mastodon: Add Helm values; move to chart 6.10.6 (Mastodon 4.7.5).
Upgraded 4.5.21 -> 4.6.11 -> 4.7.5 with the chart's migration hooks.
Secrets live in unmanaged Secrets (mastodon-app*); the OIDC client
secret is in the untracked values-secrets.yaml. Bitnami's free images
moved to bitnamilegacy, including the ES volume-permissions image.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Change-Id: I74df14f38b76a3a5d1e93f21380d8c65a5de6665
diff --git a/.gitignore b/.gitignore
index 39038e4..cd23af6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,4 @@
*-secrets.yaml
/samba/smbpasswd
/users/key/
+mastodon/values-secrets.yaml
diff --git a/mastodon/values.yaml b/mastodon/values.yaml
new file mode 100644
index 0000000..b968b4e
--- /dev/null
+++ b/mastodon/values.yaml
@@ -0,0 +1,194 @@
+# Helm values for release mastodon/mastodon (chart github.com/mastodon/chart 6.10.6):
+#
+# helm upgrade mastodon <chart checkout> -n mastodon \
+# -f mastodon/values.yaml -f mastodon/values-secrets.yaml --timeout 30m
+#
+# values-secrets.yaml is not in git; it holds externalAuth.oidc.client_secret.
+# All other secrets live in Secrets that Helm does not manage:
+# mastodon-app SECRET_KEY_BASE, OTP_SECRET, VAPID_*, ACTIVE_RECORD_ENCRYPTION_*, password (DB)
+# mastodon-app-smtp login, password
+# mastodon-app-redis redis-password
+
+image:
+ repository: ghcr.io/mastodon/mastodon
+ tag: v4.7.5
+ pullPolicy: IfNotPresent
+
+deploymentAnnotations:
+ k8s-app: mastodon
+revisionPodAnnotation: true
+podSecurityContext:
+ fsGroup: 991
+ runAsGroup: 991
+ runAsUser: 991
+service:
+ port: 80
+ type: ClusterIP
+serviceAccount:
+ create: true
+
+mastodon:
+ local_domain: mastodon.benkard.de
+ web_domain: mastodon.benkard.de
+ locale: de
+ authorizedFetch: false
+ limitedFederationMode: false
+ singleUserMode: false
+ preparedStatements: true
+ # Only runs on install; the admin account exists.
+ createAdmin:
+ enabled: false
+ cron:
+ removeMedia:
+ enabled: true
+ schedule: 0 0 * * 0
+ secrets:
+ existingSecret: mastodon-app
+ persistence:
+ assets:
+ accessMode: ReadWriteOnce
+ resources:
+ requests:
+ storage: 10Gi
+ storageClassName: local-path
+ system:
+ accessMode: ReadWriteOnce
+ resources:
+ requests:
+ storage: 100Gi
+ storageClassName: local-path
+ sidekiq:
+ workers:
+ - name: all-queues
+ concurrency: 25
+ replicas: 1
+ queues:
+ - default,8
+ - push,6
+ - ingress,4
+ - mailers,2
+ - pull
+ - scheduler
+ smtp:
+ existingSecret: mastodon-app-smtp
+ auth_method: plain
+ ca_file: /etc/ssl/certs/ca-certificates.crt
+ delivery_method: smtp
+ domain: mail.benkard.de
+ enable_starttls: auto
+ from_address: mastodon@benkard.de
+ openssl_verify_mode: peer
+ port: 587
+ server: mail.benkard.de
+ tls: true
+ streaming:
+ port: 4000
+ replicas: 1
+ workers: 4
+ web:
+ port: 3000
+ replicas: 1
+ workers: "2"
+ minThreads: "5"
+ maxThreads: "5"
+ persistentTimeout: "20"
+
+externalAuth:
+ oauth_global:
+ omniauth_only: true
+ oidc:
+ enabled: true
+ display_name: Keycloak
+ issuer: https://login.benkard.de/auth/realms/master
+ discovery: true
+ scope: openid,profile,email
+ uid_field: preferred_username
+ client_id: mastodon
+ redirect_uri: https://mastodon.benkard.de/auth/auth/openid_connect/callback
+ assume_email_is_verified: true
+
+ingress:
+ enabled: true
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-prod
+ kubernetes.io/ingress.class: nginx
+ kubernetes.io/tls-acme: "true"
+ nginx.ingress.kubernetes.io/proxy-body-size: 100m
+ nginx.org/client-max-body-size: 100m
+ hosts:
+ - host: mastodon.benkard.de
+ paths:
+ - path: /
+ tls:
+ - hosts:
+ - mastodon.benkard.de
+ secretName: mastodon-tls
+
+# Shared PostgreSQL 18 in namespace system.
+postgresql:
+ enabled: false
+ postgresqlHostname: postgresql.system
+ postgresqlPort: 5432
+ auth:
+ database: mastodon
+ username: mastodon
+ existingSecret: mastodon-app
+
+redis:
+ enabled: true
+ architecture: standalone
+ auth:
+ existingSecret: mastodon-app-redis
+ # Mastodon chart and Bitnami subchart use different key names.
+ existingSecretKey: redis-password
+ existingSecretPasswordKey: redis-password
+ master:
+ persistence:
+ storageClass: local-path
+ replica:
+ replicaCount: 0
+ # Chart 22 adds NetworkPolicies (with egress rules); keep the networking
+ # as it was under chart 16.
+ networkPolicy:
+ enabled: false
+
+elasticsearch:
+ enabled: true
+ image:
+ tag: 7
+ master:
+ masterOnly: false
+ replicaCount: 1
+ persistence:
+ storageClass: local-path
+ coordinating:
+ replicaCount: 0
+ data:
+ replicaCount: 0
+ ingest:
+ enabled: false
+ replicaCount: 0
+ config:
+ discovery:
+ type: single-node
+ network:
+ host: 0.0.0.0
+ path:
+ data: /bitnami/elasticsearch/data
+ xpack:
+ ml:
+ enabled: false
+ extraConfig:
+ path:
+ data: /bitnami/elasticsearch/data
+ sysctlImage:
+ enabled: false
+ # local-path volumes ignore fsGroup, so keep the chown init container.
+ # Bitnami's free images moved to bitnamilegacy; the Mastodon chart only
+ # overrides the main image repository.
+ volumePermissions:
+ enabled: true
+ image:
+ repository: bitnamilegacy/os-shell
+ networkPolicy:
+ enabled: false