Quick start

The chart installs a CloudNativePG operator. If your cluster already runs one, see the overview.

Every release publishes the chart, with its dependencies, to oci://ghcr.io/relicbuild/charts/relic. Its version is the release's without the v, and it runs that release's image.

The chart needs Helm 3.17.0 or later. Older versions stop with function "fromToml" not defined in the SeaweedFS chart.

Create the encryption key, which seals the secrets Relic stores. Keep a copy apart from your backups.

export RELIC_ENCRYPTION_KEY="$(openssl rand -base64 32)"

Create the password of the first admin:

export RELIC_ADMIN_PASSWORD="$(openssl rand -base64 18)"

Install Relic into the relic namespace:

helm install relic oci://ghcr.io/relicbuild/charts/relic --version 0.2.0-beta.4 -n relic --create-namespace --set credentials.encryptionKey="$RELIC_ENCRYPTION_KEY" --set credentials.adminPassword="$RELIC_ADMIN_PASSWORD"

The server pods restart until PostgreSQL accepts connections. Check the PostgreSQL cluster:

kubectl -n relic get cluster relic-cluster

Check the pods:

kubectl -n relic get pods

Without an ingress, forward a local port to the Service:

kubectl -n relic port-forward svc/relic 8090:443

Open https://localhost:8090 and sign in as admin. Then sign in with the relic CLI.

By default each pod generates its own certificate authority, so browsers warn and the CLI asks whether to trust it. For a verifiable certificate, set tls.existingSecret (The server's certificate).

Names

Relic's objects are named <release>-relic, or <release> when the release name contains relic, as above. The services the chart runs are named after their charts:

• The PostgreSQL cluster: <release>-cluster, with its database credentials in the Secret <release>-cluster-app
• SeaweedFS: <release>-seaweedfs

What the chart sets up

• It refuses to render without credentials.encryptionKey and credentials.adminPassword, or existingCredentialsSecret. On helm upgrade it reads them back from its Secret if the values omit them.
• It keeps that Secret when you uninstall.
• It reads the database URI from <release>-cluster-app and the S3 keys from <release>-seaweedfs-s3-secret.
• The temporary bucket has no TTL. The worker deletes objects older than a day there, but not incomplete multipart uploads. A bucket TTL removes those.

Small or test cluster

These values run one small PostgreSQL instance and one server replica:

server:
  replicas: 1
cluster:
  cluster:
    instances: 1
    storage:
      size: 2Gi

Install with them saved as small.yaml:

helm install relic oci://ghcr.io/relicbuild/charts/relic --version 0.2.0-beta.4 -n relic --create-namespace -f small.yaml --set credentials.encryptionKey="$RELIC_ENCRYPTION_KEY" --set credentials.adminPassword="$RELIC_ADMIN_PASSWORD"

Single node

These values run one pod on SQLite and a volume:

database:
  engine: sqlite
objectStorage:
  type: filesystem
cluster:
  enabled: false
cloudnative-pg:
  enabled: false
seaweedfs:
  enabled: false
server:
  replicas: 1
data:
  size: 50Gi

The pod runs relic server start --worker on the ReadWriteOnce volume <release>-relic-data, which also holds the certificate authority and is kept on uninstall. The chart refuses more replicas and autoscaling. Limits and backups apply.