alf.io

Open-source event management and ticketing platform. alf.io handles event creation, ticket category management, online ticket sales, payment gateway integration, attendee management, and QR code-based check-in. Built with Spring Boot and PostgreSQL.

Security and profile default changed

Chart releases containing alf.io 2.0-M5-2609 include upstream authorization and SSRF security fixes and change alfio.profiles from dev to the upstream container default, jdbc-session. The image launcher activates spring-boot automatically. Review custom profile overrides before upgrading and never enable dev in production.

Key Features

Event management — create events, ticket categories, discount codes, and promotions
Online ticket sales — payment gateway integration (Stripe, PayPal, and others)
QR code check-in — mobile check-in app with offline support
Attendee management — registration forms, custom fields, and export
PostgreSQL backend — bundled subchart or external database
Spring Boot — production-ready Java application

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install alfio helmforge/alfio

OCI registry:

helm install alfio oci://ghcr.io/helmforgedev/helm/alfio

Deployment Examples

# values.yaml — Production alf.io with PostgreSQL and TLS
alfio:
  baseUrl: 'https://tickets.example.com'

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

resources:
  requests:
    memory: 512Mi
    cpu: 250m
  limits:
    memory: 1Gi
    cpu: 1000m

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: tickets.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: alfio-tls
      hosts:
        - tickets.example.com

# values.yaml — alf.io with external PostgreSQL
alfio:
  baseUrl: 'https://tickets.example.com'

postgresql:
  enabled: false

database:
  external:
    host: postgresql.database.svc
    port: '5432'
    name: alfio
    username: alfio
    existingSecret: alfio-db-secret
    existingSecretPasswordKey: password

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: tickets.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — alf.io with Stripe payment integration
alfio:
  baseUrl: 'https://tickets.example.com'
  extraEnv:
    # Stripe integration
    - name: STRIPE_SECRET_KEY
      valueFrom:
        secretKeyRef:
          name: alfio-payments
          key: stripe-secret-key
    - name: STRIPE_PUBLIC_KEY
      valueFrom:
        secretKeyRef:
          name: alfio-payments
          key: stripe-public-key

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

resources:
  requests:
    memory: 512Mi
    cpu: 250m
  limits:
    memory: 1Gi
    cpu: 1000m

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: tickets.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: alfio-tls
      hosts:
        - tickets.example.com

Configuration Reference

Core

Parameter	Type	Default	Description
`nameOverride`	string	`""`	Override the chart name.
`fullnameOverride`	string	`""`	Override the full release name.
`commonLabels`	object	`{}`	Extra labels added to all resources.

Image

Parameter	Type	Default	Description
`image.repository`	string	`docker.io/alfio/alf.io`	alf.io container image.
`image.tag`	string	`"2.0-M5-2609"`	Pinned alf.io image tag.
`image.pullPolicy`	string	`IfNotPresent`	Image pull policy.
`imagePullSecrets`	array	`[]`	Pull secrets for private registries.

alf.io Configuration

Parameter	Type	Default	Description
`alfio.containerPort`	integer	`8080`	Port used by the actual Spring Boot listener.
`alfio.baseUrl`	string	`""`	Public URL of the alf.io instance (e.g. `https://tickets.example.com`).
`alfio.profiles`	string	`jdbc-session`	Additional Spring profiles; the launcher activates `spring-boot`.
`alfio.extraEnv`	array	`[]`	Extra environment variables for payment gateways and advanced configuration.

baseUrl affects QR codes on issued tickets

alf.io embeds baseUrl in the QR codes printed on tickets. If this value is incorrect, attendees who have already received their tickets will have QR codes that point to the wrong URL. Set the correct public URL before selling any tickets.

Spring Boot JVM memory requirements

alf.io is a Spring Boot Java application. Without resources.limits.memory, the JVM may consume all available node memory. Set at least 512Mi for requests and 1Gi for limits. The JVM respects container memory limits via -XX:MaxRAMPercentage.

Database — Embedded Subchart

Parameter	Type	Default	Description
`postgresql.enabled`	boolean	`true`	Deploy a bundled PostgreSQL subchart for alf.io.
`postgresql.architecture`	string	`standalone`	PostgreSQL deployment architecture.
`postgresql.auth.database`	string	`alfio`	Database name created by the subchart.
`postgresql.auth.username`	string	`alfio`	Database username created by the subchart.
`postgresql.auth.password`	string	`""`	Database password (auto-generated if empty).

Database — External

Parameter	Type	Default	Description
`database.external.host`	string	`""`	External PostgreSQL hostname or IP.
`database.external.port`	string	`"5432"`	External PostgreSQL port.
`database.external.name`	string	`alfio`	Database name on the external server.
`database.external.username`	string	`alfio`	Username for the external database.
`database.external.password`	string	`""`	Password for the external database (plain text — prefer secret).
`database.external.existingSecret`	string	`""`	Existing secret containing the database password.
`database.external.existingSecretPasswordKey`	string	`password`	Key inside the existing secret for the password.

Service

Parameter	Type	Default	Description
`service.type`	string	`ClusterIP`	Kubernetes service type.
`service.port`	integer	`80`	Service port exposed to the cluster.
`service.annotations`	object	`{}`	Annotations for the Service.

service.port is independent from alfio.containerPort. The Service targets the named http port, while SERVER_PORT configures the actual process.

Ingress

Parameter	Type	Default	Description
`ingress.enabled`	boolean	`false`	Enable an Ingress resource.
`ingress.ingressClassName`	string	`traefik`	Ingress class name.
`ingress.annotations`	object	`{}`	Annotations for the Ingress (e.g. cert-manager for TLS).
`ingress.hosts`	array	`[]`	Ingress host and path rules.
`ingress.tls`	array	`[]`	TLS configuration (secret name and hosts).

Probes

Probes use the /healthz endpoint.

Parameter	Type	Default	Description
`probes.startup.enabled`	boolean	`true`	Enable startup probe.
`probes.startup.initialDelaySeconds`	integer	`15`	Startup probe initial delay.
`probes.startup.periodSeconds`	integer	`5`	Startup probe period.
`probes.startup.timeoutSeconds`	integer	`3`	Startup probe timeout.
`probes.startup.failureThreshold`	integer	`30`	Startup probe failure threshold.
`probes.liveness.enabled`	boolean	`true`	Enable liveness probe.
`probes.liveness.initialDelaySeconds`	integer	`0`	Liveness probe initial delay.
`probes.liveness.periodSeconds`	integer	`15`	Liveness probe period.
`probes.liveness.timeoutSeconds`	integer	`5`	Liveness probe timeout.
`probes.liveness.failureThreshold`	integer	`3`	Liveness probe failure threshold.
`probes.readiness.enabled`	boolean	`true`	Enable readiness probe.
`probes.readiness.initialDelaySeconds`	integer	`0`	Readiness probe initial delay.
`probes.readiness.periodSeconds`	integer	`10`	Readiness probe period.
`probes.readiness.timeoutSeconds`	integer	`5`	Readiness probe timeout.
`probes.readiness.failureThreshold`	integer	`3`	Readiness probe failure threshold.

Resources and Security

Parameter	Type	Default	Description
`resources`	object	`{}`	CPU and memory requests and limits. Min 512Mi RAM.
`podSecurityContext`	object	`seccompProfile.type: RuntimeDefault`	Pod-level security context.
`securityContext`	object	non-root, read-only, no privilege escalation	Container-level security context.

The application runs as UID/GID 1001, drops all capabilities, uses a read-only root filesystem with an ephemeral /tmp, and does not receive a Kubernetes API token. These defaults are validated against the official image.

Service Account

Parameter	Type	Default	Description
`serviceAccount.create`	boolean	`false`	Create a dedicated ServiceAccount.
`serviceAccount.name`	string	`""`	Override the ServiceAccount name.
`serviceAccount.annotations`	object	`{}`	Annotations for the ServiceAccount.
`serviceAccount.automountServiceAccountToken`	boolean	`false`	Mount a Kubernetes API token in the pod.

Network Policy

Parameter	Type	Default	Description
`networkPolicy.enabled`	boolean	`true`	Restrict inbound traffic to the named HTTP listener.
`networkPolicy.extraIngress`	array	`[]`	Additional inbound rules.

The chart does not restrict egress because alf.io can contact payment, email, webhook, and external database endpoints. Add a platform policy when those destinations are known. NetworkPolicy requires support from the cluster CNI.

Scheduling

Parameter	Type	Default	Description
`nodeSelector`	object	`{}`	Node selector for scheduling.
`tolerations`	array	`[]`	Tolerations for scheduling.
`affinity`	object	`{}`	Affinity rules.
`topologySpreadConstraints`	array	`[]`	Topology spread constraints.
`priorityClassName`	string	`""`	PriorityClass for the pod.
`terminationGracePeriodSeconds`	integer	`30`	Termination grace period.
`podLabels`	object	`{}`	Extra labels for the pod.
`podAnnotations`	object	`{}`	Extra annotations for the pod.

Extra

Parameter	Type	Default	Description
`extraVolumes`	array	`[]`	Extra volumes to attach to the pod.
`extraVolumeMounts`	array	`[]`	Extra volume mounts for the container.
`extraManifests`	array	`[]`	Extra Kubernetes manifests deployed alongside the chart.

Common Issues

Application using dev profile in production

The chart no longer enables dev by default. If an existing values file explicitly sets alfio.profiles: dev, remove that override before any event goes live or tickets are sold. Use jdbc-session unless upstream documentation requires another additional profile.

Enable HTTPS before processing payments

alf.io integrates with payment gateways that require HTTPS for webhooks and redirects. Ensure TLS is configured in the Ingress (via cert-manager or equivalent) and that baseUrl starts with https:// before configuring any payment gateway credentials.