Configuration and Secrets

Use the production values example as the non-secret values file. Never put credentials, licenses, private signing keys, or registry tokens in Helm values.

Runtime Secret

Create one Secret containing every key referenced by global.secretKeys:

kubectl -n loadouthq create secret generic loadouthq-runtime \
  --from-literal=DATABASE_URL='postgresql://USER:PASSWORD@DB_HOST:5432/loadouthq?sslmode=require' \
  --from-literal=REDIS_URL='rediss://:PASSWORD@VALKEY_HOST:6379/0' \
  --from-literal=S3_ENDPOINT='https://s3.example.com' \
  --from-literal=S3_REGION='REGION' \
  --from-literal=S3_BUCKET='BUCKET' \
  --from-literal=S3_ACCESS_KEY_ID='ACCESS_KEY' \
  --from-literal=S3_SECRET_ACCESS_KEY='SECRET_KEY' \
  --from-literal=SESSION_SECRET='AT_LEAST_32_RANDOM_CHARACTERS' \
  --from-literal=ENCRYPTION_KEY='64_HEXADECIMAL_CHARACTERS'

Prefer an external secret manager or sealed-secret workflow in production. License validation settings are part of the official API image and are not customer runtime configuration.

Required non-secret values

Value	Meaning
config.appBaseUrl	Public SPA origin used in links and redirects
config.apiPublicUrl	Public API origin used for OIDC callbacks; normally the same origin
config.corsOrigin	Allowed browser origin
config.platformAdminEmail	Local bootstrap account promoted to platform admin
global.existingSecret	Existing Secret holding connection and application keys
imagePullSecrets	Secret names granting nodes access to private images
ingress.host	Public DNS hostname when Ingress is enabled
httpRoute.parentRefs	Existing Gateway and optional listener attachment
httpRoute.hostnames	Public DNS hostnames accepted by HTTPRoute

The API validates required environment values before serving traffic. Public URLs must match the externally reachable HTTPS address, not Kubernetes Service names.

Policy defaults

Registration and organization creation are disabled in the production example. Enable them only after reviewing onboarding policy. Secure cookies must remain enabled behind HTTPS.

Registry Secret

kubectl -n loadouthq create secret docker-registry loadouthq-registry \
  --docker-server=registry.gitlab.com \
  --docker-username='DEPLOY_TOKEN_USER' \
  --docker-password='DEPLOY_TOKEN'

Use a read-registry deploy token and rotate it through the customer's secret-management process.