Deploy on Kubernetes

The Helm chart at deploy/helm/rohrpost/ deploys every Rohrpost service as its own Deployment (or StatefulSet, for Postgres/NATS/Garage), with independently configurable image, resources, and replica count per component.

1. Build and push images

The chart's values.yaml defaults every image repository toregistry.example.com/rohrpost* — placeholders. There's no public prebuilt image registry yet, so build the images yourself and push them to a registry your cluster can pull from:

git clone https://codeberg.org/ftieben/rohrpost.io
cd rohrpost.io
./deploy/deploy.sh --tag v0.1.0 --creds-file ~/registry-creds.json push

This builds rohrpost (gateway/distiller/archiver/migrate), rohrpost-admin,rohrpost-admin-web, rohrpost-proxy, and rohrpost-postgres(Postgres + pgvector + Apache AGE), then pushes them. Point values.yaml'simage.repository, adminImage.repository, etc. at wherever you pushed them.

2. Configure secrets and resources

Every value under secrets: in values.yaml is markedCHANGE IN PRODUCTION — Postgres password, Garage RPC secret and admin token, Garage S3 access/secret keys, the admin API bearer token, and the admin-web session secret. Override them in your own values file rather than editing the chart directly:

# my-values.yaml
image:
  repository: registry.example.com/rohrpost
  tag: v0.1.0
adminImage:
  repository: registry.example.com/rohrpost-admin
  tag: v0.1.0
adminWebImage:
  repository: registry.example.com/rohrpost-admin-web
  tag: v0.1.0
proxyImage:
  repository: registry.example.com/rohrpost-proxy
  tag: v0.1.0

secrets:
  postgresPassword: "<generate-with-openssl-rand-hex-24>"
  garageRpcSecret: "<openssl rand -hex 32>"
  garageAdminToken: "<openssl rand -hex 24>"
  garageAccessKey: "<your-own-key>"
  garageSecretKey: "<openssl rand -hex 32>"
  adminToken: "<openssl rand -hex 32, at least 16 chars>"
  adminWebSessionSecret: "<openssl rand -hex 32>"

Each service (gateway, distiller, archiver,admin, proxy, adminWeb, plus postgresql,nats, garage, ollama) has its ownresources.requests/limits block you can tune independently — the gateway and distiller default to the most CPU/memory since they run the embedding and extraction calls.

3. Install

helm install rohrpost ./deploy/helm/rohrpost -f my-values.yaml

This provisions Postgres, NATS JetStream, Garage, and Ollama as first-party StatefulSets/Deployments in the same release — there's no external dependency chart to add. A migrate-job.yaml Job runs database migrations before the gateway starts, and garage-bootstrap-job.yaml provisions the S3 bucket and access keys on first install.

4. Expose it (optional)

Ingress is disabled by default. Enable it and set hostnames for the gateway and admin web:

ingress:
  enabled: true
  className: "nginx"
  gateway:
    hostname: "app.your-domain.example.com"
  adminWeb:
    hostname: "admin.your-domain.example.com"
  tls:
    - secretName: rohrpost-tls
      hosts:
        - app.your-domain.example.com
        - admin.your-domain.example.com

5. Monitoring (optional)

The chart includes optional Prometheus, Grafana, Tempo, and an OpenTelemetry Collector as a monitoring: block in values.yaml — enable it the same way as the Docker Compose deployment's --monitoring flag.

Prefer a single VM instead? See the Docker Compose quick start.