22 lines
3.5 KiB
Markdown
22 lines
3.5 KiB
Markdown
# Mumble Helm chart
|
|
|
|
This repository maintains a portable Helm chart for the official `mumblevoip/mumble-server` image. It declares Mumble's Deployment, TCP/UDP Service, private runtime config rendering, TLS reload sidecar, probes, and optional Bitnami PostgreSQL dependency. It publishes to the public chart repository:
|
|
|
|
```sh
|
|
helm repo add brunner.ninja https://brunner.ninja/charts
|
|
helm repo update brunner.ninja
|
|
helm show values brunner.ninja/mumble
|
|
```
|
|
|
|
For a separate cluster, create a TLS Secret and a `mumble-secrets` Secret containing `database-password`, `superuser-password`, and `registration-password`. Put Secret *names*, database host, domain/registration details, and networking policy in a values file. See `values.example.yaml`. `./install.sh VALUES_FILE` performs a local Helm upgrade/install with `--wait`; `./test.sh` validates the chart. Do not run `install.sh` against the brunner.ninja cluster after Argo CD adoption.
|
|
|
|
The PostgreSQL subchart is optional. With `postgresql.enabled=true`, set `postgresql.auth.existingSecret` to a stable Secret with separate PostgreSQL administrator and Mumble database passwords; configure `postgresql.auth.secretKeys` to identify their keys. The same Mumble database password must be available to the application via `mumble-secrets/database-password`. This chart does not render plaintext credentials. Set `postgresql.primary.persistence.*` for durable storage and a retention policy. With the subchart disabled, the default `database.bootstrap.enabled=true` makes Mumble's init container provision its role and database on an existing PostgreSQL server using the separate administrator Secret. Set `database.bootstrap.enabled=false` when another controller, such as CloudNativePG, owns database/user creation and credentials.
|
|
|
|
The homelab deployment is selected in [homelab-gitops](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/mumble). The chart supports three PostgreSQL modes: its optional Bitnami subchart, an external server that the chart bootstraps, or an externally managed database with chart-side bootstrap disabled. The homelab uses CloudNativePG in its own `mumble` namespace. After the namespace and certificate Secret exist, `MUMBLE_NAMESPACE=mumble MUMBLE_POSTGRES_MODE=cnpg ./bootstrap-homelab-secrets.sh` copies the existing application credentials from `default/mumble-secrets` without printing them and adds the basic-auth keys CloudNativePG needs. This guarded helper does not deploy workloads. Back up the PostgreSQL data and all Mumble Secrets together.
|
|
|
|
`service.additionalServices` optionally creates named additional Services on the same TCP/UDP ports. Each entry creates `mumble-<key>` and accepts Service `spec` fields such as `type` and `externalIPs`. For example, the homelab uses `service.additionalServices.funkfeuer.spec` with `type: ClusterIP` and `externalIPs: [10.12.4.170]`. This reaches a ready Mumble pod from an address routed to a cluster node and leaves the primary LoadBalancer Service and its client-IP policy unchanged.
|
|
|
|
Chart package versions come from Git tags using `git describe --tags --long`. The tag `v1.5.939` denotes the tested upstream Mumble release; a later chart-only commit publishes a distinct `1.5.939-N-gHASH` chart version. Source CI validates the chart, publishes it to the indexed `brunner.ninja` repository, and promotes only this chart's selected version in GitOps. CI has no Kubernetes credential.
|
|
|
|
The old `mumble-server.ini` file is ignored because it contains obsolete plaintext credentials. Never commit it, kubeconfigs, generated Secret values, or database dumps.
|