Gitiles
Code Review Sign In
gerrit.benkard.de / kubeia / refs/heads/master / . / mastodon / values.yaml
blob: b968b4e4de27cc51b9ed88467c3bba9f8082e64e [file] [log] [blame]
Matthias Andreas Benkardcdddd432026-11-05 16:42:10 +0100[diff] [blame]1# Helm values for release mastodon/mastodon (chart github.com/mastodon/chart 6.10.6):
2#
3# helm upgrade mastodon <chart checkout> -n mastodon \
4# -f mastodon/values.yaml -f mastodon/values-secrets.yaml --timeout 30m
5#
6# values-secrets.yaml is not in git; it holds externalAuth.oidc.client_secret.
7# All other secrets live in Secrets that Helm does not manage:
8# mastodon-app SECRET_KEY_BASE, OTP_SECRET, VAPID_*, ACTIVE_RECORD_ENCRYPTION_*, password (DB)
9# mastodon-app-smtp login, password
10# mastodon-app-redis redis-password
11
12image:
13 repository: ghcr.io/mastodon/mastodon
14 tag: v4.7.5
15 pullPolicy: IfNotPresent
16
17deploymentAnnotations:
18 k8s-app: mastodon
19revisionPodAnnotation: true
20podSecurityContext:
21 fsGroup: 991
22 runAsGroup: 991
23 runAsUser: 991
24service:
25 port: 80
26 type: ClusterIP
27serviceAccount:
28 create: true
29
30mastodon:
31 local_domain: mastodon.benkard.de
32 web_domain: mastodon.benkard.de
33 locale: de
34 authorizedFetch: false
35 limitedFederationMode: false
36 singleUserMode: false
37 preparedStatements: true
38 # Only runs on install; the admin account exists.
39 createAdmin:
40 enabled: false
41 cron:
42 removeMedia:
43 enabled: true
44 schedule: 0 0 * * 0
45 secrets:
46 existingSecret: mastodon-app
47 persistence:
48 assets:
49 accessMode: ReadWriteOnce
50 resources:
51 requests:
52 storage: 10Gi
53 storageClassName: local-path
54 system:
55 accessMode: ReadWriteOnce
56 resources:
57 requests:
58 storage: 100Gi
59 storageClassName: local-path
60 sidekiq:
61 workers:
62 - name: all-queues
63 concurrency: 25
64 replicas: 1
65 queues:
66 - default,8
67 - push,6
68 - ingress,4
69 - mailers,2
70 - pull
71 - scheduler
72 smtp:
73 existingSecret: mastodon-app-smtp
74 auth_method: plain
75 ca_file: /etc/ssl/certs/ca-certificates.crt
76 delivery_method: smtp
77 domain: mail.benkard.de
78 enable_starttls: auto
79 from_address: mastodon@benkard.de
80 openssl_verify_mode: peer
81 port: 587
82 server: mail.benkard.de
83 tls: true
84 streaming:
85 port: 4000
86 replicas: 1
87 workers: 4
88 web:
89 port: 3000
90 replicas: 1
91 workers: "2"
92 minThreads: "5"
93 maxThreads: "5"
94 persistentTimeout: "20"
95
96externalAuth:
97 oauth_global:
98 omniauth_only: true
99 oidc:
100 enabled: true
101 display_name: Keycloak
102 issuer: https://login.benkard.de/auth/realms/master
103 discovery: true
104 scope: openid,profile,email
105 uid_field: preferred_username
106 client_id: mastodon
107 redirect_uri: https://mastodon.benkard.de/auth/auth/openid_connect/callback
108 assume_email_is_verified: true
109
110ingress:
111 enabled: true
112 annotations:
113 cert-manager.io/cluster-issuer: letsencrypt-prod
114 kubernetes.io/ingress.class: nginx
115 kubernetes.io/tls-acme: "true"
116 nginx.ingress.kubernetes.io/proxy-body-size: 100m
117 nginx.org/client-max-body-size: 100m
118 hosts:
119 - host: mastodon.benkard.de
120 paths:
121 - path: /
122 tls:
123 - hosts:
124 - mastodon.benkard.de
125 secretName: mastodon-tls
126
127# Shared PostgreSQL 18 in namespace system.
128postgresql:
129 enabled: false
130 postgresqlHostname: postgresql.system
131 postgresqlPort: 5432
132 auth:
133 database: mastodon
134 username: mastodon
135 existingSecret: mastodon-app
136
137redis:
138 enabled: true
139 architecture: standalone
140 auth:
141 existingSecret: mastodon-app-redis
142 # Mastodon chart and Bitnami subchart use different key names.
143 existingSecretKey: redis-password
144 existingSecretPasswordKey: redis-password
145 master:
146 persistence:
147 storageClass: local-path
148 replica:
149 replicaCount: 0
150 # Chart 22 adds NetworkPolicies (with egress rules); keep the networking
151 # as it was under chart 16.
152 networkPolicy:
153 enabled: false
154
155elasticsearch:
156 enabled: true
157 image:
158 tag: 7
159 master:
160 masterOnly: false
161 replicaCount: 1
162 persistence:
163 storageClass: local-path
164 coordinating:
165 replicaCount: 0
166 data:
167 replicaCount: 0
168 ingest:
169 enabled: false
170 replicaCount: 0
171 config:
172 discovery:
173 type: single-node
174 network:
175 host: 0.0.0.0
176 path:
177 data: /bitnami/elasticsearch/data
178 xpack:
179 ml:
180 enabled: false
181 extraConfig:
182 path:
183 data: /bitnami/elasticsearch/data
184 sysctlImage:
185 enabled: false
186 # local-path volumes ignore fsGroup, so keep the chown init container.
187 # Bitnami's free images moved to bitnamilegacy; the Mastodon chart only
188 # overrides the main image repository.
189 volumePermissions:
190 enabled: true
191 image:
192 repository: bitnamilegacy/os-shell
193 networkPolicy:
194 enabled: false