You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit cc128f1
Browse filesBrowse the repository at this point in the historyBrowse files
Copy file name to clipboardExpand all lines: apps/docs/content/docs/platform/self-hosting/environment-variables.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -311,7 +311,7 @@ Setting the variable to an empty string does **not** remove it: the chart reads
311
311
Null the variable in every layer that sets it. If it appears in both `app.env` and `app.envDefaults`, nulling only the `app.env` entry lets the `envDefaults` value apply again and the limit stays in force. With External Secrets, also drop the key from `externalSecrets.remoteRefs.app`, which keeps syncing it independently. Confirm what the pod will actually receive before rolling out:
`null`deletion has no effect under `helm upgrade --reuse-values` — pass your full values with `-f`, or use `--reset-then-reuse-values` (Helm 3.14+). If you deploy with Argo CD, put the `null` in `valueFiles` or the `values` string rather than `valuesObject`, which strips nulls. On Docker Compose, delete the line from your `.env` file.
This installs the chart's default image tag. For production, **pin `app`, `realtime`, and `migrations` to the same explicit release tag** — see [Upgrades](/platform/self-hosting/upgrades).
57
63
</Callout>
58
64
65
+
## Helm repository
66
+
67
+
For clusters or GitOps configs that consume `helm repo add` rather than OCI:
It serves the same chart as the OCI registry. The signature and provenance below
83
+
apply to the OCI artifact only.
84
+
85
+
## Verifying the chart
86
+
87
+
Every published version is signed with Sigstore keyless signing and carries a SLSA build-provenance attestation. Both live in the registry alongside the chart, so they survive a mirror into an internal registry.
Signing is Sigstore-only — there is no GPG `.prov` file, so `helm install --verify` does not apply.
98
+
99
+
<Callouttype="warn">
100
+
Verification requires **cosign v3.0 or newer**. Signatures use the Sigstore protobuf bundle format, which cosign v3 writes by default and cosign v2 cannot read. cosign v3.1+ auto-detects both formats.
101
+
</Callout>
102
+
59
103
## Cloud-Specific Values
60
104
61
105
These are cloud-tuned **alternatives** to the generic install above — pick one path, don't run both. The commands reuse the `$BETTER_AUTH_SECRET`, `$ENCRYPTION_KEY`, `$INTERNAL_API_SECRET`, `$API_ENCRYPTION_KEY`, `$CRON_SECRET`, and `$POSTGRES_PASSWORD` variables generated in [Installation](#installation) above, so run that block's `openssl` lines first in the same shell. They use `helm upgrade --install`, so they work whether or not a release exists yet. Two caveats when converting an existing generic install rather than starting fresh: (1) **reuse the original secret values** — recover them with `helm get values sim -n simstudio` if your shell no longer has them; supplying a newly generated `ENCRYPTION_KEY` makes every previously encrypted value (workspace environment variables, stored provider keys, MCP OAuth credentials) undecryptable. (2) The cloud values rename the bundled PostgreSQL database to `simstudio`, but Postgres only applies that setting on first initialization — add `--set postgresql.auth.database=sim` to keep your existing database. If you'd rather start clean, `helm uninstall sim -n simstudio`, delete its PVCs, and run the cloud command fresh.
62
106
63
107
```bash
64
-
helm upgrade --install sim ./helm/sim \
65
-
--values ./helm/sim/examples/values-aws.yaml \
108
+
# The example values files are not part of the packaged chart, so fetch the one
109
+
# you want at a release tag — pinning the chart but reading values off a moving
110
+
# branch would still make this command produce different deployments over time.
Every one of those overrides is required. The cloud values files hardcode a placeholder domain in all six places, and overriding only `NEXT_PUBLIC_APP_URL` leaves sign-in pointed at the placeholder, realtime rejecting every socket upgrade, and the Ingress serving the wrong host.
82
133
83
-
Swap the `--values` file for your cloud: `values-aws.yaml` (EKS), `values-azure.yaml` (AKS), or `values-gcp.yaml` (GKE). Everything else is identical.
134
+
Swap the `--values` file for your cloud: `values-aws.yaml` (EKS), `values-azure.yaml` (AKS), or `values-gcp.yaml` (GKE). Everything else is identical. Keep the downloaded file in your own config repo — the `--set` overrides above cover the six placeholder domains, but anything else you tune belongs in the file.
Copy file name to clipboardExpand all lines: apps/docs/content/docs/platform/self-hosting/reference-architectures.mdx
+11-4Lines changed: 11 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -139,16 +139,23 @@ See [Security](/platform/self-hosting/security) for the full secret inventory, w
139
139
140
140
## Calling the chart from Terraform
141
141
142
-
If you already run Terraform, the chart is the resource to wrap — not something to reimplement. It is not published to a Helm repository or an OCI registry, so there is no `repository` to point at: vendor this repo as a submodule, a release tarball, or a `git clone` in your pipeline, and give `chart`the local path.
142
+
If you already run Terraform, the chart is the resource to wrap — not something to reimplement. Point `repository` at the OCI registry and pin `version`; there is no need to vendor the repo.
143
143
144
144
```hcl
145
145
resource "helm_release" "sim" {
146
146
name = "sim"
147
147
namespace = "sim"
148
148
create_namespace = true
149
149
150
-
# Local path, not a repository. Pin the git ref you vendor from.
151
-
chart = "${path.module}/sim/helm/sim"
150
+
# Always pin `version`. Without it Terraform resolves the newest published
151
+
# chart at apply time, which is how an unplanned apply moves Sim to a new
152
+
# release with new migrations.
153
+
repository = "oci://ghcr.io/simstudioai/charts"
154
+
chart = "sim"
155
+
version = "1.9.5"
156
+
157
+
# Or the classic repository, if your tooling does not speak OCI:
158
+
# repository = "https://charts.sim.ai"
152
159
153
160
# Your own values file. The examples under helm/sim/examples/ carry
154
161
# placeholder secrets and are starting points, not deployable as-is.
The example values files ship literal placeholders such as `your-secure-production-auth-secret-here`. That includes `postgresql.auth.password`. The chart only rejects empty values and its own `CHANGE-ME` strings, so a deployment that inherits those placeholders installs cleanly with a publicly known session-signing secret and database password. Override every secret, or use External Secrets and set none of them inline.
173
180
</Callout>
174
181
175
-
Because the chart is local, `version`does nothing — what pins it is the git ref you vendor from, and `helm/sim/Chart.yaml` tells you which chart release that ref carries. Pin that ref, and pin the image tags separately, or an unplanned `terraform apply` can move Sim to a new release with new migrations. See [Upgrades](/platform/self-hosting/upgrades).
182
+
Pin `version`above, and pin the image tags separately — the chart version and the application version move independently, so pinning one does not pin the other. See [Upgrades](/platform/self-hosting/upgrades).
176
183
177
184
Once the infrastructure exists, follow [Kubernetes](/platform/self-hosting/kubernetes) for the install itself, then the [pre-launch checklist](/platform/self-hosting/security) and the [verification checklist](/platform/self-hosting/verify).
0 commit comments