{"id":13565869,"url":"https://github.com/mmz-srf/passbolt-helm","last_synced_at":"2025-04-03T23:30:41.884Z","repository":{"id":41812776,"uuid":"277742407","full_name":"mmz-srf/passbolt-helm","owner":"mmz-srf","description":"Passbolt Kubernetes Helm Charts","archived":true,"fork":false,"pushed_at":"2023-08-24T09:07:09.000Z","size":273,"stargazers_count":18,"open_issues_count":0,"forks_count":13,"subscribers_count":10,"default_branch":"master","last_synced_at":"2024-11-04T19:42:19.689Z","etag":null,"topics":["chart","helm","helm-chart","kubernetes","passbolt","password","password-manager"],"latest_commit_sha":null,"homepage":"","language":"Mustache","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mmz-srf.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2020-07-07T07:04:09.000Z","updated_at":"2024-06-07T21:11:33.000Z","dependencies_parsed_at":"2024-01-16T19:21:47.944Z","dependency_job_id":"2dfe92a7-bcf4-4123-8d80-a46843e99567","html_url":"https://github.com/mmz-srf/passbolt-helm","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mmz-srf%2Fpassbolt-helm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mmz-srf%2Fpassbolt-helm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mmz-srf%2Fpassbolt-helm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mmz-srf%2Fpassbolt-helm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mmz-srf","download_url":"https://codeload.github.com/mmz-srf/passbolt-helm/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247097604,"owners_count":20883121,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["chart","helm","helm-chart","kubernetes","passbolt","password","password-manager"],"created_at":"2024-08-01T13:01:56.939Z","updated_at":"2025-04-03T23:30:40.902Z","avatar_url":"https://github.com/mmz-srf.png","language":"Mustache","funding_links":[],"categories":["Mustache"],"sub_categories":[],"readme":"# Passbolt Kubernetes Helm Charts\n\n\u003e **Warning**\n\u003e \n\u003e This Repository is marked **deprecated** in favor of the official Passbolt charts. \n\u003e\n\u003e https://github.com/passbolt/charts-passbolt\n\n\n[![GitHub license](https://img.shields.io/github/license/mmz-srf/passbolt-helm)](https://github.com/mmz-srf/passbolt-helm/blob/master/LICENSE)\n![GitHub issues](https://img.shields.io/badge/kubernetes-v1.19-green)\n[![GitHub issues](https://img.shields.io/github/issues/mmz-srf/passbolt-helm)](https://github.com/mmz-srf/passbolt-helm/issues)\n\n## Quick start\n\nClone this repository:\n\n```\ngit clone git@github.com:mmz-srf/passbolt-helm.git\ncd passbolt-helm\n```\n\nUpdate helm dependencies:\n\n```\nhelm dep build .\n```\n\nBefore deploying this chart, you must define some secrets:\n\n* passbolt GPG server keys\n* passbolt JWT keys for mobile\n\nYou can generate them with this script:\n\n```\nbash generate-secrets.sh\n```\n\nA `values-fingerprint.yaml` file will be created containing GPG keys fingerprint.\n\n\u003e If you are a PRO user\n\u003e * put your subscription key in `secrets/pro-license/subscription_key.txt` file.\n\u003e * Set passbolt.config.license.enabled to true in values.yaml\n\u003e * Set a [pro image tag](https://hub.docker.com/r/passbolt/passbolt/tags?page=1\u0026name=pro) in values.yaml\n\nReview values.yaml file, especially the `ingress.hosts.host` for passbolt domain name then deploy passbolt in your cluster\n\nAlways review passbolt configuration options it self.\nEspecially their environment variables https://help.passbolt.com/configure/environment/reference\n\n### non-HA mode\n\nThis mode will deploy the [passbolt container](https://github.com/passbolt/passbolt_docker/tree/master) and a mysql database (mariadb)\n\n\u003e *values-fingerprint.yaml* is a file automatically created by [generate-secrets.sh](generate-secrets.sh) script and contains your GPG server fingerprint.\n\n```\nhelm install passbolt . --values values-fingerprint.yaml\n```\n\n### HA mode\n\nIf you are interested with HA deployment, take care of the `passbolt.config.php.session.redis.service` setting. It is the first pod name by default of the xxx-redis-headless service where xxx is your helm release name (passbolt by default in the below helm command).\n\nIf your helm release name is **pblt**, replace **passbolt-redis-node-0.passbolt-redis-headless** with **pblt-redis-node-0.pblt-redis-headless**\n\nWhile the database is not yet initialized, the replicaCount of passbolt-helm deployment must be set to 1. Once the database initialized, you can scale passbolt deployment to more than 1 replica.\n\nIf you want to import your passwords from keepass or csv, it is recommended to scale to 1. Database concurrency is not well managed while importing.\n\nHA Mode uses MariaDB Galera cluster and Redis cluster.\n\nYou must have at least 3 worker nodes.\n\nIf you are ok with the above points, review the values-ha.yaml file and deploy the HA mode with:\n\n```\nhelm upgrade --install passbolt . --values values-ha.yaml --values values-fingerprint.yaml\n```\n\n## Parameters\n\nFor more parameters you should have a look at ...\n- the [values.yaml](values.yaml) file of this helm chart\n- the [values.yaml](https://github.com/helm/charts/blob/master/stable/mariadb/values.yaml) file of the mariadb helm chart, when enabled\n- the [values.yaml](https://github.com/bitnami/charts/blob/master/bitnami/mariadb-galera/values.yaml) file of the mariadb-galera helm chart, when enabled\n- the [values.yaml](https://github.com/bitnami/charts/blob/master/bitnami/redis/values.yaml) file of the redis helm chart, when enabled\n- the [environment variables](https://github.com/passbolt/passbolt_docker/tree/master) of the passbolt docker image.\n\n### General\n\n| Parameter          | Description                          | Default                   |\n|--------------------|--------------------------------------|---------------------------|\n| `replicaCount`     | How many replicas should be deployed | `1`                       |\n| `image.repository` | Passbolt image repositorys           | `\"passbolt/passbolt\"`     |\n| `image.tag`        | Passbolt image tag                   | `\"latest\"`                |\n| `image.pullPolicy` | Image pull policy                    | `IfNotPresent`            |\n| `imagePullSecrets` | Image pull secrets                   | `[]`                      |\n| `nameOverride`     | Name override                        | `\"\"`                      |\n| `fullnameOverride` | Full name override                   | `\"\"`                      |\n| `service.type`     | Service type                         | `ClusterIP`               |\n| `service.port`     | Service port                         | `80`                      |\n| `ingress.enabled`  | Enable ingress                       | `true`                    |\n| `ingress.host`     | Ingress host                         | `passbolt.yourdomain.com` |\n\n### Passbolt\n\n| Parameter                                            | Description                                                                                                          | Default                             |\n|------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|-------------------------------------|\n| `passbolt.config.debug`                              | Enable/Disable debug output in passbolt image                                                                        | `false`                             |\n| `passbolt.config.registration`                       | Enable/Disable user can register                                                                                     | `false`                             |\n| `passbolt.config.salt`                               | Salt. Generate: ```openssl rand -base64 32```                                                                        | `\"your salt\"`                       |\n| `passbolt.config.gpgServerKeyFingerprint`            | The GPG server key fingerprint. See [GPG key generation](#gpg-key-generation)                                        | `\"your gpg server key fingerprint\"` |\n| `passbolt.config.serverkey`                          | The GPG server key. If set the key will not be read from [file](secrets/gpg/serverkey.asc)                           | ` `                                 |\n| `passbolt.config.serverkey_private`                  | The GPG private server key. If set the private key will not be read from [file](secrets/gpg/serverkey_private.asc)   | ` `                                 |\n| `passbolt.config.jwtkey`                             | The JWT key. If set the key will not be read from [file](secrets/jwt/jwt.key)                                        | ` `                                 |\n| `passbolt.config.jwtcert`                            | The JWT certificate. If set the cert will not be read from [file](secrets/jwt/jwt.pem)                               | ` `                                 |\n| `passbolt.config.license.enabled`                    | Set true if you own a license key. Add the license key in [secrets/pro-license/license](secrets/pro-license/license) | `false`                             |\n| `passbolt.config.license.key`                        | The license key. If set the license key will not be read from [file](secrets/pro-license/license).                   | `false`                             |\n| `passbolt.config.php.max_execution_time`             | PHP Max execution time                                                                                               | `300`                               |\n| `passbolt.config.php.memory_limit`                   | PHP Memory Limit                                                                                                     | `512M`                              |\n| `passbolt.config.php.post_max_size`                  | PHP post max size                                                                                                    | `24M`                               |\n| `passbolt.config.php.upload_max_filesize`            | PHP upload max filesize                                                                                              | `24M`                               |\n| `passbolt.config.php.pm_value`                       | PHP-FPM pm_value                                                                                                     | `dynamic`                           |\n| `passbolt.config.php.pm.max_children`                | PHP-FPM pm.max_children                                                                                              | `40`                                |\n| `passbolt.config.php.pm.start_servers`               | PHP-FPM pm.start_servers                                                                                             | `16`                                |\n| `passbolt.config.php.pm.min_spare_servers`           | PHP-FPM pm.min_spare_servers                                                                                         | `8`                                 |\n| `passbolt.config.php.pm.max_spare_servers`           | PHP-FPM pm.max_spare_servers                                                                                         | `16`                                |\n| `passbolt.config.php.pm.process_idle_timeout`        | PHP-FPM pm.process_idle_timeout                                                                                      | `10s`                               |\n| `passbolt.config.php.pm.max_requests`                | PHP-FPM pm.max_requests                                                                                              | `500`                               |\n| `passbolt.config.php.session.lifetime`               | Lifetime of your user sessions in seconds                                                                            | `3600`                              |\n| `passbolt.config.php.session.redis.enabled`          | Enable this if you want to provide your own redis as a session backend                                               | `false`                             |\n| `passbolt.config.php.session.redis.service`          | The URL of your redis endpoint, only useful if enabled                                                               | `redis`                             |\n| `passbolt.config.plugins.exportenabled`              | Enable export plugin                                                                                                 | `true`                              |\n| `passbolt.config.plugins.importenabled`              | Enable import plugin                                                                                                 | `true`                              |\n| `passbolt.config.plugins.ssoenabled`                 | Enable SSO plugin                                                                                                    | `true`                              |\n| `passbolt.config.email.enabled`                      | Enable/Disable sending emails transport                                                                              | `false`                             |\n| `passbolt.config.email.from`                         | From email address                                                                                                   | `you@localhost`                     |\n| `passbolt.config.email.from_name`                    | From Name                                                                                                            | `Your Sender Name`                  |\n| `passbolt.config.email.host`                         | Email server hostname                                                                                                | `localhost`                         |\n| `passbolt.config.email.port`                         | Email server port                                                                                                    | `25`                                |\n| `passbolt.config.email.timeout`                      | Email server timeout                                                                                                 | `30`                                |\n| `passbolt.config.email.username`                     | Username for email server auth                                                                                       | `username`                          |\n| `passbolt.config.email.password`                     | Password for email server auth                                                                                       | `password`                          |\n| `passbolt.config.livenessProbe.failureThreshold`     | failureThreshold for livenessProbe                                                                                   | `3`                                 |\n| `passbolt.config.livenessProbe.successThreshold`     | successThreshold for livenessProbe                                                                                   | `1`                                 |\n| `passbolt.config.livenessProbe.periodSeconds`        | periodSeconds for livenessProbe                                                                                      | `10`                                |\n| `passbolt.config.livenessProbe.initialDelaySeconds`  | initialDelaySeconds for livenessProbe                                                                                | `60`                                |\n| `passbolt.config.livenessProbe.timeoutSeconds`       | timeoutSeconds for livenessProbe                                                                                     | `10`                                |\n| `passbolt.config.readinessProbe.failureThreshold`    | failureThreshold for readinessProbe                                                                                  | `3`                                 |\n| `passbolt.config.readinessProbe.successThreshold`    | successThreshold for readinessProbe                                                                                  | `1`                                 |\n| `passbolt.config.readinessProbe.periodSeconds`       | periodSeconds for readinessProbe                                                                                     | `10`                                |\n| `passbolt.config.readinessProbe.initialDelaySeconds` | initialDelaySeconds for readinessProbe                                                                               | `60`                                |\n| `passbolt.config.readinessProbe.timeoutSeconds`      | timeoutSeconds for readinessProbe                                                                                    | `10`                                |\n\n### Database\n| Parameter             | Description                                       | Default    |\n|-----------------------|---------------------------------------------------|------------|\n| `mariadb.enabled`     | Set to false to use an existing external database | `true`     |\n| `mariadb.db.host`     | Name of the passbolt database                     | `passbolt` |\n| `mariadb.db.name`     | Name of the passbolt database                     | `passbolt` |\n| `mariadb.db.user`     | Username of the passbolt user                     | `passbolt` |\n| `mariadb.db.password` | Passwort for the passbold database user           | `passbolt` |\n\n## GPG key generation\n\n1. Create GPG config file gpg-server-key.conf with the following content\n\n        %echo Generating a basic OpenPGP key\n        Key-Type: RSA\n        Key-Length: 4096\n        Subkey-Type: RSA\n        Subkey-Length: 4096\n        Name-Email: joe@foo.bar\n        Name-Real: Joe Tester\n        Expire-Date: 0\n        %echo done\n\n2. Create GPG keys\n\n    :warning: do not set a password, since passbolt won't start :warning:\n\n        gpg --gen-key --batch gpg-server-key.conf\n\n\n3. List GPG keys\n\n        gpg --list-secret-keys --keyid-format LONG\n\n    You will need this to export it and in your values.yaml to validate the keys.\n\n4. Export keys\n\n        KEY_ID=\u003cput your key here\u003e\n        gpg --armor --export $KEY_ID \u003e serverkey.asc\n        gpg --armor --export-secret-keys $KEY_ID \u003e serverkey_private.asc\n\n\n:warning: Copy the serverkey.asc and serverkey_private.asc files to secrets/gpg.\n\n## JWT key generation\n\n1. Create a private key\n\n        openssl genrsa -out secrets/jwt/jwt.key 4096\n\n2. Extract the public key\n\n        openssl rsa -in secrets/jwt/jwt.key -outform PEM -pubout -out secrets/jwt/jwt.pem\n\n### Usage\n\n 1. Create custom values.yaml\n 2. Create gpg and jwt keys\n 3. Execute:\n    ```\n    helm install \\\n      -f values.yaml \\\n      --set-file passbolt.config.serverkey=./secrets/gpg/serverkey.asc \\\n      --set-file passbolt.config.serverkey_private=./secrets/gpg/serverkey_private.asc \\\n      --set-file passbolt.config.jwtkey=./secrets/jwt/jwt.key \\\n      --set-file passbolt.config.jwtcert=./secrets/jwt/jwt.pem \\\n      passbolt ../passbolt-helm/\n\n## Create first passbolt admin user\n\n    root@passbolt-passbolt-app:/var/www/passbolt# su -m -c \"bin/cake passbolt register_user -u passboltadmin@yourdomain.com -f Admin -l Istrator -r admin\" -s /bin/sh www-data\n\n## Mail testing\n\n```\nkubectl run mailpit --image=anatomicjc/mailpit\nkubectl expose pod mailpit --port 1025 --name mailpit\nkubectl port-forward mailpit 8025\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmmz-srf%2Fpassbolt-helm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmmz-srf%2Fpassbolt-helm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmmz-srf%2Fpassbolt-helm/lists"}