Docmost

Deploy Docmost on Kubernetes — an open-source collaborative wiki and documentation platform. Supports bundled or external PostgreSQL and Redis, local PVC or S3 uploads storage, and scheduled pg_dump backups.

Upgrade to 0.96

Keep APP_SECRET stable: the new encryption service derives its AES-256-GCM key from it. Back up PostgreSQL and uploaded files before upgrading. Connected Helm upgrades preserve the generated Secret; explicitly manage docmost.appSecret when rendering offline.

The release updates Node and collaboration services, adds page-version comparison and attachments, fixes Redis ACL/URL/TLS handling, and includes security fixes. Review the official notes. The bundled dependency set now uses PostgreSQL 2.1.1 and Redis 3.1.0.

Key Features

• Collaborative wiki — real-time editing, spaces, pages, and permissions
• PostgreSQL + Redis — bundled subcharts or external connections
• Auto-bootstrap — unaccent and pg_trgm extensions granted on first start
• Storage modes — local PVC (single replica) or S3-compatible (scalable)
• pg_dump backup — scheduled CronJob to S3; database-only (uploads separate)
• JWT sessions — configurable jwtTokenExpiresIn with auto-generated app secret
• Explicit listener contract — containerPorts.http changes the real Docmost process port
• Least-privilege pod identity — Kubernetes API token mounting is disabled by default

Architecture and Runtime Port

The Kubernetes Service targets the named http container port. containerPorts.http configures both that declared port and Docmost’s supported PORT environment variable, so probes, runtime, and Service routing remain aligned. service.port changes only the Kubernetes-facing port and does not reconfigure the process listener.

PostgreSQL and Redis can be bundled or external. Uploads use a local PVC for a single replica or S3-compatible storage when replicas are scaled horizontally.

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install docmost helmforge/docmost -f values.yaml

OCI registry:

helm install docmost oci://ghcr.io/helmforgedev/helm/docmost -f values.yaml

Deployment Examples

# values.yaml — Docmost with bundled PostgreSQL and Redis
docmost:
  appUrl: 'https://wiki.example.com'
  appSecret: 'generate-with-openssl-rand-hex-32'

postgresql:
  enabled: true
  auth:
    database: docmost
    username: docmost
    password: 'strong-db-password'
  standalone:
    persistence:
      enabled: true
      size: 8Gi

redis:
  enabled: true
  standalone:
    persistence:
      enabled: true
      size: 1Gi

storage:
  mode: local
  local:
    enabled: true
    size: 20Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: wiki.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Docmost with external PostgreSQL and Redis
# IMPORTANT: On the external PostgreSQL instance, run before installing:
#   GRANT CREATE ON DATABASE docmost TO docmost;
#   \connect docmost
#   CREATE EXTENSION IF NOT EXISTS unaccent;
#   CREATE EXTENSION IF NOT EXISTS pg_trgm;
docmost:
  appUrl: 'https://wiki.example.com'
  appSecret: 'generate-with-openssl-rand-hex-32'

postgresql:
  enabled: false

database:
  mode: external
  external:
    host: postgres.database.svc.cluster.local
    port: 5432
    name: docmost
    username: docmost
    existingSecret: docmost-db-credentials
    existingSecretPasswordKey: database-password

redis:
  enabled: false
  external:
    host: redis.cache.svc.cluster.local
    port: 6379
    existingSecret: docmost-redis-credentials
    existingSecretPasswordKey: redis-password

storage:
  mode: local
  local:
    enabled: true
    size: 20Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: wiki.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Docmost with S3 uploads (enables horizontal scaling)
docmost:
  appUrl: 'https://wiki.example.com'
  appSecret: 'generate-with-openssl-rand-hex-32'

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true

storage:
  mode: s3 # no local PVC created; allows replicaCount > 1
  s3:
    region: us-east-1
    bucket: docmost-uploads
    endpoint: https://s3.amazonaws.com # or MinIO endpoint
    forcePathStyle: true # required for MinIO and most S3-compatible providers
    existingSecret: docmost-s3-credentials
    existingSecretAccessKeyKey: access-key
    existingSecretSecretKeyKey: secret-key

replicaCount: 2 # safe to scale with S3 storage

# values.yaml — Full production Docmost with backup and TLS
docmost:
  appUrl: 'https://wiki.example.com'
  appSecret: 'generate-with-openssl-rand-hex-32'
  jwtTokenExpiresIn: 30d

postgresql:
  enabled: true
  auth:
    database: docmost
    username: docmost
    password: 'strong-db-password'
    postgresPassword: 'strong-superuser-password'
  standalone:
    persistence:
      enabled: true
      size: 20Gi

redis:
  enabled: true
  auth:
    enabled: true
    password: 'strong-redis-password'
  standalone:
    persistence:
      enabled: true
      size: 1Gi

storage:
  mode: local
  local:
    enabled: true
    size: 50Gi

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: docmost-backups
    existingSecret: docmost-backup-s3-credentials

resources:
  requests:
    memory: 256Mi
    cpu: 200m
  limits:
    memory: 1Gi

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: wiki.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: docmost-tls
      hosts:
        - wiki.example.com

Configuration Reference

Core

Image

Docmost Configuration

Database

Auto-detection precedence (database.mode: auto):

1. database.external.host or database.external.existingSecret → external PostgreSQL
2. postgresql.enabled: true → bundled PostgreSQL subchart

GRANT CREATE ON DATABASE docmost TO docmost;
\connect docmost
CREATE EXTENSION IF NOT EXISTS unaccent;
CREATE EXTENSION IF NOT EXISTS pg_trgm;

PostgreSQL Subchart

Redis Subchart / External

Storage

Backup

The backup CronJob runs pg_dump and uploads the result to S3. Upload files are not included.

Service and Ingress

Probes

All probes use /api/health as the HTTP path.

Resources and Scheduling

Security and Production Boundaries

The default workload drops all Linux capabilities, denies privilege escalation, uses RuntimeDefault seccomp, and does not mount the Kubernetes API token. Enable serviceAccount.automountServiceAccountToken only for a concrete integration that needs Kubernetes API credentials. The upstream image needs a writable filesystem, so the chart does not claim immutable-root support.

The chart does not provision DNS, TLS issuers, routing controllers, Storage Classes, external databases, Redis, S3, or External Secrets providers. For production, preserve APP_SECRET, back up PostgreSQL and uploads separately, and use storage.mode=s3 before increasing replicaCount.

Troubleshooting

• When probes fail after a port override, verify that containerPorts.http renders as both the container port and the PORT environment variable.
• When encrypted data fails after restore, restore the original APP_SECRET through docmost.existingSecret.
• When files differ between replicas, switch to S3 storage; a local PVC is a single-replica contract.
• For startup failures, inspect Docmost, PostgreSQL, and Redis logs together; the init containers only prove TCP reachability.
• For S3 errors, verify endpoint reachability, bucket policy, path-style mode, and both credential keys in the referenced Secret.

More Information

• Docmost Official Documentation
• Docmost GitHub Repository
• HelmForge Docmost Chart Source