# Quay Helm chart

This chart runs the official Project Quay image and owns the registry
Deployment, repository-mirror Deployment, Service, Ingress, and probes. It can
also deploy PostgreSQL and Valkey through optional Bitnami subcharts. It does
not create a second container image.

An S3-compatible object store and bucket are required. Provision them outside
this chart, then create a private `config.yaml` using
[`config.yaml.example`](config.yaml.example). The file includes the database
URI, S3 credentials, Redis credentials, and two persistent Quay encryption
keys. Keep all of those out of Helm values and public Git. Store the file in a
Secret in the release namespace (here, `quay`):

```sh
kubectl -n quay create secret generic quay-config --from-file=config.yaml
```

Set `quay.configSecretName` to that Secret name. For an existing installation,
preserve its `SECRET_KEY`, `DATABASE_SECRET_KEY`, bucket, and database records.
The chart never creates or deletes S3 objects or buckets.

Choose exactly one database arrangement:

- **Embedded PostgreSQL:** set `postgresql.enabled=true`. Use a durable storage
  class and stable `postgresql.auth.existingSecret`; the `database-password`
  key must match the password in Quay's `DB_URI`.
- **CloudNativePG:** set `cloudNativePG.enabled=true` and install the operator
  and its CRDs first. With `cloudNativePG.create=true`, this chart creates a
  `Cluster` named by `cloudNativePG.name`; configure its storage and the
  `DB_URI` to use `<name>-rw` in the release namespace. With `create=false`,
  manage that Cluster independently (useful for database-first migrations).
  The operator's generated `<name>-app` Secret contains the application
  username and password. Put the same credentials in the private Quay config.
  For a fresh operator-managed installation, first install with
  `quay.enabled=false`, `repomirror.enabled=false`, and `ingress.enabled=false`;
  wait for the Cluster and generated app Secret, create the private Quay config
  Secret, then enable Quay and its Ingress in a second upgrade.
- **External/shared PostgreSQL:** leave both switches false and point the
  `DB_URI` at your own server. The chart does not manage its data or users.

Never enable both embedded PostgreSQL and CloudNativePG. No database password
is placed in Helm values. The chart does not migrate an existing database;
perform a stopped-writer dump and restore before changing Quay's `DB_URI`.
Likewise, `valkey.enabled=true` installs a cache; keep the Redis hosts and
password in `config.yaml` aligned with either that subchart or your external
cache. Both dependencies are independently optional.

Published releases are available from the indexed Helm repository:

```sh
helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
helm upgrade --install quay brunner.ninja/quay --namespace quay --create-namespace \
  --values values.yaml --wait --timeout 15m
```

For local development, add the Bitnami chart repository, run
`helm dependency build chart/quay`, then `bash chart/test.sh`. Chart package
versions derive from the actual Quay Git
release tag with `git describe`; `Chart.yaml.appVersion` is the tested upstream
image version. Homelab-specific values are in
[`homelab-gitops/apps/quay`](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/quay).