This repository maintains a portable Helm chart for the official mumblevoip/mumble-server image. It declares Mumble's Deployment, TCP/UDP Service, private runtime config rendering, TLS reload sidecar, probes, and optional Bitnami PostgreSQL dependency. It publishes to the public chart repository:

helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
helm show values brunner.ninja/mumble

For a separate cluster, create a TLS Secret, a mumble-secrets Secret containing database-password, superuser-password, and registration-password, and a PostgreSQL credential Secret if enabling the subchart. Put Secret names, database host, domain/registration details, and networking policy in a values file. See values.example.yaml. ./install.sh VALUES_FILE performs a local Helm upgrade/install with --wait; ./test.sh validates the chart. Do not run install.sh against the brunner.ninja cluster after Argo CD adoption.

The PostgreSQL subchart is optional. With postgresql.enabled=true, set postgresql.auth.existingSecret to a stable Secret with separate PostgreSQL administrator and Mumble database passwords; configure postgresql.auth.secretKeys to identify their keys. The same Mumble database password must be available to the application via mumble-secrets/database-password. This chart does not render plaintext credentials. Set postgresql.primary.persistence.* for durable storage and a retention policy. With the subchart disabled, Mumble's init container bootstraps its role and database on an existing PostgreSQL server using the separate administrator Secret.

The homelab deployment is selected in homelab-gitops. It uses the optional PostgreSQL subchart and keeps the existing default/mumble Service and Deployment names, the mumble-secrets and TLS Secrets, and TCP/UDP port 64738. The old shared PostgreSQL database is deliberately left intact as rollback data. bootstrap-homelab-secrets.sh is a guarded, one-time secret recovery/bootstrap helper; it does not deploy workloads. Back up the dedicated PostgreSQL PVC and both Mumble Secrets together.

Chart package versions come from Git tags using git describe --tags --long. The tag v1.5.939 denotes the tested upstream Mumble release; a later chart-only commit publishes a distinct 1.5.939-N-gHASH chart version. Source CI validates the chart, publishes it to the indexed brunner.ninja repository, and promotes only this chart's selected version in GitOps. CI has no Kubernetes credential.

The old mumble-server.ini file is ignored because it contains obsolete plaintext credentials. Never commit it, kubeconfigs, generated Secret values, or database dumps.