> ## Documentation Index
> Fetch the complete documentation index at: https://docs.swarmd.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Presets

> Eight tested values files, from a laptop demo to a hardened production install.

# Presets

Rather than assembling a `values.yaml` from scratch, start from one of eight
tested shapes and edit it. Every preset is a valid, complete starting point;
filenames are literal — every feature that's on appears in the name.

They live in `deployments/h7s/swarmd/presets/`.

***

## Pick one

| # | Preset                                                 | Postgres    | ClickHouse | HTTPS | SMTP | Presidio | Best for                               |
| - | ------------------------------------------------------ | ----------- | :--------: | :---: | :--: | :------: | -------------------------------------- |
| 1 | `values-shared-pg`                                     | shared      |      —     |   —   |   —  |     —    | Prove it runs on your laptop           |
| 2 | `values-shared-pg-clickhouse`                          | shared      |      ✅     |   —   |   —  |     —    | Laptop demo with full audit history    |
| 3 | `values-shared-pg-clickhouse-https`                    | shared      |      ✅     |   ✅   |   —  |     —    | First real hostname, no user email yet |
| 4 | `values-shared-pg-clickhouse-https-smtp`               | shared      |      ✅     |   ✅   |   ✅  |     —    | Real users on a single Postgres        |
| 5 | `values-shared-pg-clickhouse-https-smtp-presidio`      | shared      |      ✅     |   ✅   |   ✅  |     ✅    | Real users + PII detection             |
| 6 | `values-per-service-pg`                                | per-service |      —     |   —   |   —  |     —    | Proving the per-service shape locally  |
| 7 | `values-per-service-pg-clickhouse`                     | per-service |      ✅     |   —   |   —  |     —    | Pre-production sizing test             |
| 8 | `values-per-service-pg-clickhouse-https-smtp-presidio` | per-service |      ✅     |   ✅   |   ✅  |     ✅    | **Hardened production**                |

Two ladders, and the trick is that **each rung adds exactly one feature**. Diff
two adjacent files and you see precisely what that feature costs you in
configuration:

```bash theme={null}
diff presets/values-shared-pg-clickhouse.yaml \
     presets/values-shared-pg-clickhouse-https.yaml
```

<Tip>
  Pick the **highest-numbered preset whose feature set you actually need**, then
  customise. Starting low and adding features by hand is how you end up with a
  values file nobody can review.
</Tip>

***

## Installing from one

```bash theme={null}
helm install swarmd deployments/h7s/swarmd \
  --namespace swarmd --create-namespace \
  -f deployments/h7s/swarmd/presets/values-shared-pg.yaml \
  --set licence.existingSecretRef.name=swarmd-licence
```

Each preset's header comment carries its own exact install command, the
persona it's for, and the pre-work it assumes.

***

## What the axes mean

| Axis                | Off                                                                                            | On                                                                                                |
| ------------------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Postgres layout** | `shared` — one Postgres, one PVC. Simplest.                                                    | `per-service` — one Postgres per DB-backed service plus Keycloak. Independent sizing and backups. |
| **ClickHouse**      | Audit and registry still work; long-window scans return empty.                                 | Full audit history and registry event stream.                                                     |
| **HTTPS ingress**   | `kubectl port-forward` only.                                                                   | `app.` / `api.` / `auth.` hostnames with TLS.                                                     |
| **SMTP**            | Signup works; verification, reset and invite emails are dropped.                               | Email flows actually deliver.                                                                     |
| **Presidio**        | Prompts pass the LLM path unfiltered — no analyzer runs, since Piiranha is off by default too. | Inline PII detection on the relay path.                                                           |

***

## The production shape

Preset 8 is what a real deployment looks like. Abridged:

```yaml global.yaml theme={null}
global:
  domain: swarmd.example.com
  ingress:
    enabled: true
    className: traefik
    tls:
      enabled: true
      secretName: swarmd-tls
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod

licence:
  existingSecretRef:
    name: swarmd-licence        # never inline in production
    key: value

postgres:
  mode: instance-per-service
  storage:
    size: 10Gi                  # default for anything not overridden
  perService:
    audit:
      storage: { size: 100Gi }  # heavy writer
    registry:
      storage: { size: 100Gi }  # heavy writer
    relay:
      storage: { size: 20Gi }

clickhouse:
  enabled: true
  deploy: true

smtp:
  enabled: true
  host: smtp.postmarkapp.com
  from: "no-reply@swarmd.example.com"
  credentialsSecret: smtp-creds

presidio:
  enabled: true
  deploy: true
```

It assumes three things exist before you install:

1. **A TLS Secret** named `swarmd-tls`, populated by cert-manager or by hand.
2. **An SMTP credentials Secret** with `username` and `password`.
3. **A licence Secret** with the key.

```bash theme={null}
kubectl -n swarmd create secret generic smtp-creds \
  --from-literal=username='<smtp-user>' \
  --from-literal=password='<smtp-pass>'

kubectl -n swarmd create secret generic swarmd-licence \
  --from-literal=value='LIC-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
```

***

## Trying a preset on minikube

Every preset has been dry-run against a fresh minikube before shipping. To
repeat it:

```bash theme={null}
minikube delete
minikube start --memory=8192 --cpus=4      # 12288 for the per-service presets
minikube addons enable ingress             # only for the HTTPS presets

helm install swarmd deployments/h7s/swarmd -n swarmd --create-namespace \
  -f deployments/h7s/swarmd/presets/values-shared-pg-clickhouse.yaml \
  --set licence.existingSecretRef.name=swarmd-licence
```

For an HTTPS preset without real DNS, borrow `nip.io` and skip TLS:

```bash theme={null}
  --set global.domain=$(minikube ip).nip.io \
  --set global.ingress.tls.enabled=false
```

<Note>
  The per-service presets run eight Postgres pods. On 8 GiB they will fight for
  memory and some will stay `Pending` — give minikube 12 GiB before blaming the
  chart.
</Note>

***

## Next

<CardGroup cols={2}>
  <Card title="Databases" icon="database" href="/self-hosting/databases">
    What the Postgres axis actually changes.
  </Card>

  <Card title="Ingress" icon="globe" href="/self-hosting/ingress">
    What the HTTPS axis actually changes.
  </Card>
</CardGroup>