Add cloudhost-platform Helm chart and registry ingress manifests.

Deploy backend, frontend, PostgreSQL, and Redis on Kubernetes with optional Ingress/TLS, SQL migration hooks, and public registry exposure at repo.3fase.ir.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/NOTES.txt

@@ -0,0 +1,37 @@
+CloudHost platform has been deployed.
+
+Release: {{ .Release.Name }}
+Namespace: {{ include "cloudhost-platform.namespace" . }}
+
+{{- if .Values.ingress.enabled }}
+
+Public URLs (configure DNS to point at your Ingress controller):
+  Frontend: {{ include "cloudhost-platform.frontendPublicUrl" . }}
+  API:      {{ include "cloudhost-platform.apiPublicUrl" . }}
+
+Build the frontend image with:
+  docker build -t <registry>/cloudhost-frontend:<tag> \
+    --build-arg NEXT_PUBLIC_API_URL={{ include "cloudhost-platform.apiPublicUrl" . }} \
+    ./frontend
+
+{{- if .Values.ingress.tls.enabled }}
+TLS: enabled (cert-manager issuer: {{ .Values.ingress.tls.clusterIssuer }})
+Ensure cert-manager and ClusterIssuer "{{ .Values.ingress.tls.clusterIssuer }}" exist.
+{{- else }}
+TLS: disabled (HTTP only)
+{{- end }}
+
+{{- else }}
+
+Ingress is disabled. Port-forward to access services:
+  kubectl port-forward -n {{ include "cloudhost-platform.namespace" . }} svc/{{ include "cloudhost-platform.frontend.fullname" . }} 3000:3000
+  kubectl port-forward -n {{ include "cloudhost-platform.namespace" . }} svc/{{ include "cloudhost-platform.backend.fullname" . }} 4000:4000
+
+{{- end }}
+
+Backend CORS (FRONTEND_URL): {{ include "cloudhost-platform.frontendPublicUrl" . }}
+
+After install, register your Kubernetes cluster in the admin panel (Clusters) so deployments can run.
+
+To retrieve auto-generated secrets:
+  kubectl get secret -n {{ include "cloudhost-platform.namespace" . }} {{ include "cloudhost-platform.secretName" . }} -o jsonpath='{.data.postgres-password}' | base64 -d; echo

backend/helm/cloudhost-platform/templates/_helpers.tpl

@@ -0,0 +1,96 @@
+{{- define "cloudhost-platform.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "cloudhost-platform.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{- define "cloudhost-platform.namespace" -}}
+{{- .Values.namespace | default "cloudhost" }}
+{{- end }}
+
+{{- define "cloudhost-platform.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
+{{- end }}
+
+{{- define "cloudhost-platform.labels" -}}
+helm.sh/chart: {{ include "cloudhost-platform.chart" . }}
+{{ include "cloudhost-platform.selectorLabels" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{- define "cloudhost-platform.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cloudhost-platform.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{- define "cloudhost-platform.postgres.fullname" -}}
+{{- printf "%s-postgres" (include "cloudhost-platform.fullname" .) }}
+{{- end }}
+
+{{- define "cloudhost-platform.redis.fullname" -}}
+{{- printf "%s-redis" (include "cloudhost-platform.fullname" .) }}
+{{- end }}
+
+{{- define "cloudhost-platform.backend.fullname" -}}
+{{- printf "%s-backend" (include "cloudhost-platform.fullname" .) }}
+{{- end }}
+
+{{- define "cloudhost-platform.frontend.fullname" -}}
+{{- printf "%s-frontend" (include "cloudhost-platform.fullname" .) }}
+{{- end }}
+
+{{- define "cloudhost-platform.secretName" -}}
+{{- printf "%s-secrets" (include "cloudhost-platform.fullname" .) }}
+{{- end }}
+
+{{- define "cloudhost-platform.tlsSecretName" -}}
+{{- if .Values.ingress.tls.secretName }}
+{{- .Values.ingress.tls.secretName }}
+{{- else }}
+{{- printf "%s-platform-tls" (include "cloudhost-platform.fullname" .) }}
+{{- end }}
+{{- end }}
+
+{{- define "cloudhost-platform.urlScheme" -}}
+{{- if and .Values.ingress.enabled .Values.ingress.tls.enabled }}https{{- else }}http{{- end }}
+{{- end }}
+
+{{- define "cloudhost-platform.frontendPublicUrl" -}}
+{{- $scheme := include "cloudhost-platform.urlScheme" . -}}
+{{- if .Values.ingress.enabled }}
+{{- if .Values.ingress.singleHost.enabled }}
+{{- printf "%s://%s" $scheme .Values.ingress.singleHost.host }}
+{{- else }}
+{{- printf "%s://%s" $scheme .Values.ingress.frontend.host }}
+{{- end }}
+{{- else }}
+{{- printf "http://%s-frontend.%s.svc.cluster.local:3000" (include "cloudhost-platform.fullname" .) (include "cloudhost-platform.namespace" .) }}
+{{- end }}
+{{- end }}
+
+{{- define "cloudhost-platform.apiPublicUrl" -}}
+{{- $scheme := include "cloudhost-platform.urlScheme" . -}}
+{{- if .Values.ingress.enabled }}
+{{- if .Values.ingress.singleHost.enabled }}
+{{- printf "%s://%s%s" $scheme .Values.ingress.singleHost.host .Values.ingress.singleHost.apiPath }}
+{{- else }}
+{{- printf "%s://%s" $scheme .Values.ingress.api.host }}
+{{- end }}
+{{- else }}
+{{- printf "http://%s-backend.%s.svc.cluster.local:4000" (include "cloudhost-platform.fullname" .) (include "cloudhost-platform.namespace" .) }}
+{{- end }}
+{{- end }}
+
+{{- define "cloudhost-platform.backendImage" -}}
+{{- printf "%s:%s" .Values.images.backend.repository .Values.images.backend.tag }}
+{{- end }}
+
+{{- define "cloudhost-platform.frontendImage" -}}
+{{- printf "%s:%s" .Values.images.frontend.repository .Values.images.frontend.tag }}
+{{- end }}

backend/helm/cloudhost-platform/templates/backend-deployment.yaml

@@ -0,0 +1,116 @@
+{{- if .Values.backend.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cloudhost-platform.backend.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.backend.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.backend.replicas }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: {{ include "cloudhost-platform.backend.fullname" . }}
+  template:
+    metadata:
+      labels:
+        app: {{ include "cloudhost-platform.backend.fullname" . }}
+    spec:
+      initContainers:
+        {{- if .Values.postgres.enabled }}
+        - name: wait-postgres
+          image: {{ .Values.images.busybox | quote }}
+          command:
+            - sh
+            - -c
+            - |
+              until nc -z {{ include "cloudhost-platform.postgres.fullname" . }} 5432; do
+                echo "waiting for postgres..."
+                sleep 2
+              done
+        {{- end }}
+        {{- if .Values.redis.enabled }}
+        - name: wait-redis
+          image: {{ .Values.images.busybox | quote }}
+          command:
+            - sh
+            - -c
+            - |
+              until nc -z {{ include "cloudhost-platform.redis.fullname" . }} 6379; do
+                echo "waiting for redis..."
+                sleep 2
+              done
+        {{- end }}
+      containers:
+        - name: backend
+          image: {{ include "cloudhost-platform.backendImage" . | quote }}
+          imagePullPolicy: {{ .Values.images.backend.pullPolicy }}
+          ports:
+            - containerPort: 4000
+          env:
+            - name: DB_HOST
+              value: {{ include "cloudhost-platform.postgres.fullname" . }}
+            - name: DB_PORT
+              value: "5432"
+            - name: DB_USERNAME
+              value: {{ .Values.postgres.username | quote }}
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: postgres-password
+            - name: DB_DATABASE
+              value: {{ .Values.postgres.database | quote }}
+            - name: REDIS_HOST
+              value: {{ include "cloudhost-platform.redis.fullname" . }}
+            - name: REDIS_PORT
+              value: "6379"
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: jwt-secret
+            - name: JWT_REFRESH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: jwt-refresh-secret
+            - name: FRONTEND_URL
+              value: {{ include "cloudhost-platform.frontendPublicUrl" . | quote }}
+            {{- range $key, $val := .Values.backend.env }}
+            - name: {{ $key }}
+              value: {{ $val | quote }}
+            {{- end }}
+            {{- range $key, $val := .Values.backend.extraEnv }}
+            - name: {{ $key }}
+              value: {{ $val | quote }}
+            {{- end }}
+          volumeMounts:
+            - name: uploads
+              mountPath: /app/uploads
+          livenessProbe:
+            httpGet:
+              path: /api/docs
+              port: 4000
+            initialDelaySeconds: 60
+            periodSeconds: 15
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /api/docs
+              port: 4000
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+          {{- with .Values.backend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: uploads
+          persistentVolumeClaim:
+            claimName: {{ include "cloudhost-platform.backend.fullname" . }}-uploads
+{{- end }}

backend/helm/cloudhost-platform/templates/backend-pvc.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.backend.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "cloudhost-platform.backend.fullname" . }}-uploads
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.backend.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- if .Values.global.storageClass }}
+  storageClassName: {{ .Values.global.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.backend.uploads.size | quote }}
+{{- end }}

backend/helm/cloudhost-platform/templates/backend-service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.backend.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "cloudhost-platform.backend.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.backend.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ include "cloudhost-platform.backend.fullname" . }}
+  ports:
+    - name: http
+      port: 4000
+      targetPort: 4000
+{{- end }}

backend/helm/cloudhost-platform/templates/frontend-deployment.yaml

@@ -0,0 +1,47 @@
+{{- if .Values.frontend.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cloudhost-platform.frontend.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.frontend.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.frontend.replicas }}
+  selector:
+    matchLabels:
+      app: {{ include "cloudhost-platform.frontend.fullname" . }}
+  template:
+    metadata:
+      labels:
+        app: {{ include "cloudhost-platform.frontend.fullname" . }}
+    spec:
+      containers:
+        - name: frontend
+          image: {{ include "cloudhost-platform.frontendImage" . | quote }}
+          imagePullPolicy: {{ .Values.images.frontend.pullPolicy }}
+          ports:
+            - containerPort: 3000
+          env:
+            - name: PORT
+              value: "3000"
+            - name: HOSTNAME
+              value: "0.0.0.0"
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          {{- with .Values.frontend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+{{- end }}

backend/helm/cloudhost-platform/templates/frontend-service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.frontend.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "cloudhost-platform.frontend.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.frontend.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ include "cloudhost-platform.frontend.fullname" . }}
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+{{- end }}

backend/helm/cloudhost-platform/templates/ingress.yaml

@@ -0,0 +1,73 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "cloudhost-platform.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+  annotations:
+    {{- if .Values.ingress.tls.enabled }}
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.tls.clusterIssuer | quote }}
+    {{- end }}
+    {{- if and .Values.ingress.singleHost.enabled .Values.ingress.singleHost.apiPath }}
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    {{- end }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    - hosts:
+        {{- if .Values.ingress.singleHost.enabled }}
+        - {{ .Values.ingress.singleHost.host | quote }}
+        {{- else }}
+        - {{ .Values.ingress.frontend.host | quote }}
+        - {{ .Values.ingress.api.host | quote }}
+        {{- end }}
+      secretName: {{ include "cloudhost-platform.tlsSecretName" . }}
+  {{- end }}
+  rules:
+    {{- if .Values.ingress.singleHost.enabled }}
+    - host: {{ .Values.ingress.singleHost.host | quote }}
+      http:
+        paths:
+          - path: {{ .Values.ingress.singleHost.apiPath }}
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "cloudhost-platform.backend.fullname" . }}
+                port:
+                  number: 4000
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "cloudhost-platform.frontend.fullname" . }}
+                port:
+                  number: 3000
+    {{- else }}
+    - host: {{ .Values.ingress.frontend.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "cloudhost-platform.frontend.fullname" . }}
+                port:
+                  number: 3000
+    - host: {{ .Values.ingress.api.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "cloudhost-platform.backend.fullname" . }}
+                port:
+                  number: 4000
+    {{- end }}
+{{- end }}

backend/helm/cloudhost-platform/templates/migrations-configmap.yaml

@@ -0,0 +1,11 @@
+{{- if and .Values.migrations.enabled .Values.postgres.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "cloudhost-platform.fullname" . }}-migrations
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+data:
+{{- (.Files.Glob "migrations/*.sql").AsConfig | nindent 2 }}
+{{- end }}

backend/helm/cloudhost-platform/templates/migrations-job.yaml

@@ -0,0 +1,62 @@
+{{- if and .Values.migrations.enabled .Values.postgres.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "cloudhost-platform.fullname" . }}-migrations
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "5"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      restartPolicy: OnFailure
+      initContainers:
+        - name: wait-postgres
+          image: {{ .Values.images.busybox | quote }}
+          command:
+            - sh
+            - -c
+            - |
+              until nc -z {{ include "cloudhost-platform.postgres.fullname" . }} 5432; do
+                sleep 2
+              done
+      containers:
+        - name: migrate
+          image: {{ .Values.migrations.image | quote }}
+          env:
+            - name: PGHOST
+              value: {{ include "cloudhost-platform.postgres.fullname" . }}
+            - name: PGPORT
+              value: "5432"
+            - name: PGDATABASE
+              value: {{ .Values.postgres.database | quote }}
+            - name: PGUSER
+              value: {{ .Values.postgres.username | quote }}
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: postgres-password
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              for f in $(ls /migrations/*.sql | sort); do
+                echo ">>> Applying $f"
+                psql -v ON_ERROR_STOP=1 -f "$f"
+              done
+              echo ">>> All migrations applied"
+          volumeMounts:
+            - name: migrations
+              mountPath: /migrations
+      volumes:
+        - name: migrations
+          configMap:
+            name: {{ include "cloudhost-platform.fullname" . }}-migrations
+{{- end }}

backend/helm/cloudhost-platform/templates/namespace.yaml

@@ -0,0 +1,8 @@
+{{- if .Values.createNamespace }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+{{- end }}

backend/helm/cloudhost-platform/templates/postgres-deployment.yaml

@@ -0,0 +1,66 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cloudhost-platform.postgres.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.postgres.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: {{ include "cloudhost-platform.postgres.fullname" . }}
+  template:
+    metadata:
+      labels:
+        app: {{ include "cloudhost-platform.postgres.fullname" . }}
+    spec:
+      containers:
+        - name: postgres
+          image: {{ .Values.images.postgres | quote }}
+          ports:
+            - containerPort: 5432
+          env:
+            - name: POSTGRES_DB
+              value: {{ .Values.postgres.database | quote }}
+            - name: POSTGRES_USER
+              value: {{ .Values.postgres.username | quote }}
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cloudhost-platform.secretName" . }}
+                  key: postgres-password
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          livenessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - {{ .Values.postgres.username }}
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - {{ .Values.postgres.username }}
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          {{- with .Values.postgres.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "cloudhost-platform.postgres.fullname" . }}-data
+{{- end }}

backend/helm/cloudhost-platform/templates/postgres-pvc.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "cloudhost-platform.postgres.fullname" . }}-data
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.postgres.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- if .Values.global.storageClass }}
+  storageClassName: {{ .Values.global.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.postgres.storage | quote }}
+{{- end }}

backend/helm/cloudhost-platform/templates/postgres-service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "cloudhost-platform.postgres.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.postgres.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ include "cloudhost-platform.postgres.fullname" . }}
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
+{{- end }}

backend/helm/cloudhost-platform/templates/redis-deployment.yaml

@@ -0,0 +1,52 @@
+{{- if .Values.redis.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "cloudhost-platform.redis.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.redis.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: {{ include "cloudhost-platform.redis.fullname" . }}
+  template:
+    metadata:
+      labels:
+        app: {{ include "cloudhost-platform.redis.fullname" . }}
+    spec:
+      containers:
+        - name: redis
+          image: {{ .Values.images.redis | quote }}
+          ports:
+            - containerPort: 6379
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          {{- with .Values.redis.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "cloudhost-platform.redis.fullname" . }}-data
+{{- end }}

backend/helm/cloudhost-platform/templates/redis-pvc.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.redis.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "cloudhost-platform.redis.fullname" . }}-data
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.redis.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  {{- if .Values.global.storageClass }}
+  storageClassName: {{ .Values.global.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.redis.storage | quote }}
+{{- end }}

backend/helm/cloudhost-platform/templates/redis-service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.redis.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "cloudhost-platform.redis.fullname" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    app: {{ include "cloudhost-platform.redis.fullname" . }}
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ include "cloudhost-platform.redis.fullname" . }}
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: 6379
+{{- end }}

backend/helm/cloudhost-platform/templates/secret.yaml

@@ -0,0 +1,25 @@
+{{- $existing := lookup "v1" "Secret" (include "cloudhost-platform.namespace" .) (include "cloudhost-platform.secretName" .) }}
+{{- $pgPass := .Values.postgres.password }}
+{{- if not $pgPass }}
+{{- if $existing }}{{- $pgPass = index $existing.data "postgres-password" | b64dec }}{{- else }}{{- $pgPass = randAlphaNum 24 }}{{- end }}
+{{- end }}
+{{- $jwt := .Values.secrets.jwtSecret }}
+{{- if not $jwt }}
+{{- if $existing }}{{- $jwt = index $existing.data "jwt-secret" | b64dec }}{{- else }}{{- $jwt = randAlphaNum 32 }}{{- end }}
+{{- end }}
+{{- $jwtRefresh := .Values.secrets.jwtRefreshSecret }}
+{{- if not $jwtRefresh }}
+{{- if $existing }}{{- $jwtRefresh = index $existing.data "jwt-refresh-secret" | b64dec }}{{- else }}{{- $jwtRefresh = randAlphaNum 32 }}{{- end }}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "cloudhost-platform.secretName" . }}
+  namespace: {{ include "cloudhost-platform.namespace" . }}
+  labels:
+    {{- include "cloudhost-platform.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  postgres-password: {{ $pgPass | quote }}
+  jwt-secret: {{ $jwt | quote }}
+  jwt-refresh-secret: {{ $jwtRefresh | quote }}