Presets

Rather than assembling a values.yaml from scratch, start from one of eight tested shapes and edit it. Every preset is a valid, complete starting point; filenames are literal — every feature that’s on appears in the name. They live in deployments/h7s/swarmd/presets/.

Pick one

#	Preset	Postgres	ClickHouse	HTTPS	SMTP	Presidio	Best for
1	`values-shared-pg`	shared	—	—	—	—	Prove it runs on your laptop
2	`values-shared-pg-clickhouse`	shared	✅	—	—	—	Laptop demo with full audit history
3	`values-shared-pg-clickhouse-https`	shared	✅	✅	—	—	First real hostname, no user email yet
4	`values-shared-pg-clickhouse-https-smtp`	shared	✅	✅	✅	—	Real users on a single Postgres
5	`values-shared-pg-clickhouse-https-smtp-presidio`	shared	✅	✅	✅	✅	Real users + PII detection
6	`values-per-service-pg`	per-service	—	—	—	—	Proving the per-service shape locally
7	`values-per-service-pg-clickhouse`	per-service	✅	—	—	—	Pre-production sizing test
8	`values-per-service-pg-clickhouse-https-smtp-presidio`	per-service	✅	✅	✅	✅	Hardened production

Two ladders, and the trick is that each rung adds exactly one feature. Diff two adjacent files and you see precisely what that feature costs you in configuration:

diff presets/values-shared-pg-clickhouse.yaml \
     presets/values-shared-pg-clickhouse-https.yaml

Pick the highest-numbered preset whose feature set you actually need, then customise. Starting low and adding features by hand is how you end up with a values file nobody can review.

Installing from one

helm install swarmd deployments/h7s/swarmd \
  --namespace swarmd --create-namespace \
  -f deployments/h7s/swarmd/presets/values-shared-pg.yaml \
  --set licence.existingSecretRef.name=swarmd-licence

Each preset’s header comment carries its own exact install command, the persona it’s for, and the pre-work it assumes.

What the axes mean

Axis	Off	On
Postgres layout	`shared` — one Postgres, one PVC. Simplest.	`per-service` — one Postgres per DB-backed service plus Keycloak. Independent sizing and backups.
ClickHouse	Audit and registry still work; long-window scans return empty.	Full audit history and registry event stream.
HTTPS ingress	`kubectl port-forward` only.	`app.` / `api.` / `auth.` hostnames with TLS.
SMTP	Signup works; verification, reset and invite emails are dropped.	Email flows actually deliver.
Presidio	Prompts pass the LLM path unfiltered — no analyzer runs, since Piiranha is off by default too.	Inline PII detection on the relay path.

The production shape

Preset 8 is what a real deployment looks like. Abridged:

global.yaml

global:
  domain: swarmd.example.com
  ingress:
    enabled: true
    className: traefik
    tls:
      enabled: true
      secretName: swarmd-tls
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod

licence:
  existingSecretRef:
    name: swarmd-licence        # never inline in production
    key: value

postgres:
  mode: instance-per-service
  storage:
    size: 10Gi                  # default for anything not overridden
  perService:
    audit:
      storage: { size: 100Gi }  # heavy writer
    registry:
      storage: { size: 100Gi }  # heavy writer
    relay:
      storage: { size: 20Gi }

clickhouse:
  enabled: true
  deploy: true

smtp:
  enabled: true
  host: smtp.postmarkapp.com
  from: "no-reply@swarmd.example.com"
  credentialsSecret: smtp-creds

presidio:
  enabled: true
  deploy: true

It assumes three things exist before you install:

A TLS Secret named swarmd-tls, populated by cert-manager or by hand.
An SMTP credentials Secret with username and password.
A licence Secret with the key.

kubectl -n swarmd create secret generic smtp-creds \
  --from-literal=username='<smtp-user>' \
  --from-literal=password='<smtp-pass>'

kubectl -n swarmd create secret generic swarmd-licence \
  --from-literal=value='LIC-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'

Trying a preset on minikube

Every preset has been dry-run against a fresh minikube before shipping. To repeat it:

minikube delete
minikube start --memory=8192 --cpus=4      # 12288 for the per-service presets
minikube addons enable ingress             # only for the HTTPS presets

helm install swarmd deployments/h7s/swarmd -n swarmd --create-namespace \
  -f deployments/h7s/swarmd/presets/values-shared-pg-clickhouse.yaml \
  --set licence.existingSecretRef.name=swarmd-licence

For an HTTPS preset without real DNS, borrow nip.io and skip TLS:

  --set global.domain=$(minikube ip).nip.io \
  --set global.ingress.tls.enabled=false

The per-service presets run eight Postgres pods. On 8 GiB they will fight for memory and some will stay Pending — give minikube 12 GiB before blaming the chart.

Databases

What the Postgres axis actually changes.

Ingress

What the HTTPS axis actually changes.

Get started

How it works

Shape your deployment

Reference

Presets

Presets

Pick one

Installing from one

What the axes mean

The production shape

Trying a preset on minikube

Next

Databases

Ingress

​Presets

​Pick one

​Installing from one

​What the axes mean

​The production shape

​Trying a preset on minikube

​Next

Databases

Ingress

Presets

Pick one

Installing from one

What the axes mean

The production shape

Trying a preset on minikube

Next