penpot-helm/charts/penpot/values.yaml

## Default values for Penpot

global:
  # -- Whether to deploy the Bitnami PostgreSQL chart as subchart. Check [the official chart](https://artifacthub.io/packages/helm/bitnami/postgresql) for configuration.
  # @section -- Global parameters
  postgresqlEnabled: false
  # -- Whether to deploy the Bitnami Redis chart as subchart. Check [the official chart](https://artifacthub.io/packages/helm/bitnami/redis) for configuration.
  # @section -- Global parameters
  redisEnabled: false
  # -- Global Docker registry secret names.
  # E.g.
  # imagePullSecrets:
  #   - myRegistryKeySecretName
  # @section -- Global parameters
  imagePullSecrets: []

# -- To partially override common.names.fullname
# @section -- Common parameters
nameOverride: ""
# -- To fully override common.names.fullname
# @section -- Common parameters
fullnameOverride: ""
serviceAccount:
  # -- Specifies whether a ServiceAccount should be created.
  # @section -- Common parameters
  enabled: true
  # -- Annotations for service account. Evaluated as a template.
  # @section -- Common parameters
  annotations: {}
  # -- The name of the ServiceAccount to use. If not set and enabled is true, a name is generated using the fullname template.
  # @section -- Common parameters
  name: "penpot"

config:
  # -- The public domain to serve Penpot on.
  # **IMPORTANT:** Set `disable-secure-session-cookies` in the flags if you plan on serving it on a non HTTPS domain.
  # @section -- Configuration parameters
  publicUri: "http://penpot.example.com"
  # -- The feature flags to enable. Check [the official docs](https://help.penpot.app/technical-guide/configuration/) for more info.
  # @section -- Configuration parameters
  flags: "enable-registration enable-login-with-password disable-email-verification enable-smtp"
  # -- A random secret key needed for persistent user sessions. Generate with `python3 -c "import secrets; print(secrets.token_urlsafe(64))"` for example.
  # @section -- Configuration parameters
  apiSecretKey: "kmZ96pAxhTgk3HZvvBkPeVTspGBneKVLEpO_3ecORs_gwACENZ77z05zCe7skvPsQ3jI3QgkULQOWCuLjmjQsg"
  # -- Comma separated list of allowed domains to register. Empty to allow all domains.
  # @section -- Configuration parameters
  registrationDomainWhitelist: ""
  # -- Whether to enable sending of anonymous telemetry data.
  # @section -- Configuration parameters
  telemetryEnabled: true

  postgresql:
    # -- The PostgreSQL host to connect to. Empty to use dependencies.
    # @section -- Configuration parameters
    host: ""  # Ex.: "postgresql.penpot.svc.cluster.local"
    # -- The PostgreSQL host port to use.
    # @section -- Configuration parameters
    port: 5432
    # -- The database username to use.
    # @section -- Configuration parameters
    username: "penpot"
    # -- The database password to use.
    # @section -- Configuration parameters
    password: "penpot"
    # -- The PostgreSQL database to use.
    # @section -- Configuration parameters
    database: "penpot"
    # -- The name of an existing secret.
    # @section -- Configuration parameters
    existingSecret: ""
    secretKeys:
      # -- The username key to use from an existing secret.
      # @section -- Configuration parameters
      usernameKey: ""
      # -- The password key to use from an existing secret.
      # @section -- Configuration parameters
      passwordKey: ""

  redis:
    # -- The Redis host to connect to. Empty to use dependencies
    # @section -- Configuration parameters
    host: ""  # Ex.: "redis-headless.penpot.svc.cluster.local"
    # -- The Redis host port to use.
    # @section -- Configuration parameters
    port: 6379
    # -- The Redis database to connect to.
    # @section -- Configuration parameters
    database: "0"

  assets:
    # -- The storage backend for assets to use. Use `assets-fs` for filesystem, and `assets-s3` for S3.
    # @section -- Configuration parameters
    storageBackend: "assets-fs"
    filesystem:
      # -- The storage directory to use if you chose the filesystem storage backend.
      # @section -- Configuration parameters
      directory: "/opt/data/assets"
    s3:
      # -- The S3 access key ID to use if you chose the S3 storage backend.
      # @section -- Configuration parameters
      accessKeyID: ""
      # -- The S3 secret access key to use if you chose the S3 storage backend.
      # @section -- Configuration parameters
      secretAccessKey: ""
      # -- The S3 region to use if you chose the S3 storage backend.
      # @section -- Configuration parameters
      region: ""
      # -- The name of the S3 bucket to use if you chose the S3 storage backend.
      # @section -- Configuration parameters
      bucket: ""
      # -- The S3 endpoint URI to use if you chose the S3 storage backend.
      # @section -- Configuration parameters
      endpointURI: ""
      # -- The name of an existing secret.
      # @section -- Configuration parameters
      existingSecret: ""
      secretKeys:
        # -- The S3 access key ID to use from an existing secret.
        # @section -- Configuration parameters
        accessKeyIDKey: ""
        # -- The S3 secret access key to use from an existing secret.
        # @section -- Configuration parameters
        secretAccessKey: ""
        # -- The S3 endpoint URI to use from an existing secret.
        # @section -- Configuration parameters
        endpointURIKey: ""

  smtp:
    # -- Whether to enable SMTP configuration. You also need to add the 'enable-smtp' flag to the PENPOT_FLAGS variable.
    # @section -- Configuration parameters
    enabled: false
    # -- The SMTP default email to send from.
    # @section -- Configuration parameters
    defaultFrom: ""
    # -- The SMTP default email to reply to.
    # @section -- Configuration parameters
    defaultReplyTo: ""
    # -- The SMTP host to use.
    # @section -- Configuration parameters
    host: ""
    # -- The SMTP host port to use.
    # @section -- Configuration parameters
    port: ""
    # -- The SMTP username to use.
    # @section -- Configuration parameters
    username: ""
    # -- The SMTP password to use.
    # @section -- Configuration parameters
    password: ""
    # -- Whether to use TLS for the SMTP connection.
    # @section -- Configuration parameters
    tls: true
    # -- Whether to use SSL for the SMTP connection.
    # @section -- Configuration parameters
    ssl: false
    # -- The name of an existing secret.
    # @section -- Configuration parameters
    existingSecret: ""
    secretKeys:
      # -- The SMTP username to use from an existing secret.
      # @section -- Configuration parameters
      usernameKey: ""
      # -- The SMTP password to use from an existing secret.
      # @section -- Configuration parameters
      passwordKey: ""

  # -- Penpot Authentication providers parameters
  # @section -- Configuration parameters
  providers:
    google:
      # -- Whether to enable Google configuration. To enable Google auth, add `enable-login-with-google` to the flags.
      # @section -- Configuration parameters
      enabled: false
      # -- The Google client ID to use. To enable Google auth, add `enable-login-with-google` to the flags.
      # @section -- Configuration parameters
      clientID: ""
      # -- The Google client secret to use. To enable Google auth, add `enable-login-with-google` to the flags.
      # @section -- Configuration parameters
      clientSecret: ""
    github:
      # -- Whether to enable GitHub configuration. To enable GitHub auth, also add `enable-login-with-github` to the flags.
      # @section -- Configuration parameters
      enabled: false
      # -- The GitHub client ID to use.
      # @section -- Configuration parameters
      clientID: ""
      # -- The GitHub client secret to use.
      # @section -- Configuration parameters
      clientSecret: ""
    gitlab:
      # -- Whether to enable GitLab configuration. To enable GitLab auth, also add `enable-login-with-gitlab` to the flags.
      # @section -- Configuration parameters
      enabled: false
      # -- The GitLab base URI to use.
      # @section -- Configuration parameters
      baseURI: "https://gitlab.com"
      # -- The GitLab client ID to use.
      # @section -- Configuration parameters
      clientID: ""
      # -- The GitLab client secret to use.
      # @section -- Configuration parameters
      clientSecret: ""
    oidc:
      # -- Whether to enable OIDC configuration. To enable OpenID Connect auth, also add `enable-login-with-oidc` to the flags.
      # @section -- Configuration parameters
      enabled: false
      # -- The OpenID Connect base URI to use.
      # @section -- Configuration parameters
      baseURI: ""
      # -- The OpenID Connect client ID to use.
      # @section -- Configuration parameters
      clientID: ""
      # -- The OpenID Connect client secret to use.
      # @section -- Configuration parameters
      clientSecret: ""
      # -- Optional OpenID Connect auth URI to use. Auto discovered if not provided.
      # @section -- Configuration parameters
      authURI: ""
      # -- Optional OpenID Connect token URI to use. Auto discovered if not provided.
      # @section -- Configuration parameters
      tokenURI: ""
      # -- Optional OpenID Connect user URI to use. Auto discovered if not provided.
      # @section -- Configuration parameters
      userURI: ""
      # -- Optional OpenID Connect roles to use. If no role is provided, roles checking  disabled.
      # @section -- Configuration parameters
      roles: "role1 role2"
      # -- Optional OpenID Connect roles attribute to use. If not provided, the roles checking will be disabled.
      # @section -- Configuration parameters
      rolesAttribute: ""
      # -- Optional OpenID Connect scopes to use. This settings allow overwrite the required scopes, use with caution because penpot requres at least `name` and `email` attrs found on the user info. Optional, defaults to `openid profile`.
      # @section -- Configuration parameters
      scopes: "scope1 scope2"
      # -- Optional OpenID Connect name attribute to use. If not provided, the `name` prop will be used.
      # @section -- Configuration parameters
      nameAttribute: ""
      # -- Optional OpenID Connect email attribute to use. If not provided, the `email` prop will be used.
      # @section -- Configuration parameters
      emailAttribute: ""
    ldap:
      # -- Whether to enable LDAP configuration. To enable LDAP, also add `enable-login-with-ldap` to the flags.
      # @section -- Configuration parameters
      enabled: false
      # -- The LDAP host to use.
      # @section -- Configuration parameters
      host: "ldap"
      # -- The LDAP port to use.
      # @section -- Configuration parameters
      port: 10389
      # -- Whether to use SSL for the LDAP connection.
      # @section -- Configuration parameters
      ssl: false
      # -- Whether to utilize StartTLS for the LDAP connection.
      # @section -- Configuration parameters
      startTLS: false
      # -- The LDAP base DN to use.
      # @section -- Configuration parameters
      baseDN: "ou=people,dc=planetexpress,dc=com"
      # -- The LDAP bind DN to use.
      # @section -- Configuration parameters
      bindDN: "cn=admin,dc=planetexpress,dc=com"
      # -- The LDAP bind password to use.
      # @section -- Configuration parameters
      bindPassword: "GoodNewsEveryone"
      # -- The LDAP user query to use.
      # @section -- Configuration parameters
      userQuery: "(&(|(uid=:username)(mail=:username))(memberOf=cn=penpot,ou=groups,dc=my-domain,dc=com))"
      # -- The LDAP attributes username to use.
      # @section -- Configuration parameters
      attributesUsername: "uid"
      # -- The LDAP attributes email to use.
      # @section -- Configuration parameters
      attributesEmail: "mail"
      # -- The LDAP attributes fullname to use.
      # @section -- Configuration parameters
      attributesFullname: "cn"
      # -- The LDAP attributes photo format to use.
      # @section -- Configuration parameters
      attributesPhoto: "jpegPhoto"
    # -- The name of an existing secret to use.
    # @section -- Configuration parameters
    existingSecret: ""
    secretKeys:
      # -- The Google client ID key to use from an existing secret.
      # @section -- Configuration parameters
      googleClientIDKey: ""
      # -- The Google client secret key to use from an existing secret.
      # @section -- Configuration parameters
      googleClientSecretKey: ""
      # -- The GitHub client ID key to use from an existing secret.
      # @section -- Configuration parameters
      githubClientIDKey: ""
      # -- The GitHub client secret key to use from an existing secret.
      # @section -- Configuration parameters
      githubClientSecretKey: ""
      # -- The GitLab client ID key to use from an existing secret.
      # @section -- Configuration parameters
      gitlabClientIDKey: ""
      # -- The GitLab client secret key to use from an existing secret.
      # @section -- Configuration parameters
      gitlabClientSecretKey: ""
      # -- The OpenID Connect client ID key to use from an existing secret.
      # @section -- Configuration parameters
      oidcClientIDKey: ""
      # -- The OpenID Connect client secret key to use from an existing secret.
      # @section -- Configuration parameters
      oidcClientSecretKey: ""

backend:
  image:
    # -- The Docker repository to pull the image from.
    # @section -- Backend parameters
    repository: penpotapp/backend
    # -- The image tag to use.
    # @section -- Backend parameters
    tag: 2.0.3
    # -- The image pull policy to use.
    # @section -- Backend parameters
    pullPolicy: IfNotPresent
  # -- The number of replicas to deploy.
  # @section -- Backend parameters
  replicaCount: 1
  service:
    # -- The http service type to create.
    # @section -- Backend parameters
    type: ClusterIP
    # -- The http service port to use.
    # @section -- Backend parameters
    port: 6060
  # -- An optional map of annotations to be applied to the controller Deployment
  # @section -- Backend parameters
  deploymentAnnotations: {}
  # -- An optional map of labels to be applied to the controller Pods
  # @section -- Backend parameters
  podLabels: {}
  # -- An optional map of annotations to be applied to the controller Pods
  # @section -- Backend parameters
  podAnnotations: {}
  # -- Configure Pods Security Context. Check [the official doc](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
  # @section -- Backend parameters
  podSecurityContext:
    # -- Enabled Penpot pods' security context
    # @section -- Backend parameters
    enabled: true
    # -- Set Penpot pod's security context fsGroup
    # @section -- Backend parameters
    fsGroup: 1001
  # -- Configure Container Security Context. Check [the official doc](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
  # @section -- Backend parameters
  containerSecurityContext:
    # -- Enabled Penpot containers' security context
    # @section -- Backend parameters
    enabled: true
    # -- Set Penpot containers' security context runAsUser
    # @section -- Backend parameters
    runAsUser: 1001
    # -- Set Penpot containers' security context allowPrivilegeEscalation
    # @section -- Backend parameters
    allowPrivilegeEscalation: false
    # -- Set Penpot containers' security context capabilities to be dropped
    # @section -- Backend parameters
    capabilities:
      drop:
        - all
    # -- Set Penpot containers' security context readOnlyRootFilesystem
    # @section -- Backend parameters
    readOnlyRootFilesystem: false
    # -- Set Penpot container's security context runAsNonRoot
    # @section -- Backend parameters
    runAsNonRoot: true
  # -- Affinity for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
  # @section -- Backend parameters
  affinity: {}
  # -- Node labels for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/user-guide/node-selection/)
  # @section -- Backend parameters
  nodeSelector: {}
  # -- Tolerations for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
  # @section -- Backend parameters
  tolerations: []
  # -- Penpot backend resource requests and limits. Check [the official doc](https://kubernetes.io/docs/user-guide/compute-resources/)
  # @section -- Backend parameters
  resources:
    # -- The resources limits for the Penpot backend containers
    # @section -- Backend parameters
    limits: {}
    # -- The requested resources for the Penpot backend containers
    # @section -- Backend parameters
    requests: {}

frontend:
  image:
    # -- The Docker repository to pull the image from.
    # @section -- Frontend parameters
    repository: penpotapp/frontend
    # -- The image tag to use.
    # @section -- Frontend parameters
    tag: 2.0.3
    # -- The image pull policy to use.
    # @section -- Frontend parameters
    pullPolicy: IfNotPresent
  # -- The number of replicas to deploy.
  # @section -- Frontend parameters
  replicaCount: 1
  service:
    # -- The service type to create.
    # @section -- Frontend parameters
    type: ClusterIP
    # -- The service port to use.
    # @section -- Frontend parameters
    port: 80
  # -- An optional map of annotations to be applied to the controller Deployment
  # @section -- Frontend parameters
  deploymentAnnotations: {}
  # -- An optional map of labels to be applied to the controller Pods
  # @section -- Frontend parameters
  podLabels: {}
  # -- An optional map of annotations to be applied to the controller Pods
  # @section -- Frontend parameters
  podAnnotations: {}
  # -- Affinity for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
  # @section -- Frontend parameters
  affinity: {}
  # -- Node labels for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/user-guide/node-selection/)
  # @section -- Frontend parameters
  nodeSelector: {}
  # -- Tolerations for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
  # @section -- Frontend parameters
  tolerations: []
  # -- Penpot frontend resource requests and limits. Check [the official doc](https://kubernetes.io/docs/user-guide/compute-resources/)
  # @section -- Frontend parameters
  resources:
    # -- The resources limits for the Penpot frontend containers
    # @section -- Frontend parameters
    limits: {}
    # -- The requested resources for the Penpot frontend containers
    # @section -- Frontend parameters
    requests: {}

exporter:
  image:
    # -- The Docker repository to pull the image from.
    # @section -- Exporter parameters
    repository: penpotapp/exporter
    # -- The image tag to use.
    # @section -- Exporter parameters
    tag: 2.0.3
    # -- The image pull policy to use.
    # @section -- Exporter parameters
    imagePullPolicy: IfNotPresent
  # -- The number of replicas to deploy. Enable persistence.exporter if you use more than 1 replicaCount
  # @section -- Exporter parameters
  replicaCount: 1
  service:
    # -- The service type to create.
    # @section -- Exporter parameters
    type: ClusterIP
    # -- The service port to use.
    # @section -- Exporter parameters
    port: 6061
  # -- An optional map of annotations to be applied to the controller Deployment
  # @section -- Exporter parameters
  deploymentAnnotations: {}
  # -- An optional map of labels to be applied to the controller Pods
  # @section -- Exporter parameters
  podLabels: {}
  # -- An optional map of annotations to be applied to the controller Pods
  # @section -- Exporter parameters
  podAnnotations: {}
  # -- Configure Pods Security Context. Check [the official doc](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
  # @section -- Exporter parameters
  podSecurityContext:
    # -- Enabled Penpot pods' security context
    # @section -- Exporter parameters
    enabled: true
    # -- Set Penpot pod's security context fsGroup
    # @section -- Exporter parameters
    fsGroup: 1001
  # -- Configure Container Security Context. Check [the official doc](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod)
  # @section -- Exporter parameters
  containerSecurityContext:
    # -- Enabled Penpot containers' security context
    # @section -- Exporter parameters
    enabled: true
    # -- Set Penpot containers' security context runAsUser
    # @section -- Exporter parameters
    runAsUser: 1001
    # -- Set Penpot containers' security context allowPrivilegeEscalation
    # @section -- Exporter parameters
    allowPrivilegeEscalation: false
    # -- Set Penpot containers' security context capabilities to be dropped
    # @section -- Exporter parameters
    capabilities:
      drop:
        - all
    # -- Set Penpot containers' security context readOnlyRootFilesystem
    # @section -- Exporter parameters
    readOnlyRootFilesystem: false
    # -- Set Penpot container's security context runAsNonRoot
    # @section -- Exporter parameters
    runAsNonRoot: true
  # -- Affinity for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
  # @section -- Exporter parameters
  affinity: {}
  # -- Node labels for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/user-guide/node-selection/)
  # @section -- Exporter parameters
  nodeSelector: {}
  # -- Tolerations for Penpot pods assignment. Check [the official doc](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
  # @section -- Exporter parameters
  tolerations: []
  # -- Penpot frontend resource requests and limits. Check [the official doc](https://kubernetes.io/docs/user-guide/compute-resources/)
  # @section -- Exporter parameters
  resources:
    # -- The resources limits for the Penpot frontend containers
    # @section -- Exporter parameters
    limits: {}
    # -- The requested resources for the Penpot frontend containers
    # @section -- Exporter parameters
    requests: {}

# @section -- Persistence parameters
persistence:
  assets:
    # -- Enable assets persistence using Persistent Volume Claims.
    # @section -- Persistence parameters
    enabled: fals
    # -- Assets persistent Volume storage class.
    # If defined, storageClassName: <storageClass>.
    # If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner.
    # @section -- Persistence parameters
    storageClass: ""
    # -- Assets persistent Volume size.
    # @section -- Persistence parameters
    size: 20Gi
    # -- The name of an existing PVC to use for assets persistence.
    # @section -- Persistence parameters
    existingClaim: ""
    # -- Assets persistent Volume access modes.
    # @section -- Persistence parameters
    accessModes:
      - ReadWriteOnce
    # -- Assetsp ersistent Volume Claim annotations.
    # @section -- Persistence parameters
    annotations: {}
  exporter:
    # -- Enable exporter persistence using Persistent Volume Claims. If exporter.replicaCount you have to enable it.
    # @section -- Persistence parameters
    enabled: false
    # -- Exporter persistent Volume storage class. Empty is choosing the default provisioner by the provider.
    # @section -- Persistence parameters
    storageClass: ""
    # -- Exporter persistent Volume size.
    # @section -- Persistence parameters
    size: 10Gi
    # -- The name of an existing PVC to use for persistence.
    # @section -- Persistence parameters
    existingClaim: ""
    # -- Exporter persistent Volume access modes.
    # @section -- Persistence parameters
    accessModes:
      - ReadWriteOnce
    # -- Exporter persistent Volume Claim annotations.
    # @section -- Persistence parameters
    annotations: {}

ingress:
  # -- Enable (frontend) Ingress Controller.
  # @section -- Ingress parameters
  enabled: false
  # -- The Ingress className.
  # @section -- Ingress parameters
  className: ""
  # -- Mapped annotations for the ingress crontroller.
  # E.g.
  # annotations:
  #   kubernetes.io/ingress.class: nginx
  #   kubernetes.io/tls-acme: "true"
  # @section -- Ingress parameters
  annotations: {}
  # -- Root path for every hosts.
  # @section -- Ingress parameters
  path: "/"
  # -- Array style hosts for the (frontend) ingress crontroller.
  # @section -- Ingress parameters
  hosts:
    # -- The default external hostname to access to the penpot app.
    # @section -- Ingress parameters
    - host: penpot.example.com
  # -- Array style TLS secrets for the (frontend) ingress crontroller.
  # E.g.
  # tls:
  #   - secretName: penpot.example.com-tls
  #     hosts:
  #       - penpot.example.com
  # @section -- Ingress parameters
  tls: []

# -- PostgreSQL configuration (Check for [more parameters here](https://artifacthub.io/packages/helm/bitnami/postgresql))
# @section -- PostgreSQL Dependencie parameters
postgresql:
  auth:
    # -- Name for a custom user to create.
    # @section -- PostgreSQL Dependencie parameters
    username: "penpot"
    # -- Password for the custom user to create.
    # @section -- PostgreSQL Dependencie parameters
    password: "penpot"
    # -- Name for a custom database to create.
    # @section -- PostgreSQL Dependencie parameters
    database: "penpot"

# -- Redis configuration (Check for [more parameters here](https://artifacthub.io/packages/helm/bitnami/redis))
# @section -- Redis Dependencie parameters
redis:
  auth:
    # -- Whether to enable password authentication.
    # @section -- Redis Dependencie parameters
    enabled: false