Wallabag

Self-hosted read-it-later application. Wallabag saves articles from the web by extracting their full text and storing them in your own PostgreSQL database. Read your saved articles offline across any device, organize them with tags, annotations, and reading lists, and share them with configurable access controls.

Key Features

• Full-text extraction — saves the complete article content, not just a link
• Multi-device access — web UI, mobile apps, browser extensions, and e-reader exports
• Tag and annotation system — organize articles with tags, highlights, and notes
• Working first install — a setup init container installs the schema on first start and runs Doctrine migrations on every upgrade
• Initial super-admin from a Secret — configurable username and email with a generated or supplied password
• PostgreSQL backend — bundled subchart or external database
• Optional Redis — subchart or external Redis for the asynchronous import queue
• Persistent storage — PVC-backed data directory for downloaded article images
• S3 backup — scheduled pg_dump of the Wallabag database to S3-compatible storage
• Ingress and Gateway API — Ingress with TLS or Gateway API HTTPRoutes
• Hardened defaults — no privilege escalation, minimal capabilities, RuntimeDefault seccomp, no ServiceAccount token

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install wallabag helmforge/wallabag

OCI registry:

helm install wallabag oci://ghcr.io/helmforgedev/helm/wallabag

Getting Started

The first pod start installs the schema and creates the initial super-admin. Read its password and open the UI:

kubectl rollout status deploy/wallabag-wallabag --timeout=300s
kubectl get secret wallabag-wallabag-admin -o jsonpath='{.data.admin-password}' | base64 -d; echo
kubectl port-forward svc/wallabag-wallabag 8080:80

Log in at http://localhost:8080/ as wallabag (or wallabag.admin.username). Resource names follow <release>-wallabag.

Deployment Examples

# values.yaml — Wallabag with bundled PostgreSQL (default)
wallabag:
  domainName: 'https://wallabag.example.com'
  secret: 'a-random-symfony-app-secret-here'

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

persistence:
  enabled: true
  size: 5Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: wallabag.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Wallabag with PostgreSQL and Redis for the asynchronous import queue
wallabag:
  domainName: 'https://wallabag.example.com'
  secret: 'a-random-symfony-app-secret-here'

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

redis:
  enabled: true
  auth:
    password: 'redis-password'

persistence:
  enabled: true
  size: 5Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: wallabag.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Wallabag with external PostgreSQL and Redis
wallabag:
  domainName: 'https://wallabag.example.com'
  secret: 'a-random-symfony-app-secret-here'

postgresql:
  enabled: false

database:
  external:
    host: postgresql.database.svc
    port: '5432'
    name: wallabag
    username: wallabag
    password: 'db-password'

redis:
  enabled: false

externalRedis:
  host: redis.cache.svc
  port: '6379'
  existingSecret: wallabag-redis
  existingSecretPasswordKey: redis-password

persistence:
  enabled: true
  size: 5Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: wallabag.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Daily backup of the Wallabag database to S3
wallabag:
  domainName: 'https://wallabag.example.com'
  secret: 'a-random-symfony-app-secret-here'

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: my-wallabag-backups
    accessKey: '<set-me>'
    secretKey: '<set-me>'

persistence:
  enabled: true
  size: 5Gi

# values.yaml — Wallabag published through a shared Gateway
wallabag:
  domainName: 'https://wallabag.example.com'

gatewayAPI:
  enabled: true
  httpRoutes:
    - name: public
      parentRefs:
        - name: shared-gateway
          namespace: gateway-system
          sectionName: https
      hostnames:
        - wallabag.example.com

Configuration Reference

Core

Image

Wallabag Configuration

Database Setup

Database — Embedded Subchart

Database — External

Import Queue — Redis Subchart

Import Queue — External Redis

Persistence

Service

Ingress

Gateway API

Probes

Backup

The backup CronJob runs pg_dump against the Wallabag PostgreSQL database and uploads the archive to S3. This protects all saved articles, tags, annotations, and user accounts.

Resources and Security

Service Account

Scheduling

Extra

Common Issues

More Information

• Wallabag Official Website
• Wallabag Documentation
• Wallabag GitHub Repository
• HelmForge Wallabag Chart Source