helm-chart/examples/aws.yaml at main · appwrite/helm-chart · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# Appwrite on EKS with AWS services: RDS for PostgreSQL, ElastiCache, S3,
# SES for email, EFS for /storage, and ClickHouse Cloud. Layer it over
# minimal.yaml, or over production.yaml to replace that file's datastores:
#
#   helm install appwrite oci://ghcr.io/appwrite/charts/appwrite \
#     --namespace appwrite \
#     -f minimal.yaml -f aws.yaml --wait --timeout 15m
#
# For Functions and Sites, add functions-existing-secrets.yaml.
#
# Before installing:
#
# - RDS for PostgreSQL in the cluster's VPC, with a security group that lets
#   the nodes in on 5432. Connect as the master user once and run
#     CREATE EXTENSION postgis; CREATE EXTENSION vector; CREATE EXTENSION pg_trgm;
#   rds.force_ssl can stay on: Appwrite connects with TLS when offered.
# - ElastiCache for Valkey or Redis OSS, node-based, cluster mode disabled,
#   in-transit encryption off (Appwrite 2.6.2 has no Redis TLS). ElastiCache
#   only allows an AUTH token with in-transit encryption, so there's no
#   password: restrict it with a security group.
# - An S3 bucket and an IAM user with an access key for it. Appwrite doesn't
#   support IRSA or EKS Pod Identity.
# - SES SMTP credentials (SES console > SMTP settings) and a verified domain.
# - A ClickHouse Cloud service whose IP access list includes the cluster's
#   NAT gateway addresses, with a URL-safe password.
# - The EFS CSI driver and a StorageClass for it (here efs-sc).
#
# Then create the namespace and the Secret. The key names are the chart's
# defaults:
#
#   kubectl create namespace appwrite
#   kubectl -n appwrite create secret generic appwrite-external \
#     --from-literal=db-password='...' \
#     --from-literal=clickhouse-password='...' \
#     --from-literal=s3-access-key='AKIA...' \
#     --from-literal=s3-secret-key='...' \
#     --from-literal=smtp-password='...'
#
# Provider notes: docs/external-databases.md, docs/storage.md#s3,
# docs/integrations.md#email-smtp

database:
  mode: external
  name: appwrite
  username: appwrite
  connectionsMax: 400                 # see docs/external-databases.md#connections to size max_connections
  password:
    secretName: appwrite-external
    secretKey: db-password            # explicit: production.yaml uses another key
  external:
    host: appwrite.abcdefghijkl.eu-west-1.rds.amazonaws.com

redis:
  mode: external
  password:
    secretName: ""                    # no AUTH token without in-transit encryption
  external:
    host: appwrite.abcdef.ng.0001.euw1.cache.amazonaws.com   # primary endpoint

clickhouse:
  mode: external
  database: appwrite
  username: appwrite
  password:
    secretName: appwrite-external
  external:
    url: https://abc123.eu-west-1.aws.clickhouse.cloud:8443

storage:
  device: s3
  s3:
    mode: external
    external:
      endpoint: ""                      # empty: AWS S3
      region: eu-west-1
    bucket: appwrite-example-com
    accessKeyId:
      secretName: appwrite-external
    secretAccessKey:
      secretName: appwrite-external
  volume:
    size: 5Gi
    accessModes: [ReadWriteMany]      # EFS lets the API and workers spread across nodes
    storageClass: efs-sc

# The executor runs in a namespace of its own and can't read the S3 Secret
# above, so Functions and Sites stay off here: add
# functions-existing-secrets.yaml to turn them on.
compute:
  enabled: false

smtp:
  host: email-smtp.eu-west-1.amazonaws.com
  port: 587
  secure: tls
  username: AKIAEXAMPLESMTPUSER       # the SES SMTP user name, not the S3 access key
  password:
    secretName: appwrite-external

appwrite:
  system:
    emailAddress: noreply@example.com # on a domain verified in SES