From eda00d0d655e222d76bfe06cf9857264230be449 Mon Sep 17 00:00:00 2001 From: Thomas Stocker Date: Tue, 4 Nov 2025 13:46:07 +0100 Subject: [PATCH] fix: replace hostname with baseUrl param and add SAML config Signed-off-by: Thomas Stocker --- contrib/helm/README.md | 300 +++++++++--------- contrib/helm/charts/probo/README.md | 36 +-- contrib/helm/charts/probo/templates/NOTES.txt | 2 +- .../charts/probo/templates/deployment.yaml | 23 +- .../helm/charts/probo/templates/secret.yaml | 8 + .../probo/values-production.yaml.example | 2 +- contrib/helm/charts/probo/values.yaml | 15 +- 7 files changed, 214 insertions(+), 172 deletions(-) diff --git a/contrib/helm/README.md b/contrib/helm/README.md index a10265f9f..078d38df1 100644 --- a/contrib/helm/README.md +++ b/contrib/helm/README.md @@ -63,7 +63,7 @@ export TRUST_TOKEN_SECRET=$(openssl rand -base64 32) ```bash helm install my-probo ./charts/probo \ - --set probo.hostname="probo.example.com" \ + --set probo.baseUrl="probo.example.com" \ --set probo.encryptionKey="$ENCRYPTION_KEY" \ --set probo.auth.cookieSecret="$COOKIE_SECRET" \ --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \ @@ -315,154 +315,154 @@ spec: ## Full Values -| Key | Type | Default | Description | -|-----------------------------------------------| ------- |----------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| replicaCount | int | `1` | Number of Probo application replicas | -| image.repository | string | `"ghcr.io/getprobo/probo"` | Container image repository | -| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | -| image.tag | string | `"latest"` | Overrides the image tag whose default is the chart appVersion | -| imagePullSecrets | list | `[]` | Image pull secrets for private registries | -| nameOverride | string | `""` | Override the name of the chart | -| fullnameOverride | string | `""` | Override the fullname of the chart | -| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | -| serviceAccount.automount | bool | `true` | Automatically mount a ServiceAccount's API credentials | -| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | -| serviceAccount.name | string | `""` | The name of the service account to use | -| podAnnotations | object | `{}` | Annotations to add to pods | -| podLabels | object | `{}` | Labels to add to pods | -| podSecurityContext.runAsUser | int | `0` | User ID to run the container as (0 = root, change to 1000 for production) | -| podSecurityContext.runAsGroup | int | `0` | Group ID to run the container as (0 = root, change to 1000 for production) | -| securityContext.runAsUser | int | `0` | User ID for the security context | -| securityContext.runAsGroup | int | `0` | Group ID for the security context | -| securityContext.privileged | bool | `true` | Enable privileged mode for the container (set to false for production) | -| securityContext.capabilities.drop | list | `["ALL"]` | Linux capabilities to drop from the container | -| securityContext.readOnlyRootFilesystem | bool | `false` | Mount root filesystem as read-only (/data directory requires write access) | -| service.type | string | `"ClusterIP"` | Kubernetes service type | -| service.port | int | `8080` | Service port | -| service.httpPort | int | `80` | HTTP port for TCP passthrough | -| service.httpsPort | int | `443` | HTTPS port for TCP passthrough | -| service.annotations | object | `{}` | Annotations for the service | -| haproxy-ingress.enabled | bool | `true` | Enable included HAProxy Ingress controller | -| haproxy-ingress.controller.ingressClass | string | `"haproxy"` | Ingress class name for the controller | +| Key | Type | Default | Description | +|---------------------------------------------------------| ------- |----------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| replicaCount | int | `1` | Number of Probo application replicas | +| image.repository | string | `"ghcr.io/getprobo/probo"` | Container image repository | +| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | +| image.tag | string | `"latest"` | Overrides the image tag whose default is the chart appVersion | +| imagePullSecrets | list | `[]` | Image pull secrets for private registries | +| nameOverride | string | `""` | Override the name of the chart | +| fullnameOverride | string | `""` | Override the fullname of the chart | +| serviceAccount.create | bool | `true` | Specifies whether a service account should be created | +| serviceAccount.automount | bool | `true` | Automatically mount a ServiceAccount's API credentials | +| serviceAccount.annotations | object | `{}` | Annotations to add to the service account | +| serviceAccount.name | string | `""` | The name of the service account to use | +| podAnnotations | object | `{}` | Annotations to add to pods | +| podLabels | object | `{}` | Labels to add to pods | +| podSecurityContext.runAsUser | int | `0` | User ID to run the container as (0 = root, change to 1000 for production) | +| podSecurityContext.runAsGroup | int | `0` | Group ID to run the container as (0 = root, change to 1000 for production) | +| securityContext.runAsUser | int | `0` | User ID for the security context | +| securityContext.runAsGroup | int | `0` | Group ID for the security context | +| securityContext.privileged | bool | `true` | Enable privileged mode for the container (set to false for production) | +| securityContext.capabilities.drop | list | `["ALL"]` | Linux capabilities to drop from the container | +| securityContext.readOnlyRootFilesystem | bool | `false` | Mount root filesystem as read-only (/data directory requires write access) | +| service.type | string | `"ClusterIP"` | Kubernetes service type | +| service.port | int | `8080` | Service port | +| service.httpPort | int | `80` | HTTP port for TCP passthrough | +| service.httpsPort | int | `443` | HTTPS port for TCP passthrough | +| service.annotations | object | `{}` | Annotations for the service | +| haproxy-ingress.enabled | bool | `true` | Enable included HAProxy Ingress controller | +| haproxy-ingress.controller.ingressClass | string | `"haproxy"` | Ingress class name for the controller | | haproxy-ingress.controller.ingressClassResource.enabled | bool | `true` | Enable IngressClass resource creation | -| haproxy-ingress.controller.ingressClassResource.name | string | `"haproxy"` | Name of the IngressClass resource | +| haproxy-ingress.controller.ingressClassResource.name | string | `"haproxy"` | Name of the IngressClass resource | | haproxy-ingress.controller.ingressClassResource.default | bool | `false` | Set as default IngressClass | -| haproxy-ingress.controller.service.type | string | `"LoadBalancer"` | HAProxy Ingress controller service type | -| haproxy-ingress.controller.extraArgs | list | `["--tcp-services-configmap=$(POD_NAMESPACE)/haproxy-tcp-services"]` | Extra arguments for HAProxy controller | -| haproxy-ingress.controller.config.ssl-redirect | string | `"false"` | Disable automatic SSL redirect | -| ingress.enabled | bool | `true` | Enable ingress resource | -| ingress.className | string | `"haproxy"` | Ingress class name | -| ingress.annotations | object | `{"kubernetes.io/ingress.class": "haproxy"}` | Annotations for the ingress resource | -| ingress.hosts[0].host | string | `"probo.example.com"` | Ingress hostname | -| ingress.hosts[0].paths[0].path | string | `"/"` | Path to match | -| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | Path matching type | -| ingress.tls | list | `[]` | TLS configuration for ingress | -| resources.limits.cpu | string | `"2000m"` | CPU limit for the container | -| resources.limits.memory | string | `"2Gi"` | Memory limit for the container | -| resources.requests.cpu | string | `"500m"` | CPU request for the container | -| resources.requests.memory | string | `"512Mi"` | Memory request for the container | -| livenessProbe.httpGet.path | string | `"/"` | Path for the liveness probe | -| livenessProbe.httpGet.port | string | `"http"` | Port for the liveness probe | -| livenessProbe.initialDelaySeconds | int | `30` | Initial delay for liveness probe | -| livenessProbe.periodSeconds | int | `10` | Period for liveness probe | -| livenessProbe.timeoutSeconds | int | `5` | Timeout for liveness probe | -| livenessProbe.failureThreshold | int | `6` | Failure threshold for liveness probe | -| readinessProbe.httpGet.path | string | `"/"` | Path for the readiness probe | -| readinessProbe.httpGet.port | string | `"http"` | Port for the readiness probe | -| readinessProbe.initialDelaySeconds | int | `10` | Initial delay for readiness probe | -| readinessProbe.periodSeconds | int | `5` | Period for readiness probe | -| readinessProbe.timeoutSeconds | int | `3` | Timeout for readiness probe | -| readinessProbe.failureThreshold | int | `3` | Failure threshold for readiness probe | -| autoscaling.enabled | bool | `false` | Enable horizontal pod autoscaling | -| autoscaling.minReplicas | int | `1` | Minimum number of replicas | -| autoscaling.maxReplicas | int | `10` | Maximum number of replicas | -| autoscaling.targetCPUUtilizationPercentage | int | `80` | Target CPU utilization percentage | -| volumes | list | `[]` | Additional volumes on the output Deployment definition | -| volumeMounts | list | `[]` | Additional volumeMounts on the output Deployment definition | -| nodeSelector | object | `{}` | Node selector for pod assignment | -| tolerations | list | `[]` | Tolerations for pod assignment | -| affinity | object | `{}` | Affinity rules for pod assignment | -| persistence.enabled | bool | `false` | Enable persistent volume for data storage | -| persistence.storageClass | string | `""` | Storage class for the persistent volume | -| persistence.accessMode | string | `"ReadWriteOnce"` | Access mode for the persistent volume | -| persistence.size | string | `"10Gi"` | Size of the persistent volume | -| persistence.annotations | object | `{}` | Annotations for the persistent volume claim | -| metrics.serviceMonitor.enabled | bool | `false` | Enable Prometheus Operator ServiceMonitor | -| metrics.serviceMonitor.interval | string | `"30s"` | Scrape interval for metrics | -| metrics.serviceMonitor.scrapeTimeout | string | `"10s"` | Scrape timeout for metrics | -| metrics.serviceMonitor.labels | object | `{}` | Labels for the ServiceMonitor | -| metrics.serviceMonitor.relabelings | list | `[]` | Relabeling configs for the ServiceMonitor | -| probo.hostname | string | `"probo.example.com"` | Public hostname where Probo will be accessible | -| probo.encryptionKey | string | `""` | **REQUIRED** Base64-encoded encryption key (generate with: openssl rand -base64 32) | -| probo.service.port | int | `8080` | Probo application service port | -| probo.metrics.port | int | `8081` | Probo metrics service port | -| probo.tracing.enabled | bool | `false` | Enable OpenTelemetry tracing | -| probo.tracing.addr | string | `""` | OTLP gRPC endpoint (e.g., tempo:4317) | -| probo.tracing.maxBatchSize | int | `512` | Maximum batch size for trace exports | -| probo.tracing.batchTimeout | int | `5` | Batch timeout in seconds | -| probo.tracing.exportTimeout | int | `30` | Export timeout in seconds | -| probo.tracing.maxQueueSize | int | `2048` | Maximum queue size for traces | -| probo.cors.allowedOrigins | list | `["https://probo.example.com", "http://..."]` | CORS allowed origins | -| probo.extraHeaderFields | object | `{}` | Extra HTTP headers to add to responses | -| probo.auth.disableSignup | bool | `false` | Disable user signup | -| probo.auth.invitationTokenValidity | int | `3600` | Invitation token validity in seconds | -| probo.auth.cookieName | string | `"SSID"` | Authentication cookie name | -| probo.auth.cookieDomain | string | `"probo.example.com"` | Authentication cookie domain | -| probo.auth.cookieSecret | string | `""` | **REQUIRED** Cookie signing secret (at least 32 bytes, generate with: openssl rand -base64 32) | -| probo.auth.cookieDuration | int | `24` | Cookie duration in hours | -| probo.auth.passwordPepper | string | `""` | **REQUIRED** Password hashing pepper (at least 32 bytes, generate with: openssl rand -base64 32) | -| probo.auth.passwordIterations | int | `1000000` | Password hashing iterations | -| probo.trustAuth.cookieName | string | `"TCT"` | Trust center cookie name | -| probo.trustAuth.cookieDomain | string | `"probo.example.com"` | Trust center cookie domain | -| probo.trustAuth.cookieDuration | int | `24` | Trust center cookie duration in hours | -| probo.trustAuth.tokenDuration | int | `168` | Trust token duration in hours | -| probo.trustAuth.reportUrlDuration | int | `15` | Report URL duration in minutes | -| probo.trustAuth.tokenSecret | string | `""` | **REQUIRED** Trust token signing secret (at least 32 bytes, generate with: openssl rand -base64 32) | -| probo.trustAuth.scope | string | `"trust_center_readonly"` | Trust token scope | -| probo.trustAuth.tokenType | string | `"trust_center_access"` | Trust token type | -| probo.mailer.senderName | string | `"Probo"` | Email sender name | -| probo.mailer.senderEmail | string | `"no-reply@notification.getprobo.com"` | Email sender address | -| probo.mailer.smtp.addr | string | `"sandbox.smtp.mailtrap.io:2525"` | SMTP server address | -| probo.mailer.smtp.user | string | `"2d1b1d0e8b3d0b"` | SMTP username | -| probo.mailer.smtp.password | string | `"25a8eb11e75e8d"` | SMTP password | -| probo.mailer.smtp.tlsRequired | bool | `true` | Require TLS for SMTP connection | -| probo.openai.apiKey | string | `""` | OpenAI API key for AI features (optional) | -| probo.openai.temperature | float | `0.1` | OpenAI temperature setting | -| probo.openai.modelName | string | `"gpt-4o"` | OpenAI model name | -| probo.customDomains.enabled | bool | `false` | Enable custom domains feature | -| probo.customDomains.renewalInterval | int | `3600` | Certificate renewal interval in seconds | -| probo.customDomains.provisionInterval | int | `30` | Domain provision interval in seconds | -| probo.customDomains.cnameTarget | string | `"probo.example.com"` | CNAME target for custom domains | -| probo.customDomains.acme.directory | string | `"https://acme-v02.api.letsencrypt.org/directory"` | ACME directory URL | -| probo.customDomains.acme.email | string | `"admin@example.com"` | ACME registration email | -| probo.customDomains.acme.keyType | string | `"EC256"` | ACME key type | -| probo.customDomains.acme.insecureTls | bool | `false` | Allow insecure TLS for ACME | -| probo.connectors | list | `[]` | External OAuth2 connectors configuration | -| postgresql.enabled | bool | `true` | Enable included PostgreSQL container for demo purposes using CloudNativePG | -| postgresql.resources.limits.memory | string | `"2Gi"` | PostgreSQL memory limit | -| postgresql.resources.limits.ephemeral-storage | string | `"5Gi"` | PostgreSQL ephemeral storage limit | -| postgresql.auth.postgresUser | string | `"probod"` | PostgreSQL username | -| postgresql.auth.postgresPassword | string | `"probod"` | PostgreSQL password | -| postgresql.auth.database | string | `"probod"` | PostgreSQL database name | -| s3.region | string | `"us-east-1"` | S3 region | -| s3.bucket | string | `"probod"` | S3 bucket name | -| s3.endpoint | string | `""` | S3 endpoint (leave empty for AWS S3, set for S3-compatible storage) | -| s3.accessKeyId | string | `""` | **REQUIRED** (when minio.enabled=false) S3 access key | -| s3.secretAccessKey | string | `""` | **REQUIRED** (when minio.enabled=false) S3 secret key | -| minio.enabled | bool | `true` | Enable included MinIO for demo purposes (NOT for production) | -| minio.mode | string | `"standalone"` | MinIO mode | -| minio.persistence.enabled | bool | `false` | Enable MinIO persistence | -| minio.resources.requests.memory | string | `"128Mi"` | MinIO memory request | -| minio.primary.enabled | bool | `true` | Enable MinIO primary node | -| minio.auth.rootUser | string | `"probod"` | MinIO root username | -| minio.auth.rootPassword | string | `"probod"` | MinIO root password | -| chrome.enabled | bool | `true` | Deploy Chrome headless in the cluster for PDF generation | -| chrome.replicaCount | int | `1` | Number of Chrome replicas | -| chrome.image.repository | string | `"chromedp/headless-shell"` | Chrome container image repository | -| chrome.image.tag | string | `"140.0.7259.2"` | Chrome image tag | -| chrome.image.pullPolicy | string | `"IfNotPresent"` | Chrome image pull policy | -| chrome.resources.limits.cpu | string | `"1000m"` | Chrome CPU limit | -| chrome.resources.limits.memory | string | `"1Gi"` | Chrome memory limit | -| chrome.resources.requests.cpu | string | `"100m"` | Chrome CPU request | -| chrome.resources.requests.memory | string | `"256Mi"` | Chrome memory request | -| chrome.external.addr | string | `""` | External Chrome address (used when chrome.enabled=false) | +| haproxy-ingress.controller.service.type | string | `"LoadBalancer"` | HAProxy Ingress controller service type | +| haproxy-ingress.controller.extraArgs | list | `["--tcp-services-configmap=$(POD_NAMESPACE)/haproxy-tcp-services"]` | Extra arguments for HAProxy controller | +| haproxy-ingress.controller.config.ssl-redirect | string | `"false"` | Disable automatic SSL redirect | +| ingress.enabled | bool | `true` | Enable ingress resource | +| ingress.className | string | `"haproxy"` | Ingress class name | +| ingress.annotations | object | `{"kubernetes.io/ingress.class": "haproxy"}` | Annotations for the ingress resource | +| ingress.hosts[0].host | string | `"probo.example.com"` | Ingress hostname | +| ingress.hosts[0].paths[0].path | string | `"/"` | Path to match | +| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | Path matching type | +| ingress.tls | list | `[]` | TLS configuration for ingress | +| resources.limits.cpu | string | `"2000m"` | CPU limit for the container | +| resources.limits.memory | string | `"2Gi"` | Memory limit for the container | +| resources.requests.cpu | string | `"500m"` | CPU request for the container | +| resources.requests.memory | string | `"512Mi"` | Memory request for the container | +| livenessProbe.httpGet.path | string | `"/"` | Path for the liveness probe | +| livenessProbe.httpGet.port | string | `"http"` | Port for the liveness probe | +| livenessProbe.initialDelaySeconds | int | `30` | Initial delay for liveness probe | +| livenessProbe.periodSeconds | int | `10` | Period for liveness probe | +| livenessProbe.timeoutSeconds | int | `5` | Timeout for liveness probe | +| livenessProbe.failureThreshold | int | `6` | Failure threshold for liveness probe | +| readinessProbe.httpGet.path | string | `"/"` | Path for the readiness probe | +| readinessProbe.httpGet.port | string | `"http"` | Port for the readiness probe | +| readinessProbe.initialDelaySeconds | int | `10` | Initial delay for readiness probe | +| readinessProbe.periodSeconds | int | `5` | Period for readiness probe | +| readinessProbe.timeoutSeconds | int | `3` | Timeout for readiness probe | +| readinessProbe.failureThreshold | int | `3` | Failure threshold for readiness probe | +| autoscaling.enabled | bool | `false` | Enable horizontal pod autoscaling | +| autoscaling.minReplicas | int | `1` | Minimum number of replicas | +| autoscaling.maxReplicas | int | `10` | Maximum number of replicas | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | Target CPU utilization percentage | +| volumes | list | `[]` | Additional volumes on the output Deployment definition | +| volumeMounts | list | `[]` | Additional volumeMounts on the output Deployment definition | +| nodeSelector | object | `{}` | Node selector for pod assignment | +| tolerations | list | `[]` | Tolerations for pod assignment | +| affinity | object | `{}` | Affinity rules for pod assignment | +| persistence.enabled | bool | `false` | Enable persistent volume for data storage | +| persistence.storageClass | string | `""` | Storage class for the persistent volume | +| persistence.accessMode | string | `"ReadWriteOnce"` | Access mode for the persistent volume | +| persistence.size | string | `"10Gi"` | Size of the persistent volume | +| persistence.annotations | object | `{}` | Annotations for the persistent volume claim | +| metrics.serviceMonitor.enabled | bool | `false` | Enable Prometheus Operator ServiceMonitor | +| metrics.serviceMonitor.interval | string | `"30s"` | Scrape interval for metrics | +| metrics.serviceMonitor.scrapeTimeout | string | `"10s"` | Scrape timeout for metrics | +| metrics.serviceMonitor.labels | object | `{}` | Labels for the ServiceMonitor | +| metrics.serviceMonitor.relabelings | list | `[]` | Relabeling configs for the ServiceMonitor | +| probo.baseUrl | string | `"probo.example.com"` | Public hostname where Probo will be accessible | +| probo.encryptionKey | string | `""` | **REQUIRED** Base64-encoded encryption key (generate with: openssl rand -base64 32) | +| probo.service.port | int | `8080` | Probo application service port | +| probo.metrics.port | int | `8081` | Probo metrics service port | +| probo.tracing.enabled | bool | `false` | Enable OpenTelemetry tracing | +| probo.tracing.addr | string | `""` | OTLP gRPC endpoint (e.g., tempo:4317) | +| probo.tracing.maxBatchSize | int | `512` | Maximum batch size for trace exports | +| probo.tracing.batchTimeout | int | `5` | Batch timeout in seconds | +| probo.tracing.exportTimeout | int | `30` | Export timeout in seconds | +| probo.tracing.maxQueueSize | int | `2048` | Maximum queue size for traces | +| probo.cors.allowedOrigins | list | `["https://probo.example.com", "http://..."]` | CORS allowed origins | +| probo.extraHeaderFields | object | `{}` | Extra HTTP headers to add to responses | +| probo.auth.disableSignup | bool | `false` | Disable user signup | +| probo.auth.invitationTokenValidity | int | `3600` | Invitation token validity in seconds | +| probo.auth.cookieName | string | `"SSID"` | Authentication cookie name | +| probo.auth.cookieDomain | string | `"probo.example.com"` | Authentication cookie domain | +| probo.auth.cookieSecret | string | `""` | **REQUIRED** Cookie signing secret (at least 32 bytes, generate with: openssl rand -base64 32) | +| probo.auth.cookieDuration | int | `24` | Cookie duration in hours | +| probo.auth.passwordPepper | string | `""` | **REQUIRED** Password hashing pepper (at least 32 bytes, generate with: openssl rand -base64 32) | +| probo.auth.passwordIterations | int | `1000000` | Password hashing iterations | +| probo.trustAuth.cookieName | string | `"TCT"` | Trust center cookie name | +| probo.trustAuth.cookieDomain | string | `"probo.example.com"` | Trust center cookie domain | +| probo.trustAuth.cookieDuration | int | `24` | Trust center cookie duration in hours | +| probo.trustAuth.tokenDuration | int | `168` | Trust token duration in hours | +| probo.trustAuth.reportUrlDuration | int | `15` | Report URL duration in minutes | +| probo.trustAuth.tokenSecret | string | `""` | **REQUIRED** Trust token signing secret (at least 32 bytes, generate with: openssl rand -base64 32) | +| probo.trustAuth.scope | string | `"trust_center_readonly"` | Trust token scope | +| probo.trustAuth.tokenType | string | `"trust_center_access"` | Trust token type | +| probo.mailer.senderName | string | `"Probo"` | Email sender name | +| probo.mailer.senderEmail | string | `"no-reply@notification.getprobo.com"` | Email sender address | +| probo.mailer.smtp.addr | string | `"sandbox.smtp.mailtrap.io:2525"` | SMTP server address | +| probo.mailer.smtp.user | string | `"2d1b1d0e8b3d0b"` | SMTP username | +| probo.mailer.smtp.password | string | `"25a8eb11e75e8d"` | SMTP password | +| probo.mailer.smtp.tlsRequired | bool | `true` | Require TLS for SMTP connection | +| probo.openai.apiKey | string | `""` | OpenAI API key for AI features (optional) | +| probo.openai.temperature | float | `0.1` | OpenAI temperature setting | +| probo.openai.modelName | string | `"gpt-4o"` | OpenAI model name | +| probo.customDomains.enabled | bool | `false` | Enable custom domains feature | +| probo.customDomains.renewalInterval | int | `3600` | Certificate renewal interval in seconds | +| probo.customDomains.provisionInterval | int | `30` | Domain provision interval in seconds | +| probo.customDomains.cnameTarget | string | `"probo.example.com"` | CNAME target for custom domains | +| probo.customDomains.acme.directory | string | `"https://acme-v02.api.letsencrypt.org/directory"` | ACME directory URL | +| probo.customDomains.acme.email | string | `"admin@example.com"` | ACME registration email | +| probo.customDomains.acme.keyType | string | `"EC256"` | ACME key type | +| probo.customDomains.acme.insecureTls | bool | `false` | Allow insecure TLS for ACME | +| probo.connectors | list | `[]` | External OAuth2 connectors configuration | +| postgresql.enabled | bool | `true` | Enable included PostgreSQL container for demo purposes using CloudNativePG | +| postgresql.resources.limits.memory | string | `"2Gi"` | PostgreSQL memory limit | +| postgresql.resources.limits.ephemeral-storage | string | `"5Gi"` | PostgreSQL ephemeral storage limit | +| postgresql.auth.postgresUser | string | `"probod"` | PostgreSQL username | +| postgresql.auth.postgresPassword | string | `"probod"` | PostgreSQL password | +| postgresql.auth.database | string | `"probod"` | PostgreSQL database name | +| s3.region | string | `"us-east-1"` | S3 region | +| s3.bucket | string | `"probod"` | S3 bucket name | +| s3.endpoint | string | `""` | S3 endpoint (leave empty for AWS S3, set for S3-compatible storage) | +| s3.accessKeyId | string | `""` | **REQUIRED** (when minio.enabled=false) S3 access key | +| s3.secretAccessKey | string | `""` | **REQUIRED** (when minio.enabled=false) S3 secret key | +| minio.enabled | bool | `true` | Enable included MinIO for demo purposes (NOT for production) | +| minio.mode | string | `"standalone"` | MinIO mode | +| minio.persistence.enabled | bool | `false` | Enable MinIO persistence | +| minio.resources.requests.memory | string | `"128Mi"` | MinIO memory request | +| minio.primary.enabled | bool | `true` | Enable MinIO primary node | +| minio.auth.rootUser | string | `"probod"` | MinIO root username | +| minio.auth.rootPassword | string | `"probod"` | MinIO root password | +| chrome.enabled | bool | `true` | Deploy Chrome headless in the cluster for PDF generation | +| chrome.replicaCount | int | `1` | Number of Chrome replicas | +| chrome.image.repository | string | `"chromedp/headless-shell"` | Chrome container image repository | +| chrome.image.tag | string | `"140.0.7259.2"` | Chrome image tag | +| chrome.image.pullPolicy | string | `"IfNotPresent"` | Chrome image pull policy | +| chrome.resources.limits.cpu | string | `"1000m"` | Chrome CPU limit | +| chrome.resources.limits.memory | string | `"1Gi"` | Chrome memory limit | +| chrome.resources.requests.cpu | string | `"100m"` | Chrome CPU request | +| chrome.resources.requests.memory | string | `"256Mi"` | Chrome memory request | +| chrome.external.addr | string | `""` | External Chrome address (used when chrome.enabled=false) | diff --git a/contrib/helm/charts/probo/README.md b/contrib/helm/charts/probo/README.md index 27b9a7dff..48f19a5e9 100644 --- a/contrib/helm/charts/probo/README.md +++ b/contrib/helm/charts/probo/README.md @@ -27,7 +27,7 @@ echo "Save these secrets securely!" ```bash helm install probo . \ - --set probo.hostname="probo.example.com" \ + --set probo.baseUrl="probo.example.com" \ --set probo.encryptionKey="$ENCRYPTION_KEY" \ --set probo.auth.cookieSecret="$COOKIE_SECRET" \ --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \ @@ -67,7 +67,7 @@ ingress: - probo.example.com probo: - hostname: "probo.example.com" + baseUrl: "probo.example.com" encryptionKey: "" cors: allowedOrigins: @@ -128,22 +128,22 @@ The following parameters **must** be configured: ### Key Configuration Parameters -| Parameter | Description | Default | -|-----------|-------------|---------| -| `image.repository` | Probo image repository | `ghcr.io/getprobo/probo` | -| `image.tag` | Probo image tag | Chart appVersion | -| `replicaCount` | Number of Probo replicas | `1` | -| `probo.hostname` | Public hostname | `probo.example.com` | -| `postgresql.host` | PostgreSQL host | `""` (required) | -| `postgresql.port` | PostgreSQL port | `5432` | -| `postgresql.database` | Database name | `probod` | -| `postgresql.username` | Database user | `probod` | -| `s3.bucket` | S3 bucket name | `probod` | -| `s3.region` | AWS region | `us-east-1` | -| `s3.endpoint` | S3 endpoint (for S3-compatible) | `""` | -| `chrome.enabled` | Deploy Chrome | `true` | -| `chrome.external.addr` | External Chrome (if disabled) | `""` | -| `ingress.enabled` | Enable ingress | `false` | +| Parameter | Description | Default | +|------------------------|---------------------------------|---------| +| `image.repository` | Probo image repository | `ghcr.io/getprobo/probo` | +| `image.tag` | Probo image tag | Chart appVersion | +| `replicaCount` | Number of Probo replicas | `1` | +| `probo.baseUrl` | Public baseUrl | `probo.example.com` | +| `postgresql.host` | PostgreSQL host | `""` (required) | +| `postgresql.port` | PostgreSQL port | `5432` | +| `postgresql.database` | Database name | `probod` | +| `postgresql.username` | Database user | `probod` | +| `s3.bucket` | S3 bucket name | `probod` | +| `s3.region` | AWS region | `us-east-1` | +| `s3.endpoint` | S3 endpoint (for S3-compatible) | `""` | +| `chrome.enabled` | Deploy Chrome | `true` | +| `chrome.external.addr` | External Chrome (if disabled) | `""` | +| `ingress.enabled` | Enable ingress | `false` | See [values.yaml](values.yaml) for all available options. diff --git a/contrib/helm/charts/probo/templates/NOTES.txt b/contrib/helm/charts/probo/templates/NOTES.txt index 38361dcc1..5928e1105 100644 --- a/contrib/helm/charts/probo/templates/NOTES.txt +++ b/contrib/helm/charts/probo/templates/NOTES.txt @@ -72,7 +72,7 @@ 📚 Next Steps: 1. Update the hostname to match your domain: - probo.hostname: "{{ .Values.probo.hostname }}" + probo.baseUrl: "{{ .Values.probo.baseUrl }}" 2. Configure email delivery: Update probo.mailer.smtp settings with your SMTP server details diff --git a/contrib/helm/charts/probo/templates/deployment.yaml b/contrib/helm/charts/probo/templates/deployment.yaml index a94a5a9d8..63cf8d1a8 100644 --- a/contrib/helm/charts/probo/templates/deployment.yaml +++ b/contrib/helm/charts/probo/templates/deployment.yaml @@ -56,7 +56,7 @@ spec: {{- end }} # Application Configuration - name: PROBOD_BASE_URL - value: {{ printf "https://%s" .Values.probo.hostname | quote }} + value: {{ printf "https://%s" .Values.probo.baseUrl | quote }} - name: PROBOD_ENCRYPTION_KEY valueFrom: secretKeyRef: @@ -106,6 +106,27 @@ spec: key: password-pepper - name: AUTH_PASSWORD_ITERATIONS value: {{ .Values.probo.auth.passwordIterations | quote }} + {{- if .Values.probo.saml.enabled }} + # SAML Authentication + - name: SAML_SESSION_DURATION + value: {{ .Values.probo.saml.sessionDuration | quote }} + - name: SAML_CLEANUP_INTERVAL_SECONDS + value: {{ .Values.probo.saml.cleanupIntervalSeconds | quote }} + {{- if .Values.probo.saml.certificate }} + - name: SAML_CERTIFICATE + valueFrom: + secretKeyRef: + name: {{ include "probo.fullname" . }} + key: saml-certificate + {{- end }} + {{- if .Values.probo.saml.privateKey }} + - name: SAML_PRIVATE_KEY + valueFrom: + secretKeyRef: + name: {{ include "probo.fullname" . }} + key: saml-private-key + {{- end }} + {{- end }} # Trust Center Authentication - name: TRUST_AUTH_COOKIE_NAME value: {{ .Values.probo.trustAuth.cookieName | quote }} diff --git a/contrib/helm/charts/probo/templates/secret.yaml b/contrib/helm/charts/probo/templates/secret.yaml index 25d832a66..94a53ca1b 100644 --- a/contrib/helm/charts/probo/templates/secret.yaml +++ b/contrib/helm/charts/probo/templates/secret.yaml @@ -32,6 +32,14 @@ stringData: openai-api-key: {{ .Values.probo.openai.apiKey | quote }} {{- end }} + # Optional SAML secrets + {{- if and .Values.probo.saml.enabled .Values.probo.saml.certificate }} + saml-certificate: {{ .Values.probo.saml.certificate | quote }} + {{- end }} + {{- if and .Values.probo.saml.enabled .Values.probo.saml.privateKey }} + saml-private-key: {{ .Values.probo.saml.privateKey | quote }} + {{- end }} + # Optional Connector secrets {{- range .Values.probo.connectors }} {{- if eq .name "slack" }} diff --git a/contrib/helm/charts/probo/values-production.yaml.example b/contrib/helm/charts/probo/values-production.yaml.example index d90768f2e..da657b31c 100644 --- a/contrib/helm/charts/probo/values-production.yaml.example +++ b/contrib/helm/charts/probo/values-production.yaml.example @@ -95,7 +95,7 @@ ingress: # Probo application configuration probo: # Must match your ingress hostname - hostname: "probo.example.com" + baseUrl: "probo.example.com" # REQUIRED: Generate with: openssl rand -base64 32 encryptionKey: "CHANGE_ME_ENCRYPTION_KEY" diff --git a/contrib/helm/charts/probo/values.yaml b/contrib/helm/charts/probo/values.yaml index 064ea42b7..79cc65392 100644 --- a/contrib/helm/charts/probo/values.yaml +++ b/contrib/helm/charts/probo/values.yaml @@ -169,7 +169,7 @@ metrics: probo: # Public hostname where Probo will be accessible # This should match your ingress host - hostname: probo.example.com + baseUrl: probo.example.com # Base64-encoded encryption key (REQUIRED) # Generate with: openssl rand -base64 32 @@ -221,6 +221,19 @@ probo: passwordPepper: "" passwordIterations: 1000000 + # SAML authentication (optional) + saml: + # Enable SAML authentication + enabled: false + # SAML session validity duration in seconds (default: 604800 = 7 days) + sessionDuration: 604800 + # Cleanup interval in seconds for expired SAML sessions (0 = disabled) + cleanupIntervalSeconds: 0 + # SAML service provider certificate in PEM format + certificate: "" + # SAML service provider private key in PEM format + privateKey: "" + # Trust center authentication trustAuth: cookieName: "TCT"