Configuration

Reference for every Helm values key and Kubernetes secret the forginate chart consumes. Everything is environment-driven; override per-install with -f values-<env>.yaml.

Global values

Key	Default	Meaning
global.environment	dev	dev | prod — labels, backup object prefix
global.domain	(maintainer dev domain)	Public base hostname; sets PUBLIC_BASE_URL and COOKIE_DOMAIN, ingress host, TLS cert
global.appsWildcard	(maintainer dev domain)	Wildcard base for tenant hosted apps (*.apps.…)
global.imageRegistry	ghcr.io/the-pizza	Registry prefix used by the image helper
global.imagePullPolicy	IfNotPresent	Applied to all service containers
global.storageClass	nfs-csi	PVCs for redis + minio — set to your cluster's class
global.ingressClass	traefik-internal	ingressClassName on the gateway Ingress — set to yours
global.certIssuer	letsencrypt-production	cert-manager ClusterIssuer name

Defaults are not neutral

The shipped defaults reflect the maintainers' environment (domain, storage class, ingress class). Treat every global.* key as required in your own values file.

Component values

postgres.* (CNPG)

enabled, name (default forginate-db — the read-write Service is <name>-rw), instances, size, storageClass, image (ghcr.io/cloudnative-pg/postgresql:17.5), database (forginate), username (forginate). Bootstrap credentials come from the forginate-db-app-user secret. Superuser access is disabled.

redis.* / minio.*

redis.image (redis:7-alpine), redis.size (PVC, AOF enabled). minio.image, minio.size. MinIO is in-cluster only (no ingress); ports 9000 (API) / 9001 (console).

backup.*

enabled (default true), image (postgres:17-bookworm), schedule ("17 3 * * *"), bucket (forginate-backups), retentionDays (14). See Backups.

apiGateway.*

Key	Default	Notes
image.repository / image.tag	ghcr.io/the-pizza/forginate-api-gateway / latest	Pin a sha-<sha> tag in production
imagePullSecret	""	docker-registry secret name for private GHCR
replicas	1
founderGithubLogin	The-Pizza	Change this. GitHub login auto-flagged as founder/admin on first sign-in
shareHost	share.forginate.com	Public share-portal hostname (SHARE_HOST)
lokiUrl	http://loki-gateway.monitoring.svc	Admin "System Logs" tab source (port 80, not 3100)
serviceMonitor.enabled	true	Requires prometheus-operator CRDs
resources	100m/192Mi req, 384Mi limit

orchestrator.*

Key	Default	Notes
image / runnerImage / qaRunnerImage	forginate-orchestrator / -factory-runner / -qa-runner	Runner images are pulled at Job-spawn time
imagePullSecret / runnerImagePullSecret	""	Separate: the runner secret is stamped onto Jobs in the runs namespace
runsNamespace	forginate-runs-dev	Created by the chart, with RBAC + default-deny NetworkPolicy
defaultMaxDollars	"0.5"	Per-run cost cap (USD)
defaultRunTimeoutSeconds	"3300"	Wall-clock cap per run
runnerRuntimeClass	""	e.g. kata-qemu for VM-isolated runner pods (requires kata-deploy)
runnerNodeSelectorKey / Value	""	Pin runner pods to labelled sandbox nodes

chatEditor.*

enabled, image, imagePullSecret, replicas, orgConcurrency (default 3 concurrent streams per org), chatBucket (forginate-chat-attachments), autoscaling.{enabled,minReplicas,maxReplicas,targetStreamsPerPod,targetCpuUtilization} — the HPA scales on the custom chat_editor_active_streams metric plus CPU, so the custom-metric target needs a Prometheus adapter to actually fire — and serviceMonitor.enabled (default false).

observability.otlpEndpoint

Default http://alloy.monitoring.svc.cluster.local:4317. OTLP gRPC endpoint injected into every service and every runner pod. See Observability.

Secrets reference

All in the release namespace, referenced by fixed names:

Secret	Keys	Required?	Env vars
forginate-db-app-user	username, password	yes (bootstrap script)	CNPG initdb, backup PGUSER/PGPASSWORD
forginate-db-url	url	yes	DATABASE_URL (gateway, orchestrator, chat-editor)
forginate-redis	password	yes (bootstrap script)	REDIS_PASSWORD → REDIS_URL
forginate-minio	root-user, root-password	yes (bootstrap script)	MINIO_ACCESS_KEY/MINIO_SECRET_KEY
forginate-jwt	secret	yes (≥ 32 chars)	JWT_SECRET
forginate-github-oauth	client-id, client-secret	yes	GITHUB_CLIENT_ID/GITHUB_CLIENT_SECRET
forginate-credential-key	key	yes (base64 32 bytes)	FORGINATE_CREDENTIAL_KEY
forginate-internal-token	token	yes	INTERNAL_SERVICE_TOKEN / INTERNAL_API_TOKEN
forginate-github-app	app_id, slug, client_id, client_secret, webhook_secret, private_key.pem	optional	GITHUB_APP_*
forginate-stripe	publishable_key, secret_key, webhook_secret	optional	STRIPE_*
forginate-aws	access-key-id, secret-access-key	optional	AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (orchestrator)
forginate-registry-pull	username, password	optional	REGISTRY_PULL_USERNAME/PASSWORD (orchestrator)

Optional means dark, not broken

Every optional secret is mounted with optional: true. The pod boots; the feature (GitHub App wizard, Stripe billing, AWS vending, private-registry mirroring) activates only once the secret exists and the pod is restarted.

Notable env vars set by the chart

Fixed in the templates (change requires a template edit, listed for debugging):

• JWT_ISSUER=forginate, COOKIE_SECURE=true, NODE_ENV=production
• PORT=8080, INTERNAL_PORT=8081 (gateway), PORT=8090 (chat-editor)
• MINIO_DOCS_BUCKET=forginate-docs, MINIO_USE_SSL=false, MINIO_ENDPOINT=minio.<namespace>.svc.cluster.local
• CHAT_EDITOR_URL=http://chat-editor.<namespace>.svc.cluster.local:8090
• API_GATEWAY_INTERNAL_BASE=http://api-gateway-internal.<namespace>.svc.cluster.local:8081
• RUNS_NAMESPACE mirrors orchestrator.runsNamespace in both gateway and orchestrator

Env-only knobs with sane defaults (not exposed as values keys; settable by editing the Deployment or the templates): orchestrator RUNNER_EGRESS_ALLOWLIST (comma-separated hostname allowlist for runner egress — Anthropic, OpenAI, GitHub, npm, PyPI by default), HEARTBEAT_TIMEOUT_MS, RUNNER_MAX_WALL_S (25 h Job ceiling for provider-wall waits), PROMETHEUS_URL (ops metrics queries), and gateway GITHUB_DEFAULT_SCOPES.