feat(sure): add sure chart #41

Merged

ryan.mcgee merged 2 commits from feat/sure-chart into main 2026-10-30 18:03:07 +00:00

Conversation 0 Commits 2 Files changed 19 +1109 -7

ryan.mcgee commented 2026-10-30 17:52:55 +00:00

Owner

Copy link

Summary

• Package Sure (we-promise/sure, self-hosted personal finance) as an in-repo chart, following the rxresume conventions (CloudNativePG, kept Secrets, validated values).

Changes

• charts/sure: web Deployment, Sidekiq worker Deployment (init container waits for the web-owned migrations), single password-protected Valkey StatefulSet (or external REDIS_URL), CNPG Cluster (or external PostgreSQL), local PVC or S3 uploads, Ingress, generated SECRET_KEY_BASE kept across upgrades.
• appUrl is required; its scheme sets RAILS_FORCE_SSL/RAILS_ASSUME_SSL (https: secure cookies, http: both off for port-forward).
• ReadWriteOnce upload volume: required pod affinity keeps web and worker on one node; more than one replica is rejected unless RWX or S3.
• renovate.json: track charts/sure (Sure via GitHub releases with v stripped and a regex scheme so 0.7.5-hotfix.N orders above 0.7.5, Valkey, PostgreSQL image). Sure is deliberately not in the automerge rule.
• README.md: chart section, Renovate notes, license line.

Verification

• make lint validate CHARTS=charts/sure (helm 4.3.0, kubeconform 0.7.0, crane in containers): lint --strict clean for both ci values, 10 and 6 resources valid against 1.33 schemas, all three images exist.
• ct lint --config ct.yaml --charts charts/sure (chart-testing 3.14.0): passed.
• Validation failures render the intended messages (empty/ftp appUrl, bad modes, missing external settings, RWO with 2 replicas).
• Smoke with podman, not a cluster (rootless k3s cannot start here: kubelet cgroup error): chart's uid, read-only rootfs, dropped caps and env against postgres:18-alpine and the chart's Valkey command. Init gate waits on an empty DB and opens after migrations; web migrated, /up 200 in about 25s, sign-up worked over http; Sidekiq connected to password-protected Valkey and registered cron jobs; https mode returns 200 on plain-http /up with HSTS.
• Not run: CNPG Cluster and its secret keys, $(REDIS_PASSWORD) expansion, pod affinity, external DB/Redis, S3, Ingress, multi-replica, upgrades, the Renovate rules themselves.

## Summary - Package Sure (we-promise/sure, self-hosted personal finance) as an in-repo chart, following the rxresume conventions (CloudNativePG, kept Secrets, validated values). ## Changes - `charts/sure`: web Deployment, Sidekiq worker Deployment (init container waits for the web-owned migrations), single password-protected Valkey StatefulSet (or external `REDIS_URL`), CNPG `Cluster` (or external PostgreSQL), local PVC or S3 uploads, Ingress, generated `SECRET_KEY_BASE` kept across upgrades. - `appUrl` is required; its scheme sets `RAILS_FORCE_SSL`/`RAILS_ASSUME_SSL` (https: secure cookies, http: both off for port-forward). - ReadWriteOnce upload volume: required pod affinity keeps web and worker on one node; more than one replica is rejected unless RWX or S3. - `renovate.json`: track `charts/sure` (Sure via GitHub releases with `v` stripped and a regex scheme so `0.7.5-hotfix.N` orders above `0.7.5`, Valkey, PostgreSQL image). Sure is deliberately not in the automerge rule. - `README.md`: chart section, Renovate notes, license line. ## Verification - `make lint validate CHARTS=charts/sure` (helm 4.3.0, kubeconform 0.7.0, crane in containers): lint --strict clean for both ci values, 10 and 6 resources valid against 1.33 schemas, all three images exist. - `ct lint --config ct.yaml --charts charts/sure` (chart-testing 3.14.0): passed. - Validation failures render the intended messages (empty/ftp appUrl, bad modes, missing external settings, RWO with 2 replicas). - Smoke with podman, not a cluster (rootless k3s cannot start here: kubelet cgroup error): chart's uid, read-only rootfs, dropped caps and env against postgres:18-alpine and the chart's Valkey command. Init gate waits on an empty DB and opens after migrations; web migrated, `/up` 200 in about 25s, sign-up worked over http; Sidekiq connected to password-protected Valkey and registered cron jobs; https mode returns 200 on plain-http `/up` with HSTS. - Not run: CNPG Cluster and its secret keys, `$(REDIS_PASSWORD)` expansion, pod affinity, external DB/Redis, S3, Ingress, multi-replica, upgrades, the Renovate rules themselves.

ryan.mcgee added 1 commit 2026-10-30 17:52:55 +00:00

feat(sure): add sure chart ... d04716ff0a

- add in-repo chart: web, Sidekiq worker, Valkey, CNPG cluster
- derive TLS settings from appUrl; keep SECRET_KEY_BASE on upgrade
- worker init container waits for web-owned migrations
- pin web and worker to one node for a ReadWriteOnce upload volume
- track Sure, Valkey and PostgreSQL images in renovate
- document the chart and what was and was not tested

ryan.mcgee added 1 commit 2026-10-30 18:00:01 +00:00

ci(renovate): automerge sure updates ... c44b34c3bc

- add charts/sure to the patch and minor automerge rule
- update the Renovate and Automerge docs to match

ryan.mcgee merged commit 73e15a641f into main 2026-10-30 18:03:07 +00:00

ryan.mcgee deleted branch feat/sure-chart 2026-10-30 18:03:07 +00:00

ryan.mcgee referenced this pull request from a commit 2026-10-30 18:03:08 +00:00

feat(sure): add sure chart (#41)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Enclave-Information-Systems/helm!41

No description provided.