fix: replace hostname with baseUrl param and add SAML config
Signed-off-by: Thomas Stocker <thomas.stocker.pro@gmail.com>
This commit is contained in:
Thomas Stocker
committed by
Bryan Frimin
Bryan Frimin
parent
3f3e06d85b
commit
eda00d0d65
@@ -63,7 +63,7 @@ export TRUST_TOKEN_SECRET=$(openssl rand -base64 32)
|
||||
|
||||
```bash
|
||||
helm install my-probo ./charts/probo \
|
||||
--set probo.hostname="probo.example.com" \
|
||||
--set probo.baseUrl="probo.example.com" \
|
||||
--set probo.encryptionKey="$ENCRYPTION_KEY" \
|
||||
--set probo.auth.cookieSecret="$COOKIE_SECRET" \
|
||||
--set probo.auth.passwordPepper="$PASSWORD_PEPPER" \
|
||||
@@ -315,154 +315,154 @@ spec:
|
||||
|
||||
## Full Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----------------------------------------------| ------- |----------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
||||
| replicaCount | int | `1` | Number of Probo application replicas |
|
||||
| image.repository | string | `"ghcr.io/getprobo/probo"` | Container image repository |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
|
||||
| image.tag | string | `"latest"` | Overrides the image tag whose default is the chart appVersion |
|
||||
| imagePullSecrets | list | `[]` | Image pull secrets for private registries |
|
||||
| nameOverride | string | `""` | Override the name of the chart |
|
||||
| fullnameOverride | string | `""` | Override the fullname of the chart |
|
||||
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
||||
| serviceAccount.automount | bool | `true` | Automatically mount a ServiceAccount's API credentials |
|
||||
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
||||
| serviceAccount.name | string | `""` | The name of the service account to use |
|
||||
| podAnnotations | object | `{}` | Annotations to add to pods |
|
||||
| podLabels | object | `{}` | Labels to add to pods |
|
||||
| podSecurityContext.runAsUser | int | `0` | User ID to run the container as (0 = root, change to 1000 for production) |
|
||||
| podSecurityContext.runAsGroup | int | `0` | Group ID to run the container as (0 = root, change to 1000 for production) |
|
||||
| securityContext.runAsUser | int | `0` | User ID for the security context |
|
||||
| securityContext.runAsGroup | int | `0` | Group ID for the security context |
|
||||
| securityContext.privileged | bool | `true` | Enable privileged mode for the container (set to false for production) |
|
||||
| securityContext.capabilities.drop | list | `["ALL"]` | Linux capabilities to drop from the container |
|
||||
| securityContext.readOnlyRootFilesystem | bool | `false` | Mount root filesystem as read-only (/data directory requires write access) |
|
||||
| service.type | string | `"ClusterIP"` | Kubernetes service type |
|
||||
| service.port | int | `8080` | Service port |
|
||||
| service.httpPort | int | `80` | HTTP port for TCP passthrough |
|
||||
| service.httpsPort | int | `443` | HTTPS port for TCP passthrough |
|
||||
| service.annotations | object | `{}` | Annotations for the service |
|
||||
| haproxy-ingress.enabled | bool | `true` | Enable included HAProxy Ingress controller |
|
||||
| haproxy-ingress.controller.ingressClass | string | `"haproxy"` | Ingress class name for the controller |
|
||||
| Key | Type | Default | Description |
|
||||
|---------------------------------------------------------| ------- |----------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
||||
| replicaCount | int | `1` | Number of Probo application replicas |
|
||||
| image.repository | string | `"ghcr.io/getprobo/probo"` | Container image repository |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
|
||||
| image.tag | string | `"latest"` | Overrides the image tag whose default is the chart appVersion |
|
||||
| imagePullSecrets | list | `[]` | Image pull secrets for private registries |
|
||||
| nameOverride | string | `""` | Override the name of the chart |
|
||||
| fullnameOverride | string | `""` | Override the fullname of the chart |
|
||||
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
|
||||
| serviceAccount.automount | bool | `true` | Automatically mount a ServiceAccount's API credentials |
|
||||
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
|
||||
| serviceAccount.name | string | `""` | The name of the service account to use |
|
||||
| podAnnotations | object | `{}` | Annotations to add to pods |
|
||||
| podLabels | object | `{}` | Labels to add to pods |
|
||||
| podSecurityContext.runAsUser | int | `0` | User ID to run the container as (0 = root, change to 1000 for production) |
|
||||
| podSecurityContext.runAsGroup | int | `0` | Group ID to run the container as (0 = root, change to 1000 for production) |
|
||||
| securityContext.runAsUser | int | `0` | User ID for the security context |
|
||||
| securityContext.runAsGroup | int | `0` | Group ID for the security context |
|
||||
| securityContext.privileged | bool | `true` | Enable privileged mode for the container (set to false for production) |
|
||||
| securityContext.capabilities.drop | list | `["ALL"]` | Linux capabilities to drop from the container |
|
||||
| securityContext.readOnlyRootFilesystem | bool | `false` | Mount root filesystem as read-only (/data directory requires write access) |
|
||||
| service.type | string | `"ClusterIP"` | Kubernetes service type |
|
||||
| service.port | int | `8080` | Service port |
|
||||
| service.httpPort | int | `80` | HTTP port for TCP passthrough |
|
||||
| service.httpsPort | int | `443` | HTTPS port for TCP passthrough |
|
||||
| service.annotations | object | `{}` | Annotations for the service |
|
||||
| haproxy-ingress.enabled | bool | `true` | Enable included HAProxy Ingress controller |
|
||||
| haproxy-ingress.controller.ingressClass | string | `"haproxy"` | Ingress class name for the controller |
|
||||
| haproxy-ingress.controller.ingressClassResource.enabled | bool | `true` | Enable IngressClass resource creation |
|
||||
| haproxy-ingress.controller.ingressClassResource.name | string | `"haproxy"` | Name of the IngressClass resource |
|
||||
| haproxy-ingress.controller.ingressClassResource.name | string | `"haproxy"` | Name of the IngressClass resource |
|
||||
| haproxy-ingress.controller.ingressClassResource.default | bool | `false` | Set as default IngressClass |
|
||||
| haproxy-ingress.controller.service.type | string | `"LoadBalancer"` | HAProxy Ingress controller service type |
|
||||
| haproxy-ingress.controller.extraArgs | list | `["--tcp-services-configmap=$(POD_NAMESPACE)/haproxy-tcp-services"]` | Extra arguments for HAProxy controller |
|
||||
| haproxy-ingress.controller.config.ssl-redirect | string | `"false"` | Disable automatic SSL redirect |
|
||||
| ingress.enabled | bool | `true` | Enable ingress resource |
|
||||
| ingress.className | string | `"haproxy"` | Ingress class name |
|
||||
| ingress.annotations | object | `{"kubernetes.io/ingress.class": "haproxy"}` | Annotations for the ingress resource |
|
||||
| ingress.hosts[0].host | string | `"probo.example.com"` | Ingress hostname |
|
||||
| ingress.hosts[0].paths[0].path | string | `"/"` | Path to match |
|
||||
| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | Path matching type |
|
||||
| ingress.tls | list | `[]` | TLS configuration for ingress |
|
||||
| resources.limits.cpu | string | `"2000m"` | CPU limit for the container |
|
||||
| resources.limits.memory | string | `"2Gi"` | Memory limit for the container |
|
||||
| resources.requests.cpu | string | `"500m"` | CPU request for the container |
|
||||
| resources.requests.memory | string | `"512Mi"` | Memory request for the container |
|
||||
| livenessProbe.httpGet.path | string | `"/"` | Path for the liveness probe |
|
||||
| livenessProbe.httpGet.port | string | `"http"` | Port for the liveness probe |
|
||||
| livenessProbe.initialDelaySeconds | int | `30` | Initial delay for liveness probe |
|
||||
| livenessProbe.periodSeconds | int | `10` | Period for liveness probe |
|
||||
| livenessProbe.timeoutSeconds | int | `5` | Timeout for liveness probe |
|
||||
| livenessProbe.failureThreshold | int | `6` | Failure threshold for liveness probe |
|
||||
| readinessProbe.httpGet.path | string | `"/"` | Path for the readiness probe |
|
||||
| readinessProbe.httpGet.port | string | `"http"` | Port for the readiness probe |
|
||||
| readinessProbe.initialDelaySeconds | int | `10` | Initial delay for readiness probe |
|
||||
| readinessProbe.periodSeconds | int | `5` | Period for readiness probe |
|
||||
| readinessProbe.timeoutSeconds | int | `3` | Timeout for readiness probe |
|
||||
| readinessProbe.failureThreshold | int | `3` | Failure threshold for readiness probe |
|
||||
| autoscaling.enabled | bool | `false` | Enable horizontal pod autoscaling |
|
||||
| autoscaling.minReplicas | int | `1` | Minimum number of replicas |
|
||||
| autoscaling.maxReplicas | int | `10` | Maximum number of replicas |
|
||||
| autoscaling.targetCPUUtilizationPercentage | int | `80` | Target CPU utilization percentage |
|
||||
| volumes | list | `[]` | Additional volumes on the output Deployment definition |
|
||||
| volumeMounts | list | `[]` | Additional volumeMounts on the output Deployment definition |
|
||||
| nodeSelector | object | `{}` | Node selector for pod assignment |
|
||||
| tolerations | list | `[]` | Tolerations for pod assignment |
|
||||
| affinity | object | `{}` | Affinity rules for pod assignment |
|
||||
| persistence.enabled | bool | `false` | Enable persistent volume for data storage |
|
||||
| persistence.storageClass | string | `""` | Storage class for the persistent volume |
|
||||
| persistence.accessMode | string | `"ReadWriteOnce"` | Access mode for the persistent volume |
|
||||
| persistence.size | string | `"10Gi"` | Size of the persistent volume |
|
||||
| persistence.annotations | object | `{}` | Annotations for the persistent volume claim |
|
||||
| metrics.serviceMonitor.enabled | bool | `false` | Enable Prometheus Operator ServiceMonitor |
|
||||
| metrics.serviceMonitor.interval | string | `"30s"` | Scrape interval for metrics |
|
||||
| metrics.serviceMonitor.scrapeTimeout | string | `"10s"` | Scrape timeout for metrics |
|
||||
| metrics.serviceMonitor.labels | object | `{}` | Labels for the ServiceMonitor |
|
||||
| metrics.serviceMonitor.relabelings | list | `[]` | Relabeling configs for the ServiceMonitor |
|
||||
| probo.hostname | string | `"probo.example.com"` | Public hostname where Probo will be accessible |
|
||||
| probo.encryptionKey | string | `""` | **REQUIRED** Base64-encoded encryption key (generate with: openssl rand -base64 32) |
|
||||
| probo.service.port | int | `8080` | Probo application service port |
|
||||
| probo.metrics.port | int | `8081` | Probo metrics service port |
|
||||
| probo.tracing.enabled | bool | `false` | Enable OpenTelemetry tracing |
|
||||
| probo.tracing.addr | string | `""` | OTLP gRPC endpoint (e.g., tempo:4317) |
|
||||
| probo.tracing.maxBatchSize | int | `512` | Maximum batch size for trace exports |
|
||||
| probo.tracing.batchTimeout | int | `5` | Batch timeout in seconds |
|
||||
| probo.tracing.exportTimeout | int | `30` | Export timeout in seconds |
|
||||
| probo.tracing.maxQueueSize | int | `2048` | Maximum queue size for traces |
|
||||
| probo.cors.allowedOrigins | list | `["https://probo.example.com", "http://..."]` | CORS allowed origins |
|
||||
| probo.extraHeaderFields | object | `{}` | Extra HTTP headers to add to responses |
|
||||
| probo.auth.disableSignup | bool | `false` | Disable user signup |
|
||||
| probo.auth.invitationTokenValidity | int | `3600` | Invitation token validity in seconds |
|
||||
| probo.auth.cookieName | string | `"SSID"` | Authentication cookie name |
|
||||
| probo.auth.cookieDomain | string | `"probo.example.com"` | Authentication cookie domain |
|
||||
| probo.auth.cookieSecret | string | `""` | **REQUIRED** Cookie signing secret (at least 32 bytes, generate with: openssl rand -base64 32) |
|
||||
| probo.auth.cookieDuration | int | `24` | Cookie duration in hours |
|
||||
| probo.auth.passwordPepper | string | `""` | **REQUIRED** Password hashing pepper (at least 32 bytes, generate with: openssl rand -base64 32) |
|
||||
| probo.auth.passwordIterations | int | `1000000` | Password hashing iterations |
|
||||
| probo.trustAuth.cookieName | string | `"TCT"` | Trust center cookie name |
|
||||
| probo.trustAuth.cookieDomain | string | `"probo.example.com"` | Trust center cookie domain |
|
||||
| probo.trustAuth.cookieDuration | int | `24` | Trust center cookie duration in hours |
|
||||
| probo.trustAuth.tokenDuration | int | `168` | Trust token duration in hours |
|
||||
| probo.trustAuth.reportUrlDuration | int | `15` | Report URL duration in minutes |
|
||||
| probo.trustAuth.tokenSecret | string | `""` | **REQUIRED** Trust token signing secret (at least 32 bytes, generate with: openssl rand -base64 32) |
|
||||
| probo.trustAuth.scope | string | `"trust_center_readonly"` | Trust token scope |
|
||||
| probo.trustAuth.tokenType | string | `"trust_center_access"` | Trust token type |
|
||||
| probo.mailer.senderName | string | `"Probo"` | Email sender name |
|
||||
| probo.mailer.senderEmail | string | `"no-reply@notification.getprobo.com"` | Email sender address |
|
||||
| probo.mailer.smtp.addr | string | `"sandbox.smtp.mailtrap.io:2525"` | SMTP server address |
|
||||
| probo.mailer.smtp.user | string | `"2d1b1d0e8b3d0b"` | SMTP username |
|
||||
| probo.mailer.smtp.password | string | `"25a8eb11e75e8d"` | SMTP password |
|
||||
| probo.mailer.smtp.tlsRequired | bool | `true` | Require TLS for SMTP connection |
|
||||
| probo.openai.apiKey | string | `""` | OpenAI API key for AI features (optional) |
|
||||
| probo.openai.temperature | float | `0.1` | OpenAI temperature setting |
|
||||
| probo.openai.modelName | string | `"gpt-4o"` | OpenAI model name |
|
||||
| probo.customDomains.enabled | bool | `false` | Enable custom domains feature |
|
||||
| probo.customDomains.renewalInterval | int | `3600` | Certificate renewal interval in seconds |
|
||||
| probo.customDomains.provisionInterval | int | `30` | Domain provision interval in seconds |
|
||||
| probo.customDomains.cnameTarget | string | `"probo.example.com"` | CNAME target for custom domains |
|
||||
| probo.customDomains.acme.directory | string | `"https://acme-v02.api.letsencrypt.org/directory"` | ACME directory URL |
|
||||
| probo.customDomains.acme.email | string | `"admin@example.com"` | ACME registration email |
|
||||
| probo.customDomains.acme.keyType | string | `"EC256"` | ACME key type |
|
||||
| probo.customDomains.acme.insecureTls | bool | `false` | Allow insecure TLS for ACME |
|
||||
| probo.connectors | list | `[]` | External OAuth2 connectors configuration |
|
||||
| postgresql.enabled | bool | `true` | Enable included PostgreSQL container for demo purposes using CloudNativePG |
|
||||
| postgresql.resources.limits.memory | string | `"2Gi"` | PostgreSQL memory limit |
|
||||
| postgresql.resources.limits.ephemeral-storage | string | `"5Gi"` | PostgreSQL ephemeral storage limit |
|
||||
| postgresql.auth.postgresUser | string | `"probod"` | PostgreSQL username |
|
||||
| postgresql.auth.postgresPassword | string | `"probod"` | PostgreSQL password |
|
||||
| postgresql.auth.database | string | `"probod"` | PostgreSQL database name |
|
||||
| s3.region | string | `"us-east-1"` | S3 region |
|
||||
| s3.bucket | string | `"probod"` | S3 bucket name |
|
||||
| s3.endpoint | string | `""` | S3 endpoint (leave empty for AWS S3, set for S3-compatible storage) |
|
||||
| s3.accessKeyId | string | `""` | **REQUIRED** (when minio.enabled=false) S3 access key |
|
||||
| s3.secretAccessKey | string | `""` | **REQUIRED** (when minio.enabled=false) S3 secret key |
|
||||
| minio.enabled | bool | `true` | Enable included MinIO for demo purposes (NOT for production) |
|
||||
| minio.mode | string | `"standalone"` | MinIO mode |
|
||||
| minio.persistence.enabled | bool | `false` | Enable MinIO persistence |
|
||||
| minio.resources.requests.memory | string | `"128Mi"` | MinIO memory request |
|
||||
| minio.primary.enabled | bool | `true` | Enable MinIO primary node |
|
||||
| minio.auth.rootUser | string | `"probod"` | MinIO root username |
|
||||
| minio.auth.rootPassword | string | `"probod"` | MinIO root password |
|
||||
| chrome.enabled | bool | `true` | Deploy Chrome headless in the cluster for PDF generation |
|
||||
| chrome.replicaCount | int | `1` | Number of Chrome replicas |
|
||||
| chrome.image.repository | string | `"chromedp/headless-shell"` | Chrome container image repository |
|
||||
| chrome.image.tag | string | `"140.0.7259.2"` | Chrome image tag |
|
||||
| chrome.image.pullPolicy | string | `"IfNotPresent"` | Chrome image pull policy |
|
||||
| chrome.resources.limits.cpu | string | `"1000m"` | Chrome CPU limit |
|
||||
| chrome.resources.limits.memory | string | `"1Gi"` | Chrome memory limit |
|
||||
| chrome.resources.requests.cpu | string | `"100m"` | Chrome CPU request |
|
||||
| chrome.resources.requests.memory | string | `"256Mi"` | Chrome memory request |
|
||||
| chrome.external.addr | string | `""` | External Chrome address (used when chrome.enabled=false) |
|
||||
| haproxy-ingress.controller.service.type | string | `"LoadBalancer"` | HAProxy Ingress controller service type |
|
||||
| haproxy-ingress.controller.extraArgs | list | `["--tcp-services-configmap=$(POD_NAMESPACE)/haproxy-tcp-services"]` | Extra arguments for HAProxy controller |
|
||||
| haproxy-ingress.controller.config.ssl-redirect | string | `"false"` | Disable automatic SSL redirect |
|
||||
| ingress.enabled | bool | `true` | Enable ingress resource |
|
||||
| ingress.className | string | `"haproxy"` | Ingress class name |
|
||||
| ingress.annotations | object | `{"kubernetes.io/ingress.class": "haproxy"}` | Annotations for the ingress resource |
|
||||
| ingress.hosts[0].host | string | `"probo.example.com"` | Ingress hostname |
|
||||
| ingress.hosts[0].paths[0].path | string | `"/"` | Path to match |
|
||||
| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | Path matching type |
|
||||
| ingress.tls | list | `[]` | TLS configuration for ingress |
|
||||
| resources.limits.cpu | string | `"2000m"` | CPU limit for the container |
|
||||
| resources.limits.memory | string | `"2Gi"` | Memory limit for the container |
|
||||
| resources.requests.cpu | string | `"500m"` | CPU request for the container |
|
||||
| resources.requests.memory | string | `"512Mi"` | Memory request for the container |
|
||||
| livenessProbe.httpGet.path | string | `"/"` | Path for the liveness probe |
|
||||
| livenessProbe.httpGet.port | string | `"http"` | Port for the liveness probe |
|
||||
| livenessProbe.initialDelaySeconds | int | `30` | Initial delay for liveness probe |
|
||||
| livenessProbe.periodSeconds | int | `10` | Period for liveness probe |
|
||||
| livenessProbe.timeoutSeconds | int | `5` | Timeout for liveness probe |
|
||||
| livenessProbe.failureThreshold | int | `6` | Failure threshold for liveness probe |
|
||||
| readinessProbe.httpGet.path | string | `"/"` | Path for the readiness probe |
|
||||
| readinessProbe.httpGet.port | string | `"http"` | Port for the readiness probe |
|
||||
| readinessProbe.initialDelaySeconds | int | `10` | Initial delay for readiness probe |
|
||||
| readinessProbe.periodSeconds | int | `5` | Period for readiness probe |
|
||||
| readinessProbe.timeoutSeconds | int | `3` | Timeout for readiness probe |
|
||||
| readinessProbe.failureThreshold | int | `3` | Failure threshold for readiness probe |
|
||||
| autoscaling.enabled | bool | `false` | Enable horizontal pod autoscaling |
|
||||
| autoscaling.minReplicas | int | `1` | Minimum number of replicas |
|
||||
| autoscaling.maxReplicas | int | `10` | Maximum number of replicas |
|
||||
| autoscaling.targetCPUUtilizationPercentage | int | `80` | Target CPU utilization percentage |
|
||||
| volumes | list | `[]` | Additional volumes on the output Deployment definition |
|
||||
| volumeMounts | list | `[]` | Additional volumeMounts on the output Deployment definition |
|
||||
| nodeSelector | object | `{}` | Node selector for pod assignment |
|
||||
| tolerations | list | `[]` | Tolerations for pod assignment |
|
||||
| affinity | object | `{}` | Affinity rules for pod assignment |
|
||||
| persistence.enabled | bool | `false` | Enable persistent volume for data storage |
|
||||
| persistence.storageClass | string | `""` | Storage class for the persistent volume |
|
||||
| persistence.accessMode | string | `"ReadWriteOnce"` | Access mode for the persistent volume |
|
||||
| persistence.size | string | `"10Gi"` | Size of the persistent volume |
|
||||
| persistence.annotations | object | `{}` | Annotations for the persistent volume claim |
|
||||
| metrics.serviceMonitor.enabled | bool | `false` | Enable Prometheus Operator ServiceMonitor |
|
||||
| metrics.serviceMonitor.interval | string | `"30s"` | Scrape interval for metrics |
|
||||
| metrics.serviceMonitor.scrapeTimeout | string | `"10s"` | Scrape timeout for metrics |
|
||||
| metrics.serviceMonitor.labels | object | `{}` | Labels for the ServiceMonitor |
|
||||
| metrics.serviceMonitor.relabelings | list | `[]` | Relabeling configs for the ServiceMonitor |
|
||||
| probo.baseUrl | string | `"probo.example.com"` | Public hostname where Probo will be accessible |
|
||||
| probo.encryptionKey | string | `""` | **REQUIRED** Base64-encoded encryption key (generate with: openssl rand -base64 32) |
|
||||
| probo.service.port | int | `8080` | Probo application service port |
|
||||
| probo.metrics.port | int | `8081` | Probo metrics service port |
|
||||
| probo.tracing.enabled | bool | `false` | Enable OpenTelemetry tracing |
|
||||
| probo.tracing.addr | string | `""` | OTLP gRPC endpoint (e.g., tempo:4317) |
|
||||
| probo.tracing.maxBatchSize | int | `512` | Maximum batch size for trace exports |
|
||||
| probo.tracing.batchTimeout | int | `5` | Batch timeout in seconds |
|
||||
| probo.tracing.exportTimeout | int | `30` | Export timeout in seconds |
|
||||
| probo.tracing.maxQueueSize | int | `2048` | Maximum queue size for traces |
|
||||
| probo.cors.allowedOrigins | list | `["https://probo.example.com", "http://..."]` | CORS allowed origins |
|
||||
| probo.extraHeaderFields | object | `{}` | Extra HTTP headers to add to responses |
|
||||
| probo.auth.disableSignup | bool | `false` | Disable user signup |
|
||||
| probo.auth.invitationTokenValidity | int | `3600` | Invitation token validity in seconds |
|
||||
| probo.auth.cookieName | string | `"SSID"` | Authentication cookie name |
|
||||
| probo.auth.cookieDomain | string | `"probo.example.com"` | Authentication cookie domain |
|
||||
| probo.auth.cookieSecret | string | `""` | **REQUIRED** Cookie signing secret (at least 32 bytes, generate with: openssl rand -base64 32) |
|
||||
| probo.auth.cookieDuration | int | `24` | Cookie duration in hours |
|
||||
| probo.auth.passwordPepper | string | `""` | **REQUIRED** Password hashing pepper (at least 32 bytes, generate with: openssl rand -base64 32) |
|
||||
| probo.auth.passwordIterations | int | `1000000` | Password hashing iterations |
|
||||
| probo.trustAuth.cookieName | string | `"TCT"` | Trust center cookie name |
|
||||
| probo.trustAuth.cookieDomain | string | `"probo.example.com"` | Trust center cookie domain |
|
||||
| probo.trustAuth.cookieDuration | int | `24` | Trust center cookie duration in hours |
|
||||
| probo.trustAuth.tokenDuration | int | `168` | Trust token duration in hours |
|
||||
| probo.trustAuth.reportUrlDuration | int | `15` | Report URL duration in minutes |
|
||||
| probo.trustAuth.tokenSecret | string | `""` | **REQUIRED** Trust token signing secret (at least 32 bytes, generate with: openssl rand -base64 32) |
|
||||
| probo.trustAuth.scope | string | `"trust_center_readonly"` | Trust token scope |
|
||||
| probo.trustAuth.tokenType | string | `"trust_center_access"` | Trust token type |
|
||||
| probo.mailer.senderName | string | `"Probo"` | Email sender name |
|
||||
| probo.mailer.senderEmail | string | `"no-reply@notification.getprobo.com"` | Email sender address |
|
||||
| probo.mailer.smtp.addr | string | `"sandbox.smtp.mailtrap.io:2525"` | SMTP server address |
|
||||
| probo.mailer.smtp.user | string | `"2d1b1d0e8b3d0b"` | SMTP username |
|
||||
| probo.mailer.smtp.password | string | `"25a8eb11e75e8d"` | SMTP password |
|
||||
| probo.mailer.smtp.tlsRequired | bool | `true` | Require TLS for SMTP connection |
|
||||
| probo.openai.apiKey | string | `""` | OpenAI API key for AI features (optional) |
|
||||
| probo.openai.temperature | float | `0.1` | OpenAI temperature setting |
|
||||
| probo.openai.modelName | string | `"gpt-4o"` | OpenAI model name |
|
||||
| probo.customDomains.enabled | bool | `false` | Enable custom domains feature |
|
||||
| probo.customDomains.renewalInterval | int | `3600` | Certificate renewal interval in seconds |
|
||||
| probo.customDomains.provisionInterval | int | `30` | Domain provision interval in seconds |
|
||||
| probo.customDomains.cnameTarget | string | `"probo.example.com"` | CNAME target for custom domains |
|
||||
| probo.customDomains.acme.directory | string | `"https://acme-v02.api.letsencrypt.org/directory"` | ACME directory URL |
|
||||
| probo.customDomains.acme.email | string | `"admin@example.com"` | ACME registration email |
|
||||
| probo.customDomains.acme.keyType | string | `"EC256"` | ACME key type |
|
||||
| probo.customDomains.acme.insecureTls | bool | `false` | Allow insecure TLS for ACME |
|
||||
| probo.connectors | list | `[]` | External OAuth2 connectors configuration |
|
||||
| postgresql.enabled | bool | `true` | Enable included PostgreSQL container for demo purposes using CloudNativePG |
|
||||
| postgresql.resources.limits.memory | string | `"2Gi"` | PostgreSQL memory limit |
|
||||
| postgresql.resources.limits.ephemeral-storage | string | `"5Gi"` | PostgreSQL ephemeral storage limit |
|
||||
| postgresql.auth.postgresUser | string | `"probod"` | PostgreSQL username |
|
||||
| postgresql.auth.postgresPassword | string | `"probod"` | PostgreSQL password |
|
||||
| postgresql.auth.database | string | `"probod"` | PostgreSQL database name |
|
||||
| s3.region | string | `"us-east-1"` | S3 region |
|
||||
| s3.bucket | string | `"probod"` | S3 bucket name |
|
||||
| s3.endpoint | string | `""` | S3 endpoint (leave empty for AWS S3, set for S3-compatible storage) |
|
||||
| s3.accessKeyId | string | `""` | **REQUIRED** (when minio.enabled=false) S3 access key |
|
||||
| s3.secretAccessKey | string | `""` | **REQUIRED** (when minio.enabled=false) S3 secret key |
|
||||
| minio.enabled | bool | `true` | Enable included MinIO for demo purposes (NOT for production) |
|
||||
| minio.mode | string | `"standalone"` | MinIO mode |
|
||||
| minio.persistence.enabled | bool | `false` | Enable MinIO persistence |
|
||||
| minio.resources.requests.memory | string | `"128Mi"` | MinIO memory request |
|
||||
| minio.primary.enabled | bool | `true` | Enable MinIO primary node |
|
||||
| minio.auth.rootUser | string | `"probod"` | MinIO root username |
|
||||
| minio.auth.rootPassword | string | `"probod"` | MinIO root password |
|
||||
| chrome.enabled | bool | `true` | Deploy Chrome headless in the cluster for PDF generation |
|
||||
| chrome.replicaCount | int | `1` | Number of Chrome replicas |
|
||||
| chrome.image.repository | string | `"chromedp/headless-shell"` | Chrome container image repository |
|
||||
| chrome.image.tag | string | `"140.0.7259.2"` | Chrome image tag |
|
||||
| chrome.image.pullPolicy | string | `"IfNotPresent"` | Chrome image pull policy |
|
||||
| chrome.resources.limits.cpu | string | `"1000m"` | Chrome CPU limit |
|
||||
| chrome.resources.limits.memory | string | `"1Gi"` | Chrome memory limit |
|
||||
| chrome.resources.requests.cpu | string | `"100m"` | Chrome CPU request |
|
||||
| chrome.resources.requests.memory | string | `"256Mi"` | Chrome memory request |
|
||||
| chrome.external.addr | string | `""` | External Chrome address (used when chrome.enabled=false) |
|
||||
|
||||
@@ -27,7 +27,7 @@ echo "Save these secrets securely!"
|
||||
|
||||
```bash
|
||||
helm install probo . \
|
||||
--set probo.hostname="probo.example.com" \
|
||||
--set probo.baseUrl="probo.example.com" \
|
||||
--set probo.encryptionKey="$ENCRYPTION_KEY" \
|
||||
--set probo.auth.cookieSecret="$COOKIE_SECRET" \
|
||||
--set probo.auth.passwordPepper="$PASSWORD_PEPPER" \
|
||||
@@ -67,7 +67,7 @@ ingress:
|
||||
- probo.example.com
|
||||
|
||||
probo:
|
||||
hostname: "probo.example.com"
|
||||
baseUrl: "probo.example.com"
|
||||
encryptionKey: "<secret>"
|
||||
cors:
|
||||
allowedOrigins:
|
||||
@@ -128,22 +128,22 @@ The following parameters **must** be configured:
|
||||
|
||||
### Key Configuration Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `image.repository` | Probo image repository | `ghcr.io/getprobo/probo` |
|
||||
| `image.tag` | Probo image tag | Chart appVersion |
|
||||
| `replicaCount` | Number of Probo replicas | `1` |
|
||||
| `probo.hostname` | Public hostname | `probo.example.com` |
|
||||
| `postgresql.host` | PostgreSQL host | `""` (required) |
|
||||
| `postgresql.port` | PostgreSQL port | `5432` |
|
||||
| `postgresql.database` | Database name | `probod` |
|
||||
| `postgresql.username` | Database user | `probod` |
|
||||
| `s3.bucket` | S3 bucket name | `probod` |
|
||||
| `s3.region` | AWS region | `us-east-1` |
|
||||
| `s3.endpoint` | S3 endpoint (for S3-compatible) | `""` |
|
||||
| `chrome.enabled` | Deploy Chrome | `true` |
|
||||
| `chrome.external.addr` | External Chrome (if disabled) | `""` |
|
||||
| `ingress.enabled` | Enable ingress | `false` |
|
||||
| Parameter | Description | Default |
|
||||
|------------------------|---------------------------------|---------|
|
||||
| `image.repository` | Probo image repository | `ghcr.io/getprobo/probo` |
|
||||
| `image.tag` | Probo image tag | Chart appVersion |
|
||||
| `replicaCount` | Number of Probo replicas | `1` |
|
||||
| `probo.baseUrl` | Public baseUrl | `probo.example.com` |
|
||||
| `postgresql.host` | PostgreSQL host | `""` (required) |
|
||||
| `postgresql.port` | PostgreSQL port | `5432` |
|
||||
| `postgresql.database` | Database name | `probod` |
|
||||
| `postgresql.username` | Database user | `probod` |
|
||||
| `s3.bucket` | S3 bucket name | `probod` |
|
||||
| `s3.region` | AWS region | `us-east-1` |
|
||||
| `s3.endpoint` | S3 endpoint (for S3-compatible) | `""` |
|
||||
| `chrome.enabled` | Deploy Chrome | `true` |
|
||||
| `chrome.external.addr` | External Chrome (if disabled) | `""` |
|
||||
| `ingress.enabled` | Enable ingress | `false` |
|
||||
|
||||
See [values.yaml](values.yaml) for all available options.
|
||||
|
||||
|
||||
@@ -72,7 +72,7 @@
|
||||
📚 Next Steps:
|
||||
|
||||
1. Update the hostname to match your domain:
|
||||
probo.hostname: "{{ .Values.probo.hostname }}"
|
||||
probo.baseUrl: "{{ .Values.probo.baseUrl }}"
|
||||
|
||||
2. Configure email delivery:
|
||||
Update probo.mailer.smtp settings with your SMTP server details
|
||||
|
||||
@@ -56,7 +56,7 @@ spec:
|
||||
{{- end }}
|
||||
# Application Configuration
|
||||
- name: PROBOD_BASE_URL
|
||||
value: {{ printf "https://%s" .Values.probo.hostname | quote }}
|
||||
value: {{ printf "https://%s" .Values.probo.baseUrl | quote }}
|
||||
- name: PROBOD_ENCRYPTION_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
@@ -106,6 +106,27 @@ spec:
|
||||
key: password-pepper
|
||||
- name: AUTH_PASSWORD_ITERATIONS
|
||||
value: {{ .Values.probo.auth.passwordIterations | quote }}
|
||||
{{- if .Values.probo.saml.enabled }}
|
||||
# SAML Authentication
|
||||
- name: SAML_SESSION_DURATION
|
||||
value: {{ .Values.probo.saml.sessionDuration | quote }}
|
||||
- name: SAML_CLEANUP_INTERVAL_SECONDS
|
||||
value: {{ .Values.probo.saml.cleanupIntervalSeconds | quote }}
|
||||
{{- if .Values.probo.saml.certificate }}
|
||||
- name: SAML_CERTIFICATE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "probo.fullname" . }}
|
||||
key: saml-certificate
|
||||
{{- end }}
|
||||
{{- if .Values.probo.saml.privateKey }}
|
||||
- name: SAML_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "probo.fullname" . }}
|
||||
key: saml-private-key
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# Trust Center Authentication
|
||||
- name: TRUST_AUTH_COOKIE_NAME
|
||||
value: {{ .Values.probo.trustAuth.cookieName | quote }}
|
||||
|
||||
@@ -32,6 +32,14 @@ stringData:
|
||||
openai-api-key: {{ .Values.probo.openai.apiKey | quote }}
|
||||
{{- end }}
|
||||
|
||||
# Optional SAML secrets
|
||||
{{- if and .Values.probo.saml.enabled .Values.probo.saml.certificate }}
|
||||
saml-certificate: {{ .Values.probo.saml.certificate | quote }}
|
||||
{{- end }}
|
||||
{{- if and .Values.probo.saml.enabled .Values.probo.saml.privateKey }}
|
||||
saml-private-key: {{ .Values.probo.saml.privateKey | quote }}
|
||||
{{- end }}
|
||||
|
||||
# Optional Connector secrets
|
||||
{{- range .Values.probo.connectors }}
|
||||
{{- if eq .name "slack" }}
|
||||
|
||||
@@ -95,7 +95,7 @@ ingress:
|
||||
# Probo application configuration
|
||||
probo:
|
||||
# Must match your ingress hostname
|
||||
hostname: "probo.example.com"
|
||||
baseUrl: "probo.example.com"
|
||||
|
||||
# REQUIRED: Generate with: openssl rand -base64 32
|
||||
encryptionKey: "CHANGE_ME_ENCRYPTION_KEY"
|
||||
|
||||
@@ -169,7 +169,7 @@ metrics:
|
||||
probo:
|
||||
# Public hostname where Probo will be accessible
|
||||
# This should match your ingress host
|
||||
hostname: probo.example.com
|
||||
baseUrl: probo.example.com
|
||||
|
||||
# Base64-encoded encryption key (REQUIRED)
|
||||
# Generate with: openssl rand -base64 32
|
||||
@@ -221,6 +221,19 @@ probo:
|
||||
passwordPepper: ""
|
||||
passwordIterations: 1000000
|
||||
|
||||
# SAML authentication (optional)
|
||||
saml:
|
||||
# Enable SAML authentication
|
||||
enabled: false
|
||||
# SAML session validity duration in seconds (default: 604800 = 7 days)
|
||||
sessionDuration: 604800
|
||||
# Cleanup interval in seconds for expired SAML sessions (0 = disabled)
|
||||
cleanupIntervalSeconds: 0
|
||||
# SAML service provider certificate in PEM format
|
||||
certificate: ""
|
||||
# SAML service provider private key in PEM format
|
||||
privateKey: ""
|
||||
|
||||
# Trust center authentication
|
||||
trustAuth:
|
||||
cookieName: "TCT"
|
||||
|
||||
Reference in New Issue
Block a user