Castopod

Open-source podcast hosting platform. Castopod manages your episodes, generates RSS feeds for distribution to Apple Podcasts, Spotify, and other directories, tracks anonymous listener analytics, and federates with the Fediverse via ActivityPub. Metadata lives in MariaDB and uploaded audio and images live on a persistent volume. The chart applies migrations and creates the superadmin on first start, so the instance never opens with a public install wizard.

Key Features

• RSS feed generation — automatic, standards-compliant podcast feeds for all directories
• Built-in analytics — privacy-respecting listener tracking with hashed IDs
• Fediverse integration — ActivityPub support for social interactions and episode sharing
• Ready on first start — setup init container runs migrations and creates the superadmin from a Secret
• Hardened pod — non-root www-data, no privilege escalation, all capabilities dropped except NET_BIND_SERVICE
• Scheduler sidecar — scheduled publishing, WebSub, and federation tasks run every minute
• MariaDB backend — bundled subchart or external database on any port
• Optional Redis cache — authenticated Redis subchart as the cache handler
• Persistent media — one PVC holds the writable directory and uploaded audio and images
• S3 backup — scheduled archive of the data volume to S3-compatible storage
• Configurable listener — castopod.port changes the real FrankenPHP port
• Ingress or Gateway API — Ingress or HTTPRoutes
• CDN support — separate media base URL for audio file delivery

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install castopod helmforge/castopod \
  --set castopod.baseURL=https://podcast.example.com

OCI registry:

helm install castopod oci://ghcr.io/helmforgedev/helm/castopod \
  --set castopod.baseURL=https://podcast.example.com

castopod.baseURL only sets the URL that Castopod embeds in links and feeds. It does not expose the Service: enable ingress or gatewayAPI for that hostname (see the Deployment Examples below) before using the public URL.

Getting Started

Without a base URL, Ingress, or HTTPRoute, the chart uses http://localhost:8080 and disables HTTPS redirection for a local check:

helm install castopod helmforge/castopod
kubectl rollout status deploy/castopod-castopod --timeout=300s
kubectl get secret castopod-castopod-admin -o jsonpath='{.data.admin-password}' | base64 -d; echo
kubectl port-forward svc/castopod-castopod 8080:80

Open http://localhost:8080/cp-auth/login and log in with [email protected] and the password above.

Deployment Examples

# values.yaml — Castopod with bundled MariaDB (default)
castopod:
  baseURL: 'https://podcast.example.com'
  admin:
    username: owner
    email: [email protected]
    existingSecret: castopod-admin # key admin-password

mariadb:
  enabled: true
  auth:
    password: 'mariadb-password'

persistence:
  enabled: true
  size: 20Gi

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: podcast.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: castopod-tls
      hosts:
        - podcast.example.com

# values.yaml — Castopod with MariaDB and Redis for caching
castopod:
  baseURL: 'https://podcast.example.com'

mariadb:
  enabled: true
  auth:
    password: 'mariadb-password'

# Castopod requires a Redis password; the subchart generates one.
redis:
  enabled: true
  architecture: standalone

persistence:
  enabled: true
  size: 20Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: podcast.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Castopod with media served from a CDN
# Audio files are stored in the PVC but served via CDN URL
castopod:
  baseURL: 'https://podcast.example.com'
  mediaBaseURL: 'https://cdn.example.com/castopod'

mariadb:
  enabled: true
  auth:
    password: 'mariadb-password'

persistence:
  enabled: true
  size: 20Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: podcast.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Castopod behind a shared Gateway
castopod:
  baseURL: 'https://podcast.example.com'

gatewayAPI:
  enabled: true
  httpRoutes:
    - name: public
      parentRefs:
        - name: shared-gateway
          namespace: gateway-system
          sectionName: https
      hostnames:
        - podcast.example.com

# values.yaml — Daily backup of the Castopod data volume to S3
# NOTE: Backup covers writable files and uploaded media only.
#       Back up the MariaDB database separately.
castopod:
  baseURL: 'https://podcast.example.com'

mariadb:
  enabled: true
  auth:
    password: 'mariadb-password'

persistence:
  enabled: true
  size: 20Gi

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: my-castopod-backups
    accessKey: '<set-me>'
    secretKey: '<set-me>'

Configuration Reference

Core

Image

Castopod Configuration

Analytics

Database — Embedded Subchart

Database — External

Cache — Redis Subchart

Persistence

One PVC holds two paths: the volume root is mounted at /var/www/html/writable (cache, sessions, logs, temporary files) and the public-media subPath at /var/www/html/public/media (uploaded audio, artwork, and site images).

Backup

Service

Ingress

Gateway API

Probes

Resources and Security

Service Account

Scheduling

Extra

Common Issues

More Information

• Castopod Official Website
• Castopod Documentation
• Castopod Source Repository
• HelmForge Castopod Chart Source