mastodon/values.yaml

# Helm values for release mastodon/mastodon (chart github.com/mastodon/chart 6.10.6):
#
#   helm upgrade mastodon <chart checkout> -n mastodon \
#     -f mastodon/values.yaml -f mastodon/values-secrets.yaml --timeout 30m
#
# values-secrets.yaml is not in git; it holds externalAuth.oidc.client_secret.
# All other secrets live in Secrets that Helm does not manage:
#   mastodon-app        SECRET_KEY_BASE, OTP_SECRET, VAPID_*, ACTIVE_RECORD_ENCRYPTION_*, password (DB)
#   mastodon-app-smtp   login, password
#   mastodon-app-redis  redis-password

image:
  repository: ghcr.io/mastodon/mastodon
  tag: v4.7.5
  pullPolicy: IfNotPresent

deploymentAnnotations:
  k8s-app: mastodon
revisionPodAnnotation: true
podSecurityContext:
  fsGroup: 991
  runAsGroup: 991
  runAsUser: 991
service:
  port: 80
  type: ClusterIP
serviceAccount:
  create: true

mastodon:
  local_domain: mastodon.benkard.de
  web_domain: mastodon.benkard.de
  locale: de
  authorizedFetch: false
  limitedFederationMode: false
  singleUserMode: false
  preparedStatements: true
  # Only runs on install; the admin account exists.
  createAdmin:
    enabled: false
  cron:
    removeMedia:
      enabled: true
      schedule: 0 0 * * 0
  secrets:
    existingSecret: mastodon-app
  persistence:
    assets:
      accessMode: ReadWriteOnce
      resources:
        requests:
          storage: 10Gi
      storageClassName: local-path
    system:
      accessMode: ReadWriteOnce
      resources:
        requests:
          storage: 100Gi
      storageClassName: local-path
  sidekiq:
    workers:
      - name: all-queues
        concurrency: 25
        replicas: 1
        queues:
          - default,8
          - push,6
          - ingress,4
          - mailers,2
          - pull
          - scheduler
  smtp:
    existingSecret: mastodon-app-smtp
    auth_method: plain
    ca_file: /etc/ssl/certs/ca-certificates.crt
    delivery_method: smtp
    domain: mail.benkard.de
    enable_starttls: auto
    from_address: mastodon@benkard.de
    openssl_verify_mode: peer
    port: 587
    server: mail.benkard.de
    tls: true
  streaming:
    port: 4000
    replicas: 1
    workers: 4
  web:
    port: 3000
    replicas: 1
    workers: "2"
    minThreads: "5"
    maxThreads: "5"
    persistentTimeout: "20"

externalAuth:
  oauth_global:
    omniauth_only: true
  oidc:
    enabled: true
    display_name: Keycloak
    issuer: https://login.benkard.de/auth/realms/master
    discovery: true
    scope: openid,profile,email
    uid_field: preferred_username
    client_id: mastodon
    redirect_uri: https://mastodon.benkard.de/auth/auth/openid_connect/callback
    assume_email_is_verified: true

ingress:
  enabled: true
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 100m
    nginx.org/client-max-body-size: 100m
  hosts:
    - host: mastodon.benkard.de
      paths:
        - path: /
  tls:
    - hosts:
        - mastodon.benkard.de
      secretName: mastodon-tls

# Shared PostgreSQL 18 in namespace system.
postgresql:
  enabled: false
  postgresqlHostname: postgresql.system
  postgresqlPort: 5432
  auth:
    database: mastodon
    username: mastodon
    existingSecret: mastodon-app

redis:
  enabled: true
  architecture: standalone
  auth:
    existingSecret: mastodon-app-redis
    # Mastodon chart and Bitnami subchart use different key names.
    existingSecretKey: redis-password
    existingSecretPasswordKey: redis-password
  master:
    persistence:
      storageClass: local-path
  replica:
    replicaCount: 0
  # Chart 22 adds NetworkPolicies (with egress rules); keep the networking
  # as it was under chart 16.
  networkPolicy:
    enabled: false

elasticsearch:
  enabled: true
  image:
    tag: 7
  master:
    masterOnly: false
    replicaCount: 1
    persistence:
      storageClass: local-path
  coordinating:
    replicaCount: 0
  data:
    replicaCount: 0
  ingest:
    enabled: false
    replicaCount: 0
  config:
    discovery:
      type: single-node
    network:
      host: 0.0.0.0
    path:
      data: /bitnami/elasticsearch/data
    xpack:
      ml:
        enabled: false
  extraConfig:
    path:
      data: /bitnami/elasticsearch/data
  sysctlImage:
    enabled: false
  # local-path volumes ignore fsGroup, so keep the chown init container.
  # Bitnami's free images moved to bitnamilegacy; the Mastodon chart only
  # overrides the main image repository.
  volumePermissions:
    enabled: true
    image:
      repository: bitnamilegacy/os-shell
  networkPolicy:
    enabled: false