about summary refs log tree commit diff
path: root/chart/values.yaml
blob: fabfeee7a8cbd20c1fc2bcdb1225ba8ce0e2ba79 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
image:
  repository: tootsuite/mastodon
  # https://hub.docker.com/r/tootsuite/mastodon/tags
  #
  # alternatively, use `latest` for the latest release or `edge` for the image
  # built from the most recent commit
  #
  # tag: latest
  tag: ""
  # use `Always` when using `latest` tag
  pullPolicy: IfNotPresent

mastodon:
  # -- create an initial administrator user; the password is autogenerated and will
  # have to be reset
  createAdmin:
    # @ignored
    enabled: false
    # @ignored
    username: not_gargron
    # @ignored
    email: not@example.com
  cron:
    # -- run `tootctl media remove` every week
    removeMedia:
      # @ignored
      enabled: true
      # @ignored
      schedule: "0 0 * * 0"
  # -- available locales: https://github.com/mastodon/mastodon/blob/main/config/application.rb#L71
  locale: en
  local_domain: mastodon.local
  # -- Use of WEB_DOMAIN requires careful consideration: https://docs.joinmastodon.org/admin/config/#federation
  # You must redirect the path LOCAL_DOMAIN/.well-known/ to WEB_DOMAIN/.well-known/ as described
  # Example: mastodon.example.com
  web_domain: null
  # -- If set to true, the frontpage of your Mastodon server will always redirect to the first profile in the database and registrations will be disabled.
  singleUserMode: false
  # -- Enables "Secure Mode" for more details see: https://docs.joinmastodon.org/admin/config/#authorized_fetch
  authorizedFetch: false
  persistence:
    assets:
      # -- ReadWriteOnce is more widely supported than ReadWriteMany, but limits
      # scalability, since it requires the Rails and Sidekiq pods to run on the
      # same node.
      accessMode: ReadWriteOnce
      resources:
        requests:
          storage: 10Gi
    system:
      accessMode: ReadWriteOnce
      resources:
        requests:
          storage: 100Gi
  s3:
    enabled: false
    access_key: ""
    access_secret: ""
    # -- you can also specify the name of an existing Secret
    # with keys AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
    existingSecret: ""
    bucket: ""
    endpoint: ""
    hostname: ""
    region: ""
    # -- If you have a caching proxy, enter its base URL here.
    alias_host: ""
  # these must be set manually; autogenerated keys are rotated on each upgrade
  secrets:
    secret_key_base: ""
    otp_secret: ""
    vapid:
      private_key: ""
      public_key: ""
    # -- you can also specify the name of an existing Secret
    # with keys SECRET_KEY_BASE and OTP_SECRET and
    # VAPID_PRIVATE_KEY and VAPID_PUBLIC_KEY
    existingSecret: ""
  sidekiq:
    # -- Pod security context for all Sidekiq Pods, overwrites .Values.podSecurityContext
    podSecurityContext: {}
    # -- (Sidekiq Container) Security Context for all Pods, overwrites .Values.securityContext
    securityContext: {}
    # -- Resources for all Sidekiq Deployments unless overwritten
    resources: {}
    # -- Affinity for all Sidekiq Deployments unless overwritten, overwrites .Values.affinity
    affinity: {}
    # limits:
    #   cpu: "1"
    #   memory: 768Mi
    # requests:
    #   cpu: 250m
    #   memory: 512Mi
    workers:
    - name: all-queues
      # -- Number of threads / parallel sidekiq jobs that are executed per Pod
      concurrency: 25
      # -- Number of Pod replicas deployed by the Deployment
      replicas: 1
      # -- Resources for this specific deployment to allow optimised scaling, overwrites .Values.mastodon.sidekiq.resources
      resources: {}
      # -- Affinity for this specific deployment, overwrites .Values.affinity and .Values.mastodon.sidekiq.affinity
      affinity: {}
      # -- Sidekiq queues for Mastodon that are handled by this worker. See https://docs.joinmastodon.org/admin/scaling/#concurrency
      # See https://github.com/mperham/sidekiq/wiki/Advanced-Options#queues for how to weight queues as argument
      queues:
        - default
        - push
        - mailers
        - pull
        - scheduler # Make sure the scheduler queue only exists once and with a worker that has 1 replica.
    #- name: push-pull
    #  concurrency: 50
    #  resources: {}
    #  replicas: 2
    #  queues:
    #    - push
    #    - pull
    #- name: mailers
    #  concurrency: 25
    #  replicas: 2
    #  queues:
    #    - mailers
    #- name: default
    #  concurrency: 25
    #  replicas: 2
    #  queues:
    #    - default
  smtp:
    auth_method: plain
    ca_file: /etc/ssl/certs/ca-certificates.crt
    delivery_method: smtp
    domain:
    enable_starttls: 'auto'
    from_address: notifications@example.com
    openssl_verify_mode: peer
    port: 587
    reply_to:
    server: smtp.mailgun.org
    tls: false
    login:
    password:
    # -- you can also specify the name of an existing Secret
    # with the keys login and password
    existingSecret:
  streaming:
    port: 4000
    # -- this should be set manually since os.cpus() returns the number of CPUs on
    # the node running the pod, which is unrelated to the resources allocated to
    # the pod by k8s
    workers: 1
    # -- The base url for streaming can be set if the streaming API is deployed to
    # a different domain/subdomain.
    base_url: null
    # -- Number of Streaming Pods running
    replicas: 1
    # -- Affinity for Streaming Pods, overwrites .Values.affinity
    affinity: {}
    # -- Pod Security Context for Streaming Pods, overwrites .Values.podSecurityContext
    podSecurityContext: {}
    # -- (Streaming Container) Security Context for Streaming Pods, overwrites .Values.securityContext
    securityContext: {}
    # -- (Streaming Container) Resources for Streaming Pods, overwrites .Values.resources
    resources: {}
    # limits:
    #   cpu: "500m"
    #   memory: 512Mi
    # requests:
    #   cpu: 250m
    #   memory: 128Mi
  web:
    port: 3000
    # -- Number of Web Pods running
    replicas: 1
    # -- Affinity for Web Pods, overwrites .Values.affinity
    affinity: {}
    # -- Pod Security Context for Web Pods, overwrites .Values.podSecurityContext
    podSecurityContext: {}
    # -- (Web Container) Security Context for Web Pods, overwrites .Values.securityContext
    securityContext: {}
    # -- (Web Container) Resources for Web Pods, overwrites .Values.resources
    resources: {}
    # limits:
    #   cpu: "1"
    #   memory: 1280Mi
    # requests:
    #   cpu: 250m
    #   memory: 768Mi

  metrics:
    statsd:
      # -- Enable statsd publishing via STATSD_ADDR environment variable
      address: ""

ingress:
  enabled: true
  annotations:
    # For choosing an ingress ingressClassName is preferred over annotations
    # kubernetes.io/ingress.class: nginx
    #
    # To automatically request TLS certificates use one of the following
    # kubernetes.io/tls-acme: "true"
    # cert-manager.io/cluster-issuer: "letsencrypt"
    #
    # ensure that NGINX's upload size matches Mastodon's
    #   for the K8s ingress controller:
    # nginx.ingress.kubernetes.io/proxy-body-size: 40m
    #   for the NGINX ingress controller:
    # nginx.org/client-max-body-size: 40m
  # -- you can specify the ingressClassName if it differs from the default
  ingressClassName:
  hosts:
    - host: mastodon.local
      paths:
        - path: '/'
  tls:
    - secretName: mastodon-tls
      hosts:
        - mastodon.local

# -- https://github.com/bitnami/charts/tree/master/bitnami/elasticsearch#parameters
elasticsearch:
  # `false` will disable full-text search
  #
  # if you enable ES after the initial install, you will need to manually run
  # RAILS_ENV=production bundle exec rake chewy:sync
  # (https://docs.joinmastodon.org/admin/optional/elasticsearch/)
  # @ignored
  enabled: true
  # @ignored
  image:
    tag: 7

# https://github.com/bitnami/charts/tree/master/bitnami/postgresql#parameters
postgresql:
  # -- disable if you want to use an existing db; in which case the values below
  # must match those of that external postgres instance
  enabled: true
  # postgresqlHostname: preexisting-postgresql
  # postgresqlPort: 5432
  auth:
    database: mastodon_production
    username: mastodon
    # you must set a password; the password generated by the postgresql chart will
    # be rotated on each upgrade:
    # https://github.com/bitnami/charts/tree/master/bitnami/postgresql#upgrade
    password: ""
    # Set the password for the "postgres" admin user
    # set this to the same value as above if you've previously installed
    # this chart and you're having problems getting mastodon to connect to the DB
    # postgresPassword: ""
    # you can also specify the name of an existing Secret
    # with a key of password set to the password you want
    existingSecret: ""

# https://github.com/bitnami/charts/tree/master/bitnami/redis#parameters
redis:
  # -- you must set a password; the password generated by the redis chart will be
  # rotated on each upgrade:
  password: ""
  # you can also specify the name of an existing Secret
  # with a key of redis-password set to the password you want
  # auth:
    # existingSecret: ""

# @ignored
service:
  type: ClusterIP
  port: 80

externalAuth:
  oidc:
    # -- OpenID Connect support is proposed in PR #16221 and awaiting merge.
    enabled: false
    # display_name: "example-label"
    # issuer: https://login.example.space/auth/realms/example-space
    # discovery: true
    # scope: "openid,profile"
    # uid_field: uid
    # client_id: mastodon
    # client_secret: SECRETKEY
    # redirect_uri: https://example.com/auth/auth/openid_connect/callback
    # assume_email_is_verified: true
    # client_auth_method:
    # response_type:
    # response_mode:
    # display:
    # prompt:
    # send_nonce:
    # send_scope_to_token_endpoint:
    # idp_logout_redirect_uri:
    # http_scheme:
    # host:
    # port:
    # jwks_uri:
    # auth_endpoint:
    # token_endpoint:
    # user_info_endpoint:
    # end_session_endpoint:
  saml:
    enabled: false
    # acs_url: http://mastodon.example.com/auth/auth/saml/callback
    # issuer: mastodon
    # idp_sso_target_url: https://login.example.com/auth/realms/example/protocol/saml
    # idp_cert: '-----BEGIN CERTIFICATE-----[your_cert_content]-----END CERTIFICATE-----'
    # idp_cert_fingerprint:
    # name_identifier_format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
    # cert:
    # private_key:
    # want_assertion_signed: true
    # want_assertion_encrypted: true
    # assume_email_is_verified: true
    # uid_attribute: "urn:oid:0.9.2342.19200300.100.1.1"
    # attributes_statements:
    #   uid: "urn:oid:0.9.2342.19200300.100.1.1"
    #   email: "urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
    #   full_name: "urn:oid:2.16.840.1.113730.3.1.241"
    #   first_name: "urn:oid:2.5.4.42"
    #   last_name: "urn:oid:2.5.4.4"
    #   verified:
    #   verified_email:
  oauth_global:
    # -- Automatically redirect to OIDC, CAS or SAML, and don't use local account authentication when clicking on Sign-In
    omniauth_only: false
  cas:
    enabled: false
    # url: https://sso.myserver.com
    # host: sso.myserver.com
    # port: 443
    # ssl: true
    # validate_url:
    # callback_url:
    # logout_url:
    # login_url:
    # uid_field: 'user'
    # ca_path:
    # disable_ssl_verification: false
    # assume_email_is_verified: true
    # keys:
    #   uid: 'user'
    #   name: 'name'
    #   email: 'email'
    #   nickname: 'nickname'
    #   first_name: 'firstname'
    #   last_name: 'lastname'
    #   location: 'location'
    #   image: 'image'
    #   phone: 'phone'
  pam:
    enabled: false
    # email_domain: example.com
    # default_service: rpam
    # controlled_service: rpam
  ldap:
    enabled: false
    # host: myservice.namespace.svc
    # port: 389
    # method: simple_tls
    # base:
    # bind_on:
    # password:
    # uid: cn
    # mail: mail
    # search_filter: "(|(%{uid}=%{email})(%{mail}=%{email}))"
    # uid_conversion:
    #   enabled: true
    #   search: "., -"
    #   replace: _

# -- https://github.com/mastodon/mastodon/blob/main/Dockerfile#L75
#
# if you manually change the UID/GID environment variables, ensure these values
# match:
podSecurityContext:
  runAsUser: 991
  runAsGroup: 991
  fsGroup: 991

# @ignored
securityContext: {}

serviceAccount:
  # -- Specifies whether a service account should be created
  create: true
  # -- Annotations to add to the service account
  annotations: {}
  # -- The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

# -- Kubernetes manages pods for jobs and pods for deployments differently, so you might
# need to apply different annotations to the two different sets of pods. The annotations
# set with podAnnotations will be added to all deployment-managed pods.
podAnnotations: {}

# -- The annotations set with jobAnnotations will be added to all job pods.
jobAnnotations: {}

# -- Default resources for all Deployments and jobs unless overwritten
resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

# @ignored
nodeSelector: {}

# @ignored
tolerations: []

# -- Affinity for all pods unless overwritten
affinity: {}