Presets

Eight tested values files, from a laptop demo to a hardened production install.

Presets

Rather than assembling a values.yaml from scratch, start from one of eight tested shapes and edit it. Every preset is a valid, complete starting point; filenames are literal — every feature that’s on appears in the name.

They ship inside the chart, so unpack the tarball we sent you to get them:

export SWARMD_CHART=~/Downloads/swarmd-<version>.tgz   # the file we sent you

tar xzf $SWARMD_CHART        # creates ./swarmd/
ls swarmd/presets/

---

Pick one

#	Preset	Postgres	ClickHouse	HTTPS	SMTP	Presidio	Best for
1	values-shared-pg	shared	—	—	—	—	Prove it runs on your laptop
2	values-shared-pg-clickhouse	shared	✅	—	—	—	Laptop demo with full audit history
3	values-shared-pg-clickhouse-https	shared	✅	✅	—	—	First real hostname, no user email yet
4	values-shared-pg-clickhouse-https-smtp	shared	✅	✅	✅	—	Real users on a single Postgres
5	values-shared-pg-clickhouse-https-smtp-presidio	shared	✅	✅	✅	✅	Real users + PII detection
6	values-per-service-pg	per-service	—	—	—	—	Proving the per-service shape locally
7	values-per-service-pg-clickhouse	per-service	✅	—	—	—	Pre-production sizing test
8	values-per-service-pg-clickhouse-https-smtp-presidio	per-service	✅	✅	✅	✅	Hardened production

Two ladders, and the trick is that each rung adds exactly one feature. Diff two adjacent files and you see precisely what that feature costs you in configuration:

diff swarmd/presets/values-shared-pg-clickhouse.yaml \
     swarmd/presets/values-shared-pg-clickhouse-https.yaml

Pick the highest-numbered preset whose feature set you actually need, then customise. Starting low and adding features by hand is how you end up with a values file nobody can review.

---

Installing from one

helm install swarmd $SWARMD_CHART \
  --namespace swarmd --create-namespace \
  -f swarmd/presets/values-shared-pg.yaml \
  --set licence.existingSecretRef.name=swarmd-licence

You install from the tarball and pass the preset from the unpacked copy. There is no need to install from the unpacked directory — a preset is just a values file.

Each preset’s header comment carries its own exact install command, the persona it’s for, and the pre-work it assumes.

---

What the axes mean

Axis	Off	On
Postgres layout	shared — one Postgres, one PVC. Simplest.	per-service — one Postgres per DB-backed service plus Keycloak. Independent sizing and backups.
ClickHouse	Audit and registry still work; long-window scans return empty.	Full audit history and registry event stream.
HTTPS ingress	kubectl port-forward only.	app. / api. / auth. hostnames with TLS.
SMTP	Signup works; verification, reset and invite emails are dropped.	Email flows actually deliver.
Presidio	Prompts pass the LLM path unfiltered — no analyzer runs, since Piiranha is off by default too.	Inline PII detection on the relay path.

---

The production shape

Preset 8 is what a real deployment looks like. Abridged:

global.yaml

global:
  domain: swarmd.example.com
  ingress:
    enabled: true
    className: traefik
    tls:
      enabled: true
      secretName: swarmd-tls
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod

licence:
  existingSecretRef:
    name: swarmd-licence        # never inline in production
    key: value

postgres:
  mode: instance-per-service
  storage:
    size: 10Gi                  # default for anything not overridden
  perService:
    audit:
      storage: { size: 100Gi }  # heavy writer
    registry:
      storage: { size: 100Gi }  # heavy writer
    relay:
      storage: { size: 20Gi }

clickhouse:
  enabled: true
  deploy: true

smtp:
  enabled: true
  host: smtp.postmarkapp.com
  from: "[e-mail]"
  credentialsSecret: smtp-creds

presidio:
  enabled: true
  deploy: true

It assumes three things exist before you install:

1. A TLS Secret named swarmd-tls, populated by cert-manager or by hand.
2. An SMTP credentials Secret with username and password.
3. A licence Secret with the key.

kubectl -n swarmd create secret generic smtp-creds \
  --from-literal=username='<smtp-user>' \
  --from-literal=password='<smtp-pass>'

kubectl -n swarmd create secret generic swarmd-licence \
  --from-literal=value='LIC-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'

---

Trying a preset on minikube

Every preset has been dry-run against a fresh minikube before shipping. To repeat it:

minikube delete
minikube start --memory=8192 --cpus=4      # 12288 for the per-service presets

helm install swarmd $SWARMD_CHART -n swarmd --create-namespace \
  -f swarmd/presets/values-shared-pg-clickhouse.yaml \
  --set licence.existingSecretRef.name=swarmd-licence

Don’t reach for minikube addons enable ingress — that installs ingress-nginx, which Swarmd does not support. For a local look, leave ingress off and kubectl port-forward; to exercise a real ingress path, install Traefik. See Ingress.

For an HTTPS preset without real DNS, borrow nip.io and skip TLS:

  --set global.domain=$(minikube ip).nip.io \
  --set global.ingress.tls.enabled=false

The per-service presets run eight Postgres pods. On 8 GiB they will fight for memory and some will stay Pending — give minikube 12 GiB before blaming the chart.

---

Next

Databases

What the Postgres axis actually changes.

Ingress

What the HTTPS axis actually changes.