helmrelease.yaml

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-3.5.1/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: memos
  namespace: memos
spec:
  chart:
    spec:
      chart: app-template
      version: 3.5.1
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: bjw-s
  interval: 1h
  driftDetection:
    mode: enabled
  values:
    controllers:
      memos:
        strategy: RollingUpdate
        containers:
          app:
            image:
              repository: ghcr.io/usememos/memos
              tag: 0.22.5@sha256:83e3a5bd72c1b9c35213f83bffaf1df7b959cf0b04ebc40e7c82582e2cd00514

            env:
              MEMOS_DRIVER: postgres
              MEMOS_DSN:
                secretKeyRef:
                  name: postgresql-app
                  key: uri
              MEMOS_PASSWORD_AUTH: "false"
            probes:
              startup:
                enabled: true
                spec:
                  failureThreshold: 30
                  periodSeconds: 5
              liveness:
                enabled: true
              readiness:
                enabled: true
            securityContext:
              readOnlyRootFilesystem: true
        pod:
          enableServiceLinks: false
          labels:
            policy.gabe565.com/egress-namespace: "true"
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-ingress: "true"
          securityContext:
            runAsUser: 65534
            runAsGroup: 65534
            fsGroup: 65534

    service:
      memos:
        controller: memos
        ports:
          http:
            port: 5230

    ingress:
      memos:
        enabled: true
        annotations:
          nginx.ingress.kubernetes.io/proxy-body-size: 64m
        hosts:
          - host: ${app_url}
            paths:
              - path: /
                service:
                  identifier: memos
                  port: http
        tls:
          - secretName: ${certificate_name}
            hosts:
              - ${app_url}