Archify Sync server, Dockerfile and Helm chart

Rust server (axum, yrs, sqlx/PostgreSQL): live shared models over the y-websocket protocol, versions, browser sign-in with PKCE, invites, single sign-on through OIDC, metrics. Docker image on distroless, compose file, and a Helm chart with one pod, optional bundled PostgreSQL and secrets from existing Secrets.

charts/archify-sync/values.yaml

@@ -0,0 +1,105 @@
+# Archify Sync runs as exactly one pod: the live copy of each space is held by
+# one server (decision 0002). Updates are Recreate, so two never overlap; the
+# extension works offline for the few seconds in between and catches up.
+
+image:
+  repository: archify-sync
+  tag: ""              # defaults to the chart's appVersion
+  pullPolicy: IfNotPresent
+imagePullSecrets: []
+
+# The address people open in the browser; invite links point here.
+publicUrl: http://localhost:8080
+
+database:
+  # postgres://user:password@host:5432/db. Ignored when existingSecret is set
+  # or the bundled postgresql is enabled.
+  url: ""
+  existingSecret: ""   # a Secret with the URL under existingSecretKey
+  existingSecretKey: url
+  maxConnections: 10
+
+# A single PostgreSQL in this release, for trying out and small installs.
+# For anything you care about, point database at a managed or operator-run one.
+postgresql:
+  enabled: false
+  image: postgres:17-alpine
+  password: ""         # generated once and kept when empty (helm install/upgrade only)
+  # A Secret with `password` and `url` (postgres://archify:<password>@<release>-postgresql:5432/archify),
+  # e.g. from an ExternalSecret. Use it under Argo CD: it renders charts without
+  # cluster access, so a generated password would change on every sync.
+  existingSecret: ""
+  storage: 5Gi
+  storageClass: ""
+  resources: {}
+
+config:
+  name: Archify Sync
+  snapshotIdleSecs: 30
+  snapshotMaxSecs: 600
+  snapshotMaxEdits: 2000
+  inviteHours: 168
+  membersCanInvite: false
+  accessTtlSecs: 900
+  refreshTtlDays: 30
+  refreshGraceSecs: 30
+  redirectSchemes: vscode,vscode-insiders,vscodium,cursor,windsurf
+  maxMessageBytes: 8388608
+  logJson: true
+  logLevel: info,tower_http=warn,sqlx=warn
+
+# Single sign-on through an OpenID Connect provider (Keycloak, …). Register
+# <publicUrl>/oidc/callback as a redirect URI of the provider's client; one
+# client can list the callbacks of every place the server runs.
+oidc:
+  enabled: false
+  issuer: ""           # https://keycloak.example.com/realms/home
+  clientId: archify-sync
+  # The client secret, from a Secret (an ExternalSecret, for example).
+  existingSecret: ""
+  existingSecretKey: client-secret
+  label: Keycloak      # "Sign in with Keycloak"
+  scopes: openid profile email
+  groupsClaim: groups
+  # Members of these groups get an account on first sign-in; others are
+  # refused. Empty: anyone the provider signs in, but new people need an invite.
+  allowedGroups: []
+  adminGroups: []
+
+# Prometheus /metrics on a port of its own, never through the ingress.
+metrics:
+  enabled: true
+  port: 9090
+  serviceMonitor:
+    enabled: false     # needs the Prometheus Operator's CRDs
+    interval: 30s
+
+extraEnv: []
+
+service:
+  type: ClusterIP
+  port: 80
+
+ingress:
+  enabled: false
+  className: ""
+  # Edits travel over a WebSocket that stays open for hours; raise the proxy's
+  # timeouts. For ingress-nginx:
+  #   nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+  #   nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+  #   nginx.ingress.kubernetes.io/proxy-body-size: 8m
+  annotations: {}
+  host: archify-sync.example.com
+  tls: []              # [{ secretName: archify-sync-tls, hosts: [archify-sync.example.com] }]
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 64Mi
+  limits:
+    memory: 512Mi
+
+podAnnotations: {}
+nodeSelector: {}
+tolerations: []
+affinity: {}