fix: use secret instead of simple env vars

Signed-off-by: Thomas Stocker <thomas.stocker.pro@gmail.com>

contrib/helm/README.md

@@ -16,38 +16,8 @@ Before deploying Probo, ensure you have:
 3. **PostgreSQL Database** - Managed service (AWS RDS, GCP Cloud SQL, Azure Database, etc.)
 4. **S3 Storage** - AWS S3 or S3-compatible storage (GCS, DigitalOcean Spaces, MinIO, etc.)
 
-## Quick Start
-
-### 1. Generate Secrets
-
-```bash
-export ENCRYPTION_KEY=$(openssl rand -base64 32)
-export COOKIE_SECRET=$(openssl rand -base64 32)
-export PASSWORD_PEPPER=$(openssl rand -base64 32)
-export TRUST_TOKEN_SECRET=$(openssl rand -base64 32)
-
-echo "Save these secrets securely!"
-```
-
-### 2. Install
-
 ## Install
 
-#### Using Official Chart Repository
-> Have Helm 3 [installed](https://helm.sh/docs/intro/install).
-
-```sh
-helm repo add probo https://getprobo.github.io/probo-helm-charts/
-helm install probo probo/probo -n probo --create-namespace --values values.yaml
-```
-
-To update versions:
-
-```
-helm repo update probo
-helm upgrade probo probo/probo -n probo --values values.yaml
-```
-
 #### Using Local Chart
 
 ##### Generate Secrets
@@ -59,6 +29,12 @@ export PASSWORD_PEPPER=$(openssl rand -base64 32)
 export TRUST_TOKEN_SECRET=$(openssl rand -base64 32)
 ```
 
+#### Download remote dependencies 
+
+```bash
+helm dependency update ./charts/probo
+```
+
 ##### Install using Chart and set values
 
 ```bash
@@ -69,9 +45,9 @@ helm install my-probo ./charts/probo \
   --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \
   --set probo.trustAuth.tokenSecret="$TRUST_TOKEN_SECRET" \
   --set postgresql.enabled=true \
-  --set postgres.auth.postgresUser="probod" \
-  --set postgres.auth.postgresPassword="your-db-password" \
-  --set postgres.auth.database="probod" \
+  --set postgresql.auth.postgresUser="probod" \
+  --set postgresql.auth.postgresPassword="your-db-password" \
+  --set postgresql.auth.database="probod" \
   --set minio.enabled=true \
   --set s3.bucket="your-bucket-name" \
   --set s3.accessKeyId="your-access-key" \
@@ -87,6 +63,11 @@ helm install my-probo ./charts/probo \
   --set probo.auth.cookieSecret="$COOKIE_SECRET" \
   --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \
   --set probo.trustAuth.tokenSecret="$TRUST_TOKEN_SECRET" \
+  --set probo.mailer.smtp.password="smtp-password" \
+  --set postgresql.enabled=true \
+  --set postgresql.auth.postgresPassword="probod" \
+  --set s3.accessKeyId="your-access-key" \
+  --set s3.secretAccessKey="your-secret-key" \
   -f ./charts/probo/values.yaml
 ```
 

contrib/helm/charts/probo/templates/deployment.yaml

@@ -38,6 +38,8 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           env:
+            - name: CONFIG_FILE
+              value: "/data/probod/config.yml"
             # Observability - Metrics
             - name: METRICS_ADDR
               value: "0.0.0.0:{{ .Values.probo.metrics.port }}"
@@ -71,7 +73,7 @@ spec:
               value: {{ join "," .Values.probo.cors.allowedOrigins | quote }}
             # PostgreSQL Database
             - name: PG_ADDR
-              value: {{ printf "%s:%s" (include "probo.postgresql.host" .) (include "probo.postgresql.port" .) | quote }}
+              value: {{ if .Values.postgresql.enabled }}{{ printf "%s-postgresql-demo:5432" .Release.Name | quote }}{{ else }}{{ .Values.probo.pg.addr | required "probo.pg.addr is required when postgresql.enabled=false" | quote }}{{ end }}
             - name: PG_USERNAME
               value: {{ include "probo.postgresql.username" . | quote }}
             - name: PG_PASSWORD

contrib/helm/charts/probo/templates/postgresql-demo-app.yml

@@ -20,7 +20,10 @@ spec:
             - name: POSTGRES_USER
               value: {{ .Values.postgresql.auth.postgresUser }}
             - name: POSTGRES_PASSWORD
-              value: {{ .Values.postgresql.auth.postgresPassword | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" . }}
+                  key: db-password
             - name: POSTGRES_DB
               value: {{ .Values.postgresql.auth.database }}
           ports:
@@ -62,7 +65,7 @@ data:
 
     psql -v ON_ERROR_STOP=1 -U $POSTGRES_USER <<-EOF
     ALTER USER probod WITH SUPERUSER;
-    ALTER USER probod PASSWORD '{{ .Values.postgresql.auth.postgresPassword | squote }}';
+    ALTER USER probod PASSWORD {{ .Values.postgresql.auth.postgresPassword | squote }};
     GRANT ALL PRIVILEGES ON DATABASE probod TO probod;
     CREATE DATABASE probod_test;
     GRANT ALL PRIVILEGES ON DATABASE probod_test TO probod;

contrib/helm/charts/probo/templates/secret.yaml

@@ -7,7 +7,7 @@ metadata:
 type: Opaque
 stringData:
   # Database credentials
-  db-password: {{ include "probo.postgresql.password" . | quote }}
+  db-password: {{ if .Values.postgresql.enabled }}{{ .Values.postgresql.auth.postgresPassword | quote }}{{ else }}{{ required "postgresql.password is required when postgresql.enabled=false" .Values.postgresql.password | quote }}{{ end }}
 
   # S3 credentials
   s3-access-key: {{ include "probo.s3.accessKeyId" . | quote }}

contrib/helm/charts/probo/values.yaml

@@ -171,10 +171,6 @@ probo:
   # This should match your ingress host
   baseUrl: probo.example.com
 
-  # Base64-encoded encryption key (REQUIRED)
-  # Generate with: openssl rand -base64 32
-  encryptionKey: ""
-
   service:
     port: 8080
 
@@ -212,13 +208,7 @@ probo:
     invitationTokenValidity: 3600
     cookieName: "SSID"
     cookieDomain: "probo.example.com"
-    # Cookie signing secret (REQUIRED, at least 32 bytes)
-    # Generate with: openssl rand -base64 32
-    cookieSecret: ""
     cookieDuration: 24
-    # Password hashing pepper (REQUIRED, at least 32 bytes)
-    # Generate with: openssl rand -base64 32
-    passwordPepper: ""
     passwordIterations: 1000000
 
   # SAML authentication (optional)
@@ -246,7 +236,6 @@ probo:
       tlsHttpServer: 443
     # Trust token signing secret (REQUIRED, at least 32 bytes)
     # Generate with: openssl rand -base64 32
-    tokenSecret: ""
     scope: "trust_center_readonly"
     tokenType: "trust_center_access"
 
@@ -308,6 +297,13 @@ postgresql:
     postgresUser: probod
     postgresPassword: probod
     database: probod
+  # External PostgreSQL configuration (used when enabled=false)
+  host: ""  # REQUIRED when enabled=false: PostgreSQL host
+  port: 5432
+  username: probod
+  password: ""  # REQUIRED when enabled=false: PostgreSQL password
+  database: probod
+  poolSize: 100
 
 # S3 storage configuration
 # For production: Use external S3 (AWS S3, GCS, etc.)