Allow public chart installs on other clusters

README.md

@@ -19,6 +19,8 @@ Edit only `chart-version.txt` for a new base chart version. CI packages a unique
 
 The published chart is available via `helm repo add brunner https://brunner.ninja/charts && helm repo update brunner`. `install.sh` is kept for manual deployments. CI renders the same chart and patches the named existing resources, since Helm release storage would require CI to read Kubernetes Secrets. A later manual Helm upgrade reconciles Helm's stored release revision with the latest chart.
 
+For other clusters, the chart also accepts optional `ingressClassName`, `clusterIssuer`, `storageClassName`, and `imagePullSecret` values. The committed `values.yaml` remains only the hostname. Set `imagePullSecret: ""` for anonymous pulls of the public Quay image. The Traefik compatibility route is installed only when `ingressClassName` is `traefik`; other ingress controllers need their own rewrite rule if a Brave client drops `/v2` from the custom URL. cert-manager and an ingress controller are prerequisites. Create DNS and a matching ClusterIssuer before expecting HTTPS to work.
+
 ## Connect a Brave browser
 
 On each supported Brave device, set `brave://flags/#brave-override-sync-server-url` to `https://sync.brunner.ninja/v2`, relaunch, and confirm the endpoint in `brave://sync-internals/`. Then create or join the Sync Chain at `brave://settings/braveSync/setup`. Enable the data types you want on each device. A compatibility route handles Brave versions that strip `/v2` from the custom URL after relaunch. Do not put Authentik forward authentication on this API; browser sync requests cannot complete its interactive login. On platforms where the flag is unavailable, a client policy or `--sync-url=https://sync.brunner.ninja/v2` may be required.

chart-version.txt

@@ -1 +1 @@
-0.1.0
+0.1.1

templates/dynamodb.yaml

@@ -61,7 +61,7 @@ spec:
         name: data
       spec:
         accessModes: [ReadWriteOnce]
-        storageClassName: rook-ceph-block
+        storageClassName: {{ default "rook-ceph-block" .Values.storageClassName | quote }}
         resources:
           requests:
             storage: 2Gi

templates/ingress.yaml

@@ -3,9 +3,9 @@ kind: Ingress
 metadata:
   name: brave-sync
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-dns
+    cert-manager.io/cluster-issuer: {{ default "letsencrypt-dns" .Values.clusterIssuer | quote }}
 spec:
-  ingressClassName: traefik
+  ingressClassName: {{ default "traefik" .Values.ingressClassName | quote }}
   tls:
     - hosts:
         - {{ .Values.host | quote }}
@@ -28,6 +28,7 @@ spec:
                 name: brave-sync
                 port:
                   name: http
+{{- if eq (default "traefik" .Values.ingressClassName) "traefik" }}
 ---
 # Brave 1.82 could strip /v2 from a custom URL on relaunch. Keep this
 # single-path compatibility route for existing affected clients.
@@ -47,7 +48,7 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.middlewares: {{ .Release.Namespace }}-brave-sync-compat@kubernetescrd
 spec:
-  ingressClassName: traefik
+  ingressClassName: {{ default "traefik" .Values.ingressClassName | quote }}
   tls:
     - hosts:
         - {{ .Values.host | quote }}
@@ -63,3 +64,4 @@ spec:
                 name: brave-sync
                 port:
                   name: http
+{{- end }}

templates/sync.yaml

@@ -28,8 +28,15 @@ spec:
       annotations:
         checksum/schema: {{ .Files.Get "schema/table.json" | sha256sum }}
     spec:
+{{- if hasKey .Values "imagePullSecret" }}
+{{- if .Values.imagePullSecret }}
+      imagePullSecrets:
+        - name: {{ .Values.imagePullSecret | quote }}
+{{- end }}
+{{- else }}
       imagePullSecrets:
         - name: quay-pull-secret
+{{- end }}
       initContainers:
         - name: initialize-table
           image: amazon/aws-cli:2.31.9