# Diun Helm chart

This repository maintains a small adapter chart for the upstream Diun image.
It owns the Deployment, service account and read-only Kubernetes Pod RBAC,
configuration, notification wiring, and optional persistent data claim. The
cluster chooses the chart release and supplies only its Secret references,
registry/Matrix endpoints, and storage settings in
[`homelab-gitops`](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/diun).

The chart uses upstream `crazymax/diun` release tags. Its Chart `appVersion`
is the Diun release; the chart package version is derived from Git tags with
`git describe`. The chart repository's baseline tag is the same release,
`v4.33.0`, so the next chart-only commit packages as
`4.33.0-1-g<commit>` rather than an unrelated `1.0.0` version. On a Diun
upgrade, update `Chart.yaml.appVersion`, verify the default image follows it,
test the chart, and tag the new upstream version. The Matrix integration
downloads Shoutrrr 0.14.0 at startup because later 0.14.1 sent duplicate
Matrix authentication data rejected by the
configured Synapse. The init image uses a readable curl image tag. No image
digests or hard-coded download checksums are used.

## Install

Add the public chart repository and install the published chart (or use the
same-release convenience script in this checkout):

```sh
helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
./install.sh
```

For a new cluster, create a values file that references existing Kubernetes
Secrets for `registry.credentialsSecretName` and
`matrix.tokenSecretName`; do not put their values in Helm values or Git.
See `values.example.yaml` for the chart interface. The default chart supports a
portable PVC; the homelab GitOps values preserve the existing `diun` claim.

Add this annotation to a Pod template to exclude it from Diun's Kubernetes
provider:

```yaml
spec:
  template:
    metadata:
      annotations:
        diun.enable: "false"
```

Diun has no web UI. It notices newly seen image references and changed image
digests on scheduled scans; a first sighting is not proof that an image is
outdated.

## Development and publication

Run `./test.sh` to lint and render the chart and check resource relationships.
Gitea Actions publishes immutable chart versions to the public `brunner.ninja`
Helm repository and promotes the published version to this Argo Application.
The repository Actions secrets are `PACKAGE_USERNAME`, `PACKAGE_TOKEN`, and
`GITOPS_TOKEN`; chart CI has no Kubernetes credentials.