Chart values

Inspect the values shipped with any published version:

helm show values r5d-chat/r5d-chat --version 0.1.0

Images

string

default:"ghcr.io/ricsam/r5d-chat-control-plane"

Control-plane image repository.

string

default:"(chart appVersion)"

Control-plane image tag. When empty, the chart’s appVersion is used, so the chart version pins the image published with it.

string

default:"IfNotPresent"

Image pull policy for the control plane.

string

default:"ghcr.io/ricsam/r5d-chat-workspace"

Workspace image repository, used for every user pod the controller creates.

string

default:"(chart appVersion)"

Workspace image tag. When empty, the chart’s appVersion is used.

array

default:"[]"

Pull secrets for control-plane pods, for example [{ name: ghcr-pull }]. This does not apply to workspace pods; set workspace.imagePullSecret too.

integer

default:"1"

Control-plane replica count.

Core settings

string

default:"self-hosted"

self-hosted or managed. Self-hosted installations should leave this at the default: it runs the complete product with no payment provider, no paywall, and invite-only registration. managed is used only by the hosted r5d.chat service and enables subscription billing and open sign-up.

string

default:"http://r5d-chat.local"

required

The exact external URL of the installation. Used for session cookies, auth redirects, and the address workspaces use to call back into the control plane. A mismatch causes login loops.

string

default:""

Name of a pre-created Secret holding the application credentials. Strongly recommended for production. When set, the chart does not create a Secret and the secrets.* values are ignored.

string

default:""

PostgreSQL connection string. Defaults to the bundled database when empty. Only used when existingSecret is empty.

string

default:""

required

Session signing key of at least 32 characters. Required when existingSecret is empty.

string

default:""

required

AES-256-GCM key of at least 32 characters that encrypts provider and OIDC credentials. Required when existingSecret is empty. Back it up with the database; losing it makes stored credentials unreadable.

string

default:""

One-time operator token required to create the first administrator. Set it before exposing the installation publicly.

Billing

These values apply only when edition: managed. A self-hosted installation ignores them entirely and never contacts a payment provider.

string

default:""

Polar product whose subscription grants access.

string

default:"production"

production or sandbox.

integer

default:"72"

Hours a lapsed subscription keeps access, so a failed renewal is not an instant lockout while the provider retries the charge.

string

default:""

Polar organization access token. Prefer supplying it through existingSecret as POLAR_ACCESS_TOKEN.

string

default:""

Shared secret used to verify Polar webhook signatures. Prefer supplying it through existingSecret as POLAR_WEBHOOK_SECRET.

Billing stays inert until the access token, webhook secret, and product id are all present. A managed installation with incomplete billing configuration grants access to everyone rather than locking every user out.

Service and ingress

string

default:"ClusterIP"

Service type for the control plane.

integer

default:"80"

Service port. It targets container port 3000.

boolean

default:"false"

Create an Ingress for the control plane.

string

default:"traefik"

Ingress class name.

string

default:"chat.example.com"

Hostname to route. Required when ingress.enabled is true, and should match the host in publicUrl.

object

default:"{}"

Additional Ingress annotations, for example certificate issuer directives.

Cloudflare Tunnel

Run a Cloudflare Tunnel connector next to the control plane to publish the installation without exposing an inbound port or provisioning TLS certificates yourself. The connector dials out to Cloudflare, so it works behind NAT and strict egress firewalls. Public hostnames and origin routing are configured remotely in Cloudflare (config_src: cloudflare), not in this chart. Point the tunnel’s public hostname at the control-plane Service, for example http://<release>-r5d-chat.<namespace>.svc.cluster.local:80.

publicUrl must still match the hostname users type in the browser, for example https://chat.example.com. Cloudflare terminates TLS at its edge, so keep the https:// scheme even though the tunnel forwards to the Service over plain HTTP inside the cluster.

ingress.enabled and cloudflared.enabled are independent. Enable only the tunnel to publish exclusively through Cloudflare, or enable both to keep a direct cluster-local entry point alongside it.

boolean

default:"false"

Deploy the cloudflared connector.

string

default:"cloudflared-tunnel"

Name of an existing Secret holding the tunnel connector token. Create it separately so the credential is never stored in values files:

kubectl -n <namespace> create secret generic cloudflared-tunnel \
  --from-literal=token='<connector-token>'

string

default:"token"

Key inside that Secret containing the token.

integer

default:"1"

Connector replicas. Each replica opens its own set of edge connections; use two or more to survive a node failure without dropping the tunnel.

string

default:"cloudflare/cloudflared"

Connector image repository.

string

default:"2026.2.0"

Connector image tag. Pin it, and update deliberately, because --no-autoupdate is set.

string

default:"1"

Arbitrary value copied to a pod annotation. Change it to force a connector restart, which is occasionally useful after editing remote tunnel routing.

object

Connector resource requests and limits.

Workspaces

string

default:"rook-ceph-block"

Storage class for per-user home PVCs. Must support ReadWriteOnce.

string

default:"5Gi"

Size of each user’s home volume. This applies at creation time; growing it later affects only newly created workspaces.

integer

default:"1800"

Seconds of inactivity, with no active leases, before a workspace scales to zero.

string

default:""

Optional RuntimeClass for workspace pods. Set to kata or gvisor for a stronger isolation boundary.

string

default:""

Name of a pull secret attached to workspace pods. Required for private workspace images.

object

default:"{ cpu: 200m, memory: 512Mi }"

Resource requests for workspace pods.

object

default:"{ cpu: '2', memory: 2Gi }"

Resource limits for workspace pods. Raise the memory limit if agents run builds or data processing.

object

default:"{ cpu: 50m, memory: 128Mi }"

Control-plane resource requests.

object

default:"{ cpu: 500m, memory: 512Mi }"

Control-plane resource limits.

Bundled PostgreSQL

boolean

default:"true"

Deploy the bundled single-replica PostgreSQL StatefulSet. Disable it to use an external database.

string

default:"postgres:17.6-alpine"

PostgreSQL image. Version 17 is the tested baseline.

string

default:"r5d_chat"

Database user created on first start.

string

default:"r5d_chat"

Database name created on first start.

string

default:"r5d_chat"

Database password. Override it, or supply POSTGRES_PASSWORD through existingSecret.

string

default:"rook-ceph-block"

Storage class for the database volume.

string

default:"2Gi"

Size of the database volume.

The bundled database is a single replica with no automated backups. It is suitable for evaluation and small installations. Production deployments should set postgresql.enabled: false and use a managed database.

Service account and network policy

boolean

default:"true"

Create a ServiceAccount with the Role needed to reconcile workspace objects.

string

default:""

Override the ServiceAccount name.

boolean

default:"true"

Create NetworkPolicies for the control plane and workspaces. Workspace ingress is restricted to the control plane on port 7337.

boolean

default:"true"

Allow workspace pods to reach the public internet, excluding RFC1918, loopback, and link-local ranges. Set to false for air-gapped tenants, which also prevents agents from installing packages.

Reference values file

The chart ships values-r5d.yaml as a worked example of a hardened install with Kata isolation and private images:

publicUrl: https://chat.example.com
imagePullSecrets:
  - name: ghcr-pull
workspace:
  runtimeClassName: kata
  imagePullSecret: ghcr-pull
ingress:
  enabled: true
  className: traefik
  host: chat.example.com
cloudflared:
  enabled: true
  tokenSecret:
    name: cloudflared-tunnel
    key: token
postgresql:
  storageClass: rook-ceph-block

Get started

Install

Configure

Operate

Reference

Images

Core settings

Billing

Service and ingress

Cloudflare Tunnel

Workspaces

Bundled PostgreSQL

Service account and network policy

Reference values file

​Images

​Core settings

​Billing

​Service and ingress

​Cloudflare Tunnel

​Workspaces

​Bundled PostgreSQL

​Service account and network policy

​Reference values file

Images

Core settings

Billing

Service and ingress

Cloudflare Tunnel

Workspaces

Bundled PostgreSQL

Service account and network policy

Reference values file