feat(helm): add Helm chart for Kubernetes deployment and update DeploymentGuide
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
@@ -200,8 +200,8 @@ def embed_metadata_into_pdf(self, local_file_path: str, extracted_text: str, met
|
|||||||
if metadata:
|
if metadata:
|
||||||
try:
|
try:
|
||||||
file_record.ai_metadata = json.dumps(metadata, ensure_ascii=False)
|
file_record.ai_metadata = json.dumps(metadata, ensure_ascii=False)
|
||||||
except Exception:
|
except Exception as json_exc:
|
||||||
pass
|
logger.warning(f"[{task_id}] Could not serialise ai_metadata: {json_exc}")
|
||||||
file_record.document_title = (
|
file_record.document_title = (
|
||||||
metadata.get("title") or metadata.get("filename") or file_record.original_filename
|
metadata.get("title") or metadata.get("filename") or file_record.original_filename
|
||||||
)
|
)
|
||||||
|
|||||||
@@ -8,7 +8,6 @@ Generation) workflows by storing full document text alongside structured
|
|||||||
metadata fields.
|
metadata fields.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
import json
|
|
||||||
import logging
|
import logging
|
||||||
from typing import Any, Optional
|
from typing import Any, Optional
|
||||||
|
|
||||||
@@ -112,7 +111,6 @@ def _get_or_create_index(client):
|
|||||||
|
|
||||||
def _build_document(file_record, text: str, metadata: dict) -> dict:
|
def _build_document(file_record, text: str, metadata: dict) -> dict:
|
||||||
"""Build a Meilisearch document from a FileRecord and extracted content."""
|
"""Build a Meilisearch document from a FileRecord and extracted content."""
|
||||||
import json as _json
|
|
||||||
|
|
||||||
tags = metadata.get("tags", [])
|
tags = metadata.get("tags", [])
|
||||||
if isinstance(tags, str):
|
if isinstance(tags, str):
|
||||||
@@ -123,8 +121,8 @@ def _build_document(file_record, text: str, metadata: dict) -> dict:
|
|||||||
if file_record.created_at:
|
if file_record.created_at:
|
||||||
try:
|
try:
|
||||||
created_at_ts = int(file_record.created_at.timestamp())
|
created_at_ts = int(file_record.created_at.timestamp())
|
||||||
except Exception:
|
except Exception as ts_exc: # noqa: BLE001
|
||||||
pass
|
logger.debug(f"Could not convert created_at to timestamp: {ts_exc}")
|
||||||
|
|
||||||
return {
|
return {
|
||||||
"file_id": file_record.id,
|
"file_id": file_record.id,
|
||||||
@@ -229,7 +227,6 @@ def search_documents(
|
|||||||
return empty
|
return empty
|
||||||
|
|
||||||
try:
|
try:
|
||||||
from app.config import settings
|
|
||||||
|
|
||||||
index = _get_or_create_index(client)
|
index = _get_or_create_index(client)
|
||||||
|
|
||||||
|
|||||||
+310
-151
@@ -1,40 +1,48 @@
|
|||||||
# Deployment Guide
|
# Deployment Guide
|
||||||
|
|
||||||
This guide provides instructions for deploying DocuElevate in various environments.
|
This guide covers all supported deployment methods for DocuElevate.
|
||||||
|
|
||||||
|
## Table of Contents
|
||||||
|
|
||||||
|
- [Prerequisites](#prerequisites)
|
||||||
|
- [Docker Compose Deployment](#docker-compose-deployment) *(recommended for single-server)*
|
||||||
|
- [Kubernetes / Helm Deployment](#kubernetes--helm-deployment) *(recommended for production scale-out)*
|
||||||
|
- [Production Considerations](#production-considerations)
|
||||||
|
- [Scaling](#scaling)
|
||||||
|
- [Backup Procedures](#backup-procedures)
|
||||||
|
- [Updates](#updates)
|
||||||
|
- [Troubleshooting](#troubleshooting)
|
||||||
|
|
||||||
## Prerequisites
|
## Prerequisites
|
||||||
|
|
||||||
- Docker and Docker Compose
|
- Docker and Docker Compose **or** a Kubernetes cluster with Helm 3
|
||||||
- Access to required external services (if configured):
|
- Access to required external services (if configured):
|
||||||
- AI provider API key (OpenAI, Anthropic, Gemini, or other configured provider)
|
- AI provider API key (OpenAI, Anthropic, Gemini, or other configured provider)
|
||||||
- Azure Document Intelligence
|
- Azure Document Intelligence
|
||||||
- Dropbox API
|
- Dropbox, Google Drive, OneDrive, S3, or other storage APIs
|
||||||
- Nextcloud instance
|
- SMTP / IMAP server (for email processing)
|
||||||
- Paperless NGX instance
|
- Notification services (Discord, Telegram, etc.)
|
||||||
- SMTP server (for email notifications)
|
|
||||||
- IMAP server(s) (for email attachment processing)
|
|
||||||
- Notification services (Discord, Telegram, etc. for system alerts)
|
|
||||||
|
|
||||||
## Docker Deployment
|
---
|
||||||
|
|
||||||
Docker is the recommended deployment method for DocuElevate.
|
## Docker Compose Deployment
|
||||||
|
|
||||||
|
Docker Compose is the quickest way to run DocuElevate on a single server.
|
||||||
|
|
||||||
### Step 1: Clone the Repository
|
### Step 1: Clone the Repository
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
git clone https://github.com/christianlouis/document-processor.git
|
git clone https://github.com/christianlouis/DocuElevate.git
|
||||||
cd document-processor
|
cd DocuElevate
|
||||||
```
|
```
|
||||||
|
|
||||||
### Step 2: Configure Environment Variables
|
### Step 2: Configure Environment Variables
|
||||||
|
|
||||||
Create a `.env` file based on the example:
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cp .env.example .env
|
cp .env.demo .env
|
||||||
```
|
```
|
||||||
|
|
||||||
Edit the `.env` file with your configuration settings. See the [Configuration Guide](ConfigurationGuide.md) for details.
|
Edit `.env` with your settings. See the [Configuration Guide](ConfigurationGuide.md) for all options.
|
||||||
|
|
||||||
### Step 3: Run with Docker Compose
|
### Step 3: Run with Docker Compose
|
||||||
|
|
||||||
@@ -42,41 +50,237 @@ Edit the `.env` file with your configuration settings. See the [Configuration Gu
|
|||||||
docker-compose up -d
|
docker-compose up -d
|
||||||
```
|
```
|
||||||
|
|
||||||
This will start:
|
This starts:
|
||||||
- The DocuElevate API server
|
|
||||||
- A worker for background tasks
|
| Service | Purpose |
|
||||||
- Redis for message broker and result storage
|
|---------|---------|
|
||||||
- Gotenberg for PDF processing
|
| `api` | FastAPI web server (port 8000) |
|
||||||
|
| `worker` | Celery background task worker |
|
||||||
|
| `redis` | Message broker for Celery |
|
||||||
|
| `gotenberg` | PDF conversion (LibreOffice headless) |
|
||||||
|
| `meilisearch` | Full-text search engine (port 7700) |
|
||||||
|
|
||||||
### Step 4: Verify the Installation
|
### Step 4: Verify the Installation
|
||||||
|
|
||||||
Access the web interface at `http://localhost:8000` and the API documentation at `http://localhost:8000/docs`.
|
Access the web interface at `http://localhost:8000` and the API docs at `http://localhost:8000/docs`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Kubernetes / Helm Deployment
|
||||||
|
|
||||||
|
The Helm chart at `helm/docuelevate/` packages all components into a single, configurable release. It supports:
|
||||||
|
|
||||||
|
- Multiple replicas for the API and Worker
|
||||||
|
- Horizontal Pod Autoscaling (HPA)
|
||||||
|
- Bundled or external Redis
|
||||||
|
- Persistent volumes for workdir and Meilisearch data
|
||||||
|
- Alembic database migration Job (pre-install/upgrade hook)
|
||||||
|
- TLS Ingress via any controller (nginx, Traefik, etc.)
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
- Kubernetes 1.24+
|
||||||
|
- Helm 3.10+
|
||||||
|
- A storage class that supports **ReadWriteMany** (e.g. NFS, CephFS, Azure Files, EFS) for the shared workdir PVC when running multiple replicas. Single-replica clusters can use `ReadWriteOnce`.
|
||||||
|
- A PostgreSQL database (strongly recommended over SQLite for multi-replica).
|
||||||
|
|
||||||
|
### Quick Start
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1. Add the Bitnami chart repository (needed for bundled Redis)
|
||||||
|
helm repo add bitnami https://charts.bitnami.com/bitnami
|
||||||
|
helm repo update
|
||||||
|
|
||||||
|
# 2. Update chart dependencies
|
||||||
|
helm dependency update ./helm/docuelevate
|
||||||
|
|
||||||
|
# 3. Install with a minimal values override
|
||||||
|
helm install docuelevate ./helm/docuelevate \
|
||||||
|
--namespace docuelevate --create-namespace \
|
||||||
|
--set secrets.DATABASE_URL="postgresql://user:pass@postgres:5432/docuelevate" \
|
||||||
|
--set secrets.SESSION_SECRET="$(openssl rand -hex 32)" \
|
||||||
|
--set secrets.OPENAI_API_KEY="sk-..." \
|
||||||
|
--set secrets.AZURE_AI_KEY="..." \
|
||||||
|
--set env.AZURE_ENDPOINT="https://my-resource.cognitiveservices.azure.com/" \
|
||||||
|
--set env.EXTERNAL_HOSTNAME="docuelevate.example.com"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Values Reference
|
||||||
|
|
||||||
|
The full list of configurable values is in [`helm/docuelevate/values.yaml`](../helm/docuelevate/values.yaml). Key sections:
|
||||||
|
|
||||||
|
#### Container Image
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/christianlouis/docuelevate
|
||||||
|
tag: "" # defaults to chart appVersion
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Non-Secret Config (`env`)
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
env:
|
||||||
|
WORKDIR: /workdir
|
||||||
|
AI_PROVIDER: openai
|
||||||
|
OPENAI_MODEL: gpt-4o-mini
|
||||||
|
AZURE_REGION: eastus
|
||||||
|
AZURE_ENDPOINT: "https://my-resource.cognitiveservices.azure.com/"
|
||||||
|
MEILISEARCH_URL: http://docuelevate-meilisearch:7700 # auto-resolved from service name
|
||||||
|
ENABLE_SEARCH: "true"
|
||||||
|
AUTH_ENABLED: "true"
|
||||||
|
EXTERNAL_HOSTNAME: docuelevate.example.com
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Secrets (`secrets`)
|
||||||
|
|
||||||
|
All secrets are stored in a Kubernetes `Secret` and injected as environment variables.
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
secrets:
|
||||||
|
DATABASE_URL: "postgresql://user:pass@postgres:5432/docuelevate"
|
||||||
|
SESSION_SECRET: "<min-32-char-random-string>"
|
||||||
|
OPENAI_API_KEY: "sk-..."
|
||||||
|
AZURE_AI_KEY: "..."
|
||||||
|
MEILISEARCH_API_KEY: "" # leave blank for unauthenticated dev Meilisearch
|
||||||
|
# Storage provider secrets ...
|
||||||
|
```
|
||||||
|
|
||||||
|
> **Tip:** In production use an external secret manager (Vault, ESO, Sealed Secrets) and reference the secret by name instead of embedding values in values.yaml.
|
||||||
|
|
||||||
|
#### Replicas & Autoscaling
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
api:
|
||||||
|
replicaCount: 2
|
||||||
|
autoscaling:
|
||||||
|
enabled: true
|
||||||
|
minReplicas: 2
|
||||||
|
maxReplicas: 8
|
||||||
|
targetCPUUtilizationPercentage: 70
|
||||||
|
|
||||||
|
worker:
|
||||||
|
replicaCount: 2
|
||||||
|
autoscaling:
|
||||||
|
enabled: true
|
||||||
|
minReplicas: 2
|
||||||
|
maxReplicas: 10
|
||||||
|
targetCPUUtilizationPercentage: 75
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Shared Workdir PVC
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
workdir:
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
accessMode: ReadWriteMany # RWX required for multi-replica
|
||||||
|
size: 20Gi
|
||||||
|
storageClass: "nfs-client" # or leave blank for cluster default
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Ingress (nginx example)
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
className: nginx
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/proxy-body-size: "1g"
|
||||||
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||||
|
hosts:
|
||||||
|
- host: docuelevate.example.com
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- secretName: docuelevate-tls
|
||||||
|
hosts:
|
||||||
|
- docuelevate.example.com
|
||||||
|
```
|
||||||
|
|
||||||
|
#### External Redis
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
redis:
|
||||||
|
enabled: false # disable bundled Redis
|
||||||
|
|
||||||
|
externalRedis:
|
||||||
|
url: "redis://my-redis-host:6379/0"
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Meilisearch
|
||||||
|
|
||||||
|
The bundled Meilisearch deployment is a single-replica, persistent StatefulSet-equivalent. For production, consider [Meilisearch Cloud](https://www.meilisearch.com/cloud) and point `env.MEILISEARCH_URL` at it.
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
meilisearch:
|
||||||
|
enabled: true
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
size: 10Gi
|
||||||
|
```
|
||||||
|
|
||||||
|
### Upgrading
|
||||||
|
|
||||||
|
```bash
|
||||||
|
helm upgrade docuelevate ./helm/docuelevate \
|
||||||
|
--namespace docuelevate \
|
||||||
|
-f my-values.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
The pre-upgrade hook runs `alembic upgrade head` automatically before the new pods start.
|
||||||
|
|
||||||
|
### Uninstalling
|
||||||
|
|
||||||
|
```bash
|
||||||
|
helm uninstall docuelevate --namespace docuelevate
|
||||||
|
# PVCs are NOT deleted automatically — remove manually if desired:
|
||||||
|
kubectl delete pvc -l app.kubernetes.io/instance=docuelevate -n docuelevate
|
||||||
|
```
|
||||||
|
|
||||||
|
### Kubernetes Architecture Diagram
|
||||||
|
|
||||||
|
```
|
||||||
|
Internet
|
||||||
|
│
|
||||||
|
▼
|
||||||
|
[Ingress / LoadBalancer]
|
||||||
|
│
|
||||||
|
▼
|
||||||
|
[API Deployment] ─────── [Worker Deployment]
|
||||||
|
│ │ │ │
|
||||||
|
│ └── shared PVC ──┘ │
|
||||||
|
│ (workdir) │
|
||||||
|
▼ ▼
|
||||||
|
[Redis Service] [Gotenberg Service]
|
||||||
|
│
|
||||||
|
[Meilisearch Service]
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## Production Considerations
|
## Production Considerations
|
||||||
|
|
||||||
### Security Headers
|
### Database
|
||||||
|
|
||||||
DocuElevate includes built-in support for HTTP security headers to improve browser-side security. **These headers are disabled by default** since most deployments use a reverse proxy (Traefik, Nginx, etc.) that already adds these headers.
|
SQLite is fine for development but **not recommended for multi-replica production** deployments because it cannot be shared safely across pods. Use PostgreSQL:
|
||||||
|
|
||||||
#### Supported Security Headers
|
```
|
||||||
|
DATABASE_URL=postgresql://docuelevate:secret@postgres-host:5432/docuelevate
|
||||||
- **Strict-Transport-Security (HSTS)**: Forces browsers to use HTTPS for all future requests
|
|
||||||
- **Content-Security-Policy (CSP)**: Controls which resources browsers are allowed to load
|
|
||||||
- **X-Frame-Options**: Prevents the page from being loaded in frames (clickjacking protection)
|
|
||||||
- **X-Content-Type-Options**: Prevents browsers from MIME-sniffing responses
|
|
||||||
|
|
||||||
#### Reverse Proxy Deployment (Traefik, Nginx, etc.) - DEFAULT
|
|
||||||
|
|
||||||
**Most deployments use a reverse proxy**, which is why security headers are disabled by default in DocuElevate. The reverse proxy should add these headers.
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# In .env file (or omit - this is the default)
|
|
||||||
SECURITY_HEADERS_ENABLED=false
|
|
||||||
```
|
```
|
||||||
|
|
||||||
##### Traefik Configuration Example
|
### Security Headers
|
||||||
|
|
||||||
Traefik can add security headers using middleware. Create a `docker-compose.yaml` with Traefik labels:
|
DocuElevate's built-in security headers are **disabled by default** since most deployments use a reverse proxy that already adds them.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Enable only if running without a reverse proxy
|
||||||
|
SECURITY_HEADERS_ENABLED=true
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Traefik (Docker Compose) example
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
services:
|
services:
|
||||||
@@ -85,35 +289,25 @@ services:
|
|||||||
- "traefik.enable=true"
|
- "traefik.enable=true"
|
||||||
- "traefik.http.routers.docuelevate.rule=Host(`docuelevate.example.com`)"
|
- "traefik.http.routers.docuelevate.rule=Host(`docuelevate.example.com`)"
|
||||||
- "traefik.http.routers.docuelevate.entrypoints=websecure"
|
- "traefik.http.routers.docuelevate.entrypoints=websecure"
|
||||||
- "traefik.http.routers.docuelevate.tls=true"
|
|
||||||
- "traefik.http.routers.docuelevate.tls.certresolver=letsencrypt"
|
- "traefik.http.routers.docuelevate.tls.certresolver=letsencrypt"
|
||||||
# Security headers middleware
|
|
||||||
- "traefik.http.routers.docuelevate.middlewares=security-headers@docker"
|
- "traefik.http.routers.docuelevate.middlewares=security-headers@docker"
|
||||||
- "traefik.http.middlewares.security-headers.headers.stsSeconds=31536000"
|
- "traefik.http.middlewares.security-headers.headers.stsSeconds=31536000"
|
||||||
- "traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true"
|
- "traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true"
|
||||||
- "traefik.http.middlewares.security-headers.headers.contentSecurityPolicy=default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;"
|
|
||||||
- "traefik.http.middlewares.security-headers.headers.customFrameOptionsValue=DENY"
|
|
||||||
- "traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true"
|
- "traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true"
|
||||||
|
- "traefik.http.middlewares.security-headers.headers.customFrameOptionsValue=DENY"
|
||||||
```
|
```
|
||||||
|
|
||||||
Then set `SECURITY_HEADERS_ENABLED=false` in your `.env` file.
|
#### Nginx example
|
||||||
|
|
||||||
##### Nginx Configuration Example
|
|
||||||
|
|
||||||
Add security headers to your Nginx configuration:
|
|
||||||
|
|
||||||
```nginx
|
```nginx
|
||||||
server {
|
server {
|
||||||
listen 443 ssl http2;
|
listen 443 ssl http2;
|
||||||
server_name docuelevate.example.com;
|
server_name docuelevate.example.com;
|
||||||
|
|
||||||
# SSL configuration
|
|
||||||
ssl_certificate /etc/nginx/ssl/cert.pem;
|
ssl_certificate /etc/nginx/ssl/cert.pem;
|
||||||
ssl_certificate_key /etc/nginx/ssl/key.pem;
|
ssl_certificate_key /etc/nginx/ssl/key.pem;
|
||||||
|
|
||||||
# Security headers
|
|
||||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||||
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;" always;
|
|
||||||
add_header X-Frame-Options "DENY" always;
|
add_header X-Frame-Options "DENY" always;
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
add_header X-Content-Type-Options "nosniff" always;
|
||||||
|
|
||||||
@@ -123,144 +317,109 @@ server {
|
|||||||
proxy_set_header X-Real-IP $remote_addr;
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
client_max_body_size 1g;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
Then keep `SECURITY_HEADERS_ENABLED=false` in your `.env` file (or omit it, as this is the default).
|
### Storage
|
||||||
|
|
||||||
#### Direct Deployment (No Reverse Proxy)
|
|
||||||
|
|
||||||
If you're running DocuElevate **directly without a reverse proxy**, enable security headers:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# In .env file
|
|
||||||
SECURITY_HEADERS_ENABLED=true
|
|
||||||
```
|
|
||||||
|
|
||||||
You can also configure individual headers:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
SECURITY_HEADER_HSTS_ENABLED=true
|
|
||||||
SECURITY_HEADER_CSP_ENABLED=true
|
|
||||||
SECURITY_HEADER_X_FRAME_OPTIONS_ENABLED=true
|
|
||||||
SECURITY_HEADER_X_CONTENT_TYPE_OPTIONS_ENABLED=true
|
|
||||||
```
|
|
||||||
|
|
||||||
**Note**: HSTS only works when serving content over HTTPS. If using HTTP for development, you can disable it:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
SECURITY_HEADER_HSTS_ENABLED=false
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Customizing Security Headers
|
|
||||||
|
|
||||||
If you enable security headers, you can customize individual header values in your `.env` file:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Customize HSTS (e.g., shorter duration for testing)
|
|
||||||
SECURITY_HEADER_HSTS_VALUE="max-age=300"
|
|
||||||
|
|
||||||
# Customize CSP (e.g., allow specific external domains)
|
|
||||||
SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline';"
|
|
||||||
|
|
||||||
# Allow framing from same origin
|
|
||||||
SECURITY_HEADER_X_FRAME_OPTIONS_VALUE="SAMEORIGIN"
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Security Considerations
|
|
||||||
|
|
||||||
1. **HSTS and HTTPS**: HSTS only works over HTTPS. Ensure you have a valid SSL certificate before enabling HSTS.
|
|
||||||
2. **CSP Testing**: The default CSP policy allows inline scripts and styles for compatibility. Test thoroughly before tightening.
|
|
||||||
3. **Content-Security-Policy**: The default policy allows `'unsafe-inline'` for scripts and styles for compatibility with Tailwind CSS and inline JavaScript. For stricter security, consider using nonces or hashes.
|
|
||||||
4. **X-Frame-Options**: Set to `DENY` by default. Change to `SAMEORIGIN` if you need to embed DocuElevate in iframes on the same domain.
|
|
||||||
|
|
||||||
See the [Configuration Guide](ConfigurationGuide.md) for all security header options.
|
|
||||||
|
|
||||||
### Reverse Proxy Setup
|
|
||||||
|
|
||||||
For production use, we recommend setting up a reverse proxy (like Nginx or Traefik) to handle HTTPS and domain routing:
|
|
||||||
|
|
||||||
```nginx
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
server_name docuelevate.example.com;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
proxy_pass http://localhost:8000;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
### Persistent Storage
|
|
||||||
|
|
||||||
The Docker setup uses volumes for persistent storage. For production, consider:
|
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
|
# Docker Compose
|
||||||
volumes:
|
volumes:
|
||||||
- /path/to/persistent/storage:/workdir
|
- /path/to/persistent/storage:/workdir
|
||||||
|
|
||||||
|
# Helm — use a RWX storage class for multi-replica
|
||||||
|
workdir:
|
||||||
|
persistence:
|
||||||
|
size: 20Gi
|
||||||
|
accessMode: ReadWriteMany
|
||||||
|
storageClass: "nfs-client"
|
||||||
```
|
```
|
||||||
|
|
||||||
### Security
|
### General Security Checklist
|
||||||
|
|
||||||
1. **Always use HTTPS** in production
|
1. **Always use HTTPS** in production
|
||||||
2. Enable authentication by setting `AUTH_ENABLED=true`
|
2. Set `AUTH_ENABLED=true` and use a strong `SESSION_SECRET`
|
||||||
3. Use strong passwords for all services
|
3. Rotate API keys and secrets regularly — see the [Credential Rotation Guide](CredentialRotationGuide.md)
|
||||||
4. Limit access to the Docker host
|
4. Limit network access to Redis and Meilisearch (both should be internal-only)
|
||||||
5. Regularly update the application and dependencies
|
5. Regularly update the container image to pick up dependency patches
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## Scaling
|
## Scaling
|
||||||
|
|
||||||
For high-volume deployments:
|
### Docker Compose
|
||||||
|
|
||||||
1. Increase worker processes by adding more worker containers:
|
Add more worker containers:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
worker:
|
worker:
|
||||||
image: christianlouis/document-processor:latest
|
|
||||||
deploy:
|
deploy:
|
||||||
replicas: 3
|
replicas: 3
|
||||||
```
|
```
|
||||||
|
|
||||||
2. Consider using dedicated Redis and database servers
|
### Kubernetes / Helm
|
||||||
3. Monitor system performance and adjust resources as needed
|
|
||||||
|
Enable HPA:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
api:
|
||||||
|
autoscaling:
|
||||||
|
enabled: true
|
||||||
|
minReplicas: 2
|
||||||
|
maxReplicas: 8
|
||||||
|
|
||||||
|
worker:
|
||||||
|
autoscaling:
|
||||||
|
enabled: true
|
||||||
|
minReplicas: 2
|
||||||
|
maxReplicas: 10
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## Monitoring
|
## Monitoring
|
||||||
|
|
||||||
Monitor your DocuElevate deployment using:
|
- **Docker Compose**: `docker-compose logs -f`, `docker stats`
|
||||||
|
- **Kubernetes**: `kubectl logs -l app.kubernetes.io/component=api -f`
|
||||||
|
- **Prometheus / Grafana**: Scrape the `/api/health` endpoint for readiness; add custom metrics as needed.
|
||||||
|
- **Uptime Kuma**: Set `UPTIME_KUMA_URL` to your push URL for heartbeat monitoring.
|
||||||
|
|
||||||
- Docker's built-in logging: `docker-compose logs -f`
|
---
|
||||||
- Container metrics: `docker stats`
|
|
||||||
- External monitoring tools like Prometheus and Grafana
|
|
||||||
|
|
||||||
## Backup Procedures
|
## Backup Procedures
|
||||||
|
|
||||||
Regularly back up the following:
|
Regularly back up:
|
||||||
|
|
||||||
1. The `/workdir` directory containing all processed documents
|
1. The `/workdir` volume (all processed documents and originals)
|
||||||
2. The database file (if using SQLite) or database contents (if using another DBMS)
|
2. The database (PostgreSQL `pg_dump` or SQLite file)
|
||||||
3. The `.env` configuration file
|
3. The Meilisearch data directory (`/meili_data`)
|
||||||
|
4. Your `.env` / Helm values file (store securely, it contains secrets)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## Updates
|
## Updates
|
||||||
|
|
||||||
To update DocuElevate to a newer version:
|
### Docker Compose
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# Pull the latest changes
|
|
||||||
git pull
|
git pull
|
||||||
|
|
||||||
# Pull the latest Docker images
|
|
||||||
docker-compose pull
|
docker-compose pull
|
||||||
|
docker-compose down && docker-compose up -d
|
||||||
# Restart the services
|
|
||||||
docker-compose down
|
|
||||||
docker-compose up -d
|
|
||||||
```
|
```
|
||||||
|
|
||||||
|
### Helm
|
||||||
|
|
||||||
|
```bash
|
||||||
|
helm repo update # if using a hosted chart repository
|
||||||
|
helm upgrade docuelevate ./helm/docuelevate --namespace docuelevate -f my-values.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
The migration Job runs automatically on every `helm upgrade`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## Troubleshooting
|
## Troubleshooting
|
||||||
|
|
||||||
See the [Troubleshooting](Troubleshooting.md) guide for common deployment issues and solutions.
|
See the [Troubleshooting Guide](Troubleshooting.md) for common issues and solutions.
|
||||||
|
|||||||
@@ -0,0 +1,10 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
.DS_Store
|
||||||
|
.git
|
||||||
|
.gitignore
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
.vscode
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: docuelevate
|
||||||
|
description: >
|
||||||
|
DocuElevate — intelligent document processing with OCR, AI metadata
|
||||||
|
extraction, full-text search (Meilisearch), and multi-cloud storage.
|
||||||
|
|
||||||
|
type: application
|
||||||
|
|
||||||
|
# Chart version — bump on every chart change (independent of appVersion).
|
||||||
|
version: 0.1.0
|
||||||
|
|
||||||
|
# Application version — kept in sync with the VERSION file.
|
||||||
|
appVersion: "0.54.0"
|
||||||
|
|
||||||
|
keywords:
|
||||||
|
- document-management
|
||||||
|
- ocr
|
||||||
|
- ai
|
||||||
|
- meilisearch
|
||||||
|
- fastapi
|
||||||
|
- celery
|
||||||
|
|
||||||
|
home: https://github.com/christianlouis/DocuElevate
|
||||||
|
sources:
|
||||||
|
- https://github.com/christianlouis/DocuElevate
|
||||||
|
|
||||||
|
maintainers:
|
||||||
|
- name: DocuElevate Contributors
|
||||||
|
url: https://github.com/christianlouis/DocuElevate
|
||||||
|
|
||||||
|
dependencies:
|
||||||
|
# Bundled Redis (optional — disable and point to an external instance via
|
||||||
|
# externalRedis.url if you already have Redis in the cluster).
|
||||||
|
- name: redis
|
||||||
|
version: "20.x.x"
|
||||||
|
repository: "https://charts.bitnami.com/bitnami"
|
||||||
|
condition: redis.enabled
|
||||||
@@ -0,0 +1,45 @@
|
|||||||
|
Thank you for installing {{ .Chart.Name }} {{ .Chart.Version }}!
|
||||||
|
|
||||||
|
{{- if .Values.ingress.enabled }}
|
||||||
|
The application will be available at:
|
||||||
|
{{- range .Values.ingress.hosts }}
|
||||||
|
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}
|
||||||
|
{{- end }}
|
||||||
|
{{- else }}
|
||||||
|
To access DocuElevate, run:
|
||||||
|
|
||||||
|
kubectl port-forward svc/{{ include "docuelevate.fullname" . }}-api {{ .Values.api.service.port }}:{{ .Values.api.service.port }} -n {{ .Release.Namespace }}
|
||||||
|
|
||||||
|
Then open http://localhost:{{ .Values.api.service.port }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
API docs are available at: <your-url>/docs
|
||||||
|
|
||||||
|
{{- if not .Values.secrets.SESSION_SECRET }}
|
||||||
|
|
||||||
|
⚠️ WARNING: secrets.SESSION_SECRET is not set.
|
||||||
|
Generate one with: openssl rand -hex 32
|
||||||
|
Then pass it via: --set secrets.SESSION_SECRET=<value>
|
||||||
|
or via a values file / external secret.
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if not .Values.secrets.DATABASE_URL }}
|
||||||
|
|
||||||
|
⚠️ WARNING: secrets.DATABASE_URL is not set.
|
||||||
|
For production, use PostgreSQL:
|
||||||
|
postgresql://user:pass@host:5432/docuelevate
|
||||||
|
SQLite with a PVC is supported but not recommended for multi-replica
|
||||||
|
deployments (use ReadWriteOnce PVC and replicaCount=1 in that case).
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
Useful commands:
|
||||||
|
# View API logs
|
||||||
|
kubectl logs -l app.kubernetes.io/component=api -n {{ .Release.Namespace }} -f
|
||||||
|
|
||||||
|
# View worker logs
|
||||||
|
kubectl logs -l app.kubernetes.io/component=worker -n {{ .Release.Namespace }} -f
|
||||||
|
|
||||||
|
# Run a database migration manually
|
||||||
|
kubectl create job --from=cronjob/{{ include "docuelevate.fullname" . }}-migrate migrate-manual -n {{ .Release.Namespace }}
|
||||||
@@ -0,0 +1,108 @@
|
|||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this.
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride }}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||||
|
{{- if contains $name .Release.Name }}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart label value: "chart-name-version"
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels applied to every resource.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "docuelevate.chart" . }}
|
||||||
|
{{ include "docuelevate.selectorLabels" . }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Selector labels.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.selectorLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "docuelevate.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
ServiceAccount name.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
{{- default (include "docuelevate.fullname" .) .Values.serviceAccount.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- default "default" .Values.serviceAccount.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Image reference, using appVersion as default tag.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.image" -}}
|
||||||
|
{{- $tag := .Values.image.tag | default .Chart.AppVersion }}
|
||||||
|
{{- printf "%s:%s" .Values.image.repository $tag }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Resolve REDIS_URL: prefer externalRedis.url, then secrets.REDIS_URL,
|
||||||
|
then fall back to the bundled Redis service URL.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.redisUrl" -}}
|
||||||
|
{{- if .Values.externalRedis.url }}
|
||||||
|
{{- .Values.externalRedis.url }}
|
||||||
|
{{- else if .Values.secrets.REDIS_URL }}
|
||||||
|
{{- .Values.secrets.REDIS_URL }}
|
||||||
|
{{- else if .Values.redis.enabled }}
|
||||||
|
{{- printf "redis://%s-redis-master:6379/0" .Release.Name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- "" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Resolve GOTENBERG_URL — use env override if set, otherwise build from service name.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.gotenbergUrl" -}}
|
||||||
|
{{- if .Values.env.GOTENBERG_URL }}
|
||||||
|
{{- tpl .Values.env.GOTENBERG_URL . }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "http://%s-gotenberg:3000" (include "docuelevate.fullname" .) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Resolve MEILISEARCH_URL — use env override if set, otherwise build from service name.
|
||||||
|
*/}}
|
||||||
|
{{- define "docuelevate.meilisearchUrl" -}}
|
||||||
|
{{- if .Values.env.MEILISEARCH_URL }}
|
||||||
|
{{- tpl .Values.env.MEILISEARCH_URL . }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "http://%s-meilisearch:7700" (include "docuelevate.fullname" .) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,93 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-api
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: api
|
||||||
|
spec:
|
||||||
|
{{- if not .Values.api.autoscaling.enabled }}
|
||||||
|
replicas: {{ .Values.api.replicaCount }}
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: api
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: api
|
||||||
|
{{- with .Values.api.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ include "docuelevate.serviceAccountName" . }}
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.api.podSecurityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: api
|
||||||
|
image: {{ include "docuelevate.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
command:
|
||||||
|
- uvicorn
|
||||||
|
- app.main:app
|
||||||
|
- --host
|
||||||
|
- "0.0.0.0"
|
||||||
|
- --port
|
||||||
|
- "8000"
|
||||||
|
- --proxy-headers
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 8000
|
||||||
|
protocol: TCP
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-config
|
||||||
|
- secretRef:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-secret
|
||||||
|
{{- with .Values.api.livenessProbe }}
|
||||||
|
livenessProbe:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.api.readinessProbe }}
|
||||||
|
readinessProbe:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.api.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.api.resources | nindent 12 }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: workdir
|
||||||
|
mountPath: /workdir
|
||||||
|
volumes:
|
||||||
|
- name: workdir
|
||||||
|
{{- if .Values.workdir.persistence.enabled }}
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ .Values.workdir.persistence.existingClaim | default (printf "%s-workdir" (include "docuelevate.fullname" .)) }}
|
||||||
|
{{- else }}
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.api.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.api.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.api.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-api
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: api
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.api.service.type }}
|
||||||
|
ports:
|
||||||
|
- port: {{ .Values.api.service.port }}
|
||||||
|
targetPort: http
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: api
|
||||||
@@ -0,0 +1,40 @@
|
|||||||
|
# Non-sensitive application configuration.
|
||||||
|
# All values are injected as environment variables into the API and Worker pods.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-config
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
WORKDIR: {{ .Values.env.WORKDIR | quote }}
|
||||||
|
PYTHONPATH: "/app"
|
||||||
|
PYTHONUNBUFFERED: "1"
|
||||||
|
|
||||||
|
# AI provider
|
||||||
|
AI_PROVIDER: {{ .Values.env.AI_PROVIDER | quote }}
|
||||||
|
OPENAI_MODEL: {{ .Values.env.OPENAI_MODEL | quote }}
|
||||||
|
|
||||||
|
# Azure
|
||||||
|
AZURE_REGION: {{ .Values.env.AZURE_REGION | quote }}
|
||||||
|
AZURE_ENDPOINT: {{ .Values.env.AZURE_ENDPOINT | quote }}
|
||||||
|
|
||||||
|
# Service URLs — resolved from helper templates so they always match the
|
||||||
|
# in-cluster service names even if values.yaml uses template expressions.
|
||||||
|
GOTENBERG_URL: {{ include "docuelevate.gotenbergUrl" . | quote }}
|
||||||
|
MEILISEARCH_URL: {{ include "docuelevate.meilisearchUrl" . | quote }}
|
||||||
|
MEILISEARCH_INDEX_NAME: {{ .Values.env.MEILISEARCH_INDEX_NAME | quote }}
|
||||||
|
ENABLE_SEARCH: {{ .Values.env.ENABLE_SEARCH | quote }}
|
||||||
|
|
||||||
|
# Auth
|
||||||
|
AUTH_ENABLED: {{ .Values.env.AUTH_ENABLED | quote }}
|
||||||
|
ADMIN_USERNAME: {{ .Values.env.ADMIN_USERNAME | quote }}
|
||||||
|
EXTERNAL_HOSTNAME: {{ .Values.env.EXTERNAL_HOSTNAME | quote }}
|
||||||
|
|
||||||
|
# Feature flags
|
||||||
|
ENABLE_DEDUPLICATION: {{ .Values.env.ENABLE_DEDUPLICATION | quote }}
|
||||||
|
ENABLE_TEXT_QUALITY_CHECK: {{ .Values.env.ENABLE_TEXT_QUALITY_CHECK | quote }}
|
||||||
|
ALLOW_FILE_DELETE: {{ .Values.env.ALLOW_FILE_DELETE | quote }}
|
||||||
|
|
||||||
|
DEBUG: {{ .Values.env.DEBUG | quote }}
|
||||||
@@ -0,0 +1,63 @@
|
|||||||
|
{{- if .Values.gotenberg.enabled }}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-gotenberg
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: gotenberg
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: gotenberg
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: gotenberg
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: gotenberg
|
||||||
|
image: {{ .Values.gotenberg.image.repository }}:{{ .Values.gotenberg.image.tag }}
|
||||||
|
imagePullPolicy: {{ .Values.gotenberg.image.pullPolicy }}
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 3000
|
||||||
|
protocol: TCP
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.gotenberg.resources | nindent 12 }}
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /health
|
||||||
|
port: 3000
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 30
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /health
|
||||||
|
port: 3000
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-gotenberg
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: gotenberg
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: {{ .Values.gotenberg.service.port }}
|
||||||
|
targetPort: http
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: gotenberg
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,51 @@
|
|||||||
|
{{- if .Values.api.autoscaling.enabled }}
|
||||||
|
apiVersion: autoscaling/v2
|
||||||
|
kind: HorizontalPodAutoscaler
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-api
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: api
|
||||||
|
spec:
|
||||||
|
scaleTargetRef:
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-api
|
||||||
|
minReplicas: {{ .Values.api.autoscaling.minReplicas }}
|
||||||
|
maxReplicas: {{ .Values.api.autoscaling.maxReplicas }}
|
||||||
|
metrics:
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: cpu
|
||||||
|
target:
|
||||||
|
type: Utilization
|
||||||
|
averageUtilization: {{ .Values.api.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
{{- if .Values.worker.autoscaling.enabled }}
|
||||||
|
apiVersion: autoscaling/v2
|
||||||
|
kind: HorizontalPodAutoscaler
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-worker
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: worker
|
||||||
|
spec:
|
||||||
|
scaleTargetRef:
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-worker
|
||||||
|
minReplicas: {{ .Values.worker.autoscaling.minReplicas }}
|
||||||
|
maxReplicas: {{ .Values.worker.autoscaling.maxReplicas }}
|
||||||
|
metrics:
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: cpu
|
||||||
|
target:
|
||||||
|
type: Utilization
|
||||||
|
averageUtilization: {{ .Values.worker.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,36 @@
|
|||||||
|
{{- if .Values.ingress.enabled -}}
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.ingress.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if .Values.ingress.className }}
|
||||||
|
ingressClassName: {{ .Values.ingress.className }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.ingress.tls }}
|
||||||
|
tls:
|
||||||
|
{{- toYaml .Values.ingress.tls | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
rules:
|
||||||
|
{{- range .Values.ingress.hosts }}
|
||||||
|
- host: {{ .host | quote }}
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
{{- range .paths }}
|
||||||
|
- path: {{ .path }}
|
||||||
|
pathType: {{ .pathType }}
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: {{ include "docuelevate.fullname" $ }}-api
|
||||||
|
port:
|
||||||
|
number: {{ $.Values.api.service.port }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,89 @@
|
|||||||
|
{{- if .Values.meilisearch.enabled }}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-meilisearch
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: meilisearch
|
||||||
|
spec:
|
||||||
|
# Single replica — Meilisearch Community Edition is single-node only.
|
||||||
|
# Use Meilisearch Cloud or the paid Meilisearch Cluster for HA.
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: meilisearch
|
||||||
|
strategy:
|
||||||
|
# Recreate ensures the PVC is released before the new pod starts
|
||||||
|
type: Recreate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: meilisearch
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: meilisearch
|
||||||
|
image: {{ .Values.meilisearch.image.repository }}:{{ .Values.meilisearch.image.tag }}
|
||||||
|
imagePullPolicy: {{ .Values.meilisearch.image.pullPolicy }}
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 7700
|
||||||
|
protocol: TCP
|
||||||
|
env:
|
||||||
|
- name: MEILI_NO_ANALYTICS
|
||||||
|
value: {{ .Values.meilisearch.env.MEILI_NO_ANALYTICS | quote }}
|
||||||
|
{{- if .Values.secrets.MEILISEARCH_API_KEY }}
|
||||||
|
- name: MEILI_MASTER_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-secret
|
||||||
|
key: MEILISEARCH_API_KEY
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.meilisearch.resources | nindent 12 }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: data
|
||||||
|
mountPath: /meili_data
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /health
|
||||||
|
port: 7700
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 30
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /health
|
||||||
|
port: 7700
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
{{- if .Values.meilisearch.persistence.enabled }}
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ .Values.meilisearch.persistence.existingClaim | default (printf "%s-meilisearch-data" (include "docuelevate.fullname" .)) }}
|
||||||
|
{{- else }}
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-meilisearch
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: meilisearch
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: {{ .Values.meilisearch.service.port }}
|
||||||
|
targetPort: http
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: meilisearch
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,69 @@
|
|||||||
|
# Database migration Job — runs `alembic upgrade head` once before
|
||||||
|
# the API and Worker Deployments start. Helm hooks ensure ordering:
|
||||||
|
# the Job runs during pre-upgrade/pre-install and the Deployments wait
|
||||||
|
# for it via the `helm.sh/hook-weight` annotation.
|
||||||
|
{{- if .Values.migrations.enabled }}
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-migrate-{{ .Release.Revision }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: migrate
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": pre-install,pre-upgrade
|
||||||
|
"helm.sh/hook-weight": "-5"
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation
|
||||||
|
{{- if .Values.migrations.ttlSecondsAfterFinished }}
|
||||||
|
spec:
|
||||||
|
ttlSecondsAfterFinished: {{ .Values.migrations.ttlSecondsAfterFinished }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{- if .Values.migrations.ttlSecondsAfterFinished }}
|
||||||
|
ttlSecondsAfterFinished: {{ .Values.migrations.ttlSecondsAfterFinished }}
|
||||||
|
{{- end }}
|
||||||
|
backoffLimit: 3
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: migrate
|
||||||
|
spec:
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: {{ include "docuelevate.serviceAccountName" . }}
|
||||||
|
{{- with .Values.image.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: migrate
|
||||||
|
image: {{ include "docuelevate.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
command: ["alembic", "upgrade", "head"]
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-config
|
||||||
|
- secretRef:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-secret
|
||||||
|
{{- with .Values.workdir.persistence }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: workdir
|
||||||
|
mountPath: /workdir
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 512Mi
|
||||||
|
volumes:
|
||||||
|
- name: workdir
|
||||||
|
{{- if .Values.workdir.persistence.enabled }}
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ .Values.workdir.persistence.existingClaim | default (printf "%s-workdir" (include "docuelevate.fullname" .)) }}
|
||||||
|
{{- else }}
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,49 @@
|
|||||||
|
# Shared workdir PVC — mounted by both the API and the Worker so they can
|
||||||
|
# exchange files during processing. Requires ReadWriteMany (e.g. NFS,
|
||||||
|
# CephFS, Azure Files, EFS) when running multiple replicas.
|
||||||
|
# Set workdir.persistence.accessMode=ReadWriteOnce and replicaCount=1
|
||||||
|
# for single-node / dev clusters.
|
||||||
|
{{- if .Values.workdir.persistence.enabled }}
|
||||||
|
{{- if not .Values.workdir.persistence.existingClaim }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-workdir
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- {{ .Values.workdir.persistence.accessMode }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.workdir.persistence.size }}
|
||||||
|
{{- if .Values.workdir.persistence.storageClass }}
|
||||||
|
storageClassName: {{ .Values.workdir.persistence.storageClass }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Meilisearch data PVC
|
||||||
|
{{- if and .Values.meilisearch.enabled .Values.meilisearch.persistence.enabled }}
|
||||||
|
{{- if not .Values.meilisearch.persistence.existingClaim }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-meilisearch-data
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- {{ .Values.meilisearch.persistence.accessMode }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.meilisearch.persistence.size }}
|
||||||
|
{{- if .Values.meilisearch.persistence.storageClass }}
|
||||||
|
storageClassName: {{ .Values.meilisearch.persistence.storageClass }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
{{- if .Values.serviceAccount.create -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,82 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-worker
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.labels" . | nindent 4 }}
|
||||||
|
app.kubernetes.io/component: worker
|
||||||
|
spec:
|
||||||
|
{{- if not .Values.worker.autoscaling.enabled }}
|
||||||
|
replicas: {{ .Values.worker.replicaCount }}
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 6 }}
|
||||||
|
app.kubernetes.io/component: worker
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "docuelevate.selectorLabels" . | nindent 8 }}
|
||||||
|
app.kubernetes.io/component: worker
|
||||||
|
{{- with .Values.worker.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ include "docuelevate.serviceAccountName" . }}
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.podSecurityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: worker
|
||||||
|
image: {{ include "docuelevate.image" . }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
command:
|
||||||
|
- celery
|
||||||
|
- -A
|
||||||
|
- app.celery_worker
|
||||||
|
- worker
|
||||||
|
- -B
|
||||||
|
- --loglevel=info
|
||||||
|
- -Q
|
||||||
|
- document_processor,default,celery
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-config
|
||||||
|
- secretRef:
|
||||||
|
name: {{ include "docuelevate.fullname" . }}-secret
|
||||||
|
{{- with .Values.worker.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.worker.resources | nindent 12 }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: workdir
|
||||||
|
mountPath: /workdir
|
||||||
|
volumes:
|
||||||
|
- name: workdir
|
||||||
|
{{- if .Values.workdir.persistence.enabled }}
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: {{ .Values.workdir.persistence.existingClaim | default (printf "%s-workdir" (include "docuelevate.fullname" .)) }}
|
||||||
|
{{- else }}
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.worker.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,306 @@
|
|||||||
|
# =============================================================================
|
||||||
|
# DocuElevate Helm Chart — values.yaml
|
||||||
|
#
|
||||||
|
# Override any value with:
|
||||||
|
# helm install docuelevate ./helm/docuelevate -f my-values.yaml
|
||||||
|
# helm install docuelevate ./helm/docuelevate --set key=value
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Global image settings
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
image:
|
||||||
|
repository: ghcr.io/christianlouis/docuelevate
|
||||||
|
# Defaults to the chart appVersion; pin to a specific digest in production.
|
||||||
|
tag: ""
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
|
||||||
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
nameOverride: ""
|
||||||
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Shared environment — non-secret application config
|
||||||
|
# All values map 1-to-1 onto DocuElevate environment variables.
|
||||||
|
# Sensitive values (API keys, passwords) go into `secrets` below.
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
env:
|
||||||
|
# Required ----------------------------------------------------------------
|
||||||
|
WORKDIR: /workdir
|
||||||
|
|
||||||
|
# AI provider (openai | azure | anthropic | gemini | ollama | openrouter)
|
||||||
|
AI_PROVIDER: openai
|
||||||
|
OPENAI_MODEL: gpt-4o-mini
|
||||||
|
|
||||||
|
# Azure Document Intelligence (required when OCR_PROVIDERS includes "azure")
|
||||||
|
AZURE_REGION: eastus
|
||||||
|
AZURE_ENDPOINT: "" # e.g. https://my-resource.cognitiveservices.azure.com/
|
||||||
|
|
||||||
|
# Gotenberg PDF conversion service
|
||||||
|
GOTENBERG_URL: http://{{ include "docuelevate.fullname" . }}-gotenberg:3000
|
||||||
|
|
||||||
|
# Full-text search — uses the in-cluster Meilisearch service by default
|
||||||
|
MEILISEARCH_URL: http://{{ include "docuelevate.fullname" . }}-meilisearch:7700
|
||||||
|
MEILISEARCH_INDEX_NAME: documents
|
||||||
|
ENABLE_SEARCH: "true"
|
||||||
|
|
||||||
|
# Authentication
|
||||||
|
AUTH_ENABLED: "true"
|
||||||
|
ADMIN_USERNAME: admin
|
||||||
|
|
||||||
|
# Feature flags
|
||||||
|
ENABLE_DEDUPLICATION: "true"
|
||||||
|
ENABLE_TEXT_QUALITY_CHECK: "true"
|
||||||
|
ALLOW_FILE_DELETE: "true"
|
||||||
|
|
||||||
|
# Logging / misc
|
||||||
|
DEBUG: "false"
|
||||||
|
EXTERNAL_HOSTNAME: localhost # set to your public hostname / Ingress host
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Secrets — values are stored in a Kubernetes Secret and injected as env vars.
|
||||||
|
# In production, use an external secret manager (Vault, ESO, Sealed Secrets)
|
||||||
|
# and leave these blank, then mount the Secret yourself.
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
secrets:
|
||||||
|
DATABASE_URL: "" # e.g. postgresql://user:pass@postgres:5432/docuelevate
|
||||||
|
REDIS_URL: "" # leave blank to use bundled Redis
|
||||||
|
SESSION_SECRET: "" # min 32-char random string — generate with: openssl rand -hex 32
|
||||||
|
OPENAI_API_KEY: ""
|
||||||
|
AZURE_AI_KEY: ""
|
||||||
|
MEILISEARCH_API_KEY: "" # leave blank for unauthenticated (dev) Meilisearch
|
||||||
|
|
||||||
|
# Storage provider secrets (only the ones you use)
|
||||||
|
DROPBOX_APP_KEY: ""
|
||||||
|
DROPBOX_APP_SECRET: ""
|
||||||
|
DROPBOX_REFRESH_TOKEN: ""
|
||||||
|
GOOGLE_DRIVE_CREDENTIALS_JSON: ""
|
||||||
|
ONEDRIVE_CLIENT_ID: ""
|
||||||
|
ONEDRIVE_CLIENT_SECRET: ""
|
||||||
|
ONEDRIVE_REFRESH_TOKEN: ""
|
||||||
|
AWS_ACCESS_KEY_ID: ""
|
||||||
|
AWS_SECRET_ACCESS_KEY: ""
|
||||||
|
|
||||||
|
# OAuth / Authentik
|
||||||
|
AUTHENTIK_CLIENT_ID: ""
|
||||||
|
AUTHENTIK_CLIENT_SECRET: ""
|
||||||
|
AUTHENTIK_CONFIG_URL: ""
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# External services
|
||||||
|
# Set externalRedis.url (and disable bundled redis) when you have your own.
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
externalRedis:
|
||||||
|
# When non-empty this value is injected as REDIS_URL, overriding secrets.REDIS_URL
|
||||||
|
# and the auto-generated bundled-Redis URL.
|
||||||
|
url: ""
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# API deployment
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
api:
|
||||||
|
replicaCount: 2
|
||||||
|
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 250m
|
||||||
|
memory: 512Mi
|
||||||
|
limits:
|
||||||
|
cpu: "1"
|
||||||
|
memory: 1Gi
|
||||||
|
|
||||||
|
# Horizontal Pod Autoscaler
|
||||||
|
autoscaling:
|
||||||
|
enabled: false
|
||||||
|
minReplicas: 2
|
||||||
|
maxReplicas: 8
|
||||||
|
targetCPUUtilizationPercentage: 70
|
||||||
|
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
port: 8000
|
||||||
|
|
||||||
|
# Liveness / readiness probes
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /api/health
|
||||||
|
port: 8000
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 20
|
||||||
|
failureThreshold: 3
|
||||||
|
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /api/health
|
||||||
|
port: 8000
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 10
|
||||||
|
failureThreshold: 3
|
||||||
|
|
||||||
|
podAnnotations: {}
|
||||||
|
nodeSelector: {}
|
||||||
|
tolerations: []
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
podSecurityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
fsGroup: 1000
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
readOnlyRootFilesystem: false # app writes to /workdir
|
||||||
|
capabilities:
|
||||||
|
drop: ["ALL"]
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Celery worker deployment
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
worker:
|
||||||
|
replicaCount: 2
|
||||||
|
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 1Gi
|
||||||
|
limits:
|
||||||
|
cpu: "2"
|
||||||
|
memory: 4Gi
|
||||||
|
|
||||||
|
autoscaling:
|
||||||
|
enabled: false
|
||||||
|
minReplicas: 2
|
||||||
|
maxReplicas: 10
|
||||||
|
targetCPUUtilizationPercentage: 75
|
||||||
|
|
||||||
|
podAnnotations: {}
|
||||||
|
nodeSelector: {}
|
||||||
|
tolerations: []
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
podSecurityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
fsGroup: 1000
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
capabilities:
|
||||||
|
drop: ["ALL"]
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Shared workdir volume (api + worker mount the same PVC)
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
workdir:
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
# storageClass: "" # leave blank for cluster default
|
||||||
|
accessMode: ReadWriteMany # RWX required for multiple pods
|
||||||
|
size: 20Gi
|
||||||
|
# existingClaim: ""
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Gotenberg (PDF conversion)
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
gotenberg:
|
||||||
|
enabled: true
|
||||||
|
image:
|
||||||
|
repository: gotenberg/gotenberg
|
||||||
|
tag: latest
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
service:
|
||||||
|
port: 3000
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: "1"
|
||||||
|
memory: 1Gi
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Meilisearch (full-text search)
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
meilisearch:
|
||||||
|
enabled: true
|
||||||
|
image:
|
||||||
|
repository: getmeili/meilisearch
|
||||||
|
tag: latest
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
service:
|
||||||
|
port: 7700
|
||||||
|
env:
|
||||||
|
MEILI_NO_ANALYTICS: "true"
|
||||||
|
# MEILI_MASTER_KEY: "" # set via secrets.MEILISEARCH_API_KEY instead
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
# storageClass: ""
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
size: 10Gi
|
||||||
|
# existingClaim: ""
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 256Mi
|
||||||
|
limits:
|
||||||
|
cpu: "1"
|
||||||
|
memory: 1Gi
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Bundled Redis (from Bitnami chart)
|
||||||
|
# Disable and set externalRedis.url to use your own.
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
redis:
|
||||||
|
enabled: true
|
||||||
|
architecture: standalone
|
||||||
|
auth:
|
||||||
|
enabled: false
|
||||||
|
master:
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
size: 4Gi
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 512Mi
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Ingress
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
ingress:
|
||||||
|
enabled: false
|
||||||
|
className: "" # e.g. nginx, traefik
|
||||||
|
annotations: {}
|
||||||
|
# nginx.ingress.kubernetes.io/proxy-body-size: "1g"
|
||||||
|
# cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||||
|
hosts:
|
||||||
|
- host: docuelevate.example.com
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls: []
|
||||||
|
# - secretName: docuelevate-tls
|
||||||
|
# hosts:
|
||||||
|
# - docuelevate.example.com
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# ServiceAccount
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
annotations: {}
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Database migration job
|
||||||
|
# Runs `alembic upgrade head` before the api/worker start.
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
migrations:
|
||||||
|
enabled: true
|
||||||
|
# Automatically deleted after successful completion
|
||||||
|
ttlSecondsAfterFinished: 120
|
||||||
Reference in New Issue
Block a user