Countly

Product analytics platform for mobile, web, and desktop applications. Countly provides event tracking, crash reporting, push notifications, A/B testing, funnel analysis, and a plugin system with 41+ optional modules — all backed by a MongoDB database.

Key Features

• Event and session tracking — capture user actions across mobile, web, and desktop
• Crash reporting — collect and analyze application errors
• Push notifications — send targeted messages via the built-in notification service
• A/B testing and funnels — experiment and analyze user conversion flows
• Plugin system — 41+ configurable feature plugins
• Dual-port architecture — separate API (3001) and Dashboard (6001) endpoints
• MongoDB backend — bundled subchart or external connection
• S3 backup — scheduled mongodump CronJob to S3-compatible storage

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install countly helmforge/countly -f values.yaml

OCI registry:

helm install countly oci://ghcr.io/helmforgedev/helm/countly -f values.yaml

Architecture: Dual Ports

Deployment Examples

# values.yaml — Countly with bundled MongoDB, dashboard only exposed
countly:
  apiWorkers: 4
  timezone: UTC

mongodb:
  enabled: true
  auth:
    rootPassword: 'mongo-root-password'

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: countly.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Production Countly with TLS and daily MongoDB backup
countly:
  apiWorkers: 4
  timezone: America/Sao_Paulo

mongodb:
  enabled: true
  auth:
    rootPassword: 'mongo-root-password'

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: my-countly-backups
    prefix: countly
    existingSecret: countly-s3-credentials

resources:
  requests:
    memory: 256Mi
    cpu: 100m
  limits:
    memory: 1Gi
    cpu: 1000m

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: countly.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: countly-tls
      hosts:
        - countly.example.com

# values.yaml — Countly with external managed MongoDB
externalMongodb:
  enabled: true
  existingSecret: countly-mongodb-uri
  existingSecretUriKey: mongodb-uri

mongodb:
  enabled: false

countly:
  apiWorkers: 4

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: countly.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Expose both Dashboard (6001) and SDK API (3001) externally
# When application SDKs run outside the cluster, port 3001 must be reachable.
countly:
  apiWorkers: 4

mongodb:
  enabled: true
  auth:
    rootPassword: 'mongo-root-password'

# Dashboard ingress
ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: countly.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: countly-tls
      hosts:
        - countly.example.com

# Expose SDK API as a LoadBalancer service via extraManifests
extraManifests:
  - apiVersion: v1
    kind: Service
    metadata:
      name: countly-api
    spec:
      type: LoadBalancer
      selector:
        app.kubernetes.io/name: countly
      ports:
        - name: api
          port: 3001
          targetPort: 3001

Configuration Reference

Core

Image

Countly Configuration

Database — External MongoDB

Used when mongodb.enabled: false.

Database — MongoDB Subchart

Backup

Service

Ingress

Probes

Resources and Security

Service Account

Network Policy

Scheduling

Extra

Security and Production Operations

The chart disables Kubernetes API token mounting, applies RuntimeDefault seccomp, creates a NetworkPolicy, and runs the MongoDB wait and backup containers as non-root. The pinned upstream combined image starts /sbin/my_init as root and then drops the API and dashboard processes to the countly user. This upstream entrypoint constraint is why the main container does not force runAsNonRoot or a read-only root filesystem.

For production:

• keep MongoDB and S3 credentials in existing Secrets or External Secrets;
• replace the permissive default egress with the exact MongoDB, DNS, mail, webhook, push-provider, and plugin destinations you need;
• expose the dashboard and SDK API only through TLS and apply edge controls;
• use a replicated or managed MongoDB service and test a restore;
• size ephemeral storage for one compressed backup archive;
• verify both listeners after upgrades, especially when using custom ports.

The default Ingress and HTTPRoute expose the dashboard only. SDK clients outside the cluster require a deliberate route or load balancer for service.apiPort.

Upgrade Compatibility

Older Countly chart releases accepted a space-delimited string in backup.database.mongodumpArgs. Existing releases can upgrade without resetting their values: the chart converts that legacy string into individual arguments. New and updated configurations should use an array so argument boundaries remain explicit.

More Information

• Countly Official Website
• Countly Documentation
• Countly GitHub Repository
• HelmForge Countly Chart Source