fix(helm): default to secure, and say what insecure mode turns off - #213
Merged
Conversation
The chart shipped `insecure: true`, which disables TLS and auth. So the two install paths disagreed: curl https://xerj.org/get | sh auth on, admin key auto-generated 0600 helm install xerj ./deploy/helm auth off, TLS off The second is what production runs. The old comment even said "production users should set this to false", which is the wrong way round: a default should be safe and dev should opt out of it. Flips the default to false. The statefulset template already gates the flag on this value, so with it off the `--insecure` arg is simply not passed and the engine's own defaults apply (auth.enabled = true, admin key generated on first start). Adds NOTES.txt so the choice is visible at install time rather than buried in values.yaml. When insecure is on it names every port left open. When it is off it tells the operator how to read the generated admin key, and warns that the key crosses the network in cleartext while tls.enabled is false. Closes #205.
xerj-org
force-pushed
the
fix/helm-secure-default
branch
from
August 8, 2026 05:20
0124adf to
3e2a0a1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #205.
The chart shipped
insecure: true, disabling TLS and auth. The two install paths disagreed:The second is what production runs. The old comment said "production users should set this to false", which is backwards. A default should be safe and dev should opt out.
What changed
insecure: false. The statefulset template already gates the flag on this value (templates/statefulset.yaml:31-33), so with it off the--insecurearg is not passed and the engine's own defaults apply:auth.enabled = truewith an admin key generated 0600 on first start.Adds
NOTES.txt, which the chart did not have. The point is to make the choice visible at install time instead of buried in values.yaml:tls.enabledis falseNote for existing users: anyone who installed with the old default and did not set
insecureexplicitly will get an authenticated instance on upgrade. That is the intended direction, but it is a behaviour change and should be called out in the release notes.Not verified with
helm lintorhelm templatebecause helm is not installed here. The change is a one-value flip plus a new NOTES.txt, and the template conditional was read directly to confirm the flag is gated correctly.