Apache Answer

Deploy Apache Answer on Kubernetes — an open-source Q&A platform for teams and communities. Supports SQLite (zero-configuration default), PostgreSQL, and MySQL, with automatic unattended installation and database-aware scheduled backups.

Key Features

• Three database backends — SQLite (default), PostgreSQL, MySQL
• Auto-detection — mode is inferred from which subchart or external host is configured
• Auto-install — unattended first-boot setup via environment variables (autoInstall: true)
• Database-aware backup — tar for SQLite, pg_dump for PostgreSQL, mysqldump for MySQL
• Admin credentials — existingSecret for GitOps-safe secret management
• Independent ports — configure the real Answer listener separately from the Service port
• Hardened defaults — non-root execution, read-only root filesystem, disabled API token, and NetworkPolicy

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install answer helmforge/answer -f values.yaml

OCI registry:

helm install answer oci://ghcr.io/helmforgedev/helm/answer -f values.yaml

Deployment Examples

# values.yaml — Apache Answer with SQLite (zero database configuration)
answer:
  siteName: 'My Q&A'
  siteUrl: 'https://qa.example.com'
  language: en-US
  autoInstall: true

admin:
  name: admin
  email: [email protected]
  existingSecret: answer-admin-credentials # key: admin-password
  existingSecretPasswordKey: admin-password

persistence:
  enabled: true
  size: 10Gi # covers both SQLite file (/data/answer.db) and uploads

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: qa.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: answer-tls
      hosts:
        - qa.example.com

# values.yaml — Apache Answer with bundled PostgreSQL
answer:
  siteName: 'My Q&A'
  siteUrl: 'https://qa.example.com'
  autoInstall: true

admin:
  name: admin
  email: [email protected]
  password: 'change-me'

postgresql:
  enabled: true
  auth:
    database: answer
    username: answer
    password: 'strong-db-password'
  standalone:
    persistence:
      enabled: true
      size: 20Gi

persistence:
  enabled: true
  size: 10Gi # uploads only (SQLite not used when PostgreSQL is active)

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: qa.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Apache Answer with bundled MySQL
answer:
  siteName: 'My Q&A'
  siteUrl: 'https://qa.example.com'
  autoInstall: true

admin:
  name: admin
  email: [email protected]
  password: 'change-me'

mysql:
  enabled: true
  auth:
    database: answer
    username: answer
    password: 'strong-db-password'
    rootPassword: 'strong-root-password'
  standalone:
    persistence:
      enabled: true
      size: 20Gi

persistence:
  enabled: true
  size: 10Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: qa.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Apache Answer with external PostgreSQL
answer:
  siteName: 'My Q&A'
  siteUrl: 'https://qa.example.com'
  autoInstall: true

admin:
  existingSecret: answer-admin-credentials

postgresql:
  enabled: false

database:
  mode: external
  external:
    vendor: postgres # or: mysql
    host: postgres.database.svc.cluster.local
    port: '5432'
    name: answer
    username: answer
    existingSecret: answer-db-credentials
    existingSecretPasswordKey: database-password

persistence:
  enabled: true
  size: 10Gi

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: answer-backups
    existingSecret: answer-s3-credentials

Configuration Reference

Core

Image

Answer Configuration

Admin Credentials

Database

Auto-detection precedence (database.mode: auto):

Subcharts

Persistence

Backup

Service and Ingress

containerPorts.http configures the actual Apache Answer process through the upstream-supported INSTALL_PORT, SITE_ADDR, and SWAGGER_ADDRESS_PORT variables. service.port is client-facing and may differ because the Service uses the named http target.

Example with separate ports:

containerPorts:
  http: 8080

service:
  port: 9080

Security Defaults

The Answer pod runs as UID/GID 1000 with RuntimeDefault seccomp, a read-only root filesystem, disabled privilege escalation, and only the NET_BIND_SERVICE capability required by the default port 80. /data remains writable and /tmp is ephemeral. Kubernetes API token mounting is disabled by default because Answer does not use the cluster API.

Before upgrading an existing release, verify that the /data volume is writable by UID/GID 1000. A volume created by an older root-running deployment can remain root-owned when its storage driver does not apply fsGroup; perform an administrator-controlled ownership migration before the upgrade when required.

The default NetworkPolicy controls ingress only. With networkPolicy.extraIngress: [], any source may use the named HTTP port; provide namespace or pod selectors to restrict access to the ingress controller or Gateway. NetworkPolicies are additive, so verify that the cluster network plugin enforces them and that no other policy selecting the Answer pod permits broader sources. Egress remains unrestricted for SMTP, external databases, identity providers, plugins, and external content.

Probes

All probes use /healthz as the HTTP path.

Resources and Scheduling

More Information

• Apache Answer Official Documentation
• Apache Answer GitHub Repository
• HelmForge Answer Chart Source