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: connectionString + label: "connectionString" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageAccount + label: "storageAccount" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageKey + label: "storageKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageSasToken + label: "storageSasToken" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: containerName + label: "containerName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: serviceName + label: "serviceName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "blob" + - variable: inheritFromAzureAD + label: "inheritFromAzureAD" + schema: + type: boolean + show_if: [["enabled", "=", true]] + default: false + - variable: google + label: "google (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "google"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: gkeEnvironment + label: "gkeEnvironment" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: applicationCredentials + label: "applicationCredentials" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: scheduledBackups + label: ScheduledBackups + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: backupschedule + label: BackupSchedule + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "daily-backup" + required: true + - variable: schedule + label: schedule + schema: + type: string + required: true + default: "0 0 0 * * *" + - variable: backupOwnerReference + label: backupOwnerReference + schema: + type: string + required: true + default: "self" + - variable: immediate + label: immediate + schema: + type: boolean + default: false + - variable: suspend + label: suspend + schema: + type: boolean + default: false + - variable: manualBackups + label: manualBackups + schema: + type: list + default: [] + items: + - variable: backup + label: Backup + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: metrics + group: Metrics + label: Prometheus Metrics + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Metrics + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + description: Enable Prometheus Metrics + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: prometheusRule + label: PrometheusRule + description: Enable and configure Prometheus Rules for the App. + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + description: Enable Prometheus Metrics + schema: + type: boolean + default: false + # TODO: Rule List section +# - variable: horizontalPodAutoscaler +# group: Advanced +# label: (Advanced) Horizontal Pod Autoscaler +# schema: +# type: list +# default: [] +# items: +# - variable: hpaEntry +# label: HPA Entry +# schema: +# additional_attrs: true +# type: dict +# attrs: +# - variable: name +# label: Name +# schema: +# type: string +# required: true +# default: "" +# - variable: enabled +# label: Enabled +# schema: +# type: boolean +# default: false +# show_subquestions_if: true +# subquestions: +# - variable: target +# label: Target +# description: Deployment name, Defaults to Main Deployment +# schema: +# type: string +# default: "" +# - variable: minReplicas +# label: Minimum Replicas +# schema: +# type: int +# default: 1 +# - variable: maxReplicas +# label: Maximum Replicas +# schema: +# type: int +# default: 5 +# - variable: targetCPUUtilizationPercentage +# label: Target CPU Utilization Percentage +# schema: +# type: int +# default: 80 +# - variable: targetMemoryUtilizationPercentage +# label: Target Memory Utilization Percentage +# schema: +# type: int +# default: 80 + - variable: networkPolicy + group: Advanced + label: (Advanced) Network Policy + schema: + type: list + default: [] + items: + - variable: netPolicyEntry + label: Network Policy Entry + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + default: "" + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: policyType + label: Policy Type + schema: + type: string + default: "" + enum: + - value: "" + description: Default + - value: ingress + description: Ingress + - value: egress + description: Egress + - value: ingress-egress + description: Ingress and Egress + - variable: egress + label: Egress + schema: + type: list + default: [] + items: + - variable: egressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: to + label: To + schema: + type: list + default: [] + items: + - variable: toEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: IP Block + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: CIDR + schema: + type: string + default: "" + - variable: except + label: Except + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: string + - variable: namespaceSelector + label: Namespace Selector + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: Ports + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + - variable: endPort + label: End Port + schema: + type: int + - variable: protocol + label: Protocol + schema: + type: string + default: TCP + enum: + - value: TCP + description: TCP + - value: UDP + description: UDP + - value: SCTP + description: SCTP + - variable: ingress + label: Ingress + schema: + type: list + default: [] + items: + - variable: ingressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: from + label: From + schema: + type: list + default: [] + items: + - variable: fromEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: IP Block + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: CIDR + schema: + type: string + default: "" + - variable: except + label: Except + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: string + - variable: namespaceSelector + label: Namespace Selector + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: Ports + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + - variable: endPort + label: End Port + schema: + type: int + - variable: protocol + label: Protocol + schema: + type: string + default: TCP + enum: + - value: TCP + description: TCP + - value: UDP + description: UDP + - value: SCTP + description: SCTP + - variable: addons + group: Addons + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: Codeserver + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: service + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: NodePort + description: Deprecated CHANGE THIS + - value: ClusterIP + description: ClusterIP + - value: LoadBalancer + description: LoadBalancer + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + default: 36107 + - variable: ingress + label: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + - variable: certificateIssuer + label: Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates. Cannot be used combined with tls option below' + schema: + type: string + default: "" + - variable: middlewares + label: Traefik Middlewares + description: Add previously created Traefik Middlewares to this Ingress + schema: + type: list + default: [] + items: + - variable: name + label: Name + schema: + type: string + default: "" + required: true + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: entrypoint + label: (Advanced) Traefik Entrypoint + description: Entrypoint used by Traefik when using Traefik as Ingress Provider + schema: + type: string + default: websecure + show_if: [["advanced", "=", true]] + required: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + show_if: [["advanced", "=", true]] + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: envList + label: Codeserver Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + - variable: netshoot + label: Netshoot + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: envList + label: Netshoot Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + - variable: vpn + label: VPN + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type + schema: + type: string + default: disabled + enum: + - value: disabled + description: disabled + - value: gluetun + description: Gluetun + - value: tailscale + description: Tailscale + - value: openvpn + description: OpenVPN (Deprecated) + - value: wireguard + description: Wireguard (Deprecated) + - variable: openvpn + label: OpenVPN Settings + schema: + additional_attrs: true + type: dict + show_if: [["type", "=", "openvpn"]] + attrs: + - variable: username + label: Authentication Username (Optional) + description: Authentication Username, Optional + schema: + type: string + default: "" + - variable: password + label: Authentication Password + description: Authentication Credentials + schema: + type: string + show_if: [["username", "!=", ""]] + default: "" + required: true + - variable: tailscale + label: Tailscale Settings + schema: + additional_attrs: true + type: dict + show_if: [["type", "=", "tailscale"]] + attrs: + - variable: authkey + label: Authentication Key + description: Provide an auth key to automatically authenticate the node as your user account. + schema: + type: string + private: true + default: "" + - variable: auth_once + label: Auth Once + description: Only attempt to log in if not already logged in. + schema: + type: boolean + default: true + - variable: accept_dns + label: Accept DNS + description: Accept DNS configuration from the admin console. + schema: + type: boolean + default: false + - variable: userspace + label: Userspace + description: Userspace Networking mode allows running Tailscale where you do not have access to create a VPN tunnel device. + schema: + type: boolean + default: false + - variable: routes + label: Routes + description: Expose physical subnet routes to your entire Tailscale network. + schema: + type: string + default: "" + - variable: dest_ip + label: Destination IP + description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched. + schema: + type: string + default: "" + - variable: sock5_server + label: Sock5 Server + description: The address on which to listen for SOCKS5 proxying into the tailscale net. + schema: + type: string + default: "" + - variable: outbound_http_proxy_listen + label: Outbound HTTP Proxy Listen + description: The address on which to listen for HTTP proxying into the tailscale net. + schema: + type: string + default: "" + - variable: extra_args + label: Extra Args + description: Extra Args + schema: + type: string + default: "" + - variable: daemon_extra_args + label: Tailscale Daemon Extra Args + description: Tailscale Daemon Extra Args + schema: + type: string + default: "" + - variable: killSwitch + label: Enable Killswitch + schema: + type: boolean + show_if: [["type", "!=", "disabled"]] + default: true + - variable: excludedNetworks_IPv4 + label: Killswitch Excluded IPv4 networks + description: List of Killswitch Excluded IPv4 Addresses + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv4 + label: IPv4 Network + schema: + type: string + required: true + - variable: excludedNetworks_IPv6 + label: Killswitch Excluded IPv6 networks + description: "List of Killswitch Excluded IPv6 Addresses" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv6 + label: IPv6 Network + schema: + type: string + required: true + - variable: configFile + label: VPN Config File Location + schema: + type: string + show_if: [["type", "!=", "disabled"]] + default: "" + + - variable: envList + label: VPN Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + max_length: 10240 + - variable: docs + group: Documentation + label: Please read the documentation at https://truecharts.org + description: Please read the documentation at +
https://truecharts.org + schema: + additional_attrs: true + type: dict + attrs: + - variable: confirmDocs + label: I have checked the documentation + schema: + type: boolean + default: true + - variable: donateNag + group: Documentation + label: Please consider supporting TrueCharts, see https://truecharts.org/sponsor + description: Please consider supporting TrueCharts, see +
https://truecharts.org/sponsor + schema: + additional_attrs: true + type: dict + attrs: + - variable: confirmDonate + label: I have considered donating + schema: + type: boolean + default: true + hidden: true diff --git a/stable/authentik/17.0.4/templates/NOTES.txt b/stable/authentik/17.0.4/templates/NOTES.txt new file mode 100644 index 0000000000..efcb74cb77 --- /dev/null +++ b/stable/authentik/17.0.4/templates/NOTES.txt @@ -0,0 +1 @@ +{{- include "tc.v1.common.lib.chart.notes" $ -}} diff --git a/stable/authentik/17.0.4/templates/_config.tpl b/stable/authentik/17.0.4/templates/_config.tpl new file mode 100644 index 0000000000..c46407c309 --- /dev/null +++ b/stable/authentik/17.0.4/templates/_config.tpl @@ -0,0 +1,128 @@ +{{/* Define the configmaps */}} +{{- define "authentik.configmaps" -}} + + {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} + {{- $serverHost := printf "https://%v:%v" $fullname .Values.service.main.ports.main.port -}} + {{- $host := .Values.chartContext.appUrl }} +server: + enabled: true + data: + AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.main.ports.main.port | quote }} + AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.http.ports.http.port | quote }} + AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.servermetrics.ports.servermetrics.port | quote }} + +server-worker: + enabled: true + data: + {{/* Dependencies */}} + AUTHENTIK_POSTGRESQL__NAME: {{ .Values.cnpg.main.database }} + AUTHENTIK_POSTGRESQL__USER: {{ .Values.cnpg.main.user }} + AUTHENTIK_POSTGRESQL__HOST: {{ .Values.cnpg.main.creds.host }} + AUTHENTIK_POSTGRESQL__PORT: "5432" + AUTHENTIK_REDIS__HOST: {{ .Values.redis.creds.plain }} + AUTHENTIK_REDIS__PORT: "6379" + + {{/* Outposts */}} + AUTHENTIK_OUTPOSTS__DISCOVER: "false" + + {{/* GeoIP */}} + {{- $geoipPath := (printf "/geoip/%v.mmdb" .Values.authentik.geoip.editionID) -}} + {{- if not .Values.authentik.geoip.enabled -}} + {{- $geoipPath = "/tmp/non-existent-file" -}} + {{- end -}} + + {{- if or .Values.authentik.geoip.enabled .Values.authentik.geoip.wipeBuiltInDb }} + AUTHENTIK_GEOIP: {{ $geoipPath }} + {{- end }} + + {{/* Mail */}} + AUTHENTIK_EMAIL__USE_TLS: {{ .Values.authentik.email.useTLS | quote }} + AUTHENTIK_EMAIL__USE_SSL: {{ .Values.authentik.email.useSSL | quote }} + {{- with .Values.authentik.email.port }} + AUTHENTIK_EMAIL__PORT: {{ . | quote }} + {{- end -}} + {{- with .Values.authentik.email.timeout }} + AUTHENTIK_EMAIL__TIMEOUT: {{ . | quote }} + {{- end }} + + {{/* LDAP */}} + AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS: {{ .Values.authentik.ldap.taskTimeoutHours | quote }} + AUTHENTIK_LDAP__TLS__CIPHERS: {{ .Values.authentik.ldap.tlsCiphers | quote }} + + {{/* Logging */}} + AUTHENTIK_LOG_LEVEL: {{ .Values.authentik.logging.logLevel }} + + {{/* Error Reporting */}} + AUTHENTIK_ERROR_REPORTING__ENABLED: {{ .Values.authentik.errorReporting.enabled | quote }} + AUTHENTIK_ERROR_REPORTING__SEND_PII: {{ .Values.authentik.errorReporting.sendPII | quote }} + {{- with .Values.authentik.errorReporting.environment }} + AUTHENTIK_ERROR_REPORTING__ENVIRONMENT: {{ . | quote }} + {{- end -}} + {{- with .Values.authentik.errorReporting.sentryDSN }} + AUTHENTIK_ERROR_REPORTING__SENTRY_DSN: {{ . | quote }} + {{- end -}} + {{- with .Values.authentik.general.avatars }} + AUTHENTIK_AVATARS: {{ join "," . }} + {{- end -}} + {{- with .Values.authentik.general.footerLinks }} + AUTHENTIK_FOOTER_LINKS: {{ toJson . | squote }} + {{- end }} + + {{/* General */}} + AUTHENTIK_DISABLE_UPDATE_CHECK: {{ .Values.authentik.general.disableUpdateCheck | quote }} + AUTHENTIK_DISABLE_STARTUP_ANALYTICS: {{ .Values.authentik.general.disableStartupAnalytics | quote }} + AUTHENTIK_DEFAULT_USER_CHANGE_NAME: {{ .Values.authentik.general.allowUserChangeName | quote }} + AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL: {{ .Values.authentik.general.allowUserChangeEmail | quote }} + AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: {{ .Values.authentik.general.allowUserChangeUsername | quote }} + AUTHENTIK_GDPR_COMPLIANCE: {{ .Values.authentik.general.gdprCompliance | quote }} + AUTHENTIK_DEFAULT_TOKEN_LENGTH: {{ .Values.authentik.general.tokenLength | quote }} + AUTHENTIK_IMPERSONATION: {{ .Values.authentik.general.impersonation | quote }} + +{{- if .Values.authentik.outposts.proxy.enabled }} +proxy: + enabled: true + data: + AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.http.port | quote }} + AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.https.port | quote }} + AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.proxymetrics.ports.proxymetrics.port | quote }} + AUTHENTIK_HOST: {{ $serverHost }} + AUTHENTIK_INSECURE: "true" + # TODO: node ip or ingress host + AUTHENTIK_HOST_BROWSER: {{ $host }} +{{- end -}} + +{{- if .Values.authentik.outposts.radius.enabled }} +radius: + enabled: true + data: + AUTHENTIK_LISTEN__RADIUS: {{ printf "0.0.0.0:%v" .Values.service.radius.ports.radius.port | quote }} + AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.radiusmetrics.ports.radiusmetrics.port | quote }} + AUTHENTIK_HOST: {{ $serverHost }} + AUTHENTIK_INSECURE: "true" + # TODO: node ip or ingress host + AUTHENTIK_HOST_BROWSER: {{ $host }} +{{- end -}} + +{{- if .Values.authentik.outposts.ldap.enabled }} +ldap: + enabled: true + data: + AUTHENTIK_LISTEN__LDAP: {{ printf "0.0.0.0:%v" .Values.service.ldap.ports.ldap.port | quote }} + AUTHENTIK_LISTEN__LDAPS: {{ printf "0.0.0.0:%v" .Values.service.ldaps.ports.ldaps.port | quote }} + AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.ldapmetrics.ports.ldapmetrics.port | quote }} + AUTHENTIK_HOST: {{ $serverHost }} + AUTHENTIK_INSECURE: "true" + # TODO: node ip or ingress host + AUTHENTIK_HOST_BROWSER: {{ $host }} +{{- end -}} + +{{- if .Values.authentik.geoip.enabled }} +geoip: + enabled: true + data: + GEOIPUPDATE_EDITION_IDS: {{ .Values.authentik.geoip.editionID }} + GEOIPUPDATE_FREQUENCY: {{ .Values.authentik.geoip.frequency | quote }} + GEOIPUPDATE_DB_DIR: {{ .Values.persistence.geoip.targetSelector.geoip.geoip.mountPath | quote }} +{{- end -}} + +{{- end -}} diff --git a/stable/authentik/17.0.4/templates/_secret.tpl b/stable/authentik/17.0.4/templates/_secret.tpl new file mode 100644 index 0000000000..faf26d54e1 --- /dev/null +++ b/stable/authentik/17.0.4/templates/_secret.tpl @@ -0,0 +1,74 @@ +{{/* Define the secrets */}} +{{- define "authentik.secrets" -}} + + {{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}} + {{- $fetchname := printf "%v-server-worker" $fullname -}} + + {{- $secretKey := randAlphaNum 32 -}} + {{- with (lookup "v1" "Secret" .Release.Namespace $fetchname) -}} + {{- $secretKey = index .data "AUTHENTIK_SECRET_KEY" | b64dec -}} + {{- end }} + +server-worker: + enabled: true + data: + {{/* Dependencies */}} + AUTHENTIK_POSTGRESQL__PASSWORD: {{ .Values.cnpg.main.creds.password | trimAll "\"" }} + AUTHENTIK_REDIS__PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }} + + {{/* Secret Key */}} + AUTHENTIK_SECRET_KEY: {{ $secretKey }} + + {{/* Initial credentials */}} + AUTHENTIK_BOOTSTRAP_EMAIL: {{ .Values.authentik.credentials.email | quote }} + AUTHENTIK_BOOTSTRAP_PASSWORD: {{ .Values.authentik.credentials.password | quote }} + {{- with .Values.authentik.credentials.bootstrapToken }} + AUTHENTIK_BOOTSTRAP_TOKEN: {{ . }} + {{- end }} + + {{/* Mail */}} + {{- with .Values.authentik.email.host }} + AUTHENTIK_EMAIL__HOST: {{ . }} + {{- end -}} + {{- with .Values.authentik.email.username }} + AUTHENTIK_EMAIL__USERNAME: {{ . }} + {{- end -}} + {{- with .Values.authentik.email.password }} + AUTHENTIK_EMAIL__PASSWORD: {{ . }} + {{- end -}} + {{- with .Values.authentik.email.from }} + AUTHENTIK_EMAIL__FROM: {{ . }} + {{- end -}} + +{{- if .Values.authentik.geoip.enabled }} +geoip: + enabled: true + data: + GEOIPUPDATE_VERBOSE: "0" + GEOIPUPDATE_PRESERVE_FILE_TIMES: "1" + GEOIPUPDATE_ACCOUNT_ID: {{ .Values.authentik.geoip.accountID | quote }} + GEOIPUPDATE_LICENSE_KEY: {{ .Values.authentik.geoip.licenseKey | quote }} +{{- end -}} + +{{- if .Values.authentik.outposts.proxy.enabled }} +proxy: + enabled: true + data: + AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.proxy.token | quote }} +{{- end -}} + +{{- if .Values.authentik.outposts.radius.enabled }} +radius: + enabled: true + data: + AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.radius.token | quote }} +{{- end -}} + +{{- if .Values.authentik.outposts.ldap.enabled }} +ldap: + enabled: true + data: + AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.ldap.token | quote }} +{{- end -}} + +{{- end -}} diff --git a/stable/authentik/17.0.4/templates/_validation.tpl b/stable/authentik/17.0.4/templates/_validation.tpl new file mode 100644 index 0000000000..5a1b5f029b --- /dev/null +++ b/stable/authentik/17.0.4/templates/_validation.tpl @@ -0,0 +1,23 @@ +{{- define "authentik.validation" -}} + {{- range $outpost, $values := .Values.authentik.outposts -}} + {{- if (kindIs "dict" $values) -}} + {{- if and $values.enabled (not $values.token) -}} + {{- fail (printf "Authentik - Outpost [%v] is enabled, but [token] was not provided" ($outpost | upper)) -}} + {{- end -}} + {{- end -}} + {{- end -}} + + {{- if .Values.authentik.geoip.enabled -}} + {{- if not .Values.authentik.geoip.accountID -}} + {{- fail "Authentik - GeoIP is enabled but [accountID] was not provided" -}} + {{- end -}} + + {{- if not .Values.authentik.geoip.licenseKey -}} + {{- fail "Authentik - GeoIP is enabled but [licenseKey] was not provided" -}} + {{- end -}} + + {{- if contains " " .Values.authentik.geoip.editionID -}} + {{- fail "Authentik - GeoIP is enabled but [editionID] cannot contain spaces" -}} + {{- end -}} + {{- end -}} +{{- end -}} diff --git a/stable/authentik/17.0.4/templates/_waitAuthentik.tpl b/stable/authentik/17.0.4/templates/_waitAuthentik.tpl new file mode 100644 index 0000000000..b2421746ce --- /dev/null +++ b/stable/authentik/17.0.4/templates/_waitAuthentik.tpl @@ -0,0 +1,20 @@ +{{- define "authentik.wait.server" -}} +{{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $) -}} +{{- $serverUrl := printf "https://%v:%v/-/health/ready/" $fullname .Values.service.main.ports.main.port }} +enabled: true +type: init +imageSelector: alpineImage +command: /bin/sh +args: + - -c + - | + echo "Waiting Authentik Server [{{ $serverUrl }}] to be ready..." + until wget --no-check-certificate --spider --quiet "{{ $serverUrl }}"; + do + echo "Waiting Authentik Server [{{ $serverUrl }}] to be ready..." + sleep 3 + done + + echo "Authentik [{{ $serverUrl }}] is ready..." + echo "Starting Outpost..." +{{- end -}} diff --git a/stable/authentik/17.0.4/templates/common.yaml b/stable/authentik/17.0.4/templates/common.yaml new file mode 100644 index 0000000000..f60f125473 --- /dev/null +++ b/stable/authentik/17.0.4/templates/common.yaml @@ -0,0 +1,97 @@ +{{/* Make sure all variables are set properly */}} +{{- include "tc.v1.common.loader.init" . }} + +{{- include "authentik.validation" $ -}} + +{{/* Render secrets for authentik and friends */}} +{{- $secrets := include "authentik.secrets" . | fromYaml -}} +{{- if $secrets -}} + {{ $secrets := (mustMergeOverwrite .Values.secret $secrets) }} + {{- $_ := set .Values "secret" $secrets -}} +{{- end -}} + +{{/* Render configmaps for authentik and friends */}} +{{- $configmaps := include "authentik.configmaps" . | fromYaml -}} +{{- if $configmaps -}} + {{ $configmaps := (mustMergeOverwrite .Values.configmap $configmaps) }} + {{- $_ := set .Values "configmap" $configmaps -}} +{{- end -}} + +{{- if .Values.authentik.general.overwriteDefaultBlueprints -}} + {{- $_ := set .Values.persistence.blueprints.targetSelector.worker.worker "mountPath" "/blueprints" -}} +{{- end -}} + +{{- if .Values.authentik.geoip.enabled -}} + {{- $_ := set .Values.workload.geoip "enabled" true -}} +{{- else -}} + {{- $_ := set .Values.workload.geoip "enabled" false -}} + {{- $_ := set .Values.persistence.geoip "enabled" false -}} +{{- end -}} + +{{- if or .Values.authentik.geoip.enabled .Values.authentik.geoip.wipeBuiltInDb -}} + {{- $_ := set .Values.persistence.geoip "enabled" true -}} +{{- end -}} + +{{- if .Values.authentik.outposts.proxy.enabled -}} + {{- $_ := set .Values.workload.proxy "enabled" true -}} + {{- if not .Values.workload.proxy.podSpec.initContainers -}} + {{- $_ := set .Values.workload.proxy.podSpec "initContainers" dict -}} + {{- end -}} + {{- $_ := set .Values.workload.proxy.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}} + {{- $_ := set .Values.service.proxy "enabled" true -}} + {{- $_ := set .Values.service.proxymetrics "enabled" true -}} + {{- $_ := set .Values.metrics.proxymetrics "enabled" true -}} +{{- else -}} + {{- $_ := set .Values.workload.proxy "enabled" false -}} + {{- $_ := set .Values.service.proxy "enabled" false -}} + {{- $_ := set .Values.service.proxymetrics "enabled" false -}} + {{- $_ := set .Values.metrics.proxymetrics "enabled" false -}} +{{- end -}} + +{{- if .Values.authentik.outposts.radius.enabled -}} + {{- $_ := set .Values.workload.radius "enabled" true -}} + {{- if not .Values.workload.radius.podSpec.initContainers -}} + {{- $_ := set .Values.workload.radius.podSpec "initContainers" dict -}} + {{- end -}} + {{- $_ := set .Values.workload.radius.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}} + {{- $_ := set .Values.service.radius "enabled" true -}} + {{- $_ := set .Values.service.radiusmetrics "enabled" true -}} + {{- $_ := set .Values.metrics.radiusmetrics "enabled" true -}} +{{- else -}} + {{- $_ := set .Values.workload.radius "enabled" false -}} + {{- $_ := set .Values.service.radius "enabled" false -}} + {{- $_ := set .Values.service.radiusmetrics "enabled" false -}} + {{- $_ := set .Values.metrics.radiusmetrics "enabled" false -}} +{{- end -}} + +{{- if .Values.authentik.outposts.ldap.enabled -}} + {{- $_ := set .Values.workload.ldap "enabled" true -}} + {{- if not .Values.workload.ldap.podSpec.initContainers -}} + {{- $_ := set .Values.workload.ldap.podSpec "initContainers" dict -}} + {{- end -}} + {{- $_ := set .Values.workload.ldap.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}} + {{- $_ := set .Values.service.ldap "enabled" true -}} + {{- $_ := set .Values.service.ldaps "enabled" true -}} + {{- $_ := set .Values.service.ldapmetrics "enabled" true -}} + {{- $_ := set .Values.metrics.ldapmetrics "enabled" true -}} +{{- else -}} + {{- $_ := set .Values.workload.ldap "enabled" false -}} + {{- $_ := set .Values.service.ldap "enabled" false -}} + {{- $_ := set .Values.service.ldaps "enabled" false -}} + {{- $_ := set .Values.service.ldapmetrics "enabled" false -}} + {{- $_ := set .Values.metrics.ldapmetrics "enabled" false -}} +{{- end -}} + +{{/* FIXME: See values.yaml */}} +{{- $_ := set .Values.service.servermetrics "enabled" false -}} +{{- $_ := set .Values.service.proxymetrics "enabled" false -}} +{{- $_ := set .Values.service.radiusmetrics "enabled" false -}} +{{- $_ := set .Values.service.ldapmetrics "enabled" false -}} + +{{- $_ := set .Values.metrics.servermetrics "enabled" false -}} +{{- $_ := set .Values.metrics.proxymetrics "enabled" false -}} +{{- $_ := set .Values.metrics.radiusmetrics "enabled" false -}} +{{- $_ := set .Values.metrics.ldapmetrics "enabled" false -}} + +{{/* Render the templates */}} +{{ include "tc.v1.common.loader.apply" . }} diff --git a/stable/authentik/17.0.4/values.yaml b/stable/authentik/17.0.4/values.yaml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/stable/nextcloud/25.0.6/CHANGELOG.md b/stable/nextcloud/25.0.6/CHANGELOG.md new file mode 100644 index 0000000000..add12b037d --- /dev/null +++ b/stable/nextcloud/25.0.6/CHANGELOG.md @@ -0,0 +1,99 @@ +**Important:** +*for the complete changelog, please refer to the website* + + + + +## [nextcloud-25.0.6](https://github.com/truecharts/charts/compare/nextcloud-25.0.5...nextcloud-25.0.6) (2023-12-21) + +### Chore + +- require ingress for certain charts + + + + +## [nextcloud-25.0.5](https://github.com/truecharts/charts/compare/nextcloud-25.0.4...nextcloud-25.0.5) (2023-12-21) + +### Chore + +- bump nextcloud + + ### Fix + +- nextcloud collabora service in ingress being wrong + + + + +## [nextcloud-25.0.4](https://github.com/truecharts/charts/compare/nextcloud-25.0.3...nextcloud-25.0.4) (2023-12-21) + +### Chore + +- bump everything to ensure patches are applied globally + + ### Fix + +- ensure the cnpg GUI is included on CNPG apps + + + + +## [nextcloud-25.0.3](https://github.com/truecharts/charts/compare/nextcloud-25.0.2...nextcloud-25.0.3) (2023-12-21) + +### Chore + +- update helm general non-major by renovate ([#16341](https://github.com/truecharts/charts/issues/16341)) + + + + +## [nextcloud-25.0.2](https://github.com/truecharts/charts/compare/nextcloud-25.0.1...nextcloud-25.0.2) (2023-12-21) + +### Fix + +- correctly reference collabora's interfacemode ([#16327](https://github.com/truecharts/charts/issues/16327)) + + + + +## [nextcloud-25.0.1](https://github.com/truecharts/charts/compare/nextcloud-25.0.0...nextcloud-25.0.1) (2023-12-20) + +### Chore + +- bump patch versions on all charts for new GUI release + + + + +## [nextcloud-25.0.0](https://github.com/truecharts/charts/compare/nextcloud-24.0.0...nextcloud-25.0.0) (2023-12-20) + +### Chore + +- update helm general major by renovate (major) ([#14631](https://github.com/truecharts/charts/issues/14631)) + + + + +## [nextcloud-24.0.0](https://github.com/truecharts/charts/compare/nextcloud-23.0.2...nextcloud-24.0.0) (2023-12-20) + + + + +## [nextcloud-23.0.2](https://github.com/truecharts/charts/compare/nextcloud-23.0.1...nextcloud-23.0.2) (2023-12-20) + +### Chore + +- Bump everything to force min/max scale version update + + + + +## [nextcloud-23.0.1](https://github.com/truecharts/charts/compare/nextcloud-23.0.0...nextcloud-23.0.1) (2023-12-18) + +### Fix + +- add nginx changes for nc 28 ([#16306](https://github.com/truecharts/charts/issues/16306)) + + + diff --git a/stable/nextcloud/25.0.6/Chart.yaml b/stable/nextcloud/25.0.6/Chart.yaml new file mode 100644 index 0000000000..7d7aad7b77 --- /dev/null +++ b/stable/nextcloud/25.0.6/Chart.yaml @@ -0,0 +1,48 @@ +kubeVersion: ">=1.24.0-0" +apiVersion: v2 +name: nextcloud +version: 25.0.6 +appVersion: 28.0.0 +description: A private cloud server that puts the control and security of your own data back into your hands. +home: https://truecharts.org/charts/stable/nextcloud +icon: https://truecharts.org/img/hotlink-ok/chart-icons/nextcloud.png +deprecated: false +sources: + - https://github.com/nextcloud/helm + - https://github.com/nextcloud/docker + - https://github.com/truecharts/charts/tree/master/charts/stable/nextcloud + - https://hub.docker.com/r/collabora/code +maintainers: + - name: TrueCharts + email: info@truecharts.org + url: https://truecharts.org +keywords: + - nextcloud + - storage + - http + - web + - php +dependencies: + - name: common + version: 16.2.9 + repository: https://library-charts.truecharts.org + condition: "" + alias: "" + tags: [] + import-values: [] + - name: redis + version: 10.0.4 + repository: https://deps.truecharts.org + condition: redis.enabled + alias: "" + tags: [] + import-values: [] +annotations: + max_scale_version: 23.10.2 + min_scale_version: 23.10.0 + truecharts.org/SCALE-support: "true" + truecharts.org/category: cloud + truecharts.org/max_helm_version: "3.13" + truecharts.org/min_helm_version: "3.12" + truecharts.org/train: stable +type: application diff --git a/stable/nextcloud/25.0.6/LICENSE b/stable/nextcloud/25.0.6/LICENSE new file mode 100644 index 0000000000..33a8cbb23f --- /dev/null +++ b/stable/nextcloud/25.0.6/LICENSE @@ -0,0 +1,106 @@ +Business Source License 1.1 + +Parameters + +Licensor: The TrueCharts Project, it's owner and it's contributors +Licensed Work: The TrueCharts "Blocky" Helm Chart +Additional Use Grant: You may use the licensed work in production, as long + as it is directly sourced from a TrueCharts provided + official repository, catalog or source. You may also make private + modification to the directly sourced licenced work, + when used in production. + + The following cases are, due to their nature, also + defined as 'production use' and explicitly prohibited: + - Bundling, including or displaying the licensed work + with(in) another work intended for production use, + with the apparent intend of facilitating and/or + promoting production use by third parties in + violation of this license. + +Change Date: 2050-01-01 + +Change License: 3-clause BSD license + +For information about alternative licensing arrangements for the Software, +please contact: legal@truecharts.org + +Notice + +The Business Source License (this document, or the “License”) is not an Open +Source license. However, the Licensed Work will eventually be made available +under an Open Source License, as stated in this License. + +License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved. +“Business Source License” is a trademark of MariaDB Corporation Ab. + +----------------------------------------------------------------------------- + +Business Source License 1.1 + +Terms + +The Licensor hereby grants you the right to copy, modify, create derivative +works, redistribute, and make non-production use of the Licensed Work. The +Licensor may make an Additional Use Grant, above, permitting limited +production use. + +Effective on the Change Date, or the fourth anniversary of the first publicly +available distribution of a specific version of the Licensed Work under this +License, whichever comes first, the Licensor hereby grants you rights under +the terms of the Change License, and the rights granted in the paragraph +above terminate. + +If your use of the Licensed Work does not comply with the requirements +currently in effect as described in this License, you must purchase a +commercial license from the Licensor, its affiliated entities, or authorized +resellers, or you must refrain from using the Licensed Work. + +All copies of the original and modified Licensed Work, and derivative works +of the Licensed Work, are subject to this License. This License applies +separately for each version of the Licensed Work and the Change Date may vary +for each version of the Licensed Work released by Licensor. + +You must conspicuously display this License on each original or modified copy +of the Licensed Work. If you receive the Licensed Work in original or +modified form from a third party, the terms and conditions set forth in this +License apply to your use of that work. + +Any use of the Licensed Work in violation of this License will automatically +terminate your rights under this License for the current and all other +versions of the Licensed Work. + +This License does not grant you any right in any trademark or logo of +Licensor or its affiliates (provided that you may use a trademark or logo of +Licensor as expressly required by this License). + +TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON +AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, +EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND +TITLE. + +MariaDB hereby grants you permission to use this License’s text to license +your works, and to refer to it using the trademark “Business Source License”, +as long as you comply with the Covenants of Licensor below. + +Covenants of Licensor + +In consideration of the right to use this License’s text and the “Business +Source License” name and trademark, Licensor covenants to MariaDB, and to all +other recipients of the licensed work to be provided by Licensor: + +1. To specify as the Change License the GPL Version 2.0 or any later version, + or a license that is compatible with GPL Version 2.0 or a later version, + where “compatible” means that software provided under the Change License can + be included in a program with software provided under GPL Version 2.0 or a + later version. Licensor may specify additional Change Licenses without + limitation. + +2. To either: (a) specify an additional grant of rights to use that does not + impose any additional restriction on the right granted in this License, as + the Additional Use Grant; or (b) insert the text “None”. + +3. To specify a Change Date. + +4. Not to modify this License in any other way. diff --git a/stable/nextcloud/25.0.6/README.md b/stable/nextcloud/25.0.6/README.md new file mode 100644 index 0000000000..d551b5d959 --- /dev/null +++ b/stable/nextcloud/25.0.6/README.md @@ -0,0 +1,27 @@ +# README + +## General Info + +TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE. +However only installations using the TrueNAS SCALE Apps system are supported. + +For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/nextcloud) + +**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)** + + +## Support + +- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro). +- See the [Website](https://truecharts.org) +- Check our [Discord](https://discord.gg/tVsPTHWTtr) +- Open a [issue](https://github.com/truecharts/charts/issues/new/choose) + +--- + +## Sponsor TrueCharts + +TrueCharts can only exist due to the incredible effort of our staff. +Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! + +*All Rights Reserved - The TrueCharts Project* diff --git a/stable/nextcloud/25.0.6/app-changelog.md b/stable/nextcloud/25.0.6/app-changelog.md new file mode 100644 index 0000000000..921f387694 --- /dev/null +++ b/stable/nextcloud/25.0.6/app-changelog.md @@ -0,0 +1,9 @@ + + +## [nextcloud-25.0.6](https://github.com/truecharts/charts/compare/nextcloud-25.0.5...nextcloud-25.0.6) (2023-12-21) + +### Chore + +- require ingress for certain charts + + \ No newline at end of file diff --git a/stable/nextcloud/25.0.6/app-readme.md b/stable/nextcloud/25.0.6/app-readme.md new file mode 100644 index 0000000000..1369f69bf5 --- /dev/null +++ b/stable/nextcloud/25.0.6/app-readme.md @@ -0,0 +1,8 @@ +A private cloud server that puts the control and security of your own data back into your hands. + +This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/stable/nextcloud](https://truecharts.org/charts/stable/nextcloud) + +--- + +TrueCharts can only exist due to the incredible effort of our staff. +Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can! diff --git a/stable/nextcloud/25.0.6/charts/common-16.2.9.tgz b/stable/nextcloud/25.0.6/charts/common-16.2.9.tgz new file mode 100644 index 0000000000..c1db66f452 Binary files /dev/null and b/stable/nextcloud/25.0.6/charts/common-16.2.9.tgz differ diff --git a/stable/nextcloud/25.0.6/charts/redis-10.0.4.tgz b/stable/nextcloud/25.0.6/charts/redis-10.0.4.tgz new file mode 100644 index 0000000000..09d05b543f Binary files /dev/null and b/stable/nextcloud/25.0.6/charts/redis-10.0.4.tgz differ diff --git a/stable/nextcloud/25.0.6/ix_values.yaml b/stable/nextcloud/25.0.6/ix_values.yaml new file mode 100644 index 0000000000..2150ea9265 --- /dev/null +++ b/stable/nextcloud/25.0.6/ix_values.yaml @@ -0,0 +1,516 @@ +image: + repository: tccr.io/truecharts/nextcloud-fpm + pullPolicy: IfNotPresent + tag: v28.0.0@sha256:a765a49bafef4e3e6c1f874c5ee1c4d2ce39b2bd6793b9a2e044ed75645bbc1a +nginxImage: + repository: nginxinc/nginx-unprivileged + pullPolicy: IfNotPresent + tag: 1.25.3@sha256:1d026ae92e50e76c77ca776f234f154d4a1d39e33e8f813115e53c2a9b893bc9 +imaginaryImage: + repository: tccr.io/truecharts/nextcloud-imaginary + pullPolicy: IfNotPresent + tag: v20230401@sha256:6a227d1b0200d29f25028e07b8852f60e3d91a5814048933e70eccee749dc04c +hpbImage: + repository: tccr.io/truecharts/nextcloud-push-notify + pullPolicy: IfNotPresent + tag: v0.6.3@sha256:b9c35ab123354eeac3996e361f8c30b8e4de6d2ccd69e5179a7c2a101a67b46f +clamavImage: + repository: clamav/clamav + pullPolicy: IfNotPresent + tag: 1.2.1@sha256:d584c29eefc29e138eb14f243abef2f6712cffecac52194626a2b2f6bb3ec2c7 +collaboraImage: + repository: collabora/code + pullPolicy: IfNotPresent + tag: 23.05.6.3.1@sha256:6d21951e6376be4a12009b5058c57f3da7df06faf05c62406030b3652a3e78f6 +nextcloud: + # Initial Credentials + credentials: + initialAdminUser: admin + initialAdminPassword: adminpass + # General settings + general: + # Custom Nextcloud Scripts + run_optimize: true + default_phone_region: GR + # IP used for exposing nextcloud, + # often the loadbalancer IP + accessIP: "" + # Allows Nextcloud to connect to unsecure (http) endpoints + force_enable_allow_local_remote_servers: false + # File settings + files: + shared_folder_name: Shared + max_chunk_size: 10485760 + # Expiration settings + expirations: + activity_expire_days: 90 + trash_retention_obligation: auto + versions_retention_obligation: auto + # Previews settings + previews: + enabled: true + # It will also deploy the container + imaginary: true + cron: true + schedule: "*/30 * * * *" + max_x: 2048 + max_y: 2048 + max_memory: 1024 + max_file_size_image: 50 + # Setting for Imaginary + max_allowed_resolution: 18.0 + jpeg_quality: 60 + square_sizes: 32 256 + width_sizes: 256 384 + height_sizes: 256 + # Casings are important + # https://github.com/nextcloud/server/blob/master/config/config.sample.php#L1269 + # Only the last part of the provider is needed + providers: + - PNG + - JPEG + # Logging settings + logging: + log_level: 2 + log_file: /var/www/html/data/logs/nextcloud.log + log_audit_file: /var/www/html/data/logs/audit.log + log_date_format: d/m/Y H:i:s + # ClamAV settings + clamav: + # It will also deploy the container + # Note that this runs as root + enabled: false + stream_max_length: 26214400 + file_max_size: -1 + infected_action: only_log + # Notify Push settings + notify_push: + # It will also deploy the container + enabled: true + # Collabora settings + collabora: + # It will also deploy the container + enabled: false + # default|compact|tabbed + interface_mode: default + username: admin + password: changeme + dictionaries: + - de_DE + - en_GB + - en_US + - el_GR + - es_ES + - fr_FR + - pt_BR + - pt_PT + - it + - nl + - ru + onlyoffice: + # It will not deploy the container + # Only add the OnlyOffice settings + enabled: false + url: "" + internal_url: "" + verify_ssl: true + jwt: "" + jwt_header: Authorization + # PHP settings + php: + memory_limit: 1G + upload_limit: 10G + pm_max_children: 180 + pm_start_servers: 18 + pm_min_spare_servers: 12 + pm_max_spare_servers: 30 + opcache: + interned_strings_buffer: 32 + max_accelerated_files: 10000 + memory_consumption: 128 + revalidate_freq: 60 + jit_buffer_size: 128 +# Do NOT edit below this line +workload: + # Nextcloud php-fpm + main: + type: Deployment + podSpec: + containers: + main: + enabled: true + primary: true + envFrom: + - configMapRef: + name: nextcloud-config + probes: + liveness: + enabled: true + type: exec + command: /healthcheck.sh + readiness: + enabled: true + type: exec + command: /healthcheck.sh + startup: + enabled: true + type: tcp + port: "{{ .Values.service.nextcloud.ports.nextcloud.targetPort }}" + nginx: + enabled: true + type: Deployment + strategy: RollingUpdate + replicas: 1 + podSpec: + containers: + nginx: + enabled: true + primary: true + imageSelector: nginxImage + probes: + readiness: + enabled: true + path: /robots.txt + port: "{{ .Values.service.main.ports.main.port }}" + httpHeaders: + Host: kube.internal.healthcheck + liveness: + enabled: true + path: /robots.txt + port: "{{ .Values.service.main.ports.main.port }}" + httpHeaders: + Host: kube.internal.healthcheck + startup: + enabled: true + type: tcp + port: "{{ .Values.service.main.ports.main.port }}" + notify: + enabled: true + type: Deployment + strategy: RollingUpdate + replicas: 1 + podSpec: + containers: + notify: + primary: true + enabled: true + imageSelector: hpbImage + envFrom: + - configMapRef: + name: hpb-config + probes: + readiness: + enabled: true + path: /push/test/cookie + port: 7867 + httpHeaders: + Host: kube.internal.healthcheck + liveness: + enabled: true + path: /push/test/cookie + port: 7867 + httpHeaders: + Host: kube.internal.healthcheck + startup: + enabled: true + type: tcp + port: 7867 + imaginary: + enabled: true + type: Deployment + strategy: RollingUpdate + replicas: 1 + podSpec: + containers: + imaginary: + primary: true + enabled: true + imageSelector: imaginaryImage + command: imaginary + args: + - -p + - "{{ .Values.service.imaginary.ports.imaginary.port }}" + - -concurrency + - "10" + - -max-allowed-resolution + - "{{ .Values.nextcloud.previews.max_allowed_resolution }}" + - -enable-url-source + - -return-size + probes: + readiness: + enabled: true + path: /health + port: "{{ .Values.service.imaginary.ports.imaginary.port }}" + liveness: + enabled: true + path: /health + port: "{{ .Values.service.imaginary.ports.imaginary.port }}" + startup: + enabled: true + type: tcp + port: "{{ .Values.service.imaginary.ports.imaginary.port }}" + clamav: + enabled: true + type: Deployment + strategy: RollingUpdate + replicas: 1 + podSpec: + containers: + clamav: + primary: true + enabled: true + imageSelector: clamavImage + # FIXME: https://github.com/Cisco-Talos/clamav/issues/478 + securityContext: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + envFrom: + - configMapRef: + name: clamav-config + probes: + readiness: + enabled: true + type: exec + command: clamdcheck.sh + liveness: + enabled: true + type: exec + command: clamdcheck.sh + startup: + enabled: true + type: tcp + port: "{{ .Values.service.clamav.ports.clamav.targetPort }}" + collabora: + enabled: true + type: Deployment + strategy: RollingUpdate + replicas: 1 + podSpec: + containers: + collabora: + primary: true + enabled: true + imageSelector: collaboraImage + securityContext: + runAsUser: 100 + runAsGroup: 102 + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + capabilities: + add: + - CHOWN + - FOWNER + - SYS_CHROOT + - MKNOD + envFrom: + - configMapRef: + name: collabora-config + probes: + readiness: + enabled: true + type: http + path: /collabora/ + port: "{{ .Values.service.collabora.ports.collabora.targetPort }}" + liveness: + enabled: true + type: http + path: /collabora/ + port: "{{ .Values.service.collabora.ports.collabora.targetPort }}" + startup: + enabled: true + type: tcp + port: "{{ .Values.service.collabora.ports.collabora.targetPort }}" +cronjobs: + # Don't change names, it's used in the persistence + - name: nextcloud-cron + enabled: true + schedule: "*/5 * * * *" + cmd: + - echo "Running [php -f /var/www/html/cron.php] ..." + - php -f /var/www/html/cron.php + - echo "Finished [php -f /var/www/html/cron.php]" + - name: preview-cron + enabled: "{{ .Values.nextcloud.previews.cron }}" + schedule: "{{ .Values.nextcloud.previews.schedule }}" + cmd: + - echo "Running [occ preview:pre-generate] ..." + - occ preview:pre-generate + - echo "Finished [occ preview:pre-generate]" +service: + # Main service links to ingress easier + # That's why the nginx is swapped with nextcloud + main: + targetSelector: nginx + ports: + main: + targetSelector: nginx + port: 8080 + nextcloud: + enabled: true + targetSelector: main + ports: + nextcloud: + enabled: true + targetSelector: main + port: 9000 + targetPort: 9000 + notify: + enabled: true + targetSelector: notify + ports: + notify: + enabled: true + primary: true + port: 7867 + targetPort: 7867 + targetSelector: notify + metrics: + enabled: true + port: 7868 + targetSelector: notify + imaginary: + enabled: true + targetSelector: imaginary + ports: + imaginary: + enabled: true + port: 9090 + targetSelector: imaginary + clamav: + enabled: true + targetSelector: clamav + ports: + clamav: + enabled: true + port: 3310 + targetPort: 3310 + targetSelector: clamav + collabora: + enabled: true + targetSelector: collabora + ports: + collabora: + enabled: true + port: 9980 + targetPort: 9980 + targetSelector: collabora +persistence: + php-tune: + enabled: true + type: configmap + objectName: php-tune + targetSelector: + main: + main: + mountPath: /usr/local/etc/php-fpm.d/zz-tune.conf + subPath: zz-tune.conf + readOnly: true + redis-session: + enabled: true + type: configmap + objectName: redis-session + targetSelector: + main: + main: + mountPath: /usr/local/etc/php/conf.d/redis-session.ini + subPath: redis-session.ini + readOnly: true + opcache-recommended: + enabled: true + type: configmap + objectName: opcache + targetSelector: + main: + main: + mountPath: /usr/local/etc/php/conf.d/opcache-recommended.ini + subPath: opcache-recommended.ini + readOnly: true + nginx: + enabled: true + type: configmap + objectName: nginx-config + targetSelector: + nginx: + nginx: + mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + readOnly: true + nginx-temp: + enabled: true + type: emptyDir + targetSelector: + nginx: + nginx: + mountPath: /tmp/nginx + html: + enabled: true + targetSelector: + main: + main: + mountPath: /var/www/html + nextcloud-cron: + nextcloud-cron: + mountPath: /var/www/html + preview-cron: + preview-cron: + mountPath: /var/www/html + nginx: + nginx: + mountPath: /var/www/html + readOnly: true + config: + enabled: true + targetSelector: + main: + main: + mountPath: /var/www/html/config + nextcloud-cron: + nextcloud-cron: + mountPath: /var/www/html/config + preview-cron: + preview-cron: + mountPath: /var/www/html/config + notify: + notify: + mountPath: /var/www/html/config + readOnly: true + nginx: + nginx: + mountPath: /var/www/html/config + readOnly: true + data: + enabled: true + targetSelector: + main: + main: + mountPath: /var/www/html/data + init-perms: + mountPath: /var/www/html/data + nextcloud-cron: + nextcloud-cron: + mountPath: /var/www/html/data + preview-cron: + preview-cron: + mountPath: /var/www/html/data + nginx: + nginx: + mountPath: /var/www/html/data + readOnly: true +cnpg: + main: + enabled: true + user: nextcloud + database: nextcloud +redis: + enabled: true + username: default +portal: + open: + enabled: true +updated: true + +ingress: + main: + required: true diff --git a/stable/nextcloud/25.0.6/questions.yaml b/stable/nextcloud/25.0.6/questions.yaml new file mode 100644 index 0000000000..fa1645f5a4 --- /dev/null +++ b/stable/nextcloud/25.0.6/questions.yaml @@ -0,0 +1,4318 @@ +groups: + - name: Container Image + description: Image to be used for container + - name: General Settings + description: General Deployment Settings + - name: Workload Settings + description: Workload Settings + - name: App Configuration + description: App Specific Config Options + - name: Networking and Services + description: Configure Network and Services for Container + - name: Storage and Persistence + description: Persist and Share Data that is Separate from the Container + - name: Ingress + description: Ingress Configuration + - name: Security and Permissions + description: Configure Security Context and Permissions + - name: Resources and Devices + description: "Specify Resources/Devices to be Allocated to Workload" + - name: Middlewares + description: Traefik Middlewares + - name: Metrics + description: Metrics + - name: Addons + description: Addon Configuration + - name: Advanced + description: Advanced Configuration + - name: Postgresql + description: Postgresql + - name: Documentation + description: Documentation +portals: + open: + protocols: + - "$kubernetes-resource_configmap_tcportal-open_protocol" + host: + - "$kubernetes-resource_configmap_tcportal-open_host" + ports: + - "$kubernetes-resource_configmap_tcportal-open_port" +questions: + - variable: global + group: General Settings + label: "Global Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: stopAll + label: Stop All + description: "Stops All Running pods and hibernates cnpg" + schema: + type: boolean + default: false + - variable: workload + group: "Workload Settings" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type (Advanced) + schema: + type: string + default: Deployment + enum: + - value: Deployment + description: Deployment + - value: DaemonSet + description: DaemonSet + - variable: replicas + label: Replicas (Advanced) + description: Set the number of Replicas + schema: + type: int + show_if: [["type", "!=", "DaemonSet"]] + default: 1 + - variable: podSpec + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: containers + label: Containers + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Container + schema: + additional_attrs: true + type: dict + attrs: + - variable: envList + label: Extra Environment Variables + description: "Please be aware that some variables are set in the background, adding duplicates here might cause issues or prevent the app from starting..." + schema: + type: list + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + - variable: value + label: Value + schema: + type: string + - variable: extraArgs + label: Extra Args + schema: + type: list + default: [] + items: + - variable: arg + label: Arg + schema: + type: string + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: command + label: Command + schema: + type: list + default: [] + items: + - variable: param + label: Param + schema: + type: string + - variable: TZ + label: Timezone + group: "General Settings" + schema: + type: string + default: "Etc/UTC" + $ref: + - "definitions/timezone" + - variable: nextcloud + group: App Configuration + label: Nextcloud + schema: + additional_attrs: true + type: dict + attrs: + - variable: credentials + label: Initial Credentials + schema: + additional_attrs: true + type: dict + attrs: + - variable: initialAdminUser + label: Initial Admin User + description: Sets the initial admin username + schema: + type: string + required: true + default: "" + - variable: initialAdminPassword + label: Initial Admin Password + description: Sets the initial admin password + schema: + type: string + required: true + private: true + default: "" + - variable: general + label: General + schema: + additional_attrs: true + type: dict + attrs: + - variable: run_optimize + label: Run Optimize Scripts + description: | + Runs the following commands at startup:
+ occ db:add-missing-indices
+ occ db:add-missing-columns
+ occ db:add-missing-primary-keys
+ yes | occ db:convert-filecache-bigint
+ occ maintenance:mimetype:update-js
+ occ maintenance:mimetype:update-db
+ occ maintenance:update:htaccess
+ schema: + type: boolean + default: false + - variable: default_phone_region + label: Default Phone Region + description: | + Sets the default phone region in ISO_3166-1 format (e.g. US).
+ https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#Officially_assigned_code_elements + schema: + type: string + valid_chars: '^[A-Z]{2}$' + required: true + default: "" + - variable: accessIP + label: Access IP + description: Set to the IP-Address used to reach Nextcloud. + schema: + type: string + required: true + $ref: + - "definitions/nodeIP" + - variable: force_enable_allow_local_remote_servers + label: Force Enable Allow Local Remote Servers + description: + Enables 'allow_local_remote_servers' option + schema: + type: boolean + default: false + - variable: files + label: Files Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: shared_folder_name + label: Shared Folder Name + schema: + type: string + required: true + default: Shared + - variable: max_chunk_size + label: Max Chunk Size + schema: + type: int + required: true + default: 10485760 + - variable: expirations + label: Expirations Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: activity_expire_days + label: Activity Expire Days + schema: + type: int + required: true + default: 90 + - variable: trash_retention_obligation + label: Trash Retention Obligation + schema: + type: string + required: true + default: auto + - variable: versions_retention_obligation + label: Versions Retention Obligation + schema: + type: string + required: true + default: auto + - variable: previews + label: Previews Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Previews + schema: + type: boolean + default: true + show_subquestions_if: true + subquestions: + - variable: imaginary + label: Enable imaginary + description: | + Enable imaginary to generate previews in the background.
+ It will also deploy the needed container. + schema: + type: boolean + default: true + - variable: cron + label: Enable cron + description: | + Enable cron to generate previews in the background. + schema: + type: boolean + default: true + - variable: schedule + label: Cron Schedule + schema: + type: string + default: "*/30 * * * *" + - variable: max_x + label: Max X + schema: + type: int + required: true + default: 2048 + - variable: max_y + label: Max Y + schema: + type: int + required: true + default: 2048 + - variable: max_memory + label: Max Memory + schema: + type: int + required: true + default: 1024 + - variable: max_allowed_resolution + label: Max Allowed Resolution + schema: + type: string + valid_chars: '^[0-9]{1,5}(\.[0-9]{1,2})?$' + show_if: [["imaginary", "=", true]] + required: true + default: "18.0" + - variable: max_file_size_image + label: Max File Size Image + schema: + type: int + required: true + default: 50 + - variable: jpeg_quality + label: JPEG Quality + schema: + type: int + required: true + default: 60 + - variable: square_sizes + label: Square Sizes + schema: + type: string + required: true + default: "32 256" + - variable: width_sizes + label: Width Sizes + schema: + type: string + required: true + default: "256 384" + - variable: height_sizes + label: Height Sizes + schema: + type: string + required: true + default: "256" + - variable: providers + label: Providers + schema: + type: list + empty: false + required: true + default: + - BMP + - GIF + - JPEG + - Krita + - MarkDown + - MP3 + - OpenDocument + - PNG + - TXT + - XBitmap + items: + - variable: provider_entry + label: Provider Entry + schema: + type: string + required: true + default: "" + enum: + - value: BMP + description: BMP + - value: Font + description: Font + - value: GIF + description: GIF + - value: HEIC + description: HEIC + - value: Illustrator + description: Illustrator + - value: JPEG + description: JPEG + - value: Krita + description: Krita + - value: MarkDown + description: MarkDown + - value: Movie + description: Movie + - value: MP3 + description: MP3 + - value: MSOffice2003 + description: MSOffice2003 + - value: MSOffice2007 + description: MSOffice2007 + - value: MSOfficeDoc + description: MSOfficeDoc + - value: OpenDocument + description: OpenDocument + - value: PDF + description: PDF + - value: Photoshop + description: Photoshop + - value: PNG + description: PNG + - value: Postscript + description: Postscript + - value: StarOffice + description: StarOffice + - value: SVG + description: SVG + - value: TIFF + description: TIFF + - value: TXT + description: TXT + - value: XBitmap + description: XBitmap + - variable: logging + label: Logging Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: log_level + label: Log Level + schema: + type: int + required: true + default: 2 + enum: + - value: 0 + description: Debug + - value: 1 + description: Info + - value: 2 + description: Warning + - value: 3 + description: Error + - value: 4 + description: Fatal + - variable: log_date_format + label: Log Date Format + schema: + type: string + required: true + default: d/m/Y H:i:s + - variable: notify_push + label: Notify Push Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Notify Push + description: | + Enable and Configure Notify Push.
+ It will also deploy the needed container + schema: + type: boolean + default: true + - variable: clamav + label: ClamAV Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable ClamAV + description: | + Enable and configure ClamAV.
+ It will also deploy the needed container.
+ Keep in mind that this will run as root.
+ https://github.com/Cisco-Talos/clamav/issues/478 + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: stream_max_length + label: Stream Max Length + schema: + type: int + required: true + default: 104857600 + - variable: file_max_size + label: File Max Size + schema: + type: int + required: true + default: -1 + - variable: infected_action + label: Infected Action + schema: + type: string + required: true + default: only_log + enum: + - value: delete + description: Delete + - value: only_log + description: Only Log + - variable: collabora + label: Collabora Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Collabora + description: | + Enable and configure Collabora.
+ It will also deploy the needed container.
+ Keep in mind that this will run as root. + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: interface_mode + label: Interface Mode + schema: + type: string + required: true + default: default + enum: + - value: default + description: Default + - value: compact + description: Compact + - value: tabbed + description: Tabbed + - variable: username + label: Username + schema: + type: string + default: admin + required: true + - variable: password + label: Password + schema: + type: string + default: "" + required: true + - variable: dictionaries + label: Dictionaries + schema: + type: list + empty: false + required: true + default: + - de_DE + - en_GB + - en_US + - el_GR + - es_ES + - fr_FR + - pt_BR + - pt_PT + - it + - nl + - ru + items: + - variable: dictionary + label: Dictionary + schema: + type: string + required: true + default: "" + - variable: onlyoffice + label: Only Office Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable OnlyOffice + description: | + Enable and configure OnlyOffice.
+ This will NOT deploy the needed container.
+ You need to deploy it yourself. + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: url + label: Public URL + description: | + The public FQDN and port of the OnlyOffice Document Server + schema: + type: string + required: true + default: "" + - variable: internal_url + label: Internal URL + description: | + The internal FQDN and port of the OnlyOffice Document Server + schema: + type: string + required: true + default: "" + - variable: verify_ssl + label: Verify SSL (Advanced) + description: | + Verify SSL when connecting to OnlyOffice Document Server + schema: + type: boolean + default: true + - variable: jwt + label: JWT + schema: + type: string + required: true + default: "" + - variable: jwt_header + label: JWT Header + schema: + type: string + required: true + default: Authorization + - variable: php + label: PHP Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: memory_limit + label: Memory Limit + schema: + type: string + required: true + default: 1G + - variable: upload_limit + label: Upload Limit + schema: + type: string + required: true + default: 10G + - variable: pm_max_children + label: Max Children + schema: + type: int + required: true + default: 180 + - variable: pm_start_servers + label: Start Servers + schema: + type: int + required: true + default: 18 + - variable: pm_min_spare_servers + label: Minimum Spare Servers + schema: + type: int + required: true + default: 12 + - variable: pm_max_spare_servers + label: Maximum Spare Servers + schema: + type: int + required: true + default: 30 + - variable: opcache + label: OPCache Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: interned_strings_buffer + label: Interned Strings Buffer + description: The amount of memory used to store interned strings, in megabytes. + schema: + type: int + required: true + default: 32 + - variable: max_accelerated_files + label: Max Accelerated Files + description: The maximum number of keys (and therefore scripts) in the OPcache hash table. + schema: + type: int + required: true + default: 10000 + - variable: memory_consumption + label: Memory Consumption + description: The size of the shared memory storage used by OPcache, in megabytes. + schema: + type: int + required: true + default: 128 + - variable: revalidate_freq + label: Revalidate Frequency + description: How often to check script timestamps for updates, in seconds. 0 will result in OPcache checking for updates on every request. + schema: + type: int + required: true + default: 60 + - variable: jit_buffer_size + label: JIT Buffer Size + description: The amount of shared memory (in megabytes) to reserve for compiled JIT code. A zero value disables the JIT. + schema: + type: int + required: true + default: 128 + + - variable: podOptions + group: "General Settings" + label: "Global Pod Options (Advanced)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: expertPodOpts + label: "Expert - Pod Options" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostNetwork + label: "Host Networking" + schema: + type: boolean + default: false + - variable: dnsConfig + label: "DNS Configuration" + schema: + type: dict + additional_attrs: true + attrs: + - variable: options + label: "Options" + schema: + type: list + default: [{"name": "ndots", "value": "1"}] + items: + - variable: optionsEntry + label: "Option Entry" + schema: + type: dict + additional_attrs: true + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: value + label: "Value" + schema: + type: string + - variable: nameservers + label: "Nameservers" + schema: + type: list + default: [] + items: + - variable: nsEntry + label: "Nameserver Entry" + schema: + type: string + required: true + - variable: searches + label: "Searches" + schema: + type: list + default: [] + items: + - variable: searchEntry + label: "Search Entry" + schema: + type: string + required: true + + - variable: imagePullSecretList + group: "General Settings" + label: "Image Pull Secrets" + schema: + type: list + default: [] + items: + - variable: pullsecretentry + label: "Pull Secret" + schema: + type: dict + additional_attrs: true + attrs: + - variable: registry + label: "Registry" + schema: + type: string + required: true + default: "https://index.docker.io/v1/" + - variable: username + label: "Username" + schema: + type: string + required: true + default: "" + - variable: password + label: "Password" + schema: + type: string + required: true + default: "" + - variable: email + label: "Email" + schema: + type: string + required: true + default: "" + - variable: service + group: Networking and Services + label: Configure Service(s) + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Service + description: The Primary service on which the healthcheck runs, often the webUI + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Service + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Service Port Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + description: This port exposes the container port on the service + schema: + type: int + default: 12000 + required: true + - variable: serviceexpert + group: Networking and Services + label: Show Expert Config + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: scaleExternalInterface + description: Add External Interfaces + label: Add external Interfaces + group: Networking + schema: + type: list + items: + - variable: interfaceConfiguration + description: Interface Configuration + label: Interface Configuration + schema: + additional_attrs: true + type: dict + $ref: + - "normalize/interfaceConfiguration" + attrs: + - variable: hostInterface + description: Please Specify Host Interface + label: Host Interface + schema: + type: string + required: true + $ref: + - "definitions/interface" + - variable: ipam + description: Define how IP Address will be managed + label: IP Address Management + schema: + additional_attrs: true + type: dict + required: true + attrs: + - variable: type + description: Specify type for IPAM + label: IPAM Type + schema: + type: string + required: true + enum: + - value: dhcp + description: Use DHCP + - value: static + description: Use Static IP + - variable: staticIPConfigurations + label: Static IP Addresses + schema: + type: list + show_if: [["type", "=", "static"]] + items: + - variable: staticIP + label: Static IP + schema: + type: ipaddr + cidr: true + - variable: staticRoutes + label: Static Routes + schema: + type: list + show_if: [["type", "=", "static"]] + items: + - variable: staticRouteConfiguration + label: Static Route Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: destination + label: Destination + schema: + type: ipaddr + cidr: true + required: true + - variable: gateway + label: Gateway + schema: + type: ipaddr + cidr: false + required: true + - variable: serviceList + label: Add Manual Custom Services + group: Networking and Services + schema: + type: list + default: [] + items: + - variable: serviceListEntry + label: Custom Service + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the service + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Name + schema: + type: string + default: "" + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: LoadBalancer + description: LoadBalancer (Expose Ports) + - value: ClusterIP + description: ClusterIP (Do Not Expose Ports) + - value: Simple + description: Deprecated CHANGE THIS + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: advancedsvcset + label: Show Advanced Service Settings + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: externalIPs + label: "External IP's" + description: "External IP's" + schema: + type: list + default: [] + items: + - variable: externalIP + label: External IP + schema: + type: string + - variable: ipFamilyPolicy + label: IP Family Policy + description: Specify the IP Policy + schema: + type: string + default: SingleStack + enum: + - value: SingleStack + description: SingleStack + - value: PreferDualStack + description: PreferDualStack + - value: RequireDualStack + description: RequireDualStack + - variable: ipFamilies + label: IP Families + description: (Advanced) The IP Families that should be used + schema: + type: list + default: [] + items: + - variable: ipFamily + label: IP Family + schema: + type: string + - variable: portsList + label: Additional Service Ports + schema: + type: list + default: [] + items: + - variable: portsListEntry + label: Custom ports + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Port + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Port Name + schema: + type: string + default: "" + - variable: protocol + label: Port Type + schema: + type: string + default: tcp + enum: + - value: http + description: HTTP + - value: https + description: HTTPS + - value: tcp + description: TCP + - value: udp + description: UDP + - variable: targetPort + label: Target Port + description: This port exposes the container port on the service + schema: + type: int + required: true + - variable: port + label: Container Port + schema: + type: int + required: true + - variable: persistence + label: Integrated Persistent Storage + description: Integrated Persistent Storage + group: Storage and Persistence + schema: + additional_attrs: true + type: dict + attrs: + - variable: html + label: App HTML Storage + description: Stores the Application HTML. + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: config + label: App Config Storage + description: Stores the Application Config. + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: data + label: User Data Storage + description: Stores the User Data. + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: pvc + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - value: iscsi + description: iSCSI Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size quotum of Storage (Do NOT REDUCE after installation) + description: This value can ONLY be INCREASED after the installation + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: disabled + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: persistenceList + label: Additional App Storage + group: Storage and Persistence + schema: + type: list + default: [] + items: + - variable: persistenceListEntry + label: Custom Storage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the storage + schema: + type: boolean + default: true + hidden: true + - variable: type + label: Type of Storage + description: Sets the persistence type, Anything other than PVC could break rollback! + schema: + type: string + default: hostPath + enum: + - value: pvc + description: PVC + - value: hostPath + description: Host Path + - value: emptyDir + description: emptyDir + - value: nfs + description: NFS Share + - variable: server + label: NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: path + label: Path on NFS Server + schema: + show_if: [["type", "=", "nfs"]] + type: string + default: "" + - variable: iscsi + label: iSCSI Options + schema: + show_if: [["type", "=", "iscsi"]] + type: dict + additional_attrs: true + attrs: + - variable: targetPortal + label: targetPortal + schema: + type: string + required: true + default: "" + - variable: iqn + label: iqn + schema: + type: string + required: true + default: "" + - variable: lun + label: lun + schema: + type: int + default: 0 + - variable: authSession + label: authSession + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: authDiscovery + label: authDiscovery + schema: + type: dict + additional_attrs: true + attrs: + - variable: username + label: username + schema: + type: string + default: "" + - variable: password + label: password + schema: + type: string + default: "" + - variable: usernameInitiator + label: usernameInitiator + schema: + type: string + default: "" + - variable: passwordInitiator + label: passwordInitiator + schema: + type: string + default: "" + - variable: autoPermissions + label: Automatic Permissions Configuration + description: Automatically set permissions + schema: + show_if: [["type", "!=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: chown + label: Run CHOWN + description: | + It will run CHOWN on the path with the given fsGroup + schema: + type: boolean + default: false + - variable: chmod + label: Run CHMOD + description: | + It will run CHMOD on the path with the given value
+ Format should be 3 digits, e.g. 770 + schema: + type: string + valid_chars: '[0-9]{3}' + default: "" + - variable: recursive + label: Recursive + description: | + It will run CHOWN and CHMOD recursively + schema: + type: boolean + default: false + - variable: readOnly + label: Read Only + schema: + type: boolean + default: false + - variable: hostPath + label: Host Path + description: Path inside the container the storage is mounted + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: mountPath + label: Mount Path + description: Path inside the container the storage is mounted + schema: + type: string + default: "" + required: true + valid_chars: '^\/([a-zA-Z0-9._-]+(\s?[a-zA-Z0-9._-]+|\/?))+$' + - variable: medium + label: EmptyDir Medium + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: Default + - value: Memory + description: Memory + - variable: size + label: Size Quotum of Storage + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: 256Gi + - variable: storageClass + label: 'storageClass (Advanced)' + description: 'sets the storageClass to something other than iX default. Only for advanced usecases!' + schema: + show_if: [["type", "=", "pvc"]] + type: string + default: "" + - variable: static + label: 'Static Fixed PVC Bindings (Experimental)' + description: Link a PVC to a specific storage location + schema: + show_if: [["type", "=", "pvc"]] + type: dict + additional_attrs: true + attrs: + - variable: mode + label: mode + description: | + disabled: use normal dynamic PVCs + smb: connect to an SMB share + nfs: connect to an NFS share + schema: + type: string + default: "disabled" + enum: + - value: "disabled" + description: disabled + - value: smb + description: smb + - value: nfs + description: nfs + - variable: server + label: Server + description: server to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "myserver" + - variable: share + label: Share + description: share to connect to + schema: + type: string + show_if: [["mode", "!=", "disabled"]] + default: "/myshare" + - variable: user + label: User + description: connecting user + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "myuser" + - variable: domain + label: Domain + description: user domain + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: password + label: Password + description: connecting password + schema: + type: string + show_if: [["mode", "=", "smb"]] + default: "" + - variable: volumeSnapshots + label: 'Volume Snapshots (Experimental)' + description: Add an entry to the list to force creation of a volumeSnapshot of this PVC + schema: + show_if: [["type", "=", "pvc"]] + type: list + default: [] + items: + - variable: volumeSnapshotEntry + label: Custom volumeSnapshot + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + description: 'WARNING: renaming this, means deletion of the snapshot with the old name!' + schema: + type: string + default: "mysnapshot" + required: true + - variable: volumeSnapshotClassName + label: 'volumeSnapshot Class Name (Advanced)' + description: For use with PVCs using a non-default storageClass + schema: + type: string + default: "" + - variable: ingress + label: "" + group: Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + + + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: ingressList + label: Add Manual Custom Ingresses + group: Ingress + schema: + type: list + default: [] + items: + - variable: ingressListEntry + label: Custom Ingress + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: true + hidden: true + - variable: name + label: Name + schema: + type: string + default: "" + - variable: ingressClassName + label: IngressClass Name + schema: + type: string + default: "" + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + - variable: service + label: Linked Service + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Service Name + schema: + type: string + default: "" + - variable: port + label: Service Port + schema: + type: int + - variable: tls + label: TLS-Settings + schema: + type: list + default: [] + show_if: [["certificateIssuer", "=", ""]] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your Cert-Manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: scaleCert + label: Use TrueNAS SCALE Certificate (Deprecated) + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: Use Custom Secret (Advanced) + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: integrations + label: Integrations + description: Connect ingress with other charts + schema: + additional_attrs: true + type: dict + attrs: + - variable: traefik + label: Traefik + description: Connect ingress with Traefik + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + default: false + show_if: [["enabled", "=", true]] + - variable: entrypoints + label: Entrypoints + schema: + type: list + default: ["websecure"] + show_if: [["enabled", "=", true]] + items: + - variable: entrypoint + label: Entrypoint + schema: + type: string + - variable: middlewares + label: Middlewares + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: middleware + label: Middleware + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: namespace + label: namespace + schema: + type: string + default: "" + - variable: certManager + label: certManager + description: Connect ingress with certManager + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: true + - variable: certificateIssuer + label: certificateIssuer + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: homepage + label: Homepage + description: Connect ingress with Homepage + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: enabled + schema: + type: boolean + default: false + - variable: name + label: Name + description: defaults to chartname + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: description + label: Description + description: defaults to chart description + schema: + type: string + default: "" + show_if: [["enabled", "=", true]] + - variable: group + label: Group + schema: + type: string + required: true + default: "default" + show_if: [["enabled", "=", true]] + - variable: securityContext + group: Security and Permissions + label: Security Context + schema: + additional_attrs: true + type: dict + attrs: + - variable: container + label: Container + schema: + additional_attrs: true + type: dict + attrs: + # Settings from questions.yaml get appended here on a per-app basis + - variable: runAsUser + label: runAsUser + description: The UserID of the user running the application + schema: + type: int + default: 568 + - variable: runAsGroup + label: runAsGroup + description: The groupID of the user running the application + schema: + type: int + default: 568 + # Settings from questions.yaml get appended here on a per-app basis + - variable: PUID + label: Process User ID - PUID + description: When supported by the container, this sets the User ID running the Application Process. Not supported by all Apps + schema: + type: int + show_if: [["runAsUser", "=", 0]] + default: 568 + - variable: UMASK + label: UMASK + description: When supported by the container, this sets the UMASK for the App. Not supported by all Apps + schema: + type: string + default: "0022" + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: true + - variable: pod + label: Pod + schema: + additional_attrs: true + type: dict + attrs: + - variable: fsGroupChangePolicy + label: "When should we take ownership?" + schema: + type: string + default: OnRootMismatch + enum: + - value: OnRootMismatch + description: OnRootMismatch + - value: Always + description: Always + - variable: supplementalGroups + label: Supplemental Groups + schema: + type: list + default: [] + items: + - variable: supplementalGroupsEntry + label: Supplemental Group + schema: + type: int + # Settings from questions.yaml get appended here on a per-app basis + - variable: fsGroup + label: fsGroup + description: The group that should own ALL storage. + schema: + type: int + default: 568 + - variable: resources + group: Resources and Devices + label: "Resource Limits" + schema: + additional_attrs: true + type: dict + attrs: + - variable: limits + label: Advanced Limit Resource Consumption + schema: + additional_attrs: true + type: dict + attrs: + - variable: cpu + label: CPU + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 4000m + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: RAM + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 8Gi + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: requests + label: "Minimum Resources Required (request)" + schema: + additional_attrs: true + type: dict + hidden: true + attrs: + - variable: cpu + label: CPU + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 10m + hidden: true + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: "RAM" + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/SCALE/validation" + schema: + type: string + default: 50Mi + hidden: true + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: deviceList + label: Mount USB Devices + group: Resources and Devices + schema: + type: list + default: [] + items: + - variable: deviceListEntry + label: Device + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable the Storage + schema: + type: boolean + default: true + - variable: type + label: (Advanced) Type of Storage + description: Sets the persistence type + schema: + type: string + default: device + hidden: true + - variable: readOnly + label: readOnly + schema: + type: boolean + default: false + - variable: hostPath + label: Host Device Path + description: Path to the device on the host system + schema: + type: path + - variable: mountPath + label: Container Device Path + description: Path inside the container the device is mounted + schema: + type: string + default: "/dev/ttyACM0" + - variable: scaleGPU + label: GPU Configuration + group: Resources and Devices + schema: + type: list + default: [] + items: + - variable: scaleGPUEntry + label: GPU + schema: + additional_attrs: true + type: dict + attrs: + # Specify GPU configuration + - variable: gpu + label: Select GPU + schema: + additional_attrs: true + type: dict + $ref: + - "definitions/gpuConfiguration" + attrs: [] + - variable: workaround + label: "Workaround" + schema: + type: string + default: workaround + hidden: true + - variable: cnpg + group: Postgresql + label: "CloudNative-PG (CNPG)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Postgresql Database" + schema: + additional_attrs: true + type: dict + attrs: + - variable: hibernate + label: Hibernate + description: "enable to safely hibernate and shutdown the postgresql cluster" + schema: + type: boolean + default: false + - variable: cluster + label: "Cluster Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: instances + label: Instances + schema: + type: int + default: 1 + - variable: singleNode + label: singleNode + schema: + type: boolean + default: true + hidden: true + - variable: storage + label: "Storage" + schema: + additional_attrs: true + type: dict + attrs: + - variable: size + label: Size + schema: + type: string + default: "256Gi" + - variable: walStorage + label: "WAL Storage" + schema: + additional_attrs: true + type: dict + attrs: + - variable: size + label: Size + schema: + type: string + default: "256Gi" + - variable: monitoring + label: "Monitoring Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enablePodMonitor + label: "enablePodMonitor" + schema: + type: boolean + default: true + - variable: disableDefaultQueries + label: "disableDefaultQueries" + schema: + type: boolean + default: false + - variable: pooler + label: "Pooler Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: instances + label: Instances + schema: + type: int + default: 1 + - variable: createRO + label: "Create ReadOnly Instance" + schema: + type: boolean + default: false + - variable: recovery + label: "Recovery Settings (Experimental)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + - variable: endpointURL + label: "endpointURL" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: method + label: "method" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "object_store" + - variable: backupName + label: "backupName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: provider + label: "provider" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "s3" + - variable: s3 + label: "s3" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "s3"], ["enabled", "=", true]] + attrs: + - variable: region + label: "region" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: accessKey + label: "accessKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: secretKey + label: "secretKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: azure + label: "azure (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "azure"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: connectionString + label: "connectionString" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageAccount + label: "storageAccount" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageKey + label: "storageKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageSasToken + label: "storageSasToken" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: containerName + label: "containerName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: serviceName + label: "serviceName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "blob" + - variable: inheritFromAzureAD + label: "inheritFromAzureAD" + schema: + type: boolean + show_if: [["enabled", "=", true]] + default: false + - variable: google + label: "google (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "google"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: gkeEnvironment + label: "gkeEnvironment" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: applicationCredentials + label: "applicationCredentials" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: backups + label: "Backup Settings (Experimental)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + - variable: endpointURL + label: "endpointURL" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: destinationPath + label: "destinationPath" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: retentionPolicy + label: "retentionPolicy" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "30d" + - variable: provider + label: "provider" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "s3" + - variable: s3 + label: "s3" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "s3"], ["enabled", "=", true]] + attrs: + - variable: region + label: "region" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: accessKey + label: "accessKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: secretKey + label: "secretKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: azure + label: "azure (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "azure"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: connectionString + label: "connectionString" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageAccount + label: "storageAccount" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageKey + label: "storageKey" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: storageSasToken + label: "storageSasToken" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: containerName + label: "containerName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: serviceName + label: "serviceName" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "blob" + - variable: inheritFromAzureAD + label: "inheritFromAzureAD" + schema: + type: boolean + show_if: [["enabled", "=", true]] + default: false + - variable: google + label: "google (EXTREMELY EXPERIMENTAL)" + schema: + additional_attrs: true + type: dict + show_if: [["provider", "=", "google"], ["enabled", "=", true]] + attrs: + - variable: path + label: "path" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "/" + - variable: bucket + label: "bucket" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: gkeEnvironment + label: "gkeEnvironment" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: applicationCredentials + label: "applicationCredentials" + schema: + type: string + show_if: [["enabled", "=", true]] + default: "" + - variable: scheduledBackups + label: ScheduledBackups + schema: + type: list + default: [] + show_if: [["enabled", "=", true]] + items: + - variable: backupschedule + label: BackupSchedule + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "daily-backup" + required: true + - variable: schedule + label: schedule + schema: + type: string + required: true + default: "0 0 0 * * *" + - variable: backupOwnerReference + label: backupOwnerReference + schema: + type: string + required: true + default: "self" + - variable: immediate + label: immediate + schema: + type: boolean + default: false + - variable: suspend + label: suspend + schema: + type: boolean + default: false + - variable: manualBackups + label: manualBackups + schema: + type: list + default: [] + items: + - variable: backup + label: Backup + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: name + schema: + type: string + default: "" + required: true + - variable: metrics + group: Metrics + label: Prometheus Metrics + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: Main Metrics + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + description: Enable Prometheus Metrics + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: prometheusRule + label: PrometheusRule + description: Enable and configure Prometheus Rules for the App. + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + description: Enable Prometheus Metrics + schema: + type: boolean + default: false + # TODO: Rule List section +# - variable: horizontalPodAutoscaler +# group: Advanced +# label: (Advanced) Horizontal Pod Autoscaler +# schema: +# type: list +# default: [] +# items: +# - variable: hpaEntry +# label: HPA Entry +# schema: +# additional_attrs: true +# type: dict +# attrs: +# - variable: name +# label: Name +# schema: +# type: string +# required: true +# default: "" +# - variable: enabled +# label: Enabled +# schema: +# type: boolean +# default: false +# show_subquestions_if: true +# subquestions: +# - variable: target +# label: Target +# description: Deployment name, Defaults to Main Deployment +# schema: +# type: string +# default: "" +# - variable: minReplicas +# label: Minimum Replicas +# schema: +# type: int +# default: 1 +# - variable: maxReplicas +# label: Maximum Replicas +# schema: +# type: int +# default: 5 +# - variable: targetCPUUtilizationPercentage +# label: Target CPU Utilization Percentage +# schema: +# type: int +# default: 80 +# - variable: targetMemoryUtilizationPercentage +# label: Target Memory Utilization Percentage +# schema: +# type: int +# default: 80 + - variable: networkPolicy + group: Advanced + label: (Advanced) Network Policy + schema: + type: list + default: [] + items: + - variable: netPolicyEntry + label: Network Policy Entry + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + default: "" + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: policyType + label: Policy Type + schema: + type: string + default: "" + enum: + - value: "" + description: Default + - value: ingress + description: Ingress + - value: egress + description: Egress + - value: ingress-egress + description: Ingress and Egress + - variable: egress + label: Egress + schema: + type: list + default: [] + items: + - variable: egressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: to + label: To + schema: + type: list + default: [] + items: + - variable: toEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: IP Block + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: CIDR + schema: + type: string + default: "" + - variable: except + label: Except + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: string + - variable: namespaceSelector + label: Namespace Selector + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: Ports + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + - variable: endPort + label: End Port + schema: + type: int + - variable: protocol + label: Protocol + schema: + type: string + default: TCP + enum: + - value: TCP + description: TCP + - value: UDP + description: UDP + - value: SCTP + description: SCTP + - variable: ingress + label: Ingress + schema: + type: list + default: [] + items: + - variable: ingressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: from + label: From + schema: + type: list + default: [] + items: + - variable: fromEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: IP Block + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: CIDR + schema: + type: string + default: "" + - variable: except + label: Except + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: string + - variable: namespaceSelector + label: Namespace Selector + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: Match Expressions + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: Key + schema: + type: string + - variable: operator + label: Operator + schema: + type: string + default: TCP + enum: + - value: In + description: In + - value: NotIn + description: NotIn + - value: Exists + description: Exists + - value: DoesNotExist + description: DoesNotExist + - variable: values + label: Values + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: Ports + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + - variable: endPort + label: End Port + schema: + type: int + - variable: protocol + label: Protocol + schema: + type: string + default: TCP + enum: + - value: TCP + description: TCP + - value: UDP + description: UDP + - value: SCTP + description: SCTP + - variable: addons + group: Addons + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: Codeserver + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: service + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Service Type + description: "ClusterIP's are only internally available and Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: LoadBalancer + enum: + - value: NodePort + description: Deprecated CHANGE THIS + - value: ClusterIP + description: ClusterIP + - value: LoadBalancer + description: LoadBalancer + - variable: loadBalancerIP + label: LoadBalancer IP + description: "MetalLB Only: Selects the Loadbalancer IP to expose on. Required when using PortalButton with MetalLB" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: ports + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: Port + schema: + type: int + default: 36107 + - variable: ingress + label: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enable Ingress + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: Hosts + schema: + type: list + default: [] + items: + - variable: hostEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: HostName + schema: + type: string + default: "" + required: true + - variable: paths + label: Paths + schema: + type: list + default: [{path: "/", pathType: "Prefix"}] + items: + - variable: pathEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: Path + schema: + type: string + required: true + default: "/" + - variable: pathType + label: Path Type + schema: + type: string + required: true + default: Prefix + - variable: certificateIssuer + label: Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates. Cannot be used combined with tls option below' + schema: + type: string + default: "" + - variable: middlewares + label: Traefik Middlewares + description: Add previously created Traefik Middlewares to this Ingress + schema: + type: list + default: [] + items: + - variable: name + label: Name + schema: + type: string + default: "" + required: true + - variable: advanced + label: Show Advanced Settings + description: Advanced settings are not covered by TrueCharts Support + schema: + type: boolean + default: false + - variable: entrypoint + label: (Advanced) Traefik Entrypoint + description: Entrypoint used by Traefik when using Traefik as Ingress Provider + schema: + type: string + default: websecure + show_if: [["advanced", "=", true]] + required: true + - variable: allowCors + label: "Allow Cross Origin Requests" + schema: + type: boolean + show_if: [["advanced", "=", true]] + default: false + - variable: ingressClassName + label: (Advanced/Optional) IngressClass Name + schema: + type: string + show_if: [["advanced", "=", true]] + default: "" + - variable: tls + label: TLS-Settings + schema: + type: list + show_if: [["advanced", "=", true]] + default: [] + items: + - variable: tlsEntry + label: Host + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: Certificate Hosts + schema: + type: list + default: [] + items: + - variable: host + label: Host + schema: + type: string + default: "" + required: true + - variable: certificateIssuer + label: Use Cert-Manager clusterIssuer + description: 'add the name of your cert-manager clusterIssuer here for automatic tls certificates.' + schema: + type: string + default: "" + - variable: clusterCertificate + label: 'Cluster Certificate (Advanced)' + description: 'Add the name of your cluster-wide certificate, that you set up in the ClusterIssuer chart.' + schema: + type: string + show_if: [["certificateIssuer", "=", ""]] + default: "" + - variable: secretName + label: 'Use Custom Certificate Secret (Advanced)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: string + default: "" + - variable: scaleCert + label: 'Use TrueNAS SCALE Certificate (Deprecated)' + schema: + show_if: [["certificateIssuer", "=", ""]] + type: int + $ref: + - "definitions/certificate" + - variable: envList + label: Codeserver Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + - variable: netshoot + label: Netshoot + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: Enabled + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: envList + label: Netshoot Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + - variable: vpn + label: VPN + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: Type + schema: + type: string + default: disabled + enum: + - value: disabled + description: disabled + - value: gluetun + description: Gluetun + - value: tailscale + description: Tailscale + - value: openvpn + description: OpenVPN (Deprecated) + - value: wireguard + description: Wireguard (Deprecated) + - variable: openvpn + label: OpenVPN Settings + schema: + additional_attrs: true + type: dict + show_if: [["type", "=", "openvpn"]] + attrs: + - variable: username + label: Authentication Username (Optional) + description: Authentication Username, Optional + schema: + type: string + default: "" + - variable: password + label: Authentication Password + description: Authentication Credentials + schema: + type: string + show_if: [["username", "!=", ""]] + default: "" + required: true + - variable: tailscale + label: Tailscale Settings + schema: + additional_attrs: true + type: dict + show_if: [["type", "=", "tailscale"]] + attrs: + - variable: authkey + label: Authentication Key + description: Provide an auth key to automatically authenticate the node as your user account. + schema: + type: string + private: true + default: "" + - variable: auth_once + label: Auth Once + description: Only attempt to log in if not already logged in. + schema: + type: boolean + default: true + - variable: accept_dns + label: Accept DNS + description: Accept DNS configuration from the admin console. + schema: + type: boolean + default: false + - variable: userspace + label: Userspace + description: Userspace Networking mode allows running Tailscale where you do not have access to create a VPN tunnel device. + schema: + type: boolean + default: false + - variable: routes + label: Routes + description: Expose physical subnet routes to your entire Tailscale network. + schema: + type: string + default: "" + - variable: dest_ip + label: Destination IP + description: Tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched. + schema: + type: string + default: "" + - variable: sock5_server + label: Sock5 Server + description: The address on which to listen for SOCKS5 proxying into the tailscale net. + schema: + type: string + default: "" + - variable: outbound_http_proxy_listen + label: Outbound HTTP Proxy Listen + description: The address on which to listen for HTTP proxying into the tailscale net. + schema: + type: string + default: "" + - variable: extra_args + label: Extra Args + description: Extra Args + schema: + type: string + default: "" + - variable: daemon_extra_args + label: Tailscale Daemon Extra Args + description: Tailscale Daemon Extra Args + schema: + type: string + default: "" + - variable: killSwitch + label: Enable Killswitch + schema: + type: boolean + show_if: [["type", "!=", "disabled"]] + default: true + - variable: excludedNetworks_IPv4 + label: Killswitch Excluded IPv4 networks + description: List of Killswitch Excluded IPv4 Addresses + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv4 + label: IPv4 Network + schema: + type: string + required: true + - variable: excludedNetworks_IPv6 + label: Killswitch Excluded IPv6 networks + description: "List of Killswitch Excluded IPv6 Addresses" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv6 + label: IPv6 Network + schema: + type: string + required: true + - variable: configFile + label: VPN Config File Location + schema: + type: string + show_if: [["type", "!=", "disabled"]] + default: "" + + - variable: envList + label: VPN Environment Variables + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: Environment Variable + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: Name + schema: + type: string + required: true + - variable: value + label: Value + schema: + type: string + required: true + max_length: 10240 + - variable: docs + group: Documentation + label: Please read the documentation at https://truecharts.org + description: Please read the documentation at +
https://truecharts.org + schema: + additional_attrs: true + type: dict + attrs: + - variable: confirmDocs + label: I have checked the documentation + schema: + type: boolean + default: true + - variable: donateNag + group: Documentation + label: Please consider supporting TrueCharts, see https://truecharts.org/sponsor + description: Please consider supporting TrueCharts, see +
https://truecharts.org/sponsor + schema: + additional_attrs: true + type: dict + attrs: + - variable: confirmDonate + label: I have considered donating + schema: + type: boolean + default: true + hidden: true diff --git a/stable/nextcloud/25.0.6/templates/NOTES.txt b/stable/nextcloud/25.0.6/templates/NOTES.txt new file mode 100644 index 0000000000..efcb74cb77 --- /dev/null +++ b/stable/nextcloud/25.0.6/templates/NOTES.txt @@ -0,0 +1 @@ +{{- include "tc.v1.common.lib.chart.notes" $ -}} diff --git a/stable/nextcloud/25.0.6/templates/_configmap.tpl b/stable/nextcloud/25.0.6/templates/_configmap.tpl new file mode 100644 index 0000000000..081cf5d71c --- /dev/null +++ b/stable/nextcloud/25.0.6/templates/_configmap.tpl @@ -0,0 +1,443 @@ +{{- define "nextcloud.accessurl" -}} + {{- $accessUrl := .Values.chartContext.appUrl -}} + {{- if or (contains "127.0.0.1" $accessUrl) (contains "localhost" $accessUrl) -}} + {{- if .Values.nextcloud.general.accessIP -}} + {{- $prot := "http" -}} + {{- $host := .Values.nextcloud.general.accessIP -}} + {{- $port := .Values.service.main.ports.main.port -}} + {{/* + Allowing here to override protocol and port + should be enough to make it work with any rev proxy + */}} + {{- $accessUrl = printf "%v://%v:%v" $prot $host $port -}} + {{- end -}} + {{- end -}} + + {{- $accessUrl -}} +{{- end -}} + +{{- define "nextcloud.accesshost" -}} + {{- $accessUrl := (include "nextcloud.accessurl" $) -}} + {{- $accessHost := regexReplaceAll ".*://(.*)" $accessUrl "${1}" -}} + {{- $accessHost = regexReplaceAll "(.*):.*" $accessHost "${1}" -}} + + {{- $accessHost -}} +{{- end -}} + +{{/* Define the configmap */}} +{{- define "nextcloud.configmaps" -}} +{{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $) -}} +{{- $fqdn := (include "tc.v1.common.lib.chart.names.fqdn" $) -}} +{{- $accessUrl := (include "nextcloud.accessurl" $) -}} +{{- $accessHost := (include "nextcloud.accesshost" $) -}} +{{- $accessHostPort := regexReplaceAll ".*://(.*)" $accessUrl "${1}" -}} +{{- $accessProtocol := regexReplaceAll "(.*)://.*" $accessUrl "${1}" -}} +{{- $redisHost := .Values.redis.creds.plainhost | trimAll "\"" -}} +{{- $redisPass := .Values.redis.creds.redisPassword | trimAll "\"" -}} +{{- $healthHost := "kube.internal.healthcheck" -}} + +php-tune: + enabled: true + data: + zz-tune.conf: | + [www] + pm.max_children = {{ .Values.nextcloud.php.pm_max_children }} + pm.start_servers = {{ .Values.nextcloud.php.pm_start_servers }} + pm.min_spare_servers = {{ .Values.nextcloud.php.pm_min_spare_servers }} + pm.max_spare_servers = {{ .Values.nextcloud.php.pm_max_spare_servers }} + +opcache: + enabled: true + data: + opcache-recommended.ini: | + opcache.enable=1 + opcache.save_comments=1 + opcache.jit=1255 + opcache.interned_strings_buffer={{ .Values.nextcloud.opcache.interned_strings_buffer }} + opcache.max_accelerated_files={{ .Values.nextcloud.opcache.max_accelerated_files }} + opcache.memory_consumption={{ .Values.nextcloud.opcache.memory_consumption }} + opcache.revalidate_freq={{ .Values.nextcloud.opcache.revalidate_freq }} + opcache.jit_buffer_size={{ printf "%vM" .Values.nextcloud.opcache.jit_buffer_size }} + +redis-session: + enabled: true + data: + redis-session.ini: | + session.save_handler = redis + session.save_path = {{ printf "tcp://%v:6379?auth=%v" $redisHost $redisPass | quote }} + redis.session.locking_enabled = 1 + redis.session.lock_retries = -1 + redis.session.lock_wait_time = 10000 + +hpb-config: + enabled: {{ .Values.nextcloud.notify_push.enabled }} + data: + NEXTCLOUD_URL: {{ printf "http://%v:%v" $fullname .Values.service.main.ports.main.port }} + HPB_HOST: {{ $healthHost }} + CONFIG_FILE: {{ printf "%v/config.php" .Values.persistence.config.targetSelector.notify.notify.mountPath }} + METRICS_PORT: {{ .Values.service.notify.ports.metrics.port | quote }} + +clamav-config: + enabled: {{ .Values.nextcloud.clamav.enabled }} + data: + CLAMAV_NO_CLAMD: "false" + CLAMAV_NO_FRESHCLAMD: "true" + CLAMAV_NO_MILTERD: "true" + CLAMD_STARTUP_TIMEOUT: "1800" + +collabora-config: + enabled: {{ .Values.nextcloud.collabora.enabled }} + data: + aliasgroup1: {{ $accessUrl }} + server_name: {{ $accessHostPort }} + dictionaries: {{ join " " .Values.nextcloud.collabora.dictionaries }} + username: {{ .Values.nextcloud.collabora.username | quote }} + password: {{ .Values.nextcloud.collabora.password | quote }} + DONT_GEN_SSL_CERT: "true" + # mount_jail_tree is only used for local storage + # not needed for WOPI https://github.com/CollaboraOnline/online/issues/3604#issuecomment-989833814 + extra_params: | + --o:ssl.enable=false + --o:ssl.termination=true + --o:net.service_root=/collabora + --o:home_mode.enable=true + --o:welcome.enable=false + --o:logging.level=warning + --o:logging.level_startup=warning + --o:security.seccomp=true + --o:mount_jail_tree=false + --o:user_interface.mode={{ .Values.nextcloud.collabora.interface_mode }} + +nextcloud-config: + enabled: true + data: + {{/* Database */}} + POSTGRES_DB: {{ .Values.cnpg.main.database | quote }} + POSTGRES_USER: {{ .Values.cnpg.main.user | quote }} + POSTGRES_PASSWORD: {{ .Values.cnpg.main.creds.password | trimAll "\"" }} + POSTGRES_HOST: {{ .Values.cnpg.main.creds.host | trimAll "\"" }} + + {{/* Redis */}} + NX_REDIS_HOST: {{ $redisHost }} + NX_REDIS_PASS: {{ $redisPass }} + + {{/* Nextcloud INITIAL credentials */}} + NEXTCLOUD_ADMIN_USER: {{ .Values.nextcloud.credentials.initialAdminUser | quote }} + NEXTCLOUD_ADMIN_PASSWORD: {{ .Values.nextcloud.credentials.initialAdminPassword | quote }} + + {{/* PHP Variables */}} + PHP_MEMORY_LIMIT: {{ .Values.nextcloud.php.memory_limit | quote }} + PHP_UPLOAD_LIMIT: {{ .Values.nextcloud.php.upload_limit | quote }} + + {{/* Notify Push */}} + NX_NOTIFY_PUSH: {{ .Values.nextcloud.notify_push.enabled | quote }} + {{- if .Values.nextcloud.notify_push.enabled }} + NX_NOTIFY_PUSH_ENDPOINT: {{ $accessUrl }}/push + {{- end }} + + {{/* Previews */}} + NX_PREVIEWS: {{ .Values.nextcloud.previews.enabled | quote }} + NX_PREVIEW_PROVIDERS: {{ join " " .Values.nextcloud.previews.providers }} + NX_PREVIEW_MAX_X: {{ .Values.nextcloud.previews.max_x | quote }} + NX_PREVIEW_MAX_Y: {{ .Values.nextcloud.previews.max_y | quote }} + NX_PREVIEW_MAX_MEMORY: {{ .Values.nextcloud.previews.max_memory | quote }} + NX_PREVIEW_MAX_FILESIZE_IMAGE: {{ .Values.nextcloud.previews.max_file_size_image | quote }} + NX_JPEG_QUALITY: {{ .Values.nextcloud.previews.jpeg_quality | quote }} + NX_PREVIEW_SQUARE_SIZES: {{ .Values.nextcloud.previews.square_sizes | quote }} + NX_PREVIEW_WIDTH_SIZES: {{ .Values.nextcloud.previews.width_sizes | quote }} + NX_PREVIEW_HEIGHT_SIZES: {{ .Values.nextcloud.previews.height_sizes | quote }} + + {{/* Imaginary */}} + NX_IMAGINARY: {{ and .Values.nextcloud.previews.enabled .Values.nextcloud.previews.imaginary | quote }} + {{- if and .Values.nextcloud.previews.enabled .Values.nextcloud.previews.imaginary }} + NX_IMAGINARY_URL: {{ printf "http://%v-imaginary:%v" $fullname .Values.service.imaginary.ports.imaginary.port }} + {{- end }} + + {{/* Expirations */}} + NX_ACTIVITY_EXPIRE_DAYS: {{ .Values.nextcloud.expirations.activity_expire_days | quote }} + NX_TRASH_RETENTION: {{ .Values.nextcloud.expirations.trash_retention_obligation | quote }} + NX_VERSIONS_RETENTION: {{ .Values.nextcloud.expirations.versions_retention_obligation | quote }} + + {{/* General */}} + NX_RUN_OPTIMIZE: {{ .Values.nextcloud.general.run_optimize | quote }} + NX_DEFAULT_PHONE_REGION: {{ .Values.nextcloud.general.default_phone_region | quote }} + NEXTCLOUD_DATA_DIR: {{ .Values.persistence.data.targetSelector.main.main.mountPath }} + NX_FORCE_ENABLE_ALLOW_LOCAL_REMOTE_SERVERS: {{ .Values.nextcloud.general.force_enable_allow_local_remote_servers | quote }} + + {{/* Files */}} + NX_SHARED_FOLDER_NAME: {{ .Values.nextcloud.files.shared_folder_name | quote }} + NX_MAX_CHUNKSIZE: {{ .Values.nextcloud.files.max_chunk_size | mul 1 | quote }} + + {{/* Logging */}} + NX_LOG_LEVEL: {{ .Values.nextcloud.logging.log_level | quote }} + NX_LOG_FILE: {{ .Values.nextcloud.logging.log_file | quote }} + NX_LOG_FILE_AUDIT: {{ .Values.nextcloud.logging.log_audit_file | quote }} + NX_LOG_DATE_FORMAT: {{ .Values.nextcloud.logging.log_date_format | quote }} + NX_LOG_TIMEZONE: {{ .Values.TZ | quote }} + + {{/* ClamAV */}} + NX_CLAMAV: {{ .Values.nextcloud.clamav.enabled | quote }} + {{- if .Values.nextcloud.clamav.enabled }} + NX_CLAMAV_HOST: {{ printf "%v-clamav" $fullname }} + NX_CLAMAV_PORT: {{ .Values.service.clamav.ports.clamav.targetPort | quote }} + NX_CLAMAV_STREAM_MAX_LENGTH: {{ .Values.nextcloud.clamav.stream_max_length | mul 1 | quote }} + NX_CLAMAV_FILE_MAX_SIZE: {{ .Values.nextcloud.clamav.file_max_size | quote }} + NX_CLAMAV_INFECTED_ACTION: {{ .Values.nextcloud.clamav.infected_action | quote }} + {{- end }} + + {{/* Collabora */}} + NX_COLLABORA: {{ .Values.nextcloud.collabora.enabled | quote }} + {{- if .Values.nextcloud.collabora.enabled }} + NX_COLLABORA_URL: {{ printf "%v/collabora" $accessUrl | quote }} + # Ideally this would be a combo of: public ip, pod cidr, svc cidr + # But not always people have static IP. + NX_COLLABORA_ALLOWLIST: "0.0.0.0/0" + {{- end }} + + {{/* Only Office */}} + NX_ONLYOFFICE: {{ .Values.nextcloud.onlyoffice.enabled | quote }} + {{- if .Values.nextcloud.onlyoffice.enabled }} + NX_ONLYOFFICE_URL: {{ .Values.nextcloud.onlyoffice.url | quote }} + NX_ONLYOFFICE_INTERNAL_URL: {{ .Values.nextcloud.onlyoffice.internal_url | quote }} + NX_ONLYOFFICE_VERIFY_SSL: {{ .Values.nextcloud.onlyoffice.verify_ssl | quote }} + NX_ONLYOFFICE_NEXTCLOUD_INTERNAL_URL: {{ printf "http://%v.svc.cluster.local:%v" $fqdn .Values.service.main.ports.main.port }} + NX_ONLYOFFICE_JWT: {{ .Values.nextcloud.onlyoffice.jwt | quote }} + NX_ONLYOFFICE_JWT_HEADER: {{ .Values.nextcloud.onlyoffice.jwt_header | quote }} + {{- end }} + + {{/* URLs */}} + NX_OVERWRITE_HOST: {{ $accessHostPort }} + NX_OVERWRITE_CLI_URL: {{ $accessUrl }} + # Return the protocol part of the URL + NX_OVERWRITE_PROTOCOL: {{ $accessProtocol | lower }} + # IP (or range in this case) of the proxy(ies) + NX_TRUSTED_PROXIES: | + {{ .Values.chartContext.podCIDR }} + {{ .Values.chartContext.svcCIDR }} + # fullname-* will allow access from the + # other services in the same namespace + NX_TRUSTED_DOMAINS: | + 127.0.0.1 + localhost + {{ $fullname }} + {{ printf "%v-*" $fullname }} + {{ $healthHost }} + {{- if not (contains "127.0.0.1" $accessHost) }} + {{- $accessHost | nindent 6 }} + {{- end -}} + {{- with .Values.nextcloud.general.accessIP }} + {{- . | nindent 6 }} + {{- end }} + +# TODO: Replace locations with ingress +# like /push, /.well-known/carddav, /.well-known/caldav +# needs some work as nginx converts urls to pretty urls +# before matching them to locations, so ingress needs to +# take that into consideration. +nginx-config: + enabled: true + data: + nginx.conf: | + worker_processes auto; + + error_log /var/log/nginx/error.log warn; + # Set to /tmp so it can run as non-root + pid /tmp/nginx.pid; + + events { + worker_connections 1024; + } + + http { + # Set to /tmp so it can run as non-root + client_body_temp_path /tmp/nginx/client_temp; + proxy_temp_path /tmp/nginx/proxy_temp_path; + fastcgi_temp_path /tmp/nginx/fastcgi_temp; + uwsgi_temp_path /tmp/nginx/uwsgi_temp; + scgi_temp_path /tmp/nginx/scgi_temp; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + # Prevent nginx HTTP Server Detection + server_tokens off; + + keepalive_timeout 65; + + #gzip on; + + upstream php-handler { + server {{ printf "%v-nextcloud" $fullname }}:{{ .Values.service.nextcloud.ports.nextcloud.targetPort }}; + } + + server { + listen {{ .Values.service.main.ports.main.port }}; + absolute_redirect off; + + {{- if .Values.nextcloud.notify_push.enabled }} + # Forward Notify_Push "High Performance Backend" to it's own container + location ^~ /push/ { + # The trailing "/" is important! + proxy_pass http://{{ printf "%v-notify" $fullname }}:{{ .Values.service.notify.ports.notify.targetPort }}/; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + {{- end }} + + # HSTS settings + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + + # Set max upload size + client_max_body_size {{ .Values.nextcloud.php.upload_limit | default "512M" }}; + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + # Pagespeed is not supported by Nextcloud, so if your server is built + # with the `ngx_pagespeed` module, uncomment this line to disable it. + #pagespeed off; + + include mime.types; + types { + text/javascript js mjs; + } + + # HTTP response headers borrowed from Nextcloud `.htaccess` + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "noindex, nofollow" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + # Path to the root of your installation + root {{ .Values.persistence.html.targetSelector.nginx.nginx.mountPath }}; + + # Specify how to handle directories -- specifying `/index.php$request_uri` + # here as the fallback means that Nginx always exhibits the desired behaviour + # when a client requests a path that corresponds to a directory that exists + # on the server. In particular, if that directory contains an index.php file, + # that file is correctly served; if it doesn't, then the request is passed to + # the front-end controller. This consistent behaviour means that we don't need + # to specify custom rules for certain paths (e.g. images and other assets, + # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus + # `try_files $uri $uri/ /index.php$request_uri` + # always provides the desired behaviour. + index index.php index.html /index.php$request_uri; + + # Rule borrowed from `.htaccess` to handle Microsoft DAV clients + location = / { + if ( $http_user_agent ~ ^DavClnt ) { + return 302 /remote.php/webdav/$is_args$args; + } + } + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + # Make a regex exception for `/.well-known` so that clients can still + # access it despite the existence of the regex rule + # `location ~ /(\.|autotest|...)` which would otherwise handle requests + # for `/.well-known`. + location ^~ /.well-known { + # The rules in this block are an adaptation of the rules + # in `.htaccess` that concern `/.well-known`. + + location = /.well-known/carddav { return 301 /remote.php/dav/; } + location = /.well-known/caldav { return 301 /remote.php/dav/; } + + location /.well-known/acme-challenge { try_files $uri $uri/ =404; } + location /.well-known/pki-validation { try_files $uri $uri/ =404; } + + # Let Nextcloud's API for `/.well-known` URIs handle all other + # requests by passing them to the front-end controller. + return 301 /index.php$request_uri; + } + + # Rules borrowed from `.htaccess` to hide certain paths from clients + location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } + location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } + + # Ensure this block, which passes PHP files to the PHP process, is above the blocks + # which handle static assets (as seen below). If this block is not declared first, + # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php` + # to the URI, resulting in a HTTP 500 error response. + location ~ \.php(?:$|/) { + # Required for legacy support + rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri; + + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + set $path_info $fastcgi_path_info; + + try_files $fastcgi_script_name =404; + + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + #fastcgi_param HTTPS on; + + fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice + fastcgi_param front_controller_active true; # Enable pretty urls + fastcgi_pass php-handler; + + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + proxy_send_timeout 3600s; + proxy_read_timeout 3600s; + fastcgi_send_timeout 3600s; + fastcgi_read_timeout 3600s; + } + + location ~ \.(?:css|js|svg|gif)$ { + try_files $uri /index.php$request_uri; + expires 6M; # Cache-Control policy borrowed from `.htaccess` + access_log off; # Optional: Don't log access to assets + } + + location ~ \.woff2?$ { + try_files $uri /index.php$request_uri; + expires 7d; # Cache-Control policy borrowed from `.htaccess` + access_log off; # Optional: Don't log access to assets + } + + # Rule borrowed from `.htaccess` + location /remote { + return 301 /remote.php$request_uri; + } + + location / { + try_files $uri $uri/ /index.php$request_uri; + } + } + } +{{- end -}} diff --git a/stable/nextcloud/25.0.6/templates/_cronjobs.tpl b/stable/nextcloud/25.0.6/templates/_cronjobs.tpl new file mode 100644 index 0000000000..0fa050dba6 --- /dev/null +++ b/stable/nextcloud/25.0.6/templates/_cronjobs.tpl @@ -0,0 +1,34 @@ +{{- define "nextcloud.cronjobs" -}} +{{- range $cj := .Values.cronjobs }} + {{- $name := $cj.name | required "Nextcloud - Expected non-empty name in cronjob" -}} + {{- $schedule := $cj.schedule | required "Nextcloud - Expected non-empty schedule in cronjob" }} + +{{ $name }}: + enabled: {{ $cj.enabled | quote }} + type: CronJob + schedule: {{ $schedule | quote }} + podSpec: + restartPolicy: Never + containers: + {{ $name }}: + enabled: true + primary: true + imageSelector: image + command: + - /bin/bash + - -c + - | + {{- range $cj.cmd }} + {{- . | nindent 12 }} + {{- else -}} + {{- fail "Nextcloud - Expected non-empty cmd in cronjob" -}} + {{- end }} + probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false +{{- end }} +{{- end -}} diff --git a/stable/nextcloud/25.0.6/templates/_ingressInjector.tpl b/stable/nextcloud/25.0.6/templates/_ingressInjector.tpl new file mode 100644 index 0000000000..12960bd28d --- /dev/null +++ b/stable/nextcloud/25.0.6/templates/_ingressInjector.tpl @@ -0,0 +1,24 @@ +{{- define "nextcloud.ingressInjector" -}} + {{- if .Values.ingress.main.enabled -}} + {{- $injectPaths := list -}} + {{- if .Values.nextcloud.collabora.enabled -}} + {{- $injectPaths = mustAppend $injectPaths (include "nextcloud.collabora.ingress" $ | fromYaml) -}} + {{- end -}} + {{/* Append more paths here if needed */}} + + {{- range $host := .Values.ingress.main.hosts -}} + {{- $paths := $host.paths -}} + {{- $paths = concat $paths $injectPaths -}} + {{- $_ := set $host "paths" $paths -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{- define "nextcloud.collabora.ingress" -}} +{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" . }} +path: /collabora/ +pathType: Prefix +overrideService: + name: {{ printf "%v-collabora" $fullname }} + port: {{ .Values.service.collabora.ports.collabora.port }} +{{- end -}} diff --git a/stable/nextcloud/25.0.6/templates/_initPerms.tpl b/stable/nextcloud/25.0.6/templates/_initPerms.tpl new file mode 100644 index 0000000000..ed94790ad9 --- /dev/null +++ b/stable/nextcloud/25.0.6/templates/_initPerms.tpl @@ -0,0 +1,29 @@ +{{- define "nextcloud.init.perms" -}} +{{- $uid := .Values.securityContext.container.runAsUser -}} +{{- $gid := .Values.securityContext.container.runAsGroup -}} +{{- $path := .Values.persistence.data.targetSelector.main.main.mountPath }} +enabled: true +type: install +imageSelector: alpineImage +securityContext: + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + capabilities: + disableS6Caps: true + add: + - DAC_OVERRIDE + - FOWNER + - CHOWN +command: /bin/sh +args: + - -c + - | + echo "Setting permissions to 700 on data directory [{{ $path }}] ..." + chmod 770 {{ $path }} | echo "Failed to set permissions on data directory [{{ $path }}]" + + echo "Setting ownership to {{ $uid }}:{{ $gid }} on data directory [{{ $path }}] ..." + chown {{ $uid }}:{{ $gid }} {{ $path }} | echo "Failed to set ownership on data directory [{{ $path }}]" + + echo "Finished." +{{- end -}} diff --git a/stable/nextcloud/25.0.6/templates/_validation.tpl b/stable/nextcloud/25.0.6/templates/_validation.tpl new file mode 100644 index 0000000000..5650c0f63f --- /dev/null +++ b/stable/nextcloud/25.0.6/templates/_validation.tpl @@ -0,0 +1,42 @@ +{{- define "nextcloud.validation" -}} + + {{- if not (mustRegexMatch "^[0-9]+(M|G){1}$" .Values.nextcloud.php.memory_limit) -}} + {{- fail (printf "Nextcloud - Expected Memory Limit to be in format [1M, 1G] but got [%v]" .Values.nextcloud.php.memory_limit) -}} + {{- end -}} + + {{- if not (mustRegexMatch "^[0-9]+(M|G){1}$" .Values.nextcloud.php.upload_limit) -}} + {{- fail (printf "Nextcloud - Expected Memory Limit to be in format [1M, 1G] but got [%v]" .Values.nextcloud.php.upload_limit) -}} + {{- end -}} + + {{- if not (deepEqual .Values.nextcloud.previews.providers (uniq .Values.nextcloud.previews.providers)) -}} + {{- fail (printf "Nextcloud - Expected preview providers to be unique but got [%v]" .Values.nextcloud.previews.providers) -}} + {{- end -}} + + {{- if and .Values.nextcloud.collabora.enabled .Values.nextcloud.onlyoffice.enabled -}} + {{- fail "Nextcloud - Expected only one of [Collabora, OnlyOffice] to be enabled" -}} + {{- end -}} + + {{- if contains "$" .Values.nextcloud.collabora.password -}} + {{- fail "Nextcloud - Collabora [Password] cannot contain [$]" -}} + {{- end -}} + + {{- if .Values.nextcloud.collabora.enabled -}} + {{- if lt (len .Values.nextcloud.collabora.password) 8 -}} + {{- fail "Nextcloud - Collabora [Password] must be at least 8 characters" -}} + {{- end -}} + + {{- $collaboraUIModes := (list "default" "compact" "tabbed") -}} + {{- if not (mustHas .Values.nextcloud.collabora.interface_mode $collaboraUIModes) -}} + {{- fail (printf "Nextcloud - Expected [Interface Mode] in Collabora to be one of [%v], but got [%v]" (join "," $collaboraUIModes) .Values.nextcloud.collabora.interface_mode) -}} + {{- end -}} + + {{- if not .Values.nextcloud.collabora.dictionaries -}} + {{- fail "Nextcloud - Expected non-empty Collabora [Dictionaries]" -}} + {{- end -}} + + {{- if not (deepEqual .Values.nextcloud.collabora.dictionaries (uniq .Values.nextcloud.collabora.dictionaries)) -}} + {{- fail "Nextcloud - Collabora [Dictionaries] must be unique" -}} + {{- end -}} + {{- end -}} + +{{- end -}} diff --git a/stable/nextcloud/25.0.6/templates/_waitNextcloud.tpl b/stable/nextcloud/25.0.6/templates/_waitNextcloud.tpl new file mode 100644 index 0000000000..24946d640e --- /dev/null +++ b/stable/nextcloud/25.0.6/templates/_waitNextcloud.tpl @@ -0,0 +1,25 @@ +{{- define "nextcloud.wait.nextcloud" -}} +{{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $) -}} +{{- $ncURL := printf "%v-nextcloud:%v" $fullname .Values.service.nextcloud.ports.nextcloud.targetPort }} +enabled: true +type: init +imageSelector: image +securityContext: +command: /bin/sh +args: + - -c + - | + echo "Waiting Nextcloud [{{ $ncURL }}] to be ready and installed..." + until \ + REQUEST_METHOD="GET" \ + SCRIPT_NAME="status.php" \ + SCRIPT_FILENAME="status.php" \ + cgi-fcgi -bind -connect "{{ $ncURL }}" | grep -q '"installed":true'; + do + echo "Waiting Nextcloud [{{ $ncURL }}] to be ready and installed..." + sleep 3 + done + + echo "Nextcloud is ready and installed..." + echo "Starting Nginx..." +{{- end -}} diff --git a/stable/nextcloud/25.0.6/templates/common.yaml b/stable/nextcloud/25.0.6/templates/common.yaml new file mode 100644 index 0000000000..1eeaf033eb --- /dev/null +++ b/stable/nextcloud/25.0.6/templates/common.yaml @@ -0,0 +1,80 @@ +{{/* Make sure all variables are set properly */}} +{{- include "tc.v1.common.loader.init" . -}} + +{{- include "nextcloud.validation" $ -}} + +{{/* Render configmaps for all pods */}} +{{- $configmaps := include "nextcloud.configmaps" . | fromYaml -}} +{{- if $configmaps -}} + {{- $_ := mustMergeOverwrite .Values.configmap $configmaps -}} +{{- end -}} + +{{/* Create hostAliases (resolve ingress host to Node/LB IP) */}} +{{- $hostAlias := (list (dict + "ip" .Values.nextcloud.general.accessIP + "hostnames" ( + list (include "nextcloud.accesshost" $) + ) + )) -}} + +{{/* Add [hostAliases] to nextcloud and collabora pod */}} +{{- $_ := set .Values.workload.main.podSpec "hostAliases" $hostAlias -}} +{{- $_ := set .Values.workload.collabora.podSpec "hostAliases" $hostAlias -}} + +{{/* Add [init perms] container to nextcloud */}} +{{- if not (get .Values.workload.main.podSpec "initContainers") -}} + {{- $_ := set .Values.workload.main.podSpec "initContainers" dict -}} +{{- end -}} + +{{- $initPerms := (include "nextcloud.init.perms" . | fromYaml) -}} +{{- $_ := set .Values.workload.main.podSpec.initContainers "init-perms" $initPerms -}} + +{{/* Add [wait nextcloud] container to nginx */}} +{{- if not (get .Values.workload.nginx.podSpec "initContainers") -}} + {{- $_ := set .Values.workload.nginx.podSpec "initContainers" dict -}} +{{- end -}} +{{- $waitNextcloud := (include "nextcloud.wait.nextcloud" . | fromYaml) -}} +{{- $_ := set .Values.workload.nginx.podSpec.initContainers "wait-nextcloud" $waitNextcloud -}} + +{{/* Disable [notify push] if requested */}} +{{- if not .Values.nextcloud.notify_push.enabled -}} + {{- $_ := set .Values.workload.notify "enabled" false -}} + {{- $_ := set .Values.service.notify "enabled" false -}} +{{- else -}} + {{/* Add [wait nextcloud] container to notify push */}} + {{- if not (get .Values.workload.notify.podSpec "initContainers") -}} + {{- $_ := set .Values.workload.notify.podSpec "initContainers" dict -}} + {{- end -}} + {{- $waitNextcloud := (include "nextcloud.wait.nextcloud" . | fromYaml) -}} + {{- $_ := set .Values.workload.notify.podSpec.initContainers "wait-nextcloud" $waitNextcloud -}} +{{- end -}} + +{{/* Disable [clamav] if requested */}} +{{- if not .Values.nextcloud.clamav.enabled -}} + {{- $_ := set .Values.workload.clamav "enabled" false -}} + {{- $_ := set .Values.service.clamav "enabled" false -}} +{{- end -}} + +{{/* Disable [previews] if requested */}} +{{- if or (not .Values.nextcloud.previews.imaginary) (not .Values.nextcloud.previews.enabled) -}} + {{- $_ := set .Values.workload.imaginary "enabled" false -}} + {{- $_ := set .Values.service.imaginary "enabled" false -}} +{{- end -}} + +{{/* Disable [collabora] if requested */}} +{{- if not .Values.nextcloud.collabora.enabled -}} + {{- $_ := set .Values.workload.collabora "enabled" false -}} + {{- $_ := set .Values.service.collabora "enabled" false -}} +{{- end -}} + +{{/* Create [cronjobs] defined */}} +{{- $cronjobs := include "nextcloud.cronjobs" . | fromYaml -}} +{{- if $cronjobs -}} + {{- $_ := mustMergeOverwrite .Values.workload $cronjobs -}} +{{- end -}} + +{{/* TODO: Do we have to cleanup when something (eg Collabora) is disabled? */}} +{{- include "nextcloud.ingressInjector" $ -}} + +{{/* Render the templates */}} +{{- include "tc.v1.common.loader.apply" . -}} diff --git a/stable/nextcloud/25.0.6/values.yaml b/stable/nextcloud/25.0.6/values.yaml new file mode 100644 index 0000000000..e69de29bb2