Kubernetes with Helm

The official Helm chart runs the PostQueen image on a cluster you already operate. It is published as an OCI artifact on the GitHub Container Registry. If you do not run Kubernetes already, Docker Compose is the supported path and much less work.

What the chart deploys


Chart	`oci://ghcr.io/gkhankinay/postqueen-helmchart/charts/postqueen-app`, version 1.1.6
App	One pod with the PostQueen image (web app, API and workers), container port 5000, behind a Service on port 80
Settings	`env` becomes a ConfigMap and `secrets` a Secret. Every key in either becomes an environment variable in the app.
Databases	Bitnami PostgreSQL and Redis subcharts, on by default, with their images from `bitnamilegacy/` on Docker Hub. Turn either off to use your own.
Ingress	Optional, off by default
Temporal	Not included. You point the app at your own Temporal server.

Bring a Temporal server. PostQueen schedules and publishes through Temporal. Install it with Temporal’s Helm charts or use Temporal Cloud, and set env.TEMPORAL_ADDRESS to its host:port. Without it the web app loads, and no post is ever published.

You also need Helm 3, kubectl for the cluster, and an ingress controller with TLS for a public install: the networks send their sign-in callbacks to an https address.

Install

Write my-values.yaml

my-values.yaml

image:
  tag: "vX.Y.Z"   # a release tag, with its v

env:
  MAIN_URL: "https://postqueen.example.com"
  FRONTEND_URL: "https://postqueen.example.com"
  NEXT_PUBLIC_BACKEND_URL: "https://postqueen.example.com/api"
  TEMPORAL_ADDRESS: "temporal-frontend.temporal.svc.cluster.local:7233"
  RUN_CRON: "true"

secrets:
  JWT_SECRET: "generate-with-openssl-rand-hex-32"
  ENCRYPTION_KEY: "generate-another-one"
  DATABASE_URL: "postgresql://postqueen:postqueen-password@postqueen-postgresql:5432/postqueen"
  REDIS_URL: "redis://:postqueen-redis-password@postqueen-redis-master:6379"

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: postqueen.example.com
      paths:
        - path: /
          pathType: Prefix
          port: 80
  tls:
    - secretName: postqueen-tls
      hosts:
        - postqueen.example.com

image.tag: take the newest tag from the app’s tags. The chart’s default is latest, which moves. Its appVersion names the release current when the chart was published (v3.6.84 in chart 1.1.6).
RUN_CRON: the chart does not set it. Without it the recurring workflows never start, so posts that failed to schedule are never picked up again and analytics do not sync.
The connection strings: the app reads only secrets.DATABASE_URL and secrets.REDIS_URL. The chart does not derive them from the subcharts. The values above match a release named postqueen with the bundled databases and their default passwords.
Chart 1.1.4 and newer set STORAGE_PROVIDER to local, UPLOAD_DIRECTORY to /uploads, NEXT_PUBLIC_UPLOAD_STATIC_DIRECTORY to uploads and IS_GENERAL to true.

Install the release

helm install postqueen \
  oci://ghcr.io/gkhankinay/postqueen-helmchart/charts/postqueen-app \
  --version 1.1.6 \
  -f my-values.yaml

There is no helm repo add step. The chart’s name is postqueen-app, although it lives in charts/postqueen in its repository. Flux and Argo CD take the same reference in OCI mode.

Check it

kubectl get pods
kubectl logs deploy/postqueen-postqueen-app | grep -iE "started successfully|configuration issue"

Backend started successfully on port 3000, and no Configuration issue lines.

Every variable is described in Configuration reference. Network keys go under secrets in the same way, for example LINKEDIN_CLIENT_ID.

Apply a change

The chart hands env and secrets to the pod through a ConfigMap and a Secret, and a pod reads them only when it starts. After helm upgrade with changed values, restart the pod:

kubectl rollout restart deployment/postqueen-postqueen-app

Change the defaults for a real install

Passwords. Change postgresql.auth.password and redis.auth.password, and the two connection strings with them.
Your own databases. Set postgresql.enabled: false or redis.enabled: false and point the connection string at your service.
Uploads. Without extraVolumes, /uploads is an emptyDir that is lost when the pod restarts. Mount a persistent volume at /uploads with extraVolumes and extraVolumeMounts, or store media in Cloudflare R2. With more than one replica, the volume has to be ReadWriteMany so every pod mounts it, or media goes to R2.

Traps

The image tag needs its v

Published tags look like v3.6.84. An empty image.tag falls back to the chart’s appVersion, which falls behind as the app moves on. Write the tag out, and only ever move it forward: every start applies that image’s database schema.

Chart 1.1.0 cannot pull its databases

Chart 1.1.0 bundles Bitnami image tags that Docker Hub no longer serves under bitnami/, so its database pods stay in ImagePullBackOff. Chart 1.1.3 and newer take the same tags from bitnamilegacy/. Use 1.1.4.

There are no health probes

The deployment defines no liveness or readiness probe, so traffic can reach a pod that is still starting and a stuck pod is not restarted. Add your own probe against / on port 5000 if you need that.

Resource names look doubled

A release named postqueen creates objects named postqueen-postqueen-app. That is the chart’s naming helper. The bundled databases are postqueen-postgresql and postqueen-redis-master, which is why the connection strings look the way they do.

An empty secret is still set

Every key under secrets is rendered, so a key left as "" reaches the app as an empty variable rather than an absent one.

Upgrade

helm upgrade postqueen \
  oci://ghcr.io/gkhankinay/postqueen-helmchart/charts/postqueen-app \
  --version 1.1.6 -f my-values.yaml

Raise image.tag in my-values.yaml to move to a newer PostQueen, after a database backup. helm uninstall postqueen removes the release; the bundled databases’ volumes stay until you delete their PersistentVolumeClaims. The chart’s README lists the changes in each chart version, and values.yaml every value.

Next steps

Channel developer apps

Each network’s app, variables and redirect URI.

Email

Resend or SMTP, so password resets and invitations arrive.

Uploads and storage

Media on the local disk, or in Cloudflare R2.

Backups and upgrades

The volumes to back up, and how to move to a newer image.

Start here

Install

Domain and HTTPS

Configure

Channel developer apps

Operate

Develop

What the chart deploys

Install

Apply a change

Change the defaults for a real install

Traps

Upgrade

Next steps

Channel developer apps

Email

Uploads and storage

Backups and upgrades

​What the chart deploys

​Install

​Apply a change

​Change the defaults for a real install

​Traps

​Upgrade

​Next steps

Channel developer apps

Email

Uploads and storage

Backups and upgrades

What the chart deploys

Install

Apply a change

Change the defaults for a real install

Traps

Upgrade

Next steps