Helm values reference

Chart: deploy/helm/backstory. Profiles select which dependencies the chart installs; everything else is the same five services.

Profile

profile: external   # saas | external | bundled

Images

image:
  repository: ghcr.io/backstory
  tag: ""            # defaults to the chart appVersion
  pullPolicy: IfNotPresent

Data stores (external and saas)

datastores:
  postgres:
    url: postgres://backstory:***@postgres:5432/backstory?sslmode=require
  clickhouse:
    addr: clickhouse:9000
    db: backstory
    user: default
    passwordSecret: backstory-clickhouse   # key: password
  s3:
    endpoint: https://s3.internal
    bucket: backstory-chunks
    region: us-east-1
    forcePathStyle: true
    credentialsSecret: backstory-s3        # keys: accessKey, secretKey
  valkey:
    url: ""                                 # required for Live Assist
  livekit:
    url: ""                                 # wss://…; empty disables voice

datastores.s3 is the store the process starts with. The instance owner replaces it in Storage setup (Amazon Web Services, Google Cloud, Microsoft Azure, or the store on this install). Cluster backups stay under bundled.backups and are not changed from that screen.

Services

Each of gateway, worker, api, aiGateway, web accepts:

gateway:
  enabled: true
  replicas: 2
  port: 8080
  resources:            # requests == limits (Guaranteed QoS); GOMEMLIMIT is derived at 85%
    cpu: 250m
    memory: 256Mi
  env: {}
  hpa: { enabled: true, min: 2, max: 20, targetCPU: 70 }
  pdb: { enabled: true, minAvailable: 1 }

Defaults: gateway 256Mi/250m, worker 512Mi/500m, api 256Mi/250m, web 64Mi/50m, aiGateway 512Mi/250m.

Secrets and keys

secrets:
  masterKey: backstory-master     # key: BACKSTORY_MASTER_KEY (base64 32 bytes)
  mail: backstory-mail            # SES or SMTP credentials
  oauth: backstory-oauth          # BACKSTORY_OAUTH_*_CLIENT_ID / _SECRET

Ingress

ingress:
  enabled: true
  className: nginx
  host: backstory.example.com
  tls: { secretName: backstory-tls }

Routes: /v1/ingest → gateway, /v1 and /auth → api, / → web.

Bundled profile

profile: bundled
bundled:
  acknowledgeSizing: true      # required; the chart refuses to render without it (16 GB node minimum)
  createClusters: true         # phase 2 after operators are ready
  subcharts:
    postgres:      { enabled: true, instances: 1, storage: 50Gi }
    clickhouse:    { enabled: true, replicas: 1, memory: 12Gi, storage: 200Gi }
    minio:         { enabled: true, drives: 4, driveSize: 100Gi }
    valkey:        { enabled: true }
    livekit:       { enabled: true, hostNetwork: true }

Install in two phases so the operators exist before their custom resources:

helm dependency update deploy/helm/backstory
helm install backstory deploy/helm/backstory -f deploy/helm/backstory/values-bundled.yaml --set bundled.createClusters=false
helm upgrade backstory deploy/helm/backstory -f deploy/helm/backstory/values-bundled.yaml --set bundled.createClusters=true

Scheduling

scheduling:
  topologySpread: true          # spread across zones
  nodeSelector: {}
  tolerations: []
serviceAccount:
  perService: true
  roleArns: { gateway: "", worker: "", api: "" }   # IRSA / pod identity on EKS