Trek_CN/chart/README.md

# TREK Helm Chart

This is a minimal Helm chart for deploying the TREK app.

## Features
- Deploys the TREK container
- Exposes port 3000 via Service
- Optional persistent storage for `/app/data` and `/app/uploads`
- Configurable environment variables and secrets
- Optional generic Ingress support
- Health checks on `/api/health`

## Usage

```sh
helm install trek ./chart \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host=yourdomain.com
```

See `values.yaml` for more options.

## Files
- `Chart.yaml` — chart metadata
- `values.yaml` — configuration values
- `templates/` — Kubernetes manifests

## Notes
- Ingress is off by default. Enable and configure hosts for your domain.
- PVCs require a default StorageClass or specify one as needed.
- `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
- `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via `secretEnv.ENCRYPTION_KEY` or `existingSecret`. If left empty, the server falls back automatically: existing installs use `data/.jwt_secret` (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
- If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
- Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.
feat: add Helm chart for Kubernetes deployment — thanks @another-novelty * feat: Add basic helm chart * Delete chart/my-values.yaml 2026-03-30 05:44:20 +08:00			`# TREK Helm Chart`

			`This is a minimal Helm chart for deploying the TREK app.`

			`## Features`
			`- Deploys the TREK container`
			`- Exposes port 3000 via Service`
			- Optional persistent storage for `/app/data` and `/app/uploads`
			`- Configurable environment variables and secrets`
			`- Optional generic Ingress support`
			- Health checks on `/api/health`

			`## Usage`

			```sh
			`helm install trek ./chart \`
			`--set ingress.enabled=true \`
			`--set ingress.hosts[0].host=yourdomain.com`
			```

			See `values.yaml` for more options.

			`## Files`
			- `Chart.yaml` — chart metadata
			- `values.yaml` — configuration values
			- `templates/` — Kubernetes manifests

			`## Notes`
			`- Ingress is off by default. Enable and configure hosts for your domain.`
			`- PVCs require a default StorageClass or specify one as needed.`
fix: remove JWT_SECRET env var — server manages it exclusively Setting JWT_SECRET via environment variable was broken by design: the admin panel rotation updates the in-memory binding and persists the new value to data/.jwt_secret, but an env var would silently override it on the next restart, reverting the rotation. The server now always loads JWT_SECRET from data/.jwt_secret (auto-generating it on first start), making the file the single source of truth. Rotation is handled exclusively through the admin panel. - config.ts: drop process.env.JWT_SECRET fallback and JWT_SECRET_IS_GENERATED export; always read from / write to data/.jwt_secret - index.ts: remove the now-obsolete JWT_SECRET startup warning - .env.example, docker-compose.yml, README: remove JWT_SECRET entries - Helm chart: remove JWT_SECRET from secretEnv, secret.yaml, and deployment.yaml; rename generateJwtSecret → generateEncryptionKey and update NOTES.txt and README accordingly 2026-04-01 12:38:38 +08:00			- `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
chore(helm): update ENCRYPTION_KEY docs to reflect automatic fallback Existing installs no longer need to manually set ENCRYPTION_KEY to their old JWT secret on upgrade — the server falls back to data/.jwt_secret automatically. Update values.yaml, NOTES.txt, and chart README accordingly. 2026-04-01 15:49:57 +08:00			- `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via `secretEnv.ENCRYPTION_KEY` or `existingSecret`. If left empty, the server falls back automatically: existing installs use `data/.jwt_secret` (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
feat: add Helm chart for Kubernetes deployment — thanks @another-novelty * feat: Add basic helm chart * Delete chart/my-values.yaml 2026-03-30 05:44:20 +08:00			- If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
fix: add SSRF protection for link preview and Immich URL - Create server/src/utils/ssrfGuard.ts with checkSsrf() and createPinnedAgent() - Resolves DNS before allowing outbound requests to catch hostnames that map to private IPs (closes the TOCTOU gap in the old inline checks) - Always blocks loopback (127.x, ::1) and link-local/metadata (169.254.x) - RFC-1918, CGNAT (100.64/10), and IPv6 ULA ranges blocked by default; opt-in via ALLOW_INTERNAL_NETWORK=true for self-hosters running Immich on a local network - createPinnedAgent() pins node-fetch to the validated IP, preventing DNS rebinding between the check and the actual connection - Replace isValidImmichUrl() (hostname-string check, no DNS resolution) with checkSsrf(); make PUT /integrations/immich/settings async - Audit log entry (immich.private_ip_configured) written when a user saves an Immich URL that resolves to a private IP - Response includes a warning field surfaced as a toast in the UI - Replace ~20 lines of duplicated inline SSRF logic in the link-preview handler with a single checkSsrf() call + pinned agent - Document ALLOW_INTERNAL_NETWORK in README, docker-compose.yml, server/.env.example, chart/values.yaml, chart/templates/configmap.yaml, and chart/README.md 2026-04-01 13:53:46 +08:00			- Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.