frontend: fix uploads

frontend/src/index.jsx

@@ -3050,122 +3050,122 @@ const AppLayout = () => {
     }
 
     const items = Array.from(dataTransfer.items || []);
-    const results = [];
+    console.info('[Uploads] drop start', { items: items.length, files: (dataTransfer.files || []).length });
 
-    const pushFile = (file, ancestors) => {
+    const results = [];
-      if (file) {
+    const seenKeys = new Set();
-        results.push({
+
-          file,
+    const pushFile = (file, ancestors = []) => {
-          segments: (ancestors || []).filter(Boolean),
+      if (!file) return;
+      const segments = (ancestors || []).filter(Boolean);
+      const key = `${segments.join('/')}/${file.name}:${file.size}`;
+      if (seenKeys.has(key)) {
+        // skipped duplicate
+        return;
+      }
+      seenKeys.add(key);
+      results.push({ file, segments });
+      // queued file
+    };
+
+    const readAllEntries = async (reader) => {
+      const entries = [];
+      while (true) {
+        // eslint-disable-next-line no-await-in-loop
+        const batch = await new Promise((resolve, reject) => reader.readEntries(resolve, reject));
+        if (!batch.length) {
+          break;
+        }
+        entries.push(...batch);
+      }
+      return entries;
+    };
+
+    const walkEntry = async (entry, ancestors = []) => {
+      if (!entry) return;
+      if (entry.isFile) {
+        const file = await new Promise((resolve, reject) => {
+          try {
+            entry.file(resolve, reject);
+          } catch (error) {
+            console.warn('[Uploads] entry.file failed', error);
+            reject(error);
+          }
         });
+        pushFile(file, ancestors);
+        return;
+      }
+      if (entry.isDirectory) {
+        const nextAncestors = entry.name ? [...ancestors, entry.name] : [...ancestors];
+        const reader = entry.createReader();
+        const entries = await readAllEntries(reader);
+        for (const child of entries) {
+          // eslint-disable-next-line no-await-in-loop
+          await walkEntry(child, nextAncestors);
+        }
       }
     };
 
-    const supportsFileSystemAccess =
+    await Promise.all(
-      window.isSecureContext &&
+      items.map(async (item, index) => {
-      items.some((item) => typeof item.getAsFileSystemHandle === 'function');
+        if (item.kind !== 'file') return;
-    const supportsWebkitEntries = items.some(
+
-      (item) => typeof item.webkitGetAsEntry === 'function',
+        const fileFromItem = typeof item.getAsFile === 'function' ? item.getAsFile() : null;
+        if (fileFromItem) {
+          const relativePath =
+            typeof fileFromItem.webkitRelativePath === 'string' ? fileFromItem.webkitRelativePath : '';
+          const segments = relativePath
+            ? relativePath
+                .split('/')
+                .slice(0, -1)
+                .filter(Boolean)
+            : [];
+          pushFile(fileFromItem, segments);
+        }
+
+        if (typeof item.webkitGetAsEntry === 'function') {
+          try {
+            const entry = item.webkitGetAsEntry();
+            if (entry) {
+              // processing entry
+              await walkEntry(entry, []);
+              return;
+            }
+          } catch (error) {
+            console.warn('[Uploads] webkitGetAsEntry failed', error);
+          }
+        }
+
+        if (!fileFromItem) {
+          console.info('[Uploads] item missing file handle', index);
+        }
+      }),
     );
 
-    if (supportsFileSystemAccess) {
+    Array.from(dataTransfer.files || []).forEach((file, index) => {
-      const walkDirectoryHandle = async (handle, ancestors) => {
+      if (!file) return;
-        const nextAncestors = handle.name ? [...ancestors, handle.name] : [...ancestors];
+      // FileList entry suppressed
-        for await (const child of handle.values()) {
+      const relativePath =
-          if (child.kind === 'file') {
+        typeof file.webkitRelativePath === 'string' ? file.webkitRelativePath : '';
-            const file = await child.getFile();
+      const segments = relativePath
-            pushFile(file, nextAncestors);
+        ? relativePath
-          } else if (child.kind === 'directory') {
+            .split('/')
-            // eslint-disable-next-line no-await-in-loop
+            .slice(0, -1)
-            await walkDirectoryHandle(child, nextAncestors);
+            .filter(Boolean)
-          }
+        : [];
-        }
+      pushFile(file, segments);
-      };
+    });
-
-      for (const item of items) {
-        if (item.kind !== 'file') continue;
-        const getHandle = item.getAsFileSystemHandle?.bind(item);
-        if (!getHandle) {
-          continue;
-        }
-
-        // eslint-disable-next-line no-await-in-loop
-        const handle = await getHandle();
-        if (!handle) continue;
-
-        if (handle.kind === 'file') {
-          // eslint-disable-next-line no-await-in-loop
-          const file = await handle.getFile();
-          pushFile(file, []);
-        } else if (handle.kind === 'directory') {
-          // eslint-disable-next-line no-await-in-loop
-          await walkDirectoryHandle(handle, []);
-        }
-      }
-    } else if (supportsWebkitEntries) {
-      const walkWebkitEntry = async (entry, ancestors) => {
-        if (!entry) return;
-        if (entry.isFile) {
-          const file = await new Promise((resolve, reject) => {
-            entry.file(resolve, reject);
-          });
-          pushFile(file, ancestors);
-          return;
-        }
-        if (entry.isDirectory) {
-          const nextAncestors = entry.name ? [...ancestors, entry.name] : [...ancestors];
-          const reader = entry.createReader();
-          const readEntries = () =>
-            new Promise((resolve, reject) => {
-              reader.readEntries(resolve, reject);
-            });
-
-          // eslint-disable-next-line no-constant-condition
-          while (true) {
-            // eslint-disable-next-line no-await-in-loop
-            const batch = await readEntries();
-            if (!batch.length) {
-              break;
-            }
-            // eslint-disable-next-line no-await-in-loop
-            for (const child of batch) {
-              // eslint-disable-next-line no-await-in-loop
-              await walkWebkitEntry(child, nextAncestors);
-            }
-          }
-        }
-      };
-
-      for (const item of items) {
-        const entry =
-          typeof item.webkitGetAsEntry === 'function' ? item.webkitGetAsEntry() : null;
-        if (!entry) continue;
-        // eslint-disable-next-line no-await-in-loop
-        await walkWebkitEntry(entry, []);
-      }
-    } else {
-      const files = Array.from(dataTransfer.files || []);
-      files.forEach((file) => {
-        if (!file) return;
-        const relativePath =
-          typeof file.webkitRelativePath === 'string' ? file.webkitRelativePath : '';
-        const segments = relativePath
-          ? relativePath
-              .split('/')
-              .slice(0, -1)
-              .filter(Boolean)
-          : [];
-        pushFile(file, segments);
-      });
-    }
 
     if (!results.length) {
       throw new Error('No files detected in drop payload.');
     }
 
+    console.info('[Uploads] prepared files', results.length);
+
     return results;
   }, []);
 
+
   const handleFileDrop = useCallback(
     async (dataTransfer, targetFolderId) => {
       if (!token) {

k8s/papercrate/.helmignore

@@ -0,0 +1,9 @@
+# Common VCS dirs
+.git/
+.svn/
+.hg/
+
+# IDE files
+.idea/
+.vscode/
+.DS_Store

k8s/papercrate/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: papercrate
+description: Helm chart for deploying the Papercrate application stack
+version: 0.1.0
+appVersion: "0.1.0"

k8s/papercrate/files/quickwit/documents-index.yaml

@@ -0,0 +1,28 @@
+version: 0.8
+index_id: documents
+doc_mapping:
+  tokenizers:
+    - name: substring
+      type: ngram
+      min_gram: 2
+      max_gram: 20
+      prefix_only: false
+  field_mappings:
+    - name: document_id
+      type: text
+      stored: true
+    - name: version_id
+      type: text
+      stored: true
+    - name: title
+      type: text
+      tokenizer: substring
+      stored: true
+    - name: text
+      type: text
+      tokenizer: substring
+      record: position
+search_settings:
+  default_search_fields:
+    - title
+    - text

k8s/papercrate/templates/NOTES.txt

@@ -0,0 +1,6 @@
+1. Backend service: {{ include "papercrate.fullname" . }}-backend (port {{ .Values.backend.service.port }})
+2. Frontend service: {{- if .Values.frontend.enabled }} {{ include "papercrate.fullname" . }}-frontend (port {{ .Values.frontend.service.port }}){{ else }} disabled{{ end }}
+3. Quickwit service: {{- if .Values.quickwit.enabled }} {{ include "papercrate.fullname" . }}-quickwit (port {{ .Values.quickwit.service.port }}){{ else }} disabled{{ end }}
+4. Postgres service: {{- if .Values.postgres.enabled }} {{ include "papercrate.fullname" . }}-postgres:5432{{ else }} disabled{{ end }}
+
+Update values.yaml with your registry, tags, and secret references before installing.

k8s/papercrate/templates/_helpers.tpl

@@ -0,0 +1,67 @@
+{{- define "papercrate.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "papercrate.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "papercrate.labels" -}}
+app.kubernetes.io/name: {{ include "papercrate.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- range $key, $value := .Values.global.labels }}
+{{ $key }}: {{ $value | quote }}
+{{- end }}
+{{- end -}}
+
+{{- define "papercrate.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "papercrate.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "papercrate.image" -}}
+{{- $registry := .Values.global.imageRegistry -}}
+{{- $repository := .image.repository -}}
+{{- if $registry }}
+{{- printf "%s/%s" $registry $repository -}}
+{{- else -}}
+{{- $repository -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "papercrate.backend.image" -}}
+{{- include "papercrate.image" (dict "Values" .Values "image" .Values.backend.image) -}}
+{{- end -}}
+
+{{- define "papercrate.frontend.image" -}}
+{{- include "papercrate.image" (dict "Values" .Values "image" .Values.frontend.image) -}}
+{{- end -}}
+
+{{- define "papercrate.quickwit.image" -}}
+{{- include "papercrate.image" (dict "Values" .Values "image" .Values.quickwit.image) -}}
+{{- end -}}
+
+{{- define "papercrate.postgres.image" -}}
+{{- include "papercrate.image" (dict "Values" .Values "image" .Values.postgres.image) -}}
+{{- end -}}
+
+{{- define "papercrate.image.tag" -}}
+{{- if .image.tag -}}
+{{- .image.tag -}}
+{{- else -}}
+{{- .Chart.AppVersion -}}
+{{- end -}}
+{{- end -}}

k8s/papercrate/templates/backend-deployment.yaml

@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "papercrate.fullname" . }}-backend
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+spec:
+  replicas: {{ .Values.backend.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: backend
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: backend
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      containers:
+        - name: backend
+          image: {{ include "papercrate.backend.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.backend.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.backend.service.port }}
+              protocol: TCP
+          env:
+            - name: SERVER_HOST
+              value: 0.0.0.0
+            - name: SERVER_PORT
+              value: {{ .Values.backend.service.port | quote }}
+            {{- with .Values.global.s3.endpoint }}
+            - name: AWS_ENDPOINT_URL
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.region }}
+            - name: AWS_REGION
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.bucket }}
+            - name: S3_BUCKET
+              value: {{ . | quote }}
+            {{- end }}
+            {{- range .Values.backend.env.extra }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          envFrom:
+            - secretRef:
+                name: {{ if .Values.backend.env.existingSecret }}{{ .Values.backend.env.existingSecret }}{{ else }}{{ include "papercrate.fullname" . }}-backend-env{{ end }}
+            {{- with .Values.global.s3.credentialsSecret }}
+            - secretRef:
+                name: {{ . }}
+            {{- end }}
+            {{- range .Values.backend.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- with .Values.backend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.backend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

k8s/papercrate/templates/backend-secret.yaml

@@ -0,0 +1,25 @@
+{{- if not .Values.backend.env.existingSecret }}
+{{- $jwt := required "backend.env.jwtSecret must be provided when auto-creating secret" .Values.backend.env.jwtSecret -}}
+{{- $config := dict "databaseUrl" .Values.backend.env.databaseUrl -}}
+{{- if not (index $config "databaseUrl") -}}
+  {{- if .Values.postgres.enabled -}}
+    {{- $dbUser := required "postgres.auth.username is required when postgres.enabled" .Values.postgres.auth.username -}}
+    {{- $dbPass := required "postgres.auth.password is required when postgres.enabled" .Values.postgres.auth.password -}}
+    {{- $dbName := default "papercrate" .Values.backend.env.databaseName -}}
+    {{- $dbHost := printf "%s-postgres" (include "papercrate.fullname" .) -}}
+    {{- $_ := set $config "databaseUrl" (printf "postgres://%s:%s@%s:5432/%s" $dbUser $dbPass $dbHost $dbName) -}}
+  {{- else -}}
+    {{- fail "backend.env.databaseUrl must be provided when postgres.enabled is false" -}}
+  {{- end -}}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "papercrate.fullname" . }}-backend-env
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+stringData:
+  JWT_SECRET: {{ $jwt | quote }}
+  DATABASE_URL: {{ index $config "databaseUrl" | quote }}
+{{- end }}

k8s/papercrate/templates/backend-service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "papercrate.fullname" . }}-backend
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+spec:
+  type: {{ .Values.backend.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.backend.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "papercrate.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: backend

k8s/papercrate/templates/frontend-deployment.yaml

@@ -0,0 +1,69 @@
+{{- if .Values.frontend.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "papercrate.fullname" . }}-frontend
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: frontend
+spec:
+  replicas: {{ .Values.frontend.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: frontend
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: frontend
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      containers:
+        - name: frontend
+          image: {{ include "papercrate.frontend.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.frontend.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.frontend.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.frontend.service.port }}
+              protocol: TCP
+          env:
+            {{- range .Values.frontend.env.extra }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          {{- if or .Values.frontend.envFrom .Values.frontend.env.existingSecret }}
+          envFrom:
+            {{- if .Values.frontend.env.existingSecret }}
+            - secretRef:
+                name: {{ .Values.frontend.env.existingSecret }}
+            {{- end }}
+            {{- range .Values.frontend.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.frontend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.frontend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.frontend.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.frontend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

k8s/papercrate/templates/frontend-service.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.frontend.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "papercrate.fullname" . }}-frontend
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: frontend
+spec:
+  type: {{ .Values.frontend.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.frontend.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "papercrate.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: frontend
+{{- end }}

k8s/papercrate/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "papercrate.fullname" . }}
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ingress
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host }}
+      http:
+        paths:
+          {{- $root := $ }}
+          {{- $paths := .paths | default (list (dict "path" "/" "pathType" "Prefix" "service" (dict "name" "frontend" "port" "http")) (dict "path" "/api" "pathType" "Prefix" "service" (dict "name" "backend" "port" "http"))) }}
+          {{- range $paths }}
+          - path: {{ .path | default "/" }}
+            pathType: {{ .pathType | default "Prefix" }}
+            backend:
+              service:
+                name: {{ printf "%s-%s" (include "papercrate.fullname" $root) (.service.name | default "frontend") }}
+                port:
+                  {{- $port := .service.port | default "http" -}}
+                  {{- if kindIs "string" $port }}
+                  name: {{ $port }}
+                  {{- else }}
+                  number: {{ $port }}
+                  {{- end }}
+          {{- end }}
+    {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- toYaml .Values.ingress.tls | nindent 4 }}
+  {{- end }}
+{{- end }}

k8s/papercrate/templates/postgres-configmap.yaml

@@ -0,0 +1,27 @@
+{{- if and .Values.postgres.enabled .Values.postgres.auth.databases }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "papercrate.fullname" . }}-postgres-init
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+data:
+  init-databases.sh: |
+    #!/bin/sh
+    set -e
+    {{- range $name, $_ := .Values.postgres.auth.databases }}
+    if ! psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \
+      -tAc "SELECT 1 FROM pg_database WHERE datname = '{{ $name }}'" | grep -q 1; then
+      psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres \
+        -c "CREATE DATABASE \"{{ $name }}\"";
+    fi
+    {{- end }}
+    if [ -n "$PGDATA" ] && [ -f "$PGDATA/postgresql.conf" ]; then
+      if grep -q "^max_connections" "$PGDATA/postgresql.conf"; then
+        sed -i "s/^max_connections.*/max_connections = {{ .Values.postgres.maxConnections | default 200 }}/" "$PGDATA/postgresql.conf"
+      else
+        echo "max_connections = {{ .Values.postgres.maxConnections | default 200 }}" >> "$PGDATA/postgresql.conf"
+      fi
+    fi
+{{- end }}

k8s/papercrate/templates/postgres-secret.yaml

@@ -0,0 +1,13 @@
+{{- if and .Values.postgres.enabled .Values.postgres.auth.password }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "papercrate.fullname" . }}-postgres
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+type: Opaque
+data:
+  POSTGRES_USER: {{ .Values.postgres.auth.username | b64enc }}
+  POSTGRES_PASSWORD: {{ .Values.postgres.auth.password | b64enc }}
+{{- end }}

k8s/papercrate/templates/postgres-service.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "papercrate.fullname" . }}-postgres
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  type: ClusterIP
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+      protocol: TCP
+  selector:
+    {{- include "papercrate.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+{{- end }}

k8s/papercrate/templates/postgres-statefulset.yaml

@@ -0,0 +1,112 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "papercrate.fullname" . }}-postgres
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  serviceName: {{ include "papercrate.fullname" . }}-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: postgres
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: postgres
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      {{- $dbList := keys .Values.postgres.auth.databases }}
+      {{- $primaryDb := "" }}
+      {{- if gt (len $dbList) 0 }}
+      {{- $primaryDb = index $dbList 0 }}
+      {{- end }}
+      containers:
+        - name: postgres
+          image: {{ include "papercrate.postgres.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.postgres.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.postgres.image.pullPolicy }}
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "papercrate.fullname" . }}-postgres
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "papercrate.fullname" . }}-postgres
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_DB
+              value: {{ default "postgres" $primaryDb | quote }}
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            {{- if .Values.postgres.auth.databases }}
+            - name: init-scripts
+              mountPath: /docker-entrypoint-initdb.d/init-databases.sh
+              subPath: init-databases.sh
+            {{- end }}
+          {{- with .Values.postgres.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.postgres.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postgres.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postgres.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if or (not .Values.postgres.persistence.enabled) .Values.postgres.auth.databases }}
+      volumes:
+        {{- if not .Values.postgres.persistence.enabled }}
+        - name: data
+          emptyDir: {}
+        {{- end }}
+        {{- if .Values.postgres.auth.databases }}
+        - name: init-scripts
+          configMap:
+            name: {{ include "papercrate.fullname" . }}-postgres-init
+            defaultMode: 0755
+        {{- end }}
+      {{- end }}
+  {{- if .Values.postgres.persistence.enabled }}
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          {{- range .Values.postgres.persistence.accessModes }}
+          - {{ . }}
+          {{- end }}
+        {{- if .Values.postgres.persistence.storageClass }}
+        storageClassName: {{ .Values.postgres.persistence.storageClass }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.postgres.persistence.size }}
+  {{- end }}
+{{- end }}

k8s/papercrate/templates/quickwit-deployment.yaml

@@ -0,0 +1,98 @@
+{{- if .Values.quickwit.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "papercrate.fullname" . }}-quickwit
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: quickwit
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: quickwit
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      {{- $qw := dict "storageUri" .Values.quickwit.env.storageUri "metastoreUri" .Values.quickwit.env.metastoreUri -}}
+      {{- if and (not (index $qw "storageUri")) .Values.global.s3.bucket -}}
+        {{- $_ := set $qw "storageUri" (printf "s3://%s/quickwit" .Values.global.s3.bucket) -}}
+      {{- end -}}
+      {{- if not (index $qw "storageUri") -}}
+        {{- fail "quickwit.env.storageUri must be set, or provide global.s3.bucket" -}}
+      {{- end -}}
+      {{- if and (not (index $qw "metastoreUri")) .Values.postgres.enabled -}}
+        {{- $dbUser := required "postgres.auth.username is required when postgres.enabled" .Values.postgres.auth.username -}}
+        {{- $dbPass := required "postgres.auth.password is required when postgres.enabled" .Values.postgres.auth.password -}}
+        {{- $dbHost := printf "%s-postgres" (include "papercrate.fullname" .) -}}
+        {{- $_ := set $qw "metastoreUri" (printf "postgres://%s:%s@%s:5432/quickwit" $dbUser $dbPass $dbHost) -}}
+      {{- end -}}
+      {{- if not (index $qw "metastoreUri") -}}
+        {{- fail "quickwit.env.metastoreUri must be set when not using bundled Postgres" -}}
+      {{- end }}
+      containers:
+        - name: quickwit
+          image: {{ include "papercrate.quickwit.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.quickwit.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.quickwit.image.pullPolicy }}
+          args: ["run"]
+          ports:
+            - name: http
+              containerPort: {{ .Values.quickwit.service.port }}
+              protocol: TCP
+          env:
+            - name: QW_STORAGE_URI
+              value: {{ index $qw "storageUri" | quote }}
+            - name: QW_METASTORE_URI
+              value: {{ index $qw "metastoreUri" | quote }}
+            {{- with .Values.global.s3.endpoint }}
+            - name: AWS_ENDPOINT_URL
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.region }}
+            - name: AWS_REGION
+              value: {{ . | quote }}
+            {{- end }}
+            {{- range .Values.quickwit.env.extra }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          {{- if or .Values.quickwit.envFrom .Values.global.s3.credentialsSecret }}
+          envFrom:
+            {{- with .Values.global.s3.credentialsSecret }}
+            - secretRef:
+                name: {{ . }}
+            {{- end }}
+            {{- range .Values.quickwit.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.quickwit.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.quickwit.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.quickwit.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.quickwit.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

k8s/papercrate/templates/quickwit-index-configmap.yaml

@@ -0,0 +1,34 @@
+{{- if and .Values.quickwit.enabled .Values.quickwit.indexJob.enabled .Values.quickwit.indexJob.indexConfig.create }}
+{{- $cfg := .Values.quickwit.indexJob.indexConfig -}}
+{{- $config := dict "value" "" -}}
+{{- if $cfg.file }}
+  {{- with $.Files.Get $cfg.file -}}
+    {{- $_ := set $config "value" . -}}
+  {{- end -}}
+{{- end -}}
+{{- if and (not (index $config "value")) $cfg.contents }}
+  {{- $_ := set $config "value" $cfg.contents -}}
+{{- end -}}
+{{- if eq (trim (default "" (index $config "value"))) "" -}}
+  {{- fail "Quickwit index configuration requires either indexConfig.file or indexConfig.contents" -}}
+{{- end }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "papercrate.fullname" . }}-quickwit-index
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit
+    app.kubernetes.io/part-of: quickwit-index
+data:
+  {{ $cfg.key }}: |
+{{ index $config "value" | indent 4 }}
+{{- $ctx := dict "storageUri" (.Values.quickwit.env.storageUri | default "") -}}
+{{- if and (eq (index $ctx "storageUri") "") .Values.global.s3.bucket -}}
+{{- $_ := set $ctx "storageUri" (printf "s3://%s/quickwit" .Values.global.s3.bucket) -}}
+{{- end -}}
+{{- $storageUri := index $ctx "storageUri" -}}
+{{- if $storageUri }}
+{{ printf "index_uri: %s/documents" (trimSuffix "/" $storageUri) | indent 4 }}
+{{- end }}
+{{- end }}

k8s/papercrate/templates/quickwit-index-job.yaml

@@ -0,0 +1,78 @@
+{{- if and .Values.quickwit.enabled .Values.quickwit.indexJob.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "papercrate.fullname" . }}-quickwit-index
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit-index
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: {{ .Values.quickwit.indexJob.backoffLimit }}
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: quickwit-index
+    spec:
+      restartPolicy: Never
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      {{- $qw := dict "storageUri" .Values.quickwit.env.storageUri "metastoreUri" .Values.quickwit.env.metastoreUri -}}
+      {{- if and (not (index $qw "storageUri")) .Values.global.s3.bucket -}}
+        {{- $_ := set $qw "storageUri" (printf "s3://%s/quickwit" .Values.global.s3.bucket) -}}
+      {{- end -}}
+      {{- if not (index $qw "storageUri") -}}
+        {{- fail "quickwit.env.storageUri must be set, or provide global.s3.bucket" -}}
+      {{- end -}}
+      {{- if and (not (index $qw "metastoreUri")) .Values.postgres.enabled -}}
+        {{- $dbUser := required "postgres.auth.username is required when postgres.enabled" .Values.postgres.auth.username -}}
+        {{- $dbPass := required "postgres.auth.password is required when postgres.enabled" .Values.postgres.auth.password -}}
+        {{- $dbHost := printf "%s-postgres" (include "papercrate.fullname" .) -}}
+        {{- $_ := set $qw "metastoreUri" (printf "postgres://%s:%s@%s:5432/quickwit" $dbUser $dbPass $dbHost) -}}
+      {{- end -}}
+      {{- if not (index $qw "metastoreUri") -}}
+        {{- fail "quickwit.env.metastoreUri must be set when not using bundled Postgres" -}}
+      {{- end }}
+      containers:
+        - name: quickwit-index
+          image: {{ include "papercrate.quickwit.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.quickwit.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.quickwit.image.pullPolicy }}
+          command:
+            - quickwit
+            - index
+            - create
+          args:
+            - --index-config=/config/{{ .Values.quickwit.indexJob.indexConfig.key }}
+            - --endpoint=http://{{ include "papercrate.fullname" . }}-quickwit:{{ .Values.quickwit.service.port }}
+          {{- if or .Values.quickwit.envFrom .Values.global.s3.credentialsSecret }}
+          envFrom:
+            {{- with .Values.global.s3.credentialsSecret }}
+            - secretRef:
+                name: {{ . }}
+            {{- end }}
+            {{- range .Values.quickwit.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- end }}
+          {{- if or .Values.quickwit.indexJob.indexConfig.existingConfigMap .Values.quickwit.indexJob.indexConfig.create }}
+          volumeMounts:
+            - name: index-config
+              mountPath: /config
+          {{- end }}
+      {{- if or .Values.quickwit.indexJob.indexConfig.existingConfigMap .Values.quickwit.indexJob.indexConfig.create }}
+      volumes:
+        - name: index-config
+          configMap:
+            name: {{ if .Values.quickwit.indexJob.indexConfig.existingConfigMap }}{{ .Values.quickwit.indexJob.indexConfig.existingConfigMap }}{{ else }}{{ include "papercrate.fullname" . }}-quickwit-index{{ end }}
+      {{- end }}
+{{- end }}

k8s/papercrate/templates/quickwit-service.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.quickwit.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "papercrate.fullname" . }}-quickwit
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit
+spec:
+  type: {{ .Values.quickwit.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.quickwit.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "papercrate.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: quickwit
+{{- end }}

k8s/papercrate/templates/worker-deployment.yaml

@@ -0,0 +1,86 @@
+{{- if .Values.worker.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "papercrate.fullname" . }}-worker
+  labels:
+    {{- include "papercrate.labels" . | nindent 4 }}
+    app.kubernetes.io/component: worker
+spec:
+  replicas: {{ .Values.worker.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "papercrate.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: worker
+  template:
+    metadata:
+      labels:
+        {{- include "papercrate.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: worker
+    spec:
+      {{- if or .Values.global.imagePullSecrets .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+        {{- range .Values.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      {{- $workerSecrets := dict "primary" "" -}}
+      {{- if .Values.worker.env.existingSecret -}}
+        {{- $_ := set $workerSecrets "primary" .Values.worker.env.existingSecret -}}
+      {{- else if .Values.backend.env.existingSecret -}}
+        {{- $_ := set $workerSecrets "primary" .Values.backend.env.existingSecret -}}
+      {{- else -}}
+        {{- $_ := set $workerSecrets "primary" (printf "%s-backend-env" (include "papercrate.fullname" .)) -}}
+      {{- end }}
+      containers:
+        - name: worker
+          image: {{ include "papercrate.backend.image" . }}:{{ include "papercrate.image.tag" (dict "image" .Values.backend.image "Chart" .Chart) }}
+          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
+          command: ["/usr/local/bin/papercrate-worker"]
+          env:
+            {{- with .Values.global.s3.endpoint }}
+            - name: AWS_ENDPOINT_URL
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.region }}
+            - name: AWS_REGION
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.global.s3.bucket }}
+            - name: S3_BUCKET
+              value: {{ . | quote }}
+            {{- end }}
+            {{- range .Values.worker.env.extra }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+          envFrom:
+            - secretRef:
+                name: {{ index $workerSecrets "primary" }}
+            {{- with .Values.global.s3.credentialsSecret }}
+            - secretRef:
+                name: {{ . }}
+            {{- end }}
+            {{- range .Values.worker.envFrom }}
+            - {{ toYaml . | nindent 12 | trim }}
+            {{- end }}
+          {{- with .Values.worker.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.worker.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}

k8s/papercrate/values.yaml

@@ -0,0 +1,137 @@
+global:
+  imageRegistry: ""
+  imagePullSecrets:
+    - papercrate-regcred
+  labels: {}
+  s3:
+    endpoint: http://minio:9000
+    region: us-east-1
+    bucket: documents
+    credentialsSecret: ""
+
+backend:
+  replicaCount: 1
+  image:
+    repository: registry.example.com/papercrate-backend
+    tag: ""
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 3000
+  env:
+    existingSecret: ""
+    extra: []
+    jwtSecret: ""
+  envFrom: []
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+worker:
+  replicaCount: 1
+  enabled: true
+  env:
+    existingSecret: ""
+    extra: []
+  envFrom: []
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+frontend:
+  enabled: true
+  replicaCount: 1
+  image:
+    repository: registry.example.com/papercrate-frontend
+    tag: ""
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 80
+  env:
+    existingSecret: ""
+    extra: []
+  envFrom: []
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: app.papercrate.local
+      paths:
+        - path: /
+          pathType: Prefix
+          service:
+            name: frontend
+            port: http
+    - host: api.papercrate.local
+      paths:
+        - path: /
+          pathType: Prefix
+          service:
+            name: backend
+            port: http
+  tls: []
+
+postgres:
+  enabled: true
+  image:
+    repository: postgres
+    tag: "16-alpine"
+    pullPolicy: IfNotPresent
+  auth:
+    username: papercrate
+    password: papercrate_dev
+    databases:
+      papercrate: {}
+      quickwit: {}
+  maxConnections: 200
+  persistence:
+    enabled: true
+    accessModes:
+      - ReadWriteOnce
+    size: 10Gi
+    storageClass: ""
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+quickwit:
+  enabled: true
+  image:
+    repository: quickwit/quickwit
+    tag: "0.8.2"
+    pullPolicy: IfNotPresent
+  service:
+    type: ClusterIP
+    port: 7280
+  env:
+    storageUri: ""
+    metastoreUri: ""
+    extra: []
+  envFrom: []
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  indexJob:
+    enabled: true
+    backoffLimit: 3
+    indexConfig:
+      existingConfigMap: ""
+      key: documents-index.yaml
+      create: true
+      file: files/quickwit/documents-index.yaml
+      contents: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""