This chart runs the official Project Quay image and owns the registry Deployment, repository-mirror Deployment, Service, Ingress, and probes. It can also deploy PostgreSQL and Valkey through optional Bitnami subcharts. It does not create a second container image.

An S3-compatible object store and bucket are required. Provision them outside this chart, then create a private config.yaml using config.yaml.example. The file includes the database URI, S3 credentials, Redis credentials, and two persistent Quay encryption keys. Keep all of those out of Helm values and public Git. Store the file in a Secret in the release namespace (here, quay):

kubectl -n quay create secret generic quay-config --from-file=config.yaml

Set quay.configSecretName to that Secret name. For an existing installation, preserve its SECRET_KEY, DATABASE_SECRET_KEY, bucket, and database records. The chart never creates or deletes S3 objects or buckets.

Choose exactly one database arrangement:

Embedded PostgreSQL: set postgresql.enabled=true. Use a durable storage class and stable postgresql.auth.existingSecret; the database-password key must match the password in Quay's DB_URI.
CloudNativePG: set cloudNativePG.enabled=true and install the operator and its CRDs first. With cloudNativePG.create=true, this chart creates a Cluster named by cloudNativePG.name; configure its storage and the DB_URI to use <name>-rw in the release namespace. With create=false, manage that Cluster independently (useful for database-first migrations). The operator's generated <name>-app Secret contains the application username and password. Put the same credentials in the private Quay config. For a fresh operator-managed installation, first install with quay.enabled=false, repomirror.enabled=false, and ingress.enabled=false; wait for the Cluster and generated app Secret, create the private Quay config Secret, then enable Quay and its Ingress in a second upgrade.
External/shared PostgreSQL: leave both switches false and point the DB_URI at your own server. The chart does not manage its data or users.

Never enable both embedded PostgreSQL and CloudNativePG. No database password is placed in Helm values. The chart does not migrate an existing database; perform a stopped-writer dump and restore before changing Quay's DB_URI. Likewise, valkey.enabled=true installs a cache; keep the Redis hosts and password in config.yaml aligned with either that subchart or your external cache. Both dependencies are independently optional.

Published releases are available from the indexed Helm repository:

helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
helm upgrade --install quay brunner.ninja/quay --namespace quay --create-namespace \
  --values values.yaml --wait --timeout 15m

For local development, add the Bitnami chart repository, run helm dependency build chart/quay, then bash chart/test.sh. Chart package versions derive from the actual Quay Git release tag with git describe; Chart.yaml.appVersion is the tested upstream image version. Homelab-specific values are in homelab-gitops/apps/quay.