diff --git a/k8s/papercrate/.helmignore b/k8s/papercrate/.helmignore
new file mode 100644
index 0000000..d7ea335
--- /dev/null
+++ b/k8s/papercrate/.helmignore
@@ -0,0 +1,9 @@
+# Common VCS dirs
+.git/
+.svn/
+.hg/
+
+# IDE files
+.idea/
+.vscode/
+.DS_Store
diff --git a/k8s/papercrate/Chart.yaml b/k8s/papercrate/Chart.yaml
new file mode 100644
index 0000000..b35719f
--- /dev/null
+++ b/k8s/papercrate/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: papercrate
+description: Helm chart for deploying the Papercrate application stack
+version: 0.1.0
+appVersion: "0.1.0"
diff --git a/k8s/papercrate/files/quickwit/documents-index.yaml b/k8s/papercrate/files/quickwit/documents-index.yaml
new file mode 100644
index 0000000..0fd479a
--- /dev/null
+++ b/k8s/papercrate/files/quickwit/documents-index.yaml
@@ -0,0 +1,28 @@
+version: 0.8
+index_id: documents
+doc_mapping:
+  tokenizers:
+    - name: substring
+      type: ngram
+      min_gram: 2
+      max_gram: 20
+      prefix_only: false
+  field_mappings:
+    - name: document_id
+      type: text
+      stored: true
+    - name: version_id
+      type: text
+      stored: true
+    - name: title
+      type: text
+      tokenizer: substring
+      stored: true
+    - name: text
+      type: text
+      tokenizer: substring
+      record: position
+search_settings:
+  default_search_fields:
+    - title
+    - text
diff --git a/k8s/papercrate/templates/NOTES.txt b/k8s/papercrate/templates/NOTES.txt
new file mode 100644
index 0000000..fc66568
--- /dev/null
+++ b/k8s/papercrate/templates/NOTES.txt
@@ -0,0 +1,6 @@
+1. Backend service: {{ include "papercrate.fullname" . }}-backend (port {{ .Values.backend.service.port }})
+2. Frontend service: {{- if .Values.frontend.enabled }} {{ include "papercrate.fullname" . }}-frontend (port {{ .Values.frontend.service.port }}){{ else }} disabled{{ end }}
+3. Quickwit service: {{- if .Values.quickwit.enabled }} {{ include "papercrate.fullname" . }}-quickwit (port {{ .Values.quickwit.service.port }}){{ else }} disabled{{ end }}
+4. Postgres service: {{- if .Values.postgres.enabled }} {{ include "papercrate.fullname" . }}-postgres:5432{{ else }} disabled{{ end }}
+
+Update values.yaml with your registry, tags, and secret references before installing.
diff --git a/k8s/papercrate/templates/_helpers.tpl b/k8s/papercrate/templates/_helpers.tpl
new file mode 100644
index 0000000..969b618
--- /dev/null
+++ b/k8s/papercrate/templates/_helpers.tpl
@@ -0,0 +1,67 @@
+{{- define "papercrate.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "papercrate.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "papercrate.labels" -}}
+app.kubernetes.io/name: {{ include "papercrate.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- range $key, $value := .Values.global.labels }}
+{{ $key }}: {{ $value | quote }}
+{{- end }}
+{{- end -}}
+
+{{- define "papercrate.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "papercrate.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "papercrate.image" -}}
+{{- $registry := .Values.global.imageRegistry -}}
+{{- $repository := .image.repository -}}
+{{- if $registry }}
+{{- printf "%s/%s" $registry $repository -}}
+{{- else -}}
+{{- $repository -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "papercrate.backend.image" -}}
+{{- include "papercrate.image" (dict "Values" .Values "image" .Values.backend.image) -}}
+{{- end -}}
+
+{{- define "papercrate.frontend.image" -}}
+{{- include "papercrate.image" (dict "Values" .Values "image" .Values.frontend.image) -}}
+{{- end -}}
+
+{{- define "papercrate.quickwit.image" -}}
+{{- include "papercrate.image" (dict "Values" .Values "image" .Values.quickwit.image) -}}
+{{- end -}}
+
+{{- define "papercrate.postgres.image" -}}
+{{- include "papercrate.image" (dict "Values" .Values "image" .Values.postgres.image) -}}
+{{- end -}}
+
+{{- define "papercrate.image.tag" -}}
+{{- if .image.tag -}}
+{{- .image.tag -}}
+{{- else -}}
+{{- .Chart.AppVersion -}}
+{{- end -}}
+{{- end -}}
diff --git a/k8s/papercrate/templates/backend-deployment.yaml b/k8s/papercrate/templates/backend-deployment.yaml
new file mode 100644
index 0000000..23dc09a
--- /dev/null
+++ b/k8s/papercrate/templates/backend-deployment.yaml
@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "papercrate.fullname" . }}-backend
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+spec:
+  replicas: {{ .Values.backend.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: backend
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: backend
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      containers:
+        - name: backend
+          image: {{ include "papercrate.backend.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.backend.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.backend.service.port }}
+              protocol: TCP
+          env:
+            - name: SERVER_HOST
+              value: 0.0.0.0
+            - name: SERVER_PORT
+              value: {{ .Values.backend.service.port | quote }}
+            {{- with .Values.global.s3.endpoint }}
+            - name: AWS_ENDPOINT_URL
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.region }}
+            - name: AWS_REGION
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.bucket }}
+            - name: S3_BUCKET
+              value: {{ . | quote }}
+            {{- end }}
+            {{- range .Values.backend.env.extra }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          envFrom:
+            - secretRef:
+                name: {{ if .Values.backend.env.existingSecret }}{{ .Values.backend.env.existingSecret }}{{ else }}{{ include "papercrate.fullname" . }}-backend-env{{ end }}
+            {{- with .Values.global.s3.credentialsSecret }}
+            - secretRef:
+                name: {{ . }}
+            {{- end }}
+            {{- range .Values.backend.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- with .Values.backend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.backend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/k8s/papercrate/templates/backend-secret.yaml b/k8s/papercrate/templates/backend-secret.yaml
new file mode 100644
index 0000000..6e4a37b
--- /dev/null
+++ b/k8s/papercrate/templates/backend-secret.yaml
@@ -0,0 +1,25 @@
+{{- if not .Values.backend.env.existingSecret }}
+{{- $jwt := required "backend.env.jwtSecret must be provided when auto-creating secret" .Values.backend.env.jwtSecret -}}
+{{- $config := dict "databaseUrl" .Values.backend.env.databaseUrl -}}
+{{- if not (index $config "databaseUrl") -}}
+  {{- if .Values.postgres.enabled -}}
+    {{- $dbUser := required "postgres.auth.username is required when postgres.enabled" .Values.postgres.auth.username -}}
+    {{- $dbPass := required "postgres.auth.password is required when postgres.enabled" .Values.postgres.auth.password -}}
+    {{- $dbName := default "papercrate" .Values.backend.env.databaseName -}}
+    {{- $dbHost := printf "%s-postgres" (include "papercrate.fullname" .) -}}
+    {{- $_ := set $config "databaseUrl" (printf "postgres://%s:%s@%s:5432/%s" $dbUser $dbPass $dbHost $dbName) -}}
+  {{- else -}}
+    {{- fail "backend.env.databaseUrl must be provided when postgres.enabled is false" -}}
+  {{- end -}}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "papercrate.fullname" . }}-backend-env
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+stringData:
+  JWT_SECRET: {{ $jwt | quote }}
+  DATABASE_URL: {{ index $config "databaseUrl" | quote }}
+{{- end }}
diff --git a/k8s/papercrate/templates/backend-service.yaml b/k8s/papercrate/templates/backend-service.yaml
new file mode 100644
index 0000000..29516b0
--- /dev/null
+++ b/k8s/papercrate/templates/backend-service.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "papercrate.fullname" . }}-backend
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+spec:
+  type: {{ .Values.backend.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.backend.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "papercrate.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
diff --git a/k8s/papercrate/templates/frontend-deployment.yaml b/k8s/papercrate/templates/frontend-deployment.yaml
new file mode 100644
index 0000000..2a6c7a0
--- /dev/null
+++ b/k8s/papercrate/templates/frontend-deployment.yaml
@@ -0,0 +1,69 @@
+{{- if .Values.frontend.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "papercrate.fullname" . }}-frontend
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: frontend
+spec:
+  replicas: {{ .Values.frontend.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: frontend
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: frontend
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      containers:
+        - name: frontend
+          image: {{ include "papercrate.frontend.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.frontend.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.frontend.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.frontend.service.port }}
+              protocol: TCP
+          env:
+            {{- range .Values.frontend.env.extra }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          {{- if or .Values.frontend.envFrom .Values.frontend.env.existingSecret }}
+          envFrom:
+            {{- if .Values.frontend.env.existingSecret }}
+            - secretRef:
+                name: {{ .Values.frontend.env.existingSecret }}
+            {{- end }}
+            {{- range .Values.frontend.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.frontend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.frontend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.frontend.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.frontend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
diff --git a/k8s/papercrate/templates/frontend-service.yaml b/k8s/papercrate/templates/frontend-service.yaml
new file mode 100644
index 0000000..7de163d
--- /dev/null
+++ b/k8s/papercrate/templates/frontend-service.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.frontend.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "papercrate.fullname" . }}-frontend
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: frontend
+spec:
+  type: {{ .Values.frontend.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.frontend.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "papercrate.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: frontend
+{{- end }}
diff --git a/k8s/papercrate/templates/ingress.yaml b/k8s/papercrate/templates/ingress.yaml
new file mode 100644
index 0000000..92a4905
--- /dev/null
+++ b/k8s/papercrate/templates/ingress.yaml
@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "papercrate.fullname" . }}
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ingress
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host }}
+      http:
+        paths:
+          {{- $root := $ }}
+          {{- $paths := .paths | default (list (dict "path" "/" "pathType" "Prefix" "service" (dict "name" "frontend" "port" "http")) (dict "path" "/api" "pathType" "Prefix" "service" (dict "name" "backend" "port" "http"))) }}
+          {{- range $paths }}
+          - path: {{ .path | default "/" }}
+            pathType: {{ .pathType | default "Prefix" }}
+            backend:
+              service:
+                name: {{ printf "%s-%s" (include "papercrate.fullname" $root) (.service.name | default "frontend") }}
+                port:
+                  {{- $port := .service.port | default "http" -}}
+                  {{- if kindIs "string" $port }}
+                  name: {{ $port }}
+                  {{- else }}
+                  number: {{ $port }}
+                  {{- end }}
+          {{- end }}
+    {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- toYaml .Values.ingress.tls | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/k8s/papercrate/templates/postgres-configmap.yaml b/k8s/papercrate/templates/postgres-configmap.yaml
new file mode 100644
index 0000000..ccf1c0b
--- /dev/null
+++ b/k8s/papercrate/templates/postgres-configmap.yaml
@@ -0,0 +1,27 @@
+{{- if and .Values.postgres.enabled .Values.postgres.auth.databases }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "papercrate.fullname" . }}-postgres-init
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+data:
+  init-databases.sh: |
+    #!/bin/sh
+    set -e
+    {{- range $name, $_ := .Values.postgres.auth.databases }}
+    if ! psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \
+      -tAc "SELECT 1 FROM pg_database WHERE datname = '{{ $name }}'" | grep -q 1; then
+      psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \
+        -c "CREATE DATABASE \"{{ $name }}\"";
+    fi
+    {{- end }}
+    if [ -n "$PGDATA" ] && [ -f "$PGDATA/postgresql.conf" ]; then
+      if grep -q "^max_connections" "$PGDATA/postgresql.conf"; then
+        sed -i "s/^max_connections.*/max_connections = {{ .Values.postgres.maxConnections | default 200 }}/" "$PGDATA/postgresql.conf"
+      else
+        echo "max_connections = {{ .Values.postgres.maxConnections | default 200 }}" >> "$PGDATA/postgresql.conf"
+      fi
+    fi
+{{- end }}
diff --git a/k8s/papercrate/templates/postgres-secret.yaml b/k8s/papercrate/templates/postgres-secret.yaml
new file mode 100644
index 0000000..d43946d
--- /dev/null
+++ b/k8s/papercrate/templates/postgres-secret.yaml
@@ -0,0 +1,13 @@
+{{- if and .Values.postgres.enabled .Values.postgres.auth.password }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "papercrate.fullname" . }}-postgres
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+type: Opaque
+data:
+  POSTGRES_USER: {{ .Values.postgres.auth.username | b64enc }}
+  POSTGRES_PASSWORD: {{ .Values.postgres.auth.password | b64enc }}
+{{- end }}
diff --git a/k8s/papercrate/templates/postgres-service.yaml b/k8s/papercrate/templates/postgres-service.yaml
new file mode 100644
index 0000000..8f7a6af
--- /dev/null
+++ b/k8s/papercrate/templates/postgres-service.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "papercrate.fullname" . }}-postgres
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  type: ClusterIP
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+      protocol: TCP
+  selector:
+    {{- include "papercrate.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+{{- end }}
diff --git a/k8s/papercrate/templates/postgres-statefulset.yaml b/k8s/papercrate/templates/postgres-statefulset.yaml
new file mode 100644
index 0000000..56d1923
--- /dev/null
+++ b/k8s/papercrate/templates/postgres-statefulset.yaml
@@ -0,0 +1,112 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "papercrate.fullname" . }}-postgres
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  serviceName: {{ include "papercrate.fullname" . }}-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: postgres
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: postgres
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      {{- $dbList := keys .Values.postgres.auth.databases }}
+      {{- $primaryDb := "" }}
+      {{- if gt (len $dbList) 0 }}
+      {{- $primaryDb = index $dbList 0 }}
+      {{- end }}
+      containers:
+        - name: postgres
+          image: {{ include "papercrate.postgres.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.postgres.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.postgres.image.pullPolicy }}
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "papercrate.fullname" . }}-postgres
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "papercrate.fullname" . }}-postgres
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_DB
+              value: {{ default "postgres" $primaryDb | quote }}
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            {{- if .Values.postgres.auth.databases }}
+            - name: init-scripts
+              mountPath: /docker-entrypoint-initdb.d/init-databases.sh
+              subPath: init-databases.sh
+            {{- end }}
+          {{- with .Values.postgres.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.postgres.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postgres.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postgres.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if or (not .Values.postgres.persistence.enabled) .Values.postgres.auth.databases }}
+      volumes:
+        {{- if not .Values.postgres.persistence.enabled }}
+        - name: data
+          emptyDir: {}
+        {{- end }}
+        {{- if .Values.postgres.auth.databases }}
+        - name: init-scripts
+          configMap:
+            name: {{ include "papercrate.fullname" . }}-postgres-init
+            defaultMode: 0755
+        {{- end }}
+      {{- end }}
+  {{- if .Values.postgres.persistence.enabled }}
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          {{- range .Values.postgres.persistence.accessModes }}
+          - {{ . }}
+          {{- end }}
+        {{- if .Values.postgres.persistence.storageClass }}
+        storageClassName: {{ .Values.postgres.persistence.storageClass }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.postgres.persistence.size }}
+  {{- end }}
+{{- end }}
diff --git a/k8s/papercrate/templates/quickwit-deployment.yaml b/k8s/papercrate/templates/quickwit-deployment.yaml
new file mode 100644
index 0000000..a6e0a6d
--- /dev/null
+++ b/k8s/papercrate/templates/quickwit-deployment.yaml
@@ -0,0 +1,98 @@
+{{- if .Values.quickwit.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "papercrate.fullname" . }}-quickwit
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: quickwit
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: quickwit
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      {{- $qw := dict "storageUri" .Values.quickwit.env.storageUri "metastoreUri" .Values.quickwit.env.metastoreUri -}}
+      {{- if and (not (index $qw "storageUri")) .Values.global.s3.bucket -}}
+        {{- $_ := set $qw "storageUri" (printf "s3://%s/quickwit" .Values.global.s3.bucket) -}}
+      {{- end -}}
+      {{- if not (index $qw "storageUri") -}}
+        {{- fail "quickwit.env.storageUri must be set, or provide global.s3.bucket" -}}
+      {{- end -}}
+      {{- if and (not (index $qw "metastoreUri")) .Values.postgres.enabled -}}
+        {{- $dbUser := required "postgres.auth.username is required when postgres.enabled" .Values.postgres.auth.username -}}
+        {{- $dbPass := required "postgres.auth.password is required when postgres.enabled" .Values.postgres.auth.password -}}
+        {{- $dbHost := printf "%s-postgres" (include "papercrate.fullname" .) -}}
+        {{- $_ := set $qw "metastoreUri" (printf "postgres://%s:%s@%s:5432/quickwit" $dbUser $dbPass $dbHost) -}}
+      {{- end -}}
+      {{- if not (index $qw "metastoreUri") -}}
+        {{- fail "quickwit.env.metastoreUri must be set when not using bundled Postgres" -}}
+      {{- end }}
+      containers:
+        - name: quickwit
+          image: {{ include "papercrate.quickwit.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.quickwit.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.quickwit.image.pullPolicy }}
+          args: ["run"]
+          ports:
+            - name: http
+              containerPort: {{ .Values.quickwit.service.port }}
+              protocol: TCP
+          env:
+            - name: QW_STORAGE_URI
+              value: {{ index $qw "storageUri" | quote }}
+            - name: QW_METASTORE_URI
+              value: {{ index $qw "metastoreUri" | quote }}
+            {{- with .Values.global.s3.endpoint }}
+            - name: AWS_ENDPOINT_URL
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.region }}
+            - name: AWS_REGION
+              value: {{ . | quote }}
+            {{- end }}
+            {{- range .Values.quickwit.env.extra }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          {{- if or .Values.quickwit.envFrom .Values.global.s3.credentialsSecret }}
+          envFrom:
+            {{- with .Values.global.s3.credentialsSecret }}
+            - secretRef:
+                name: {{ . }}
+            {{- end }}
+            {{- range .Values.quickwit.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.quickwit.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.quickwit.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.quickwit.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.quickwit.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
diff --git a/k8s/papercrate/templates/quickwit-index-configmap.yaml b/k8s/papercrate/templates/quickwit-index-configmap.yaml
new file mode 100644
index 0000000..99475c1
--- /dev/null
+++ b/k8s/papercrate/templates/quickwit-index-configmap.yaml
@@ -0,0 +1,34 @@
+{{- if and .Values.quickwit.enabled .Values.quickwit.indexJob.enabled .Values.quickwit.indexJob.indexConfig.create }}
+{{- $cfg := .Values.quickwit.indexJob.indexConfig -}}
+{{- $config := dict "value" "" -}}
+{{- if $cfg.file }}
+  {{- with $.Files.Get $cfg.file -}}
+    {{- $_ := set $config "value" . -}}
+  {{- end -}}
+{{- end -}}
+{{- if and (not (index $config "value")) $cfg.contents }}
+  {{- $_ := set $config "value" $cfg.contents -}}
+{{- end -}}
+{{- if eq (trim (default "" (index $config "value"))) "" -}}
+  {{- fail "Quickwit index configuration requires either indexConfig.file or indexConfig.contents" -}}
+{{- end }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "papercrate.fullname" . }}-quickwit-index
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit
+    app.kubernetes.io/part-of: quickwit-index
+data:
+  {{ $cfg.key }}: |
+{{ index $config "value" | indent 4 }}
+{{- $ctx := dict "storageUri" (.Values.quickwit.env.storageUri | default "") -}}
+{{- if and (eq (index $ctx "storageUri") "") .Values.global.s3.bucket -}}
+{{- $_ := set $ctx "storageUri" (printf "s3://%s/quickwit" .Values.global.s3.bucket) -}}
+{{- end -}}
+{{- $storageUri := index $ctx "storageUri" -}}
+{{- if $storageUri }}
+{{ printf "index_uri: %s/documents" (trimSuffix "/" $storageUri) | indent 4 }}
+{{- end }}
+{{- end }}
diff --git a/k8s/papercrate/templates/quickwit-index-job.yaml b/k8s/papercrate/templates/quickwit-index-job.yaml
new file mode 100644
index 0000000..3a09393
--- /dev/null
+++ b/k8s/papercrate/templates/quickwit-index-job.yaml
@@ -0,0 +1,78 @@
+{{- if and .Values.quickwit.enabled .Values.quickwit.indexJob.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "papercrate.fullname" . }}-quickwit-index
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit-index
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: {{ .Values.quickwit.indexJob.backoffLimit }}
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: quickwit-index
+    spec:
+      restartPolicy: Never
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      {{- $qw := dict "storageUri" .Values.quickwit.env.storageUri "metastoreUri" .Values.quickwit.env.metastoreUri -}}
+      {{- if and (not (index $qw "storageUri")) .Values.global.s3.bucket -}}
+        {{- $_ := set $qw "storageUri" (printf "s3://%s/quickwit" .Values.global.s3.bucket) -}}
+      {{- end -}}
+      {{- if not (index $qw "storageUri") -}}
+        {{- fail "quickwit.env.storageUri must be set, or provide global.s3.bucket" -}}
+      {{- end -}}
+      {{- if and (not (index $qw "metastoreUri")) .Values.postgres.enabled -}}
+        {{- $dbUser := required "postgres.auth.username is required when postgres.enabled" .Values.postgres.auth.username -}}
+        {{- $dbPass := required "postgres.auth.password is required when postgres.enabled" .Values.postgres.auth.password -}}
+        {{- $dbHost := printf "%s-postgres" (include "papercrate.fullname" .) -}}
+        {{- $_ := set $qw "metastoreUri" (printf "postgres://%s:%s@%s:5432/quickwit" $dbUser $dbPass $dbHost) -}}
+      {{- end -}}
+      {{- if not (index $qw "metastoreUri") -}}
+        {{- fail "quickwit.env.metastoreUri must be set when not using bundled Postgres" -}}
+      {{- end }}
+      containers:
+        - name: quickwit-index
+          image: {{ include "papercrate.quickwit.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.quickwit.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.quickwit.image.pullPolicy }}
+          command:
+            - quickwit
+            - index
+            - create
+          args:
+            - --index-config=/config/{{ .Values.quickwit.indexJob.indexConfig.key }}
+            - --endpoint=http://{{ include "papercrate.fullname" . }}-quickwit:{{ .Values.quickwit.service.port }}
+          {{- if or .Values.quickwit.envFrom .Values.global.s3.credentialsSecret }}
+          envFrom:
+            {{- with .Values.global.s3.credentialsSecret }}
+            - secretRef:
+                name: {{ . }}
+            {{- end }}
+            {{- range .Values.quickwit.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- end }}
+          {{- if or .Values.quickwit.indexJob.indexConfig.existingConfigMap .Values.quickwit.indexJob.indexConfig.create }}
+          volumeMounts:
+            - name: index-config
+              mountPath: /config
+          {{- end }}
+      {{- if or .Values.quickwit.indexJob.indexConfig.existingConfigMap .Values.quickwit.indexJob.indexConfig.create }}
+      volumes:
+        - name: index-config
+          configMap:
+            name: {{ if .Values.quickwit.indexJob.indexConfig.existingConfigMap }}{{ .Values.quickwit.indexJob.indexConfig.existingConfigMap }}{{ else }}{{ include "papercrate.fullname" . }}-quickwit-index{{ end }}
+      {{- end }}
+{{- end }}
diff --git a/k8s/papercrate/templates/quickwit-service.yaml b/k8s/papercrate/templates/quickwit-service.yaml
new file mode 100644
index 0000000..33f947a
--- /dev/null
+++ b/k8s/papercrate/templates/quickwit-service.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.quickwit.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "papercrate.fullname" . }}-quickwit
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit
+spec:
+  type: {{ .Values.quickwit.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.quickwit.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "papercrate.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit
+{{- end }}
diff --git a/k8s/papercrate/templates/worker-deployment.yaml b/k8s/papercrate/templates/worker-deployment.yaml
new file mode 100644
index 0000000..8779e90
--- /dev/null
+++ b/k8s/papercrate/templates/worker-deployment.yaml
@@ -0,0 +1,86 @@
+{{- if .Values.worker.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "papercrate.fullname" . }}-worker
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: worker
+spec:
+  replicas: {{ .Values.worker.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: worker
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: worker
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      {{- $workerSecrets := dict "primary" "" -}}
+      {{- if .Values.worker.env.existingSecret -}}
+        {{- $_ := set $workerSecrets "primary" .Values.worker.env.existingSecret -}}
+      {{- else if .Values.backend.env.existingSecret -}}
+        {{- $_ := set $workerSecrets "primary" .Values.backend.env.existingSecret -}}
+      {{- else -}}
+        {{- $_ := set $workerSecrets "primary" (printf "%s-backend-env" (include "papercrate.fullname" .)) -}}
+      {{- end }}
+      containers:
+        - name: worker
+          image: {{ include "papercrate.backend.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.backend.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
+          command: ["/usr/local/bin/papercrate-worker"]
+          env:
+            {{- with .Values.global.s3.endpoint }}
+            - name: AWS_ENDPOINT_URL
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.region }}
+            - name: AWS_REGION
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.bucket }}
+            - name: S3_BUCKET
+              value: {{ . | quote }}
+            {{- end }}
+            {{- range .Values.worker.env.extra }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          envFrom:
+            - secretRef:
+                name: {{ index $workerSecrets "primary" }}
+            {{- with .Values.global.s3.credentialsSecret }}
+            - secretRef:
+                name: {{ . }}
+            {{- end }}
+            {{- range .Values.worker.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- with .Values.worker.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.worker.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
diff --git a/k8s/papercrate/values.yaml b/k8s/papercrate/values.yaml
new file mode 100644
index 0000000..7d99c5e
--- /dev/null
+++ b/k8s/papercrate/values.yaml
@@ -0,0 +1,137 @@
+global:
+  imageRegistry: ""
+  imagePullSecrets:
+    - papercrate-regcred
+  labels: {}
+  s3:
+    endpoint: http://minio:9000
+    region: us-east-1
+    bucket: documents
+    credentialsSecret: ""
+
+backend:
+  replicaCount: 1
+  image:
+    repository: registry.example.com/papercrate-backend
+    tag: ""
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 3000
+  env:
+    existingSecret: ""
+    extra: []
+    jwtSecret: ""
+  envFrom: []
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+worker:
+  replicaCount: 1
+  enabled: true
+  env:
+    existingSecret: ""
+    extra: []
+  envFrom: []
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+frontend:
+  enabled: true
+  replicaCount: 1
+  image:
+    repository: registry.example.com/papercrate-frontend
+    tag: ""
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 80
+  env:
+    existingSecret: ""
+    extra: []
+  envFrom: []
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: app.papercrate.local
+      paths:
+        - path: /
+          pathType: Prefix
+          service:
+            name: frontend
+            port: http
+    - host: api.papercrate.local
+      paths:
+        - path: /
+          pathType: Prefix
+          service:
+            name: backend
+            port: http
+  tls: []
+
+postgres:
+  enabled: true
+  image:
+    repository: postgres
+    tag: "16-alpine"
+    pullPolicy: IfNotPresent
+  auth:
+    username: papercrate
+    password: papercrate_dev
+    databases:
+      papercrate: {}
+      quickwit: {}
+  maxConnections: 200
+  persistence:
+    enabled: true
+    accessModes:
+      - ReadWriteOnce
+    size: 10Gi
+    storageClass: ""
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+quickwit:
+  enabled: true
+  image:
+    repository: quickwit/quickwit
+    tag: "0.8.2"
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 7280
+  env:
+    storageUri: ""
+    metastoreUri: ""
+    extra: []
+  envFrom: []
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  indexJob:
+    enabled: true
+    backoffLimit: 3
+    indexConfig:
+      existingConfigMap: ""
+      key: documents-index.yaml
+      create: true
+      file: files/quickwit/documents-index.yaml
+      contents: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""