Trek_CN/chart/README.md

# TREK Helm Chart

This is a minimal Helm chart for deploying the TREK app.

## Features
- Deploys the TREK container
- Exposes port 3000 via Service
- Optional persistent storage for `/app/data` and `/app/uploads`
- Configurable environment variables and secrets
- Optional generic Ingress support
- Health checks on `/api/health`

## Usage

```sh
helm install trek ./chart \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host=yourdomain.com
```

See `values.yaml` for more options.

## Files
- `Chart.yaml` — chart metadata
- `values.yaml` — configuration values
- `templates/` — Kubernetes manifests

## Notes
- Ingress is off by default. Enable and configure hosts for your domain.
- PVCs require a default StorageClass or specify one as needed.
- `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
- `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Auto-generated and persisted to the data PVC if not provided. **Upgrading:** if a previous version used `JWT_SECRET`-derived encryption, set `secretEnv.ENCRYPTION_KEY` to your old `JWT_SECRET` value to keep existing encrypted data readable, then re-save credentials via the admin panel.
- If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
- Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.
feat: add Helm chart for Kubernetes deployment — thanks @another-novelty * feat: Add basic helm chart * Delete chart/my-values.yaml 2026-03-30 05:44:20 +08:00			`# TREK Helm Chart`

			`This is a minimal Helm chart for deploying the TREK app.`

			`## Features`
			`- Deploys the TREK container`
			`- Exposes port 3000 via Service`
			- Optional persistent storage for `/app/data` and `/app/uploads`
			`- Configurable environment variables and secrets`
			`- Optional generic Ingress support`
			- Health checks on `/api/health`

			`## Usage`

			```sh
			`helm install trek ./chart \`
			`--set ingress.enabled=true \`
			`--set ingress.hosts[0].host=yourdomain.com`
			```

			See `values.yaml` for more options.

			`## Files`
			- `Chart.yaml` — chart metadata
			- `values.yaml` — configuration values
			- `templates/` — Kubernetes manifests

			`## Notes`
			`- Ingress is off by default. Enable and configure hosts for your domain.`
			`- PVCs require a default StorageClass or specify one as needed.`
fix: remove JWT_SECRET env var — server manages it exclusively Setting JWT_SECRET via environment variable was broken by design: the admin panel rotation updates the in-memory binding and persists the new value to data/.jwt_secret, but an env var would silently override it on the next restart, reverting the rotation. The server now always loads JWT_SECRET from data/.jwt_secret (auto-generating it on first start), making the file the single source of truth. Rotation is handled exclusively through the admin panel. - config.ts: drop process.env.JWT_SECRET fallback and JWT_SECRET_IS_GENERATED export; always read from / write to data/.jwt_secret - index.ts: remove the now-obsolete JWT_SECRET startup warning - .env.example, docker-compose.yml, README: remove JWT_SECRET entries - Helm chart: remove JWT_SECRET from secretEnv, secret.yaml, and deployment.yaml; rename generateJwtSecret → generateEncryptionKey and update NOTES.txt and README accordingly 2026-04-01 12:38:38 +08:00			- `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
fix: decouple at-rest encryption from JWT_SECRET, add JWT rotation Introduces a dedicated ENCRYPTION_KEY for encrypting stored secrets (API keys, MFA TOTP, SMTP password, OIDC client secret) so that rotating the JWT signing secret no longer invalidates encrypted data, and a compromised JWT_SECRET no longer exposes stored credentials. - server/src/config.ts: add ENCRYPTION_KEY (auto-generated to data/.encryption_key if not set, same pattern as JWT_SECRET); switch JWT_SECRET to `export let` so updateJwtSecret() keeps the CJS module binding live for all importers without restart - apiKeyCrypto.ts, mfaCrypto.ts: derive encryption keys from ENCRYPTION_KEY instead of JWT_SECRET - admin POST /rotate-jwt-secret: generates a new 32-byte hex secret, persists it to data/.jwt_secret, updates the live in-process binding via updateJwtSecret(), and writes an audit log entry - Admin panel (Settings → Danger Zone): "Rotate JWT Secret" button with a confirmation modal warning that all sessions will be invalidated; on success the acting admin is logged out immediately - docker-compose.yml, .env.example, README, Helm chart (values.yaml, secret.yaml, deployment.yaml, NOTES.txt, README): document ENCRYPTION_KEY and its upgrade migration path 2026-04-01 12:31:45 +08:00			- `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Auto-generated and persisted to the data PVC if not provided. Upgrading: if a previous version used `JWT_SECRET`-derived encryption, set `secretEnv.ENCRYPTION_KEY` to your old `JWT_SECRET` value to keep existing encrypted data readable, then re-save credentials via the admin panel.
feat: add Helm chart for Kubernetes deployment — thanks @another-novelty * feat: Add basic helm chart * Delete chart/my-values.yaml 2026-03-30 05:44:20 +08:00			- If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
fix: add SSRF protection for link preview and Immich URL - Create server/src/utils/ssrfGuard.ts with checkSsrf() and createPinnedAgent() - Resolves DNS before allowing outbound requests to catch hostnames that map to private IPs (closes the TOCTOU gap in the old inline checks) - Always blocks loopback (127.x, ::1) and link-local/metadata (169.254.x) - RFC-1918, CGNAT (100.64/10), and IPv6 ULA ranges blocked by default; opt-in via ALLOW_INTERNAL_NETWORK=true for self-hosters running Immich on a local network - createPinnedAgent() pins node-fetch to the validated IP, preventing DNS rebinding between the check and the actual connection - Replace isValidImmichUrl() (hostname-string check, no DNS resolution) with checkSsrf(); make PUT /integrations/immich/settings async - Audit log entry (immich.private_ip_configured) written when a user saves an Immich URL that resolves to a private IP - Response includes a warning field surfaced as a toast in the UI - Replace ~20 lines of duplicated inline SSRF logic in the link-preview handler with a single checkSsrf() call + pinned agent - Document ALLOW_INTERNAL_NETWORK in README, docker-compose.yml, server/.env.example, chart/values.yaml, chart/templates/configmap.yaml, and chart/README.md 2026-04-01 13:53:46 +08:00			- Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.