From 97d87da71787db8f39631b20245110f6cd0e29f1 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Fri, 9 Oct 2026 11:51:44 +0200
Subject: [PATCH] Allow public chart installs on other clusters

---
 README.md               | 2 ++
 chart-version.txt       | 2 +-
 templates/dynamodb.yaml | 2 +-
 templates/ingress.yaml  | 8 +++++---
 templates/sync.yaml     | 7 +++++++
 5 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 8e338be..c7feff3 100644
--- a/README.md
+++ b/README.md
@@ -19,6 +19,8 @@ Edit only `chart-version.txt` for a new base chart version. CI packages a unique
 
 The published chart is available via `helm repo add brunner https://brunner.ninja/charts && helm repo update brunner`. `install.sh` is kept for manual deployments. CI renders the same chart and patches the named existing resources, since Helm release storage would require CI to read Kubernetes Secrets. A later manual Helm upgrade reconciles Helm's stored release revision with the latest chart.
 
+For other clusters, the chart also accepts optional `ingressClassName`, `clusterIssuer`, `storageClassName`, and `imagePullSecret` values. The committed `values.yaml` remains only the hostname. Set `imagePullSecret: ""` for anonymous pulls of the public Quay image. The Traefik compatibility route is installed only when `ingressClassName` is `traefik`; other ingress controllers need their own rewrite rule if a Brave client drops `/v2` from the custom URL. cert-manager and an ingress controller are prerequisites. Create DNS and a matching ClusterIssuer before expecting HTTPS to work.
+
 ## Connect a Brave browser
 
 On each supported Brave device, set `brave://flags/#brave-override-sync-server-url` to `https://sync.brunner.ninja/v2`, relaunch, and confirm the endpoint in `brave://sync-internals/`. Then create or join the Sync Chain at `brave://settings/braveSync/setup`. Enable the data types you want on each device. A compatibility route handles Brave versions that strip `/v2` from the custom URL after relaunch. Do not put Authentik forward authentication on this API; browser sync requests cannot complete its interactive login. On platforms where the flag is unavailable, a client policy or `--sync-url=https://sync.brunner.ninja/v2` may be required.
diff --git a/chart-version.txt b/chart-version.txt
index 6e8bf73..17e51c3 100644
--- a/chart-version.txt
+++ b/chart-version.txt
@@ -1 +1 @@
-0.1.0
+0.1.1
diff --git a/templates/dynamodb.yaml b/templates/dynamodb.yaml
index f8f7142..6cb00b7 100644
--- a/templates/dynamodb.yaml
+++ b/templates/dynamodb.yaml
@@ -61,7 +61,7 @@ spec:
         name: data
       spec:
         accessModes: [ReadWriteOnce]
-        storageClassName: rook-ceph-block
+        storageClassName: {{ default "rook-ceph-block" .Values.storageClassName | quote }}
         resources:
           requests:
             storage: 2Gi
diff --git a/templates/ingress.yaml b/templates/ingress.yaml
index ae25785..7fd2bc0 100644
--- a/templates/ingress.yaml
+++ b/templates/ingress.yaml
@@ -3,9 +3,9 @@ kind: Ingress
 metadata:
   name: brave-sync
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-dns
+    cert-manager.io/cluster-issuer: {{ default "letsencrypt-dns" .Values.clusterIssuer | quote }}
 spec:
-  ingressClassName: traefik
+  ingressClassName: {{ default "traefik" .Values.ingressClassName | quote }}
   tls:
     - hosts:
         - {{ .Values.host | quote }}
@@ -28,6 +28,7 @@ spec:
                 name: brave-sync
                 port:
                   name: http
+{{- if eq (default "traefik" .Values.ingressClassName) "traefik" }}
 ---
 # Brave 1.82 could strip /v2 from a custom URL on relaunch. Keep this
 # single-path compatibility route for existing affected clients.
@@ -47,7 +48,7 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.middlewares: {{ .Release.Namespace }}-brave-sync-compat@kubernetescrd
 spec:
-  ingressClassName: traefik
+  ingressClassName: {{ default "traefik" .Values.ingressClassName | quote }}
   tls:
     - hosts:
         - {{ .Values.host | quote }}
@@ -63,3 +64,4 @@ spec:
                 name: brave-sync
                 port:
                   name: http
+{{- end }}
diff --git a/templates/sync.yaml b/templates/sync.yaml
index 47512ba..15d85c7 100644
--- a/templates/sync.yaml
+++ b/templates/sync.yaml
@@ -28,8 +28,15 @@ spec:
       annotations:
         checksum/schema: {{ .Files.Get "schema/table.json" | sha256sum }}
     spec:
+{{- if hasKey .Values "imagePullSecret" }}
+{{- if .Values.imagePullSecret }}
+      imagePullSecrets:
+        - name: {{ .Values.imagePullSecret | quote }}
+{{- end }}
+{{- else }}
       imagePullSecrets:
         - name: quay-pull-secret
+{{- end }}
       initContainers:
         - name: initialize-table
           image: amazon/aws-cli:2.31.9