CKAN

# values.yaml — CKAN catalog with bundled PostgreSQL, Redis, and Solr
ckan:
  containerPort: 5000
  siteUrl: 'https://data.example.com' # required; wrong value breaks all links
  siteTitle: 'My Open Data Portal'
  sysadminName: admin
  sysadminEmail: [email protected]
  existingSecret: ckan-secrets
  existingSecretPasswordKey: sysadmin-password
  existingSecretSessionKey: session-secret
  existingSecretJwtKey: jwt-secret

postgresql:
  enabled: true
  auth:
    database: ckan
    username: ckan
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

solr:
  enabled: true
  persistence:
    size: 10Gi

datapusher:
  enabled: false # requires an external, pre-provisioned DataStore

persistence:
  enabled: true
  size: 50Gi # uploaded datasets and resources

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: data.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: ckan-tls
      hosts:
        - data.example.com

# values.yaml — CKAN with external PostgreSQL (both ckan + datastore DBs) and Redis
# Both databases must be created in PostgreSQL before deploying:
#   CREATE DATABASE ckan;
#   CREATE DATABASE datastore;
#   CREATE USER ckan WITH PASSWORD '...';
#   CREATE USER datastore_ro WITH PASSWORD '...';
#   GRANT ALL ON DATABASE ckan TO ckan;
#   GRANT CONNECT ON DATABASE datastore TO ckan;
#   GRANT CONNECT ON DATABASE datastore TO datastore_ro;

ckan:
  siteUrl: 'https://data.example.com'
  existingSecret: ckan-secrets
  plugins: 'envvars image_view text_view datatables_view datastore datapusher'
  extraEnv:
    - name: PGSSLROOTCERT
      value: /etc/ckan/postgresql-ca/ca.crt

postgresql:
  enabled: false

redis:
  enabled: false

database:
  mode: external
  external:
    host: postgres.database.svc.cluster.local
    port: 5432
    ckanDatabase: ckan
    datastoreDatabase: datastore
    username: ckan
    datastoreReadUsername: datastore_ro
    existingSecret: ckan-db-credentials
    existingSecretPasswordKey: password
    existingSecretDatastoreReadPasswordKey: datastore-read-password
    sslMode: verify-full

redisConfig:
  mode: external
  external:
    host: redis.cache.svc.cluster.local
    port: 6379
    database: 0
    tls: true
    sslCertReqs: required
    existingSecret: ckan-redis-credentials
    existingSecretPasswordKey: redis-password

datapusher:
  enabled: true

solr:
  enabled: true # always use the bundled CKAN-specific Solr image

extraVolumes:
  - name: postgresql-ca
    secret:
      secretName: postgresql-ca
extraVolumeMounts:
  - name: postgresql-ca
    mountPath: /etc/ckan/postgresql-ca
    readOnly: true

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: data.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — CKAN listener tuning and image-provided plugins
ckan:
  siteUrl: 'https://data.example.com'
  existingSecret: ckan-secrets
  containerPort: 5500
  uwsgiProcesses: 4
  uwsgiHarakiri: 120
  # Only enable plugins installed in the selected image.
  plugins: 'envvars image_view text_view datatables_view'

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

datapusher:
  enabled: false

# values.yaml — CKAN with daily pg_dump backup
# Note: backup covers the ckan database only; uploaded files in /var/lib/ckan (PVC)
# are NOT included. Back up the PVC separately using Velero or storage snapshots.
ckan:
  siteUrl: 'https://data.example.com'
  existingSecret: ckan-secrets

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: ckan-backups
    existingSecret: ckan-s3-credentials

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: data.example.com
      paths:
        - path: /
          pathType: Prefix