Changeset 0.28.6 (#192)

2026-03-15 01:33:38 +00:00
parent 6f0ad1355c
commit bffda043db
59 changed files with 3022 additions and 77 deletions
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: switchboard
+description: Chat Switchboard — self-hosted enterprise AI chat platform
+type: application
+version: 0.1.0
+appVersion: "0.28.6"
+home: https://gobha.ai
+sources:
+  - https://git.gobha.me/xcaliber/chat-switchboard
+maintainers:
+  - name: xcaliber
--- a/chart/templates/NOTES.txt
+++ b/chart/templates/NOTES.txt
@@ -0,0 +1,25 @@
+Chat Switchboard {{ .Chart.AppVersion }} deployed.
+
+{{- if .Values.ingress.enabled }}
+Access the application at:
+  {{- if .Values.ingress.tls.enabled }}
+  https://{{ .Values.ingress.host }}{{ .Values.basePath }}
+  {{- else }}
+  http://{{ .Values.ingress.host }}{{ .Values.basePath }}
+  {{- end }}
+{{- else }}
+Port-forward to access:
+  kubectl port-forward svc/{{ .Release.Name }}-frontend 3000:{{ .Values.frontend.port }}
+  open http://localhost:3000{{ .Values.basePath }}
+{{- end }}
+
+{{- if .Values.admin.password }}
+Admin credentials set via Helm values.
+{{- else }}
+⚠ No admin password set. Set admin.password in values or an existing secret.
+{{- end }}
+
+{{- if not .Values.encryptionKey }}
+⚠ ENCRYPTION_KEY not set. BYOK provider keys cannot be encrypted.
+  Set encryptionKey in values for production use.
+{{- end }}
--- a/chart/templates/_helpers.tpl
+++ b/chart/templates/_helpers.tpl
@@ -0,0 +1,64 @@
+{{/*
+Common labels
+*/}}
+{{- define "switchboard.labels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+{{- end }}
+
+{{/*
+Backend selector labels
+*/}}
+{{- define "switchboard.backend.labels" -}}
+app.kubernetes.io/component: backend
+{{ include "switchboard.labels" . }}
+{{- end }}
+
+{{/*
+Frontend selector labels
+*/}}
+{{- define "switchboard.frontend.labels" -}}
+app.kubernetes.io/component: frontend
+{{ include "switchboard.labels" . }}
+{{- end }}
+
+{{/*
+Secret name
+*/}}
+{{- define "switchboard.secretName" -}}
+{{- if .Values.existingSecret -}}
+{{ .Values.existingSecret }}
+{{- else -}}
+{{ .Release.Name }}-secrets
+{{- end -}}
+{{- end }}
+
+{{/*
+Backend image
+*/}}
+{{- define "switchboard.backend.image" -}}
+{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag | default .Chart.AppVersion }}
+{{- end }}
+
+{{/*
+Frontend image
+*/}}
+{{- define "switchboard.frontend.image" -}}
+{{ .Values.frontend.image.repository }}:{{ .Values.frontend.image.tag | default .Chart.AppVersion }}
+{{- end }}
+
+{{/*
+Database URL — assembled from postgres.* if url is empty
+*/}}
+{{- define "switchboard.databaseURL" -}}
+{{- if .Values.database.url -}}
+{{ .Values.database.url }}
+{{- else if eq .Values.database.driver "sqlite" -}}
+{{ .Values.database.sqlitePath }}
+{{- else -}}
+postgres://{{ .Values.database.postgres.user }}:$(POSTGRES_PASSWORD)@{{ .Values.database.postgres.host }}:{{ .Values.database.postgres.port }}/{{ .Values.database.postgres.database }}?sslmode={{ .Values.database.postgres.sslmode }}
+{{- end -}}
+{{- end }}
--- a/chart/templates/configmap.yaml
+++ b/chart/templates/configmap.yaml
@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-config
+  labels:
+    {{- include "switchboard.labels" . | nindent 4 }}
+data:
+  PORT: {{ .Values.backend.port | quote }}
+  BASE_PATH: {{ .Values.basePath | quote }}
+  ENVIRONMENT: {{ .Values.environment | quote }}
+  DB_DRIVER: {{ .Values.database.driver | quote }}
+  AUTH_MODE: {{ .Values.auth.mode | quote }}
+  STORAGE_BACKEND: {{ .Values.storage.backend | quote }}
+  STORAGE_PATH: {{ .Values.storage.path | quote }}
+  SESSION_EXPIRY_DAYS: {{ .Values.sessionExpiryDays | quote }}
+  WORKFLOW_STALE_HOURS: {{ .Values.workflowStaleHours | quote }}
+  PROVIDER_AUTO_DISABLE_THRESHOLD: {{ .Values.providerAutoDisableThreshold | quote }}
+  EXTRACTION_MODE: {{ .Values.extraction.mode | quote }}
+  EXTRACTION_CONCURRENCY: {{ .Values.extraction.concurrency | quote }}
+  WORKSPACE_INDEXING_ENABLED: {{ .Values.workspace.indexingEnabled | quote }}
+  WORKSPACE_INDEX_CONCURRENCY: {{ .Values.workspace.indexConcurrency | quote }}
+  CORS_ALLOWED_ORIGINS: {{ .Values.corsAllowedOrigins | quote }}
+  {{- if .Values.storage.s3.endpoint }}
+  S3_ENDPOINT: {{ .Values.storage.s3.endpoint | quote }}
+  S3_BUCKET: {{ .Values.storage.s3.bucket | quote }}
+  S3_REGION: {{ .Values.storage.s3.region | quote }}
+  S3_PREFIX: {{ .Values.storage.s3.prefix | quote }}
+  S3_FORCE_PATH_STYLE: {{ .Values.storage.s3.forcePathStyle | quote }}
+  {{- end }}
+  {{- if eq .Values.auth.mode "oidc" }}
+  OIDC_ISSUER_URL: {{ .Values.auth.oidc.issuerURL | quote }}
+  OIDC_EXTERNAL_ISSUER_URL: {{ .Values.auth.oidc.externalIssuerURL | quote }}
+  OIDC_CLIENT_ID: {{ .Values.auth.oidc.clientID | quote }}
+  OIDC_REDIRECT_URL: {{ .Values.auth.oidc.redirectURL | quote }}
+  OIDC_AUTO_ACTIVATE: {{ .Values.auth.oidc.autoActivate | quote }}
+  OIDC_DEFAULT_TEAM: {{ .Values.auth.oidc.defaultTeam | quote }}
+  OIDC_DEFAULT_ROLE: {{ .Values.auth.oidc.defaultRole | quote }}
+  OIDC_ROLES_CLAIM: {{ .Values.auth.oidc.rolesClaim | quote }}
+  OIDC_GROUPS_CLAIM: {{ .Values.auth.oidc.groupsClaim | quote }}
+  OIDC_ADMIN_ROLE: {{ .Values.auth.oidc.adminRole | quote }}
+  {{- end }}
+  {{- if eq .Values.auth.mode "mtls" }}
+  MTLS_HEADER_DN: {{ .Values.auth.mtls.headerDN | quote }}
+  MTLS_HEADER_VERIFY: {{ .Values.auth.mtls.headerVerify | quote }}
+  MTLS_HEADER_FINGERPRINT: {{ .Values.auth.mtls.headerFingerprint | quote }}
+  MTLS_AUTO_ACTIVATE: {{ .Values.auth.mtls.autoActivate | quote }}
+  MTLS_DEFAULT_TEAM: {{ .Values.auth.mtls.defaultTeam | quote }}
+  MTLS_DEFAULT_ROLE: {{ .Values.auth.mtls.defaultRole | quote }}
+  {{- end }}
--- a/chart/templates/deployment-backend.yaml
+++ b/chart/templates/deployment-backend.yaml
@@ -0,0 +1,65 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-backend
+  labels:
+    {{- include "switchboard.backend.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.backend.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Chart.Name }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: backend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Chart.Name }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: backend
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: backend
+          image: {{ include "switchboard.backend.image" . }}
+          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.backend.port }}
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: {{ .Release.Name }}-config
+            - secretRef:
+                name: {{ include "switchboard.secretName" . }}
+          env:
+            - name: DATABASE_URL
+              value: {{ include "switchboard.databaseURL" . | quote }}
+          resources:
+            {{- toYaml .Values.backend.resources | nindent 12 }}
+          {{- if .Values.persistence.enabled }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.basePath }}/api/v1/health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.basePath }}/api/v1/health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+      {{- if .Values.persistence.enabled }}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-data
+      {{- end }}
--- a/chart/templates/deployment-frontend.yaml
+++ b/chart/templates/deployment-frontend.yaml
@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-frontend
+  labels:
+    {{- include "switchboard.frontend.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.frontend.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Chart.Name }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: frontend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Chart.Name }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: frontend
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: frontend
+          image: {{ include "switchboard.frontend.image" . }}
+          imagePullPolicy: {{ .Values.frontend.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.frontend.port }}
+              protocol: TCP
+          env:
+            - name: BACKEND_URL
+              value: "http://{{ .Release.Name }}-backend:{{ .Values.backend.port }}"
+            - name: BASE_PATH
+              value: {{ .Values.basePath | quote }}
+          resources:
+            {{- toYaml .Values.frontend.resources | nindent 12 }}
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 10
--- a/chart/templates/ingress.yaml
+++ b/chart/templates/ingress.yaml
@@ -0,0 +1,51 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}-ingress
+  labels:
+    {{- include "switchboard.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host }}
+      {{- if .Values.ingress.tls.secretName }}
+      secretName: {{ .Values.ingress.tls.secretName }}
+      {{- end }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          # API + WebSocket → backend
+          - path: {{ .Values.basePath }}/api
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}-backend
+                port:
+                  number: {{ .Values.backend.port }}
+          - path: {{ .Values.basePath }}/ws
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}-backend
+                port:
+                  number: {{ .Values.backend.port }}
+          # Everything else → frontend (nginx serves static + proxies API)
+          - path: {{ .Values.basePath | default "/" }}
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}-frontend
+                port:
+                  number: {{ .Values.frontend.port }}
+{{- end }}
--- a/chart/templates/pvc.yaml
+++ b/chart/templates/pvc.yaml
@@ -0,0 +1,17 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-data
+  labels:
+    {{- include "switchboard.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode }}
+  {{- if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}
--- a/chart/templates/secret.yaml
+++ b/chart/templates/secret.yaml
@@ -0,0 +1,31 @@
+{{- if not .Values.existingSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-secrets
+  labels:
+    {{- include "switchboard.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  JWT_SECRET: {{ required "jwtSecret is required" .Values.jwtSecret | quote }}
+  {{- if .Values.encryptionKey }}
+  ENCRYPTION_KEY: {{ .Values.encryptionKey | quote }}
+  {{- end }}
+  {{- if .Values.database.postgres.password }}
+  POSTGRES_PASSWORD: {{ .Values.database.postgres.password | quote }}
+  {{- end }}
+  {{- if .Values.admin.password }}
+  SWITCHBOARD_ADMIN_USERNAME: {{ .Values.admin.username | quote }}
+  SWITCHBOARD_ADMIN_PASSWORD: {{ .Values.admin.password | quote }}
+  {{- end }}
+  {{- if .Values.admin.email }}
+  SWITCHBOARD_ADMIN_EMAIL: {{ .Values.admin.email | quote }}
+  {{- end }}
+  {{- if .Values.storage.s3.accessKey }}
+  S3_ACCESS_KEY: {{ .Values.storage.s3.accessKey | quote }}
+  S3_SECRET_KEY: {{ .Values.storage.s3.secretKey | quote }}
+  {{- end }}
+  {{- if and (eq .Values.auth.mode "oidc") .Values.auth.oidc.clientSecret }}
+  OIDC_CLIENT_SECRET: {{ .Values.auth.oidc.clientSecret | quote }}
+  {{- end }}
+{{- end }}
--- a/chart/templates/services.yaml
+++ b/chart/templates/services.yaml
@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-backend
+  labels:
+    {{- include "switchboard.backend.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.backend.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: {{ .Chart.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: backend
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-frontend
+  labels:
+    {{- include "switchboard.frontend.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.frontend.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: {{ .Chart.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: frontend
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -0,0 +1,135 @@
+# Chat Switchboard — Helm values
+# helm install switchboard ./chart
+
+# ── Images ─────────────────────────────────
+backend:
+  image:
+    repository: git.gobha.me/xcaliber/chat-switchboard
+    tag: ""  # defaults to Chart.appVersion
+    pullPolicy: IfNotPresent
+  replicaCount: 1
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
+  port: 8080
+
+frontend:
+  image:
+    repository: git.gobha.me/xcaliber/chat-switchboard-frontend
+    tag: ""  # defaults to Chart.appVersion
+    pullPolicy: IfNotPresent
+  replicaCount: 1
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 500m
+      memory: 256Mi
+  port: 80
+
+# ── Database ───────────────────────────────
+database:
+  # "postgres" or "sqlite"
+  driver: postgres
+  # For postgres: full DSN or assembled from postgres.* below
+  url: ""
+  postgres:
+    host: postgresql
+    port: 5432
+    user: switchboard
+    password: ""  # set via secret
+    database: switchboard
+    sslmode: disable
+  # For sqlite: path inside the container (requires persistence)
+  sqlitePath: /data/switchboard.db
+
+# ── Core ───────────────────────────────────
+basePath: ""  # URL prefix, e.g. "/dev"
+environment: production
+jwtSecret: ""  # REQUIRED — set via secret or --set
+encryptionKey: ""  # REQUIRED for BYOK — set via secret
+
+# ── Admin bootstrap ────────────────────────
+admin:
+  username: admin
+  password: ""  # set via secret
+  email: ""
+
+# ── Storage ────────────────────────────────
+storage:
+  backend: pvc  # "pvc" or "s3"
+  path: /data/storage
+  s3:
+    endpoint: ""
+    bucket: ""
+    region: us-east-1
+    accessKey: ""
+    secretKey: ""
+    prefix: ""
+    forcePathStyle: true
+
+# ── Persistence (PVC) ─────────────────────
+persistence:
+  enabled: true
+  storageClass: ""  # use cluster default
+  size: 10Gi
+  accessMode: ReadWriteOnce
+
+# ── Ingress ────────────────────────────────
+ingress:
+  enabled: true
+  className: traefik
+  annotations: {}
+  host: switchboard.local
+  tls:
+    enabled: false
+    secretName: ""
+
+# ── Auth ───────────────────────────────────
+auth:
+  mode: builtin  # builtin | mtls | oidc
+  oidc:
+    issuerURL: ""
+    externalIssuerURL: ""
+    clientID: ""
+    clientSecret: ""
+    redirectURL: ""
+    autoActivate: true
+    defaultTeam: ""
+    defaultRole: user
+    rolesClaim: "realm_access.roles"
+    groupsClaim: groups
+    adminRole: admin
+  mtls:
+    headerDN: X-SSL-Client-DN
+    headerVerify: X-SSL-Client-Verify
+    headerFingerprint: X-SSL-Client-Fingerprint
+    autoActivate: true
+    defaultTeam: ""
+    defaultRole: user
+
+# ── Tuning ─────────────────────────────────
+sessionExpiryDays: 30
+workflowStaleHours: 72
+providerAutoDisableThreshold: 3
+extraction:
+  mode: inline
+  concurrency: 3
+workspace:
+  indexingEnabled: true
+  indexConcurrency: 2
+
+# ── CORS ───────────────────────────────────
+corsAllowedOrigins: "*"
+
+# ── Existing secret reference ──────────────
+# If set, skips creating a Secret and mounts this one instead.
+existingSecret: ""
+
+# ── Image pull secrets ─────────────────────
+imagePullSecrets: []