snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-docker/.env.example

@@ -0,0 +1,23 @@
+TAG=latest
+
+#PG_DATABASE_USER=postgres
+#PG_DATABASE_PASSWORD=replace_me_with_a_strong_password_without_special_characters
+#PG_DATABASE_HOST=db
+#PG_DATABASE_PORT=5432
+#PG_DATABASE_NAME=default
+#REDIS_URL=redis://redis:6379
+
+SERVER_URL=http://localhost:3000
+
+# Use openssl rand -base64 32 for each secret
+# ENCRYPTION_KEY=replace_me_with_a_random_string
+# FALLBACK_ENCRYPTION_KEY= # set to the previous ENCRYPTION_KEY during a rotation
+# APP_SECRET= # legacy: only required for instances that pre-date ENCRYPTION_KEY
+
+STORAGE_TYPE=local
+
+# STORAGE_S3_REGION=eu-west3
+# STORAGE_S3_NAME=my-bucket
+# STORAGE_S3_ENDPOINT=
+# STORAGE_S3_ACCESS_KEY_ID=
+# STORAGE_S3_SECRET_ACCESS_KEY=

packages/twenty-docker/Makefile

@@ -0,0 +1,79 @@
+# Makefile for building and running Twenty CRM docker containers.
+# Set the tag and/or target build platform using make command-line variables assignments.
+#
+# Optional make variables:
+# PLATFORM - defaults to 'linux/amd64'
+# TAG      - defaults to 'latest'
+#
+# Example: make prod-build
+# Example: make PLATFORM=linux/aarch64 TAG=my-tag prod-build
+# Example: make postgres-on-docker (for local development)
+
+PLATFORM ?= linux/amd64
+TAG ?= latest
+DOCKER_NETWORK=twenty_network
+
+# =============================================================================
+# Production Image Building
+# =============================================================================
+
+prod-build:
+	@cd ../.. && docker build --target twenty -f ./packages/twenty-docker/twenty/Dockerfile --platform $(PLATFORM) --tag twenty:$(TAG) . && cd -
+
+prod-run:
+	@docker run -d -p 3000:3000 --name twenty twenty:$(TAG)
+
+prod-postgres-run:
+	@docker run -d -p 5432:5432 -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres --name twenty-postgres twenty-postgres:$(TAG)
+
+# =============================================================================
+# Local Development Services
+# Run these from the repository root: make -C packages/twenty-docker <target>
+# =============================================================================
+
+ensure-docker-network:
+	docker network inspect $(DOCKER_NETWORK) >/dev/null 2>&1 || docker network create $(DOCKER_NETWORK)
+
+postgres-on-docker: ensure-docker-network
+	docker run -d --network $(DOCKER_NETWORK) \
+	--name twenty_pg \
+	-e POSTGRES_USER=postgres \
+	-e POSTGRES_PASSWORD=postgres \
+	-e ALLOW_NOSSL=true \
+	-v twenty_db_data:/var/lib/postgresql/data \
+	-p 5432:5432 \
+	postgres:16
+	@echo "Waiting for PostgreSQL to be ready..."
+	@until docker exec twenty_pg psql -U postgres -d postgres \
+		-c 'SELECT pg_is_in_recovery();' 2>/dev/null | grep -q 'f'; do \
+		sleep 1; \
+	done
+	docker exec twenty_pg psql -U postgres -d postgres \
+		-c "CREATE DATABASE \"default\" WITH OWNER postgres;" \
+		-c "CREATE DATABASE \"test\" WITH OWNER postgres;"
+
+redis-on-docker: ensure-docker-network
+	docker run -d --network $(DOCKER_NETWORK) --name twenty_redis -p 6379:6379 redis/redis-stack-server:latest
+
+clickhouse-on-docker: ensure-docker-network
+	docker run -d --network $(DOCKER_NETWORK) --name twenty_clickhouse -p 8123:8123 -p 9000:9000 -e CLICKHOUSE_PASSWORD=devPassword clickhouse/clickhouse-server:latest \
+
+grafana-on-docker: ensure-docker-network
+	docker run -d --network $(DOCKER_NETWORK) \
+	--name twenty_grafana \
+	-p 4000:3000 \
+	-e GF_SECURITY_ADMIN_USER=admin \
+	-e GF_SECURITY_ADMIN_PASSWORD=admin \
+	-e GF_INSTALL_PLUGINS=grafana-clickhouse-datasource \
+	-v $(PWD)/grafana/provisioning/datasources:/etc/grafana/provisioning/datasources \
+	grafana/grafana-oss:latest
+
+opentelemetry-collector-on-docker: ensure-docker-network
+	docker run -d --network $(DOCKER_NETWORK) \
+	--name twenty_otlp_collector \
+	-p 4317:4317 \
+	-p 4318:4318 \
+	-p 13133:13133 \
+	-v $(PWD)/otel-collector/otel-collector-config.yaml:/etc/otel-collector-config.yaml \
+	otel/opentelemetry-collector-contrib:latest \
+	--config /etc/otel-collector-config.yaml

packages/twenty-docker/docker-compose.dev.yml

@@ -0,0 +1,42 @@
+# Development infrastructure services only (Postgres + Redis).
+# Use this when developing locally against the source code.
+#
+# Usage:
+#   docker compose -f docker-compose.dev.yml up -d
+#   docker compose -f docker-compose.dev.yml down       # stop
+#   docker compose -f docker-compose.dev.yml down -v    # stop + wipe data
+
+name: twenty-dev
+
+services:
+  db:
+    image: postgres:16
+    volumes:
+      - dev-db-data:/var/lib/postgresql/data
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: default
+    healthcheck:
+      test: pg_isready -U postgres -h localhost -d postgres
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+
+  redis:
+    image: redis:7
+    ports:
+      - "6379:6379"
+    command: ["--maxmemory-policy", "noeviction"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+
+volumes:
+  dev-db-data:

packages/twenty-docker/docker-compose.yml

@@ -0,0 +1,138 @@
+name: twenty
+
+services:
+  server:
+    image: twentycrm/twenty:${TAG:-latest}
+    volumes:
+      - server-local-data:/app/packages/twenty-server/.local-storage
+    ports:
+      - "3000:3000"
+    environment:
+      NODE_PORT: 3000
+      PG_DATABASE_URL: postgres://${PG_DATABASE_USER:-postgres}:${PG_DATABASE_PASSWORD:-postgres}@${PG_DATABASE_HOST:-db}:${PG_DATABASE_PORT:-5432}/${PG_DATABASE_NAME:-default}
+      SERVER_URL: ${SERVER_URL}
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
+      DISABLE_DB_MIGRATIONS: ${DISABLE_DB_MIGRATIONS}
+      DISABLE_CRON_JOBS_REGISTRATION: ${DISABLE_CRON_JOBS_REGISTRATION}
+
+      STORAGE_TYPE: ${STORAGE_TYPE}
+      STORAGE_S3_REGION: ${STORAGE_S3_REGION}
+      STORAGE_S3_NAME: ${STORAGE_S3_NAME}
+      STORAGE_S3_ENDPOINT: ${STORAGE_S3_ENDPOINT}
+
+      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
+      FALLBACK_ENCRYPTION_KEY: ${FALLBACK_ENCRYPTION_KEY}
+      APP_SECRET: ${APP_SECRET:-}
+      # MESSAGING_PROVIDER_GMAIL_ENABLED: ${MESSAGING_PROVIDER_GMAIL_ENABLED}
+      # CALENDAR_PROVIDER_GOOGLE_ENABLED: ${CALENDAR_PROVIDER_GOOGLE_ENABLED}
+      # AUTH_GOOGLE_CLIENT_ID: ${AUTH_GOOGLE_CLIENT_ID}
+      # AUTH_GOOGLE_CLIENT_SECRET: ${AUTH_GOOGLE_CLIENT_SECRET}
+      # AUTH_GOOGLE_CALLBACK_URL: ${AUTH_GOOGLE_CALLBACK_URL}
+      # AUTH_GOOGLE_APIS_CALLBACK_URL: ${AUTH_GOOGLE_APIS_CALLBACK_URL}
+
+      # CALENDAR_PROVIDER_MICROSOFT_ENABLED: ${CALENDAR_PROVIDER_MICROSOFT_ENABLED}
+      # MESSAGING_PROVIDER_MICROSOFT_ENABLED: ${MESSAGING_PROVIDER_MICROSOFT_ENABLED}
+      # AUTH_MICROSOFT_ENABLED: ${AUTH_MICROSOFT_ENABLED}
+      # AUTH_MICROSOFT_CLIENT_ID: ${AUTH_MICROSOFT_CLIENT_ID}
+      # AUTH_MICROSOFT_CLIENT_SECRET: ${AUTH_MICROSOFT_CLIENT_SECRET}
+      # AUTH_MICROSOFT_CALLBACK_URL: ${AUTH_MICROSOFT_CALLBACK_URL}
+      # AUTH_MICROSOFT_APIS_CALLBACK_URL: ${AUTH_MICROSOFT_APIS_CALLBACK_URL}
+
+      # EMAIL_FROM_ADDRESS: ${EMAIL_FROM_ADDRESS:-contact@yourdomain.com}
+      # EMAIL_FROM_NAME: ${EMAIL_FROM_NAME:-"John from YourDomain"}
+      # EMAIL_DRIVER: ${EMAIL_DRIVER:-smtp}
+      # EMAIL_SMTP_HOST: ${EMAIL_SMTP_HOST:-smtp.gmail.com}
+      # EMAIL_SMTP_PORT: ${EMAIL_SMTP_PORT:-465}
+      # EMAIL_SMTP_USER: ${EMAIL_SMTP_USER:-}
+      # EMAIL_SMTP_PASSWORD: ${EMAIL_SMTP_PASSWORD:-}
+
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test: curl --fail http://localhost:3000/healthz
+      interval: 5s
+      timeout: 5s
+      retries: 20
+    restart: always
+
+  worker:
+    image: twentycrm/twenty:${TAG:-latest}
+    volumes:
+      - server-local-data:/app/packages/twenty-server/.local-storage
+    command: ["yarn", "worker:prod"]
+    environment:
+      PG_DATABASE_URL: postgres://${PG_DATABASE_USER:-postgres}:${PG_DATABASE_PASSWORD:-postgres}@${PG_DATABASE_HOST:-db}:${PG_DATABASE_PORT:-5432}/${PG_DATABASE_NAME:-default}
+      SERVER_URL: ${SERVER_URL}
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
+      DISABLE_DB_MIGRATIONS: "true" # it already runs on the server
+      DISABLE_CRON_JOBS_REGISTRATION: "true" # it already runs on the server
+
+      STORAGE_TYPE: ${STORAGE_TYPE}
+      STORAGE_S3_REGION: ${STORAGE_S3_REGION}
+      STORAGE_S3_NAME: ${STORAGE_S3_NAME}
+      STORAGE_S3_ENDPOINT: ${STORAGE_S3_ENDPOINT}
+
+      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
+      FALLBACK_ENCRYPTION_KEY: ${FALLBACK_ENCRYPTION_KEY}
+      APP_SECRET: ${APP_SECRET:-}
+      # MESSAGING_PROVIDER_GMAIL_ENABLED: ${MESSAGING_PROVIDER_GMAIL_ENABLED}
+      # CALENDAR_PROVIDER_GOOGLE_ENABLED: ${CALENDAR_PROVIDER_GOOGLE_ENABLED}
+      # AUTH_GOOGLE_CLIENT_ID: ${AUTH_GOOGLE_CLIENT_ID}
+      # AUTH_GOOGLE_CLIENT_SECRET: ${AUTH_GOOGLE_CLIENT_SECRET}
+      # AUTH_GOOGLE_CALLBACK_URL: ${AUTH_GOOGLE_CALLBACK_URL}
+      # AUTH_GOOGLE_APIS_CALLBACK_URL: ${AUTH_GOOGLE_APIS_CALLBACK_URL}
+
+      # CALENDAR_PROVIDER_MICROSOFT_ENABLED: ${CALENDAR_PROVIDER_MICROSOFT_ENABLED}
+      # MESSAGING_PROVIDER_MICROSOFT_ENABLED: ${MESSAGING_PROVIDER_MICROSOFT_ENABLED}
+      # AUTH_MICROSOFT_ENABLED: ${AUTH_MICROSOFT_ENABLED}
+      # AUTH_MICROSOFT_CLIENT_ID: ${AUTH_MICROSOFT_CLIENT_ID}
+      # AUTH_MICROSOFT_CLIENT_SECRET: ${AUTH_MICROSOFT_CLIENT_SECRET}
+      # AUTH_MICROSOFT_CALLBACK_URL: ${AUTH_MICROSOFT_CALLBACK_URL}
+      # AUTH_MICROSOFT_APIS_CALLBACK_URL: ${AUTH_MICROSOFT_APIS_CALLBACK_URL}
+
+      # EMAIL_FROM_ADDRESS: ${EMAIL_FROM_ADDRESS:-contact@yourdomain.com}
+      # EMAIL_FROM_NAME: ${EMAIL_FROM_NAME:-"John from YourDomain"}
+      # EMAIL_DRIVER: ${EMAIL_DRIVER:-smtp}
+      # EMAIL_SMTP_HOST: ${EMAIL_SMTP_HOST:-smtp.gmail.com}
+      # EMAIL_SMTP_PORT: ${EMAIL_SMTP_PORT:-465}
+      # EMAIL_SMTP_USER: ${EMAIL_SMTP_USER:-}
+      # EMAIL_SMTP_PASSWORD: ${EMAIL_SMTP_PASSWORD:-}
+
+    depends_on:
+      db:
+        condition: service_healthy
+      server:
+        condition: service_healthy
+    restart: always
+
+  db:
+    image: postgres:16
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: ${PG_DATABASE_NAME:-default}
+      POSTGRES_PASSWORD: ${PG_DATABASE_PASSWORD:-postgres}
+      POSTGRES_USER: ${PG_DATABASE_USER:-postgres}
+    healthcheck:
+      test: pg_isready -U ${PG_DATABASE_USER:-postgres} -h localhost -d postgres
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    restart: always
+
+  redis:
+    image: redis
+    restart: always
+    command: ["--maxmemory-policy", "noeviction"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+volumes:
+  db-data:
+  server-local-data:

packages/twenty-docker/grafana/provisioning/datasources/clickhouse-datasource.yaml

@@ -0,0 +1,15 @@
+apiVersion: 1
+
+datasources:
+  - name: ClickHouse
+    type: grafana-clickhouse-datasource
+    uid: clickhouse_datasource
+    jsonData:
+      server: twenty_clickhouse
+      defaultDatabase: twenty_dev
+      port: 9000
+      protocol: native
+      tlsSkipVerify: true
+      username: default
+    secureJsonData:
+      password: devPassword

packages/twenty-docker/helm/twenty/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: twenty
+description: A Helm chart to deploy Twenty CRM (server + worker) with optional PostgreSQL and Redis dependencies.
+type: application
+version: 0.1.0
+appVersion: "v1.14.0"
+icon: https://raw.githubusercontent.com/twentyhq/twenty/2f25922f4cd5bd61e1427c57c4f8ea224e1d552c/packages/twenty-website/public/images/core/logo.svg

packages/twenty-docker/helm/twenty/QUICKSTART.md

@@ -0,0 +1,51 @@
+# Twenty Helm Chart - Quick Install
+
+## Simple Install
+
+Set your domain and install:
+
+```bash
+export DOMAIN=crm.example.com
+
+helm install my-twenty ./packages/twenty-docker/helm/twenty \
+  --namespace twentycrm --create-namespace --wait \
+  --set "server.ingress.hosts[0].host=$DOMAIN" \
+  --set "server.ingress.tls[0].hosts[0]=$DOMAIN"
+```
+
+That's it! The chart will:
+- Auto-generate a secure access token
+- Create the PostgreSQL database "twenty" and schema "core" automatically
+- Run TypeORM migrations via server init
+- Enable TLS via cert-manager (acme: true by default for letsencrypt-prod)
+
+## Access the App
+
+Visit: `https://$DOMAIN`
+
+Sign up to create your admin account through the web UI.
+
+## Retrieve System Credentials
+
+App secret token (for configuration/integrations):
+```bash
+kubectl get secret tokens -n twentycrm -o jsonpath='{.data.accessToken}' | base64 --decode && echo
+```
+
+Internal PostgreSQL credentials are managed by the chart and not exposed by default. If you need direct access, create your own user in the database pod or use an external PostgreSQL instance.
+
+Jobs for DB creation and migrations have been removed to simplify deployments; the server handles readiness and migrations at startup.
+
+## Advanced Configuration
+
+See [full README](README.md) for:
+- External PostgreSQL/Redis
+- S3 storage configuration
+- Custom resource limits
+
+## Uninstall
+
+```bash
+helm uninstall my-twenty -n twentycrm
+kubectl delete namespace twentycrm
+```

packages/twenty-docker/helm/twenty/README.md

@@ -0,0 +1,86 @@
+# Twenty Helm Chart
+
+Deploy Twenty CRM on Kubernetes with server, worker, PostgreSQL, and Redis components.
+
+## Features
+- Server and worker deployments with full env exposure via `values.yaml`.
+- Internal PostgreSQL (Spilo) and Redis deployments included.
+- PVC-based persistence using dynamic storage classes (no static PV manifests).
+- Ingress with configurable annotations, hosts, and TLS.
+- Database readiness and migrations handled by server/worker init containers by default.
+– Standard Kubernetes Jobs for DB creation/user and migrations have been removed to simplify installs. Readiness and migrations run in init containers.
+
+## Quick Start
+
+See [QUICKSTART.md](QUICKSTART.md) for a simple 2-line install with your domain.
+
+## Installing
+
+**Prerequisites:** Kubernetes 1.21+, Helm 3.8+, default StorageClass
+
+Internal DB + Redis (default):
+```bash
+helm install my-twenty ./packages/twenty-docker/helm/twenty \
+  --namespace twentycrm --create-namespace
+```
+
+External DB/Redis:
+```bash
+helm install my-twenty ./packages/twenty-docker/helm/twenty \
+  --namespace twentycrm --create-namespace \
+  --set db.enabled=false \
+  --set db.external.host=db.example.com \
+  --set redisInternal.enabled=false
+```
+
+## Key Values
+
+
+See `values.yaml` for a comprehensive list.
+
+## Notes
+
+- Database URL and Redis URL are composed automatically from chart settings
+- Database `twenty` and schema `core` are created automatically by server init container
+- No optional jobs: the chart no longer provides separate Jobs for DB or migrations.
+- Access token auto-generated (32 chars) if not provided; reuses existing secret if present
+  - For production, provide a strong `secrets.tokens.accessToken` value via a secure values file; the auto-generated token is a convenience fallback.
+- TLS enabled by default via cert-manager (`acme: true`)
+- Requires default StorageClass for PVC provisioning
+## Testing
+
+```bash
+helm lint ./packages/twenty-docker/helm/twenty
+helm template my-twenty ./packages/twenty-docker/helm/twenty
+helm plugin install https://github.com/quintush/helm-unittest
+helm unittest ./packages/twenty-docker/helm/twenty
+```
+
+## Storage
+
+**Local (default):** Uses PVCs for persistence
+
+**S3:** Set `storage.type=s3` and provide credentials using a values file. You can either pass credentials directly or reference an existing Kubernetes Secret.
+```bash
+# values-secrets.yaml (do not commit)
+# storage:
+#   type: s3
+#   s3:
+#     bucket: my-bucket
+#     region: us-east-1
+#     # Option A: direct values
+#     accessKeyId: AKIA...
+#     secretAccessKey: ...
+#     # Option B: reference a Secret
+#     # secretName: my-s3-creds
+#     # accessKeyIdKey: accessKeyId
+#     # secretAccessKeyKey: secretAccessKey
+
+helm install my-twenty ./packages/twenty-docker/helm/twenty -f values-secrets.yaml
+```
+
+## Production Tips
+
+- **Image versioning:** The chart defaults to `Chart.yaml`'s `appVersion` (currently v1.14.0). Override via `image.tag` in values to pin a different version or use `latest` for rolling updates.
+- **Keep secrets secure:** Avoid `--set` for sensitive values; use `-f values-secrets.yaml` or reference existing Kubernetes Secrets via `server.extraEnvFrom`.
+  - S3 credentials can be referenced via `storage.s3.secretName + accessKeyIdKey/secretAccessKeyKey` to avoid embedding them in pod specs.

packages/twenty-docker/helm/twenty/templates/NOTES.txt

@@ -0,0 +1,17 @@
+Thank you for installing Twenty!
+
+To access the application:
+
+- If ingress enabled:
+  {{- if and .Values.server.ingress.enabled (gt (len .Values.server.ingress.hosts) 0) }}
+  - Primary host: {{ (index .Values.server.ingress.hosts 0).host | default "<set a host>" }}
+  {{- else }}
+  - Primary host: <set a host>
+  {{- end }}
+  - URL: {{ include "twenty.serverUrl" . }}
+- If ingress disabled: expose the service as needed (e.g., `kubectl port-forward svc/{{ include "twenty.fullname" . }}-server 3000:{{ .Values.server.service.port }}` or create a LoadBalancer/NodePort).
+
+Configuration:
+- Using internal DB: {{ ternary "yes" "no" .Values.db.enabled }}
+- Using external DB: {{ ternary "yes" "no" (not .Values.db.enabled) }}
+- Using internal Redis: {{ ternary "yes" "no" .Values.redisInternal.enabled }}

packages/twenty-docker/helm/twenty/templates/_helpers.tpl

@@ -0,0 +1,213 @@
+{{- define "twenty.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "twenty.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "twenty.namespace" -}}
+{{ .Release.Namespace }}
+{{- end -}}
+
+{{/* Server image fields merged with globals */}}
+{{- define "twenty.server.image" -}}
+{{- $repo := default $.Values.image.repository (index $.Values.server.image "repository" | default "") -}}
+{{- $tag := default (default $.Chart.AppVersion $.Values.image.tag) (index $.Values.server.image "tag" | default "") -}}
+{{- $pp := default $.Values.image.pullPolicy (index $.Values.server.image "pullPolicy" | default "") -}}
+{{- printf "%s:%s|%s" $repo $tag $pp -}}
+{{- end -}}
+
+{{/* Worker image fields merged with globals */}}
+{{- define "twenty.worker.image" -}}
+{{- $repo := default $.Values.image.repository (index $.Values.worker.image "repository" | default "") -}}
+{{- $tag := default (default $.Chart.AppVersion $.Values.image.tag) (index $.Values.worker.image "tag" | default "") -}}
+{{- $pp := default $.Values.image.pullPolicy (index $.Values.worker.image "pullPolicy" | default "") -}}
+{{- printf "%s:%s|%s" $repo $tag $pp -}}
+{{- end -}}
+
+{{/* Extract parts of image helper */}}
+{{- define "twenty.image.repository" -}}
+{{- regexFind "^([^:|]+)" . -}}
+{{- end -}}
+{{- define "twenty.image.tag" -}}
+{{- regexFind ":([^|]+)" . | trimPrefix ":" -}}
+{{- end -}}
+{{- define "twenty.image.pullPolicy" -}}
+{{- regexFind "\\|(.+)$" . | trimPrefix "|" -}}
+{{- end -}}
+
+{{/* Check if using external secret for database password */}}
+{{- define "twenty.db.useExternalSecret" -}}
+{{- if and (not .Values.db.enabled) .Values.db.external.secretName .Values.db.external.passwordKey -}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end -}}
+
+{{/* Database URL secret name */}}
+{{- define "twenty.dbUrl.secretName" -}}
+{{- printf "%s-db-url" (include "twenty.fullname" .) -}}
+{{- end -}}
+
+{{/* Database password secret name */}}
+{{- define "twenty.dbPassword.secretName" -}}
+{{- if eq (include "twenty.db.useExternalSecret" .) "true" -}}
+{{- .Values.db.external.secretName -}}
+{{- else -}}
+{{- include "twenty.dbUrl.secretName" . -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Database password secret key */}}
+{{- define "twenty.dbPassword.secretKey" -}}
+{{- if eq (include "twenty.db.useExternalSecret" .) "true" -}}
+{{- .Values.db.external.passwordKey -}}
+{{- else if .Values.db.enabled -}}
+appPassword
+{{- else -}}
+password
+{{- end -}}
+{{- end -}}
+
+{{/* Database URL template for external secret (will be evaluated at runtime) */}}
+{{- define "twenty.dbUrl.template" -}}
+{{- if eq (include "twenty.db.useExternalSecret" .) "true" -}}
+{{- $scheme := "postgres" -}}
+{{- $host := .Values.db.external.host -}}
+{{- $port := .Values.db.external.port | default 5432 -}}
+{{- $user := .Values.db.external.user | default "postgres" -}}
+{{- $db := .Values.db.external.database | default "twenty" -}}
+{{- $qs := ternary "?sslmode=require" "" (eq .Values.db.external.ssl true) -}}
+{{- printf "%s://%s:$(DB_PASSWORD)@%s:%v/%s%s" $scheme $user $host $port $db $qs -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Check if using external secret for redis password */}}
+{{- define "twenty.redis.useExternalSecret" -}}
+{{- if and (not .Values.redisInternal.enabled) .Values.redis.external.secretName .Values.redis.external.passwordKey -}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end -}}
+
+{{/* Compose Redis URL */}}
+{{- define "twenty.redisUrl" -}}
+{{- if .Values.server.env.REDIS_URL -}}
+{{- .Values.server.env.REDIS_URL -}}
+{{- else if .Values.redisInternal.enabled -}}
+{{- $host := printf "%s-redis" (include "twenty.fullname" .) -}}
+{{- printf "redis://%s.%s.svc.cluster.local:6379" $host (include "twenty.namespace" .) -}}
+{{- else -}}
+{{- $host := .Values.redis.external.host | default "redis" -}}
+{{- $port := .Values.redis.external.port | default 6379 -}}
+{{- if or (eq (include "twenty.redis.useExternalSecret" .) "true") (.Values.redis.external.password) -}}
+{{- $auth := ":$(REDIS_PASSWORD)@" -}}
+{{- printf "redis://%s%s:%v" $auth $host $port -}}
+{{- else -}}
+{{- printf "redis://%s:%v" $host $port -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Compose Server URL from override, ingress, or service */}}
+{{- define "twenty.serverUrl" -}}
+{{- if .Values.server.env.SERVER_URL -}}
+{{- .Values.server.env.SERVER_URL -}}
+{{- else if and .Values.server.ingress.enabled (gt (len .Values.server.ingress.hosts) 0) -}}
+{{- $host := (index .Values.server.ingress.hosts 0).host -}}
+{{- $tls := gt (len .Values.server.ingress.tls) 0 -}}
+{{- $scheme := ternary "https" "http" $tls -}}
+{{- $port := ternary 443 80 $tls -}}
+{{- printf "%s://%s:%v" $scheme $host $port -}}
+{{- else -}}
+{{- $svc := printf "%s-server" (include "twenty.fullname" .) -}}
+{{- $ns := include "twenty.namespace" . -}}
+{{- $port := .Values.server.service.port | default 3000 -}}
+{{- printf "http://%s.%s.svc.cluster.local:%v" $svc $ns $port -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Tokens secret name */}}
+{{- define "twenty.secret.tokens.name" -}}
+{{- .Values.secrets.tokens.name | default "tokens" -}}
+{{- end -}}
+
+{{/* Access token value: reuse existing secret if present, else provided value, else generated */}}
+{{- define "twenty.secret.tokens.access" -}}
+{{- $name := include "twenty.secret.tokens.name" . -}}
+{{- $ns := include "twenty.namespace" . -}}
+{{- $existing := lookup "v1" "Secret" $ns $name -}}
+{{- if and $existing $existing.data.accessToken -}}
+{{- b64dec $existing.data.accessToken -}}
+{{- else if .Values.secrets.tokens.accessToken -}}
+{{- .Values.secrets.tokens.accessToken -}}
+{{- else -}}
+{{- randAlphaNum 32 -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Server container port */}}
+{{- define "twenty.server.containerPort" -}}
+{{- .Values.server.service.port | default 3000 -}}
+{{- end -}}
+
+{{/* Storage type: prefer top-level storage.type, else legacy server.env.STORAGE_TYPE, else local */}}
+{{- define "twenty.storageType" -}}
+{{- if .Values.storage.type -}}
+{{- .Values.storage.type -}}
+{{- else if .Values.server.env.STORAGE_TYPE -}}
+{{- .Values.server.env.STORAGE_TYPE -}}
+{{- else -}}
+local
+{{- end -}}
+{{- end -}}
+
+{{/* Additional storage env vars (e.g., S3) */}}
+{{- define "twenty.storageEnv" -}}
+{{- if eq (include "twenty.storageType" .) "s3" -}}
+{{- with .Values.storage.s3.bucket }}
+- name: STORAGE_S3_NAME
+  value: {{ . | quote }}
+{{- end }}
+{{- with .Values.storage.s3.region }}
+- name: STORAGE_S3_REGION
+  value: {{ . | quote }}
+{{- end }}
+{{- with .Values.storage.s3.endpoint }}
+- name: STORAGE_S3_ENDPOINT
+  value: {{ . | quote }}
+{{- end }}
+{{- if and .Values.storage.s3.secretName .Values.storage.s3.accessKeyIdKey }}
+- name: STORAGE_S3_ACCESS_KEY_ID
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.storage.s3.secretName | quote }}
+      key: {{ .Values.storage.s3.accessKeyIdKey | quote }}
+{{- else }}
+  {{- with .Values.storage.s3.accessKeyId }}
+- name: STORAGE_S3_ACCESS_KEY_ID
+  value: {{ . | quote }}
+  {{- end }}
+{{- end }}
+{{- if and .Values.storage.s3.secretName .Values.storage.s3.secretAccessKeyKey }}
+- name: STORAGE_S3_SECRET_ACCESS_KEY
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.storage.s3.secretName | quote }}
+      key: {{ .Values.storage.s3.secretAccessKeyKey | quote }}
+{{- else }}
+  {{- with .Values.storage.s3.secretAccessKey }}
+- name: STORAGE_S3_SECRET_ACCESS_KEY
+  value: {{ . | quote }}
+  {{- end }}
+{{- end }}
+{{- end -}}
+{{- end -}}

packages/twenty-docker/helm/twenty/templates/deployment-db-internal.yaml

@@ -0,0 +1,62 @@
+{{- if .Values.db.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "twenty.fullname" . }}-db
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: db
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "twenty.name" . }}
+      app.kubernetes.io/component: db
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "twenty.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: db
+    spec:
+      volumes:
+        {{- if .Values.db.internal.persistence.enabled }}
+        - name: db-data
+          persistentVolumeClaim:
+            claimName: {{ if .Values.db.internal.persistence.existingClaim }}{{ .Values.db.internal.persistence.existingClaim }}{{ else }}{{ include "twenty.fullname" . }}-db{{ end }}
+        {{- end }}
+      containers:
+        - name: db
+          image: {{ .Values.db.internal.image.repository }}:{{ .Values.db.internal.image.tag }}
+          imagePullPolicy: {{ .Values.db.internal.image.pullPolicy | default "IfNotPresent" }}
+          env:
+            - name: PGUSER_SUPERUSER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.fullname" . }}-db-superuser
+                  key: username
+            - name: PGPASSWORD_SUPERUSER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.fullname" . }}-db-superuser
+                  key: password
+            - name: SPILO_PROVIDER
+              value: {{ .Values.db.internal.env.SPILO_PROVIDER | quote }}
+            - name: ALLOW_NOSSL
+              value: {{ .Values.db.internal.env.ALLOW_NOSSL | quote }}
+          ports:
+            - containerPort: 5432
+              name: tcp
+              protocol: TCP
+          resources:
+            {{- toYaml .Values.db.internal.resources | nindent 12 }}
+          {{- if .Values.db.internal.persistence.enabled }}
+          volumeMounts:
+            - name: db-data
+              mountPath: /home/postgres/pgdata
+          {{- end }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/deployment-redis-internal.yaml

@@ -0,0 +1,57 @@
+{{- if .Values.redisInternal.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "twenty.fullname" . }}-redis
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "twenty.name" . }}
+      app.kubernetes.io/component: redis
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "twenty.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: redis
+    spec:
+      containers:
+        - name: redis
+          image: {{ .Values.redisInternal.image.repository }}:{{ .Values.redisInternal.image.tag }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.redisInternal.image.pullPolicy }}
+          command:
+            - redis-stack-server
+          args:
+            - "--port"
+            - {{ .Values.redisInternal.service.port | quote }}
+            - "--maxmemory-policy"
+            - "noeviction"
+          ports:
+            - containerPort: {{ .Values.redisInternal.service.port }}
+              name: redis
+              protocol: TCP
+          resources:
+            {{- toYaml .Values.redisInternal.resources | nindent 12 }}
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+      volumes:
+        - name: redis-data
+          {{- if .Values.redisInternal.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.redisInternal.persistence.existingClaim | default (printf "%s-redis" (include "twenty.fullname" .)) }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/deployment-server.yaml

@@ -0,0 +1,219 @@
+{{- if .Values.server.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "twenty.fullname" . }}-server
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: server
+spec:
+  replicas: {{ .Values.server.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "twenty.name" . }}
+      app.kubernetes.io/component: server
+  strategy:
+    {{- if or .Values.server.dockerDataPersistence.enabled .Values.server.persistence.enabled }}
+    type: Recreate
+    {{- else }}
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    {{- end }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "twenty.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: server
+    spec:
+      securityContext:
+{{- toYaml .Values.securityContext | nindent 8 }}
+      {{- with .Values.server.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.server.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.server.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.server.dnsPolicy }}
+      dnsPolicy: {{ . }}
+      {{- end }}
+      {{- with .Values.server.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        {{- if .Values.server.dockerDataPersistence.enabled }}
+        - name: docker-data
+          persistentVolumeClaim:
+            claimName: {{ if .Values.server.dockerDataPersistence.existingClaim }}{{ .Values.server.dockerDataPersistence.existingClaim }}{{ else }}{{ include "twenty.fullname" . }}-docker-data{{ end }}
+        {{- end }}
+        {{- if .Values.server.persistence.enabled }}
+        - name: server-data
+          persistentVolumeClaim:
+            claimName: {{ if .Values.server.persistence.existingClaim }}{{ .Values.server.persistence.existingClaim }}{{ else }}{{ include "twenty.fullname" . }}-server{{ end }}
+        {{- end }}
+      initContainers:
+        - name: wait-for-db
+          image: postgres:16-alpine
+          command:
+            - sh
+            - -c
+            - |
+              until pg_isready -h {{ if .Values.db.enabled }}{{ include "twenty.fullname" . }}-db{{ else }}{{ .Values.db.external.host }}{{ end }} \
+                               -p {{ if .Values.db.enabled }}5432{{ else }}{{ .Values.db.external.port | default 5432 }}{{ end }} \
+                               -U postgres; do
+                echo "Waiting for database socket..."
+                sleep 2
+              done
+              echo "Database socket is ready!"
+        {{- if .Values.db.enabled }}
+        - name: ensure-database-exists
+          image: postgres:16-alpine
+          env:
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.fullname" . }}-db-superuser
+                  key: password
+            - name: APP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.fullname" . }}-db-url
+                  key: appPassword
+          command:
+            - sh
+            - -c
+            - |
+              DBNAME={{ .Values.db.internal.database | default "twenty" }}
+              APP_USER={{ .Values.db.internal.appUser | default "twenty_app_user" }}
+              export PGPASSWORD
+              export APP_PASSWORD
+              echo "Creating database ${DBNAME} if it doesn't exist..."
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d postgres -v db="${DBNAME}" -Atc "SELECT 1 FROM pg_database WHERE datname = :'db'" | grep -q 1 || \
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d postgres -v db="${DBNAME}" -c 'CREATE DATABASE :"db";'
+              echo "Creating app user ${APP_USER} if it doesn't exist..."
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d postgres -v app_user="${APP_USER}" -v app_password="${APP_PASSWORD}" <<'EOSQL'
+              DO
+              $do$
+              BEGIN
+              IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'app_user') THEN
+              EXECUTE format('CREATE USER %I WITH PASSWORD %L', :'app_user', :'app_password');
+              END IF;
+              END
+              $do$;
+              EOSQL
+              echo "Creating core schema and granting permissions..."
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'CREATE SCHEMA IF NOT EXISTS core'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v db="${DBNAME}" -v app_user="${APP_USER}" -c 'GRANT ALL PRIVILEGES ON DATABASE :"db" TO :"app_user";'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'GRANT ALL PRIVILEGES ON SCHEMA core TO :"app_user";'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'GRANT ALL PRIVILEGES ON SCHEMA public TO :"app_user";'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA core TO :"app_user";'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO :"app_user";'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'ALTER DEFAULT PRIVILEGES IN SCHEMA core GRANT ALL ON TABLES TO :"app_user";'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'ALTER DEFAULT PRIVILEGES IN SCHEMA core GRANT ALL ON SEQUENCES TO :"app_user";'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO :"app_user";'
+              psql -h {{ include "twenty.fullname" . }}-db -p 5432 -U postgres -d "${DBNAME}" -v app_user="${APP_USER}" -c 'ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO :"app_user";'
+              echo "Database ${DBNAME} is ready."
+        {{- end }}
+      containers:
+        - name: server
+          {{- $img := include "twenty.server.image" . }}
+          image: {{ include "twenty.image.repository" $img }}:{{ include "twenty.image.tag" $img }}
+          imagePullPolicy: {{ include "twenty.image.pullPolicy" $img }}
+          env:
+            - name: SERVER_URL
+              value: {{ include "twenty.serverUrl" . | quote }}
+            {{- if eq (include "twenty.db.useExternalSecret" .) "true" }}
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.dbPassword.secretName" . }}
+                  key: {{ include "twenty.dbPassword.secretKey" . }}
+            - name: PG_DATABASE_URL
+              value: {{ include "twenty.dbUrl.template" . | quote }}
+            {{- else }}
+            - name: PG_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.dbUrl.secretName" . }}
+                  key: url
+            {{- end }}
+            {{- if eq (include "twenty.redis.useExternalSecret" .) "true" }}
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.redis.external.secretName }}
+                  key: {{ .Values.redis.external.passwordKey }}
+            {{- else if .Values.redis.external.password }}
+            - name: REDIS_PASSWORD
+              value: {{ .Values.redis.external.password | quote }}
+            {{- end }}
+            - name: REDIS_URL
+              value: {{ include "twenty.redisUrl" . | quote }}
+            - name: SIGN_IN_PREFILLED
+              value: {{ .Values.server.env.SIGN_IN_PREFILLED | quote }}
+            - name: STORAGE_TYPE
+              value: {{ include "twenty.storageType" . | quote }}
+            - name: ACCESS_TOKEN_EXPIRES_IN
+              value: {{ .Values.server.env.ACCESS_TOKEN_EXPIRES_IN | quote }}
+            - name: LOGIN_TOKEN_EXPIRES_IN
+              value: {{ .Values.server.env.LOGIN_TOKEN_EXPIRES_IN | quote }}
+            - name: APP_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.secret.tokens.name" . }}
+                  key: accessToken
+            {{- $storageEnv := (include "twenty.storageEnv" .) }}
+            {{- if $storageEnv }}
+            {{- $storageEnv | nindent 12 }}
+            {{- end }}
+            {{- with .Values.server.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          ports:
+            - name: http-tcp
+              containerPort: {{ include "twenty.server.containerPort" . }}
+              protocol: TCP
+          {{- with .Values.server.startupProbe }}
+          startupProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.server.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.server.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.server.resources | nindent 12 }}
+          volumeMounts:
+            {{- if .Values.server.dockerDataPersistence.enabled }}
+            - name: docker-data
+              mountPath: /app/docker-data
+            {{- end }}
+            {{- if .Values.server.persistence.enabled }}
+            - name: server-data
+              mountPath: /app/packages/twenty-server/.local-storage
+            {{- end }}
+            {{- with .Values.server.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- if .Values.server.stdin }}
+          stdin: {{ .Values.server.stdin }}
+          {{- end }}
+          {{- if .Values.server.tty }}
+          tty: {{ .Values.server.tty }}
+          {{- end }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/deployment-worker.yaml

@@ -0,0 +1,119 @@
+{{- if .Values.worker.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "twenty.fullname" . }}-worker
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: worker
+spec:
+  replicas: {{ .Values.worker.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "twenty.name" . }}
+      app.kubernetes.io/component: worker
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "twenty.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: worker
+    spec:
+      securityContext:
+{{- toYaml .Values.securityContext | nindent 8 }}
+      {{- with .Values.worker.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.worker.dnsPolicy }}
+      dnsPolicy: {{ . }}
+      {{- end }}
+      {{- with .Values.worker.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      initContainers:
+        - name: wait-for-db
+          image: postgres:16-alpine
+          command:
+            - sh
+            - -c
+            - |
+              until pg_isready -h {{ if .Values.db.enabled }}{{ include "twenty.fullname" . }}-db{{ else }}{{ .Values.db.external.host }}{{ end }} \
+                               -p {{ if .Values.db.enabled }}5432{{ else }}{{ .Values.db.external.port | default 5432 }}{{ end }} \
+                               -U postgres; do
+                echo "Waiting for database socket..."
+                sleep 2
+              done
+              echo "Database socket is ready!"
+      containers:
+        - name: worker
+          {{- $img := include "twenty.worker.image" . }}
+          image: {{ include "twenty.image.repository" $img }}:{{ include "twenty.image.tag" $img }}
+          imagePullPolicy: {{ include "twenty.image.pullPolicy" $img }}
+          command:
+{{- toYaml .Values.worker.command | nindent 12 }}
+          env:
+            - name: SERVER_URL
+              value: {{ include "twenty.serverUrl" . | quote }}
+            {{- if eq (include "twenty.db.useExternalSecret" .) "true" }}
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.dbPassword.secretName" . }}
+                  key: {{ include "twenty.dbPassword.secretKey" . }}
+            - name: PG_DATABASE_URL
+              value: {{ include "twenty.dbUrl.template" . | quote }}
+            {{- else }}
+            - name: PG_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.dbUrl.secretName" . }}
+                  key: url
+            {{- end }}
+            {{- if eq (include "twenty.redis.useExternalSecret" .) "true" }}
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.redis.external.secretName }}
+                  key: {{ .Values.redis.external.passwordKey }}
+            {{- else if .Values.redis.external.password }}
+            - name: REDIS_PASSWORD
+              value: {{ .Values.redis.external.password | quote }}
+            {{- end }}
+            - name: REDIS_URL
+              value: {{ include "twenty.redisUrl" . | quote }}
+            - name: STORAGE_TYPE
+              value: {{ include "twenty.storageType" . | quote }}
+            - name: APP_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "twenty.secret.tokens.name" . }}
+                  key: accessToken
+            {{- with .Values.worker.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- $storageEnv := (include "twenty.storageEnv" .) }}
+            {{- if $storageEnv }}
+            {{- $storageEnv | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.worker.resources | nindent 12 }}
+          stdin: {{ default true .Values.worker.stdin }}
+          tty: {{ default true .Values.worker.tty }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/ingress.yaml

@@ -0,0 +1,47 @@
+{{- if and .Values.server.enabled .Values.server.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "twenty.fullname" . }}
+  namespace: {{ include "twenty.namespace" . }}
+  annotations:
+    {{- if .Values.server.ingress.acme }}
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    {{- end }}
+    {{- with .Values.server.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- if .Values.server.ingress.className }}
+  ingressClassName: {{ .Values.server.ingress.className }}
+  {{- end }}
+  rules:
+    {{- range .Values.server.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- if .paths }}
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "twenty.fullname" $ }}-server
+                port:
+                  name: http-tcp
+          {{- end }}
+          {{- else }}
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "twenty.fullname" $ }}-server
+                port:
+                  name: http-tcp
+          {{- end }}
+    {{- end }}
+  {{- if .Values.server.ingress.tls }}
+  tls:
+    {{- toYaml .Values.server.ingress.tls | nindent 4 }}
+  {{- end }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/pvc-db-internal.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.db.enabled .Values.db.internal.persistence.enabled (not .Values.db.internal.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "twenty.fullname" . }}-db
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: db
+spec:
+  accessModes:
+{{ toYaml .Values.db.internal.persistence.accessModes | nindent 4 }}
+  resources:
+    requests:
+      storage: {{ .Values.db.internal.persistence.size }}
+  {{- if .Values.db.internal.persistence.storageClass }}
+  storageClassName: {{ .Values.db.internal.persistence.storageClass }}
+  {{- end }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/pvc-docker-data.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.server.enabled .Values.server.dockerDataPersistence.enabled (not .Values.server.dockerDataPersistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "twenty.fullname" . }}-docker-data
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: server
+spec:
+  accessModes:
+{{ toYaml .Values.server.dockerDataPersistence.accessModes | nindent 4 }}
+  resources:
+    requests:
+      storage: {{ .Values.server.dockerDataPersistence.size }}
+  {{- if .Values.server.dockerDataPersistence.storageClass }}
+  storageClassName: {{ .Values.server.dockerDataPersistence.storageClass }}
+  {{- end }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/pvc-redis-internal.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.redisInternal.enabled .Values.redisInternal.persistence.enabled (not .Values.redisInternal.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "twenty.fullname" . }}-redis
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: redis
+spec:
+  accessModes:
+{{ toYaml .Values.redisInternal.persistence.accessModes | nindent 4 }}
+  resources:
+    requests:
+      storage: {{ .Values.redisInternal.persistence.size }}
+  {{- if .Values.redisInternal.persistence.storageClass }}
+  storageClassName: {{ .Values.redisInternal.persistence.storageClass }}
+  {{- end }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/pvc-server.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.server.enabled .Values.server.persistence.enabled (not .Values.server.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "twenty.fullname" . }}-server
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: server
+spec:
+  accessModes:
+{{ toYaml .Values.server.persistence.accessModes | nindent 4 }}
+  resources:
+    requests:
+      storage: {{ .Values.server.persistence.size }}
+  {{- if .Values.server.persistence.storageClass }}
+  storageClassName: {{ .Values.server.persistence.storageClass }}
+  {{- end }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/secret-db-superuser.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.db.enabled }}
+{{- $ns := include "twenty.namespace" . -}}
+{{- $existing := lookup "v1" "Secret" $ns (printf "%s-db-superuser" (include "twenty.fullname" .)) -}}
+{{- $user := .Values.db.internal.env.PGUSER_SUPERUSER | default "postgres" -}}
+{{- $pass := .Values.db.internal.env.PGPASSWORD_SUPERUSER | default "" -}}
+{{- if and $existing $existing.data.password -}}
+{{- $pass = (b64dec $existing.data.password) -}}
+{{- else if eq $pass "" -}}
+{{- $pass = randAlphaNum 32 -}}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "twenty.fullname" . }}-db-superuser
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: db
+type: Opaque
+stringData:
+  username: {{ $user | quote }}
+  password: {{ $pass | quote }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/secret-db-url.yaml

@@ -0,0 +1,45 @@
+{{- $secretName := printf "%s-db-url" (include "twenty.fullname" .) -}}
+{{- if .Values.db.enabled -}}
+{{- $existingSecret := lookup "v1" "Secret" (include "twenty.namespace" .) $secretName -}}
+{{- $appPassword := "" -}}
+{{- if $existingSecret -}}
+{{- $appPassword = index $existingSecret.data "appPassword" | b64dec -}}
+{{- else -}}
+{{- $appPassword = .Values.db.internal.appPassword | default (randAlphaNum 32) -}}
+{{- end -}}
+{{- $appUser := .Values.db.internal.appUser | default "twenty_app_user" -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: server
+type: Opaque
+stringData:
+  url: {{ printf "postgres://%s:%s@%s-db.%s.svc.cluster.local/%s" (urlquery $appUser) (urlquery $appPassword) (include "twenty.fullname" .) (include "twenty.namespace" .) (.Values.db.internal.database | default "twenty") | quote }}
+  appPassword: {{ $appPassword | quote }}
+{{- else if not .Values.db.external.secretName -}}
+{{- $scheme := "postgres" -}}
+{{- $host := .Values.db.external.host -}}
+{{- $port := .Values.db.external.port | default 5432 -}}
+{{- $user := .Values.db.external.user | default "postgres" -}}
+{{- $pass := .Values.db.external.password | default "" -}}
+{{- $db := .Values.db.external.database | default "twenty" -}}
+{{- $qs := ternary "?sslmode=require" "" (eq .Values.db.external.ssl true) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: server
+type: Opaque
+stringData:
+  url: {{ printf "%s://%s:%s@%s:%v/%s%s" $scheme (urlquery $user) (urlquery $pass) $host $port $db $qs | quote }}
+  password: {{ $pass | quote }}
+{{- end -}}

packages/twenty-docker/helm/twenty/templates/secret-tokens.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.secrets.tokens.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secrets.tokens.name | default "tokens" }}
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: tokens
+stringData:
+  accessToken: {{ include "twenty.secret.tokens.access" . | quote }}
+{{- end }}

packages/twenty-docker/helm/twenty/templates/service-db-internal.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.db.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "twenty.fullname" . }}-db
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: db
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/component: db
+  ports:
+    - port: 5432
+      targetPort: 5432
+      protocol: TCP
+      name: postgres
+{{- end }}

packages/twenty-docker/helm/twenty/templates/service-redis-internal.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.redisInternal.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "twenty.fullname" . }}-redis
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: redis
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/component: redis
+  ports:
+    - port: {{ .Values.redisInternal.service.port }}
+      targetPort: {{ .Values.redisInternal.service.port }}
+      protocol: TCP
+      name: redis
+{{- end }}

packages/twenty-docker/helm/twenty/templates/service-server.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.server.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "twenty.fullname" . }}-server
+  namespace: {{ include "twenty.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: server
+spec:
+  type: {{ .Values.server.service.type | default "ClusterIP" }}
+  selector:
+    app.kubernetes.io/name: {{ include "twenty.name" . }}
+    app.kubernetes.io/component: server
+  ports:
+    - name: http-tcp
+      port: {{ .Values.server.service.port }}
+      targetPort: {{ include "twenty.server.containerPort" . }}
+      protocol: TCP
+{{- end }}

packages/twenty-docker/helm/twenty/tests/app_user_test.yaml

@@ -0,0 +1,43 @@
+suite: app user and database initialization
+templates:
+  - templates/secret-db-url.yaml
+  - templates/deployment-server.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: db-url secret includes app password
+    template: templates/secret-db-url.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db-url
+      - isNotEmpty:
+          path: stringData.appPassword
+
+  - it: server init container creates app user with proper permissions
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: test_user
+      db.internal.database: testdb
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: CREATE USER
+
+  - it: db url uses app user not superuser
+    template: templates/secret-db-url.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: my_app
+      db.internal.database: mydb
+    asserts:
+      - matchRegex:
+          path: stringData.url
+          pattern: ^postgres://my_app:.*@my-twenty-twenty-db

packages/twenty-docker/helm/twenty/tests/env_mapping_test.yaml

@@ -0,0 +1,58 @@
+suite: env mapping
+templates:
+  - templates/deployment-server.yaml
+  - templates/deployment-worker.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders server extraEnv with plain value
+    template: templates/deployment-server.yaml
+    set:
+      server.extraEnv:
+        - name: FEATURE_X_ENABLED
+          value: "true"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: FEATURE_X_ENABLED
+            value: "true"
+
+  - it: renders server extraEnv with valueFrom
+    template: templates/deployment-server.yaml
+    set:
+      server.extraEnv:
+        - name: SMTP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: smtp-creds
+              key: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SMTP_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: smtp-creds
+                key: password
+
+  - it: renders worker extraEnv with valueFrom
+    template: templates/deployment-worker.yaml
+    set:
+      worker.extraEnv:
+        - name: CUSTOM_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: my-secret
+              key: custom
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: CUSTOM_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: my-secret
+                key: custom

packages/twenty-docker/helm/twenty/tests/ingress_test.yaml

@@ -0,0 +1,120 @@
+suite: ingress rendering
+templates:
+  - templates/ingress.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders with host and paths
+    set:
+      server.ingress.enabled: true
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+      server.ingress.tls:
+        - hosts:
+            - twenty.example.com
+          secretName: twenty-tls
+    asserts:
+      - equal:
+          path: spec.rules[0].host
+          value: twenty.example.com
+      - equal:
+          path: spec.rules[0].http.paths[0].path
+          value: /
+      - equal:
+          path: spec.rules[0].http.paths[0].pathType
+          value: Prefix
+      - equal:
+          path: spec.tls[0].hosts[0]
+          value: twenty.example.com
+      - equal:
+          path: spec.tls[0].secretName
+          value: twenty-tls
+
+  - it: adds cert-manager annotation when acme is true
+    set:
+      server.ingress.enabled: true
+      server.ingress.acme: true
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - equal:
+          path: metadata.annotations["cert-manager.io/cluster-issuer"]
+          value: letsencrypt-prod
+
+  - it: supports multiple hosts with different paths
+    set:
+      server.ingress.enabled: true
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+        - host: crm.example.com
+          paths:
+            - path: /api
+              pathType: Prefix
+            - path: /graphql
+              pathType: Exact
+    asserts:
+      - equal:
+          path: spec.rules[0].host
+          value: twenty.example.com
+      - equal:
+          path: spec.rules[1].host
+          value: crm.example.com
+      - equal:
+          path: spec.rules[1].http.paths[0].path
+          value: /api
+      - equal:
+          path: spec.rules[1].http.paths[1].path
+          value: /graphql
+      - equal:
+          path: spec.rules[1].http.paths[1].pathType
+          value: Exact
+
+  - it: does not render when ingress disabled
+    set:
+      server.ingress.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: supports custom annotations
+    set:
+      server.ingress.enabled: true
+      server.ingress.annotations:
+        nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+        custom.annotation/key: "value"
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - equal:
+          path: metadata.annotations["nginx.ingress.kubernetes.io/proxy-body-size"]
+          value: "50m"
+      - equal:
+          path: metadata.annotations["custom.annotation/key"]
+          value: "value"
+
+  - it: supports custom className
+    set:
+      server.ingress.enabled: true
+      server.ingress.className: nginx
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - equal:
+          path: spec.ingressClassName
+          value: nginx

packages/twenty-docker/helm/twenty/tests/pvc_test.yaml

@@ -0,0 +1,106 @@
+suite: pvc configuration
+templates:
+  - templates/pvc-server.yaml
+  - templates/pvc-db-internal.yaml
+  - templates/pvc-docker-data.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: server pvc renders when persistence enabled
+    template: templates/pvc-server.yaml
+    set:
+      server.persistence.enabled: true
+      server.persistence.size: 10Gi
+    asserts:
+      - isKind:
+          of: PersistentVolumeClaim
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-server
+      - equal:
+          path: spec.resources.requests.storage
+          value: 10Gi
+      - contains:
+          path: spec.accessModes
+          content: ReadWriteOnce
+
+  - it: server pvc does not render when persistence disabled
+    template: templates/pvc-server.yaml
+    set:
+      server.persistence.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: server pvc renders with correct defaults
+    template: templates/pvc-server.yaml
+    set:
+      server.persistence.enabled: true
+    asserts:
+      - isKind:
+          of: PersistentVolumeClaim
+
+  - it: server pvc omits storageClassName when set to hyphen
+    template: templates/pvc-server.yaml
+    set:
+      server.persistence.enabled: true
+      server.persistence.storageClass: ""
+    asserts:
+      - isNull:
+          path: spec.storageClassName
+
+  - it: db-internal pvc renders with correct size
+    template: templates/pvc-db-internal.yaml
+    set:
+      db.enabled: true
+      db.internal.persistence.enabled: true
+      db.internal.persistence.size: 20Gi
+    asserts:
+      - isKind:
+          of: PersistentVolumeClaim
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db
+      - isKind:
+          of: PersistentVolumeClaim
+
+  - it: db-internal pvc does not render when disabled
+    template: templates/pvc-db-internal.yaml
+    set:
+      db.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: db-internal pvc renders when enabled
+    template: templates/pvc-db-internal.yaml
+    set:
+      db.enabled: true
+      db.internal.persistence.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: docker-data pvc renders when enabled
+    template: templates/pvc-docker-data.yaml
+    set:
+      server.enabled: true
+      server.dockerDataPersistence.enabled: true
+      server.dockerDataPersistence.size: 5Gi
+    asserts:
+      - isKind:
+          of: PersistentVolumeClaim
+
+  - it: all pvcs use ReadWriteOnce access mode
+    templates:
+      - templates/pvc-server.yaml
+      - templates/pvc-db-internal.yaml
+    set:
+      server.persistence.enabled: true
+      db.enabled: true
+      db.internal.persistence.enabled: true
+    asserts:
+      - contains:
+          path: spec.accessModes
+          content: ReadWriteOnce

packages/twenty-docker/helm/twenty/tests/redis_auth_test.yaml

@@ -0,0 +1,89 @@
+suite: redis external authentication
+templates:
+  - templates/deployment-server.yaml
+  - templates/deployment-worker.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: injects REDIS_PASSWORD from external secret into server
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.secretName: redis-creds
+      redis.external.passwordKey: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: redis-creds
+                key: password
+
+  - it: injects REDIS_PASSWORD from external secret into worker
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.secretName: redis-creds
+      redis.external.passwordKey: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: redis-creds
+                key: password
+
+  - it: injects plaintext REDIS_PASSWORD when password set directly in server
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.password: "s3cr3t"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            value: "s3cr3t"
+
+  - it: injects plaintext REDIS_PASSWORD when password set directly in worker
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.password: "s3cr3t"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            value: "s3cr3t"
+
+  - it: does not inject REDIS_PASSWORD into server when using internal redis
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+          any: true
+
+  - it: does not inject REDIS_PASSWORD into worker when using internal redis
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+          any: true

packages/twenty-docker/helm/twenty/tests/redis_db_switching_test.yaml

@@ -0,0 +1,91 @@
+suite: redis and database switching
+templates:
+  - templates/deployment-redis-internal.yaml
+  - templates/service-redis-internal.yaml
+  - templates/deployment-db-internal.yaml
+  - templates/service-db-internal.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: internal redis deployment renders when enabled
+    template: templates/deployment-redis-internal.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-redis
+
+  - it: internal redis does not render when disabled
+    template: templates/deployment-redis-internal.yaml
+    set:
+      redisInternal.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: redis service renders when internal redis enabled
+    template: templates/service-redis-internal.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-redis
+
+  - it: redis uses args for port configuration
+    template: templates/deployment-redis-internal.yaml
+    set:
+      redisInternal.enabled: true
+      redisInternal.service.port: 6379
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --port
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "6379"
+
+  - it: internal db deployment renders when enabled
+    template: templates/deployment-db-internal.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db
+
+  - it: internal db does not render when disabled
+    template: templates/deployment-db-internal.yaml
+    set:
+      db.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: internal db uses Recreate strategy for PVC
+    template: templates/deployment-db-internal.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+
+  - it: db service renders when internal db enabled
+    template: templates/service-db-internal.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db

packages/twenty-docker/helm/twenty/tests/schema_permissions_test.yaml

@@ -0,0 +1,107 @@
+suite: schema permissions (core for app tables, public for extensions)
+templates:
+  - templates/deployment-server.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  # Core Schema Tests
+  # ================
+  # Twenty uses a dedicated 'core' schema for all application tables and the TypeORM
+  # migrations tracking table. This provides namespace isolation and clarity.
+
+  - it: ensure-database-exists creates core schema
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: CREATE SCHEMA IF NOT EXISTS core
+
+  - it: app user gets all privileges on core schema
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: GRANT ALL PRIVILEGES ON SCHEMA core
+
+  - it: app user gets all privileges on core tables
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA core
+
+  - it: default privileges set for future core tables
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: ALTER DEFAULT PRIVILEGES IN SCHEMA core GRANT ALL ON TABLES
+
+  - it: default privileges set for future core sequences
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: ALTER DEFAULT PRIVILEGES IN SCHEMA core GRANT ALL ON SEQUENCES
+
+  # Public Schema Tests
+  # ==================
+  # PostgreSQL extensions (like unaccent for accent-insensitive text search) are
+  # created in the 'public' schema. Twenty's migrations create these functions, so
+  # the app user needs full privileges on the public schema as well.
+
+  - it: app user gets all privileges on public schema
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: GRANT ALL PRIVILEGES ON SCHEMA public
+
+  - it: app user gets all privileges on public tables
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public
+
+  - it: default privileges set for future public tables
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES
+
+  - it: default privileges set for future public sequences
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES
+

packages/twenty-docker/helm/twenty/tests/secret_generation_test.yaml

@@ -0,0 +1,52 @@
+suite: secret generation
+templates:
+  - templates/secret-tokens.yaml
+  - templates/secret-db-superuser.yaml
+  - templates/secret-db-url.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: generates tokens
+    template: templates/secret-tokens.yaml
+    set:
+      secrets.tokens.create: true
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: tokens
+
+  # db-user secret removed; chart no longer manages app user credentials
+
+  - it: db-superuser secret generates password for internal DB
+    template: templates/secret-db-superuser.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db-superuser
+
+  - it: db-superuser secret does not render when internal DB disabled
+    template: templates/secret-db-superuser.yaml
+    set:
+      db.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: db-url secret renders for internal database
+    template: templates/secret-db-url.yaml
+    set:
+      db.enabled: true
+      db.internal.database: appdb
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db-url

packages/twenty-docker/helm/twenty/tests/server_url_test.yaml

@@ -0,0 +1,72 @@
+suite: server url
+templates:
+  - templates/deployment-server.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: derives from ingress with paths
+    set:
+      server.ingress.enabled: true
+      server.ingress.hosts:
+        - host: crm.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+      server.ingress.tls:
+        - secretName: example-tls
+          hosts:
+            - crm.example.com
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name=="SERVER_URL")].value
+          value: "https://crm.example.com:443"
+  - it: falls back to service when ingress disabled
+    set:
+      server.ingress.enabled: false
+      server.service.port: 3000
+      server.env.SERVER_URL: ""
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].env[?(@.name=="SERVER_URL")].value
+          pattern: ^http://my-twenty-twenty-server\.default\.svc\.cluster\.local:3000$
+---
+suite: ingress configuration
+templates:
+  - templates/ingress.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders with host and paths
+    set:
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+      server.ingress.tls:
+        - hosts:
+            - twenty.example.com
+          secretName: twenty-tls
+    asserts:
+      - equal:
+          path: spec.rules[0].host
+          value: twenty.example.com
+      - equal:
+          path: spec.rules[0].http.paths[0].path
+          value: /
+      - equal:
+          path: spec.tls[0].hosts[0]
+          value: twenty.example.com
+      - equal:
+          path: spec.tls[0].secretName
+          value: twenty-tls
+  - it: adds cert-manager annotation when acme true
+    set:
+      server.ingress.acme: true
+    asserts:
+      - isSubset:
+          path: metadata.annotations
+          content:
+            cert-manager.io/cluster-issuer: letsencrypt-prod

packages/twenty-docker/helm/twenty/tests/storage_env_test.yaml

@@ -0,0 +1,46 @@
+suite: storage env s3
+templates:
+  - templates/deployment-server.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: injects S3 env vars when storage.type is s3
+    set:
+      storage.type: s3
+      storage.s3.bucket: my-bucket
+      storage.s3.region: us-east-1
+      storage.s3.endpoint: https://s3.amazonaws.com
+      storage.s3.accessKeyId: AKIA
+      storage.s3.secretAccessKey: secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_TYPE
+            value: s3
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_NAME
+            value: my-bucket
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_REGION
+            value: us-east-1
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_ENDPOINT
+            value: https://s3.amazonaws.com
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_ACCESS_KEY_ID
+            value: AKIA
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_SECRET_ACCESS_KEY
+            value: secret

packages/twenty-docker/helm/twenty/tests/worker_deployment_test.yaml

@@ -0,0 +1,76 @@
+suite: worker deployment
+templates:
+  - templates/deployment-worker.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders with correct name and labels
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-worker
+      - equal:
+          path: metadata.labels["app.kubernetes.io/name"]
+          value: twenty
+      - equal:
+          path: metadata.labels["app.kubernetes.io/component"]
+          value: worker
+
+  - it: uses db-url secret for database connection
+    set:
+      db.enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name=="PG_DATABASE_URL")].valueFrom.secretKeyRef.name
+          value: my-twenty-twenty-db-url
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name=="PG_DATABASE_URL")].valueFrom.secretKeyRef.key
+          value: url
+
+  - it: does not mount storage by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.volumes
+
+  - it: uses correct command for worker process
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: yarn
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: worker:prod
+
+  - it: sets replica count to 1 by default
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 1
+
+  - it: supports local storage configuration
+    set:
+      storage.type: local
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name=="STORAGE_TYPE")].value
+          value: local
+
+  - it: uses custom image when specified
+    set:
+      worker.image.repository: custom/twenty
+      worker.image.tag: v2.0.0
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: "^custom/twenty:v2.0.0$"
+
+  - it: falls back to Chart.AppVersion when tag not specified
+    set:
+      worker.image.tag: ""
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: ":v1.14.0$"

packages/twenty-docker/helm/twenty/values.schema.json

@@ -0,0 +1,281 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Twenty Helm Chart Values",
+  "type": "object",
+  "additionalProperties": true,
+  "definitions": {
+    "probe": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "properties": {
+            "httpGet": {
+              "type": "object",
+              "properties": {
+                "path": { "type": "string" },
+                "port": { "type": ["string", "integer"] },
+                "scheme": { "type": "string", "enum": ["HTTP", "HTTPS"] },
+                "host": { "type": "string" },
+                "httpHeaders": { "type": "array" }
+              }
+            },
+            "tcpSocket": {
+              "type": "object",
+              "properties": {
+                "port": { "type": ["string", "integer"] },
+                "host": { "type": "string" }
+              },
+              "required": ["port"]
+            },
+            "exec": {
+              "type": "object",
+              "properties": {
+                "command": { "type": "array", "items": { "type": "string" } }
+              },
+              "required": ["command"]
+            },
+            "initialDelaySeconds": { "type": "integer", "minimum": 0 },
+            "periodSeconds": { "type": "integer", "minimum": 1 },
+            "timeoutSeconds": { "type": "integer", "minimum": 1 },
+            "successThreshold": { "type": "integer", "minimum": 1 },
+            "failureThreshold": { "type": "integer", "minimum": 1 },
+            "terminationGracePeriodSeconds": { "type": "integer", "minimum": 1 }
+          },
+          "oneOf": [
+            { "required": ["httpGet"] },
+            { "required": ["tcpSocket"] },
+            { "required": ["exec"] }
+          ]
+        }
+      ]
+    }
+  },
+  "properties": {
+    "image": {
+      "type": "object",
+      "properties": {
+        "repository": { "type": "string" },
+        "tag": { "type": "string" },
+        "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] }
+      }
+    },
+    "nameOverride": { "type": "string" },
+    "fullnameOverride": { "type": "string" },
+    "namespaceOverride": { "type": "string" },
+
+    "secrets": {
+      "type": "object",
+      "properties": {
+        "tokens": {
+          "type": "object",
+          "properties": {
+            "create": { "type": "boolean" },
+            "name": { "type": "string" },
+            "accessToken": { "type": "string" }
+          },
+          "required": ["create", "name"]
+        }
+      }
+    },
+
+    "server": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "replicaCount": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Number of server replicas. When using local storage with ReadWriteOnce (RWO) PersistentVolumeClaims (the default), multiple replicas cannot share the same PVC and pods will fail to schedule if replicaCount > 1. Use replicaCount = 1 for local/RWO storage, or configure a shared storage backend such as S3 before increasing this value."
+        },
+        "podSecurityContext": { "type": "object" },
+        "containerSecurityContext": { "type": "object" },
+        "env": {
+          "type": "object",
+          "properties": {
+            "SERVER_URL": { "type": "string", "description": "Override for the server URL (e.g., https://crm.example.com). If not set, derived from ingress or service." },
+            "NODE_PORT": { "type": "integer", "minimum": 1 },
+            "PG_DATABASE_URL": { "type": "string" },
+            "REDIS_URL": { "type": "string" },
+            "SIGN_IN_PREFILLED": { "type": "string" },
+            "STORAGE_TYPE": { "type": "string" },
+            "ACCESS_TOKEN_EXPIRES_IN": { "type": "string" },
+            "LOGIN_TOKEN_EXPIRES_IN": { "type": "string" },
+            "EMAIL_DRIVER": { "type": "string" },
+            "EMAIL_SMTP_HOST": { "type": "string" },
+            "EMAIL_SMTP_PORT": { "type": "integer" },
+            "EMAIL_SMTP_USER": { "type": "string" },
+            "EMAIL_SMTP_PASSWORD": { "type": "string" },
+            "EMAIL_SMTP_NO_TLS": { "type": "boolean" },
+            "EMAIL_FROM_ADDRESS": { "type": "string" },
+            "EMAIL_FROM_NAME": { "type": "string" },
+            "IS_EMAIL_VERIFICATION_REQUIRED": { "type": "boolean" },
+            "EMAIL_VERIFICATION_TOKEN_EXPIRES_IN": { "type": "string" },
+            "PASSWORD_RESET_TOKEN_EXPIRES_IN": { "type": "string" }
+          }
+        },
+        "extraEnv": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string" },
+              "value": { "type": "string" },
+              "valueFrom": { "type": "object" }
+            },
+            "required": ["name"],
+            "oneOf": [
+              { "required": ["value"] },
+              { "required": ["valueFrom"] }
+            ]
+          }
+        },
+        "service": {
+          "type": "object",
+          "properties": {
+            "type": { "type": "string", "enum": ["ClusterIP", "NodePort", "LoadBalancer"] },
+            "port": { "type": "integer", "minimum": 1 },
+            "sessionAffinity": { "type": "string", "enum": ["None", "ClientIP"] },
+            "sessionAffinityTimeoutSeconds": { "type": "integer", "minimum": 1 }
+          }
+        },
+        "ingress": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "className": { "type": "string" },
+            "acme": { "type": "boolean" },
+            "hosts": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "host": { "type": "string" },
+                  "paths": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "path": { "type": "string" },
+                        "pathType": { "type": "string", "enum": ["Prefix", "Exact", "ImplementationSpecific"] }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "tls": { "type": "array" }
+          }
+        },
+        "persistence": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "existingClaim": { "type": "string" },
+            "storageClass": { "type": "string" },
+            "accessModes": { "type": "array", "items": { "type": "string" } },
+            "size": { "type": "string" }
+          }
+        },
+        "dockerDataPersistence": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "existingClaim": { "type": "string" },
+            "storageClass": { "type": "string" },
+            "accessModes": { "type": "array", "items": { "type": "string" } },
+            "size": { "type": "string" }
+          }
+        },
+        "nodeSelector": { "type": "object" },
+        "tolerations": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "affinity": { "type": "object" },
+        "dnsPolicy": { "type": ["string", "null"], "enum": ["ClusterFirst", "ClusterFirstWithHostNet", "Default", "None", null] },
+        "dnsConfig": { "type": "object" },
+        "startupProbe": { "$ref": "#/definitions/probe" },
+        "livenessProbe": { "$ref": "#/definitions/probe" },
+        "readinessProbe": { "$ref": "#/definitions/probe" }
+      }
+    },
+
+    "worker": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "replicaCount": { "type": "integer", "minimum": 1 },
+        "podSecurityContext": { "type": "object" },
+        "containerSecurityContext": { "type": "object" },
+        "env": {
+          "type": "object",
+          "properties": {
+            "PG_DATABASE_URL": { "type": "string" },
+            "REDIS_URL": { "type": "string" },
+            "STORAGE_TYPE": { "type": "string" },
+            "DISABLE_DB_MIGRATIONS": { "type": "string" }
+          }
+        },
+        "extraEnv": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string" },
+              "value": { "type": "string" },
+              "valueFrom": { "type": "object" }
+            },
+            "required": ["name"],
+            "oneOf": [
+              { "required": ["value"] },
+              { "required": ["valueFrom"] }
+            ]
+          }
+        },
+        "nodeSelector": { "type": "object" },
+        "tolerations": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "affinity": { "type": "object" },
+        "dnsPolicy": { "type": ["string", "null"], "enum": ["ClusterFirst", "ClusterFirstWithHostNet", "Default", "None", null] },
+        "dnsConfig": { "type": "object" }
+      }
+    },
+
+    "storage": {
+      "type": "object",
+      "properties": {
+        "type": { "type": "string", "enum": ["local", "s3"] },
+        "s3": {
+          "type": "object",
+          "properties": {
+            "bucket": { "type": "string" },
+            "region": { "type": "string" },
+            "endpoint": { "type": "string" },
+            "accessKeyId": { "type": "string" },
+            "secretAccessKey": { "type": "string" },
+            "secretName": { "type": "string" },
+            "accessKeyIdKey": { "type": "string" },
+            "secretAccessKeyKey": { "type": "string" }
+          }
+        }
+      },
+      "required": ["type"],
+      "allOf": [
+        {
+          "if": { "properties": { "type": { "const": "s3" } }, "required": ["type"] },
+          "then": {
+            "required": ["s3"],
+            "properties": {
+              "s3": {
+                "required": ["bucket", "region", "accessKeyId", "secretAccessKey"]
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+}

packages/twenty-docker/helm/twenty/values.yaml

@@ -0,0 +1,228 @@
+# Default image used by all components
+image:
+  repository: twentycrm/twenty
+  tag: ""  # defaults to Chart.yaml appVersion
+  pullPolicy: IfNotPresent
+
+nameOverride: ""
+fullnameOverride: ""
+
+# Global security context (uid/gid for all pods)
+securityContext:
+  runAsUser: 1000
+  fsGroup: 1000
+
+# Storage backend: local or s3
+storage:
+  type: local
+  s3:
+    bucket: ""
+    region: ""
+    endpoint: ""
+    # Option A: direct values
+    accessKeyId: ""
+    secretAccessKey: ""
+    # Option B: reference a Secret
+    # secretName: my-s3-creds
+    # accessKeyIdKey: accessKeyId
+    # secretAccessKeyKey: secretAccessKey
+
+# Auth tokens (random if not provided)
+secrets:
+  tokens:
+    create: true
+    name: tokens
+    accessToken: ""
+
+# Server deployment
+server:
+  enabled: true
+  replicaCount: 1
+  image: {}  # override repository/tag/pullPolicy per component
+
+  resources:
+    requests:
+      cpu: 250m
+      memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 1024Mi
+
+  env:
+    SIGN_IN_PREFILLED: "false"
+    ACCESS_TOKEN_EXPIRES_IN: "7d"
+    LOGIN_TOKEN_EXPIRES_IN: "1h"
+  extraEnv: []
+  # - name: EMAIL_DRIVER
+  #   value: smtp
+  # - name: SMTP_PASSWORD
+  #   valueFrom:
+  #     secretKeyRef:
+  #       name: smtp-creds
+  #       key: password
+
+  service:
+    type: ClusterIP
+    port: 3000
+
+  ingress:
+    enabled: true
+    className: nginx
+    acme: true  # add cert-manager annotation for Let's Encrypt
+    annotations: {}
+    hosts:
+      - host: crm.example.com
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - secretName: twenty-tls
+        hosts:
+          - crm.example.com
+
+  persistence:
+    enabled: true
+    size: 10Gi
+    storageClass: ""
+    existingClaim: ""
+    accessModes:
+      - ReadWriteOnce
+
+  dockerDataPersistence:
+    enabled: true
+    size: 100Mi
+    storageClass: ""
+    existingClaim: ""
+    accessModes:
+      - ReadWriteOnce
+
+  extraVolumeMounts: []
+
+  # Pod scheduling and DNS
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  dnsPolicy: ~
+  dnsConfig: {}
+
+  # Health probes for the server container. Set any probe to null to disable it.
+  # startupProbe gates the slow initial boot (up to periodSeconds x failureThreshold),
+  # so liveness/readiness intentionally carry no initialDelaySeconds.
+  startupProbe:
+    httpGet:
+      path: /healthz
+      port: http-tcp
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 30
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http-tcp
+    periodSeconds: 30
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http-tcp
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+
+# Worker deployment
+worker:
+  enabled: true
+  replicaCount: 1
+  image: {}
+  command: ["yarn", "worker:prod"]
+
+  resources:
+    requests:
+      cpu: 250m
+      memory: 1024Mi
+    limits:
+      cpu: 1000m
+      memory: 2048Mi
+
+  extraEnv: []
+
+  # Pod scheduling and DNS
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  dnsPolicy: ~
+  dnsConfig: {}
+
+# PostgreSQL
+db:
+  enabled: true
+  internal:
+    database: twenty
+    appUser: twenty_app_user
+    appPassword: ""  # random if empty
+    image:
+      repository: twentycrm/twenty-postgres-spilo
+      tag: 3.3-p2
+    resources:
+      requests:
+        cpu: 250m
+        memory: 256Mi
+      limits:
+        cpu: 1000m
+        memory: 1024Mi
+    persistence:
+      enabled: true
+      size: 10Gi
+      storageClass: ""
+      existingClaim: ""
+      accessModes:
+        - ReadWriteOnce
+    env:
+      PGUSER_SUPERUSER: postgres
+      PGPASSWORD_SUPERUSER: postgres
+      SPILO_PROVIDER: local
+      ALLOW_NOSSL: "true"
+
+  external:
+    host: ""
+    port: 5432
+    user: twenty_app_user
+    password: ""
+    database: twenty
+    ssl: false
+    secretName: ""
+    passwordKey: ""
+
+# Redis
+redisInternal:
+  enabled: true
+  image:
+    repository: redis/redis-stack-server
+    tag: 7.2.0-v10
+    pullPolicy: IfNotPresent
+  resources:
+    requests:
+      cpu: 250m
+      memory: 1024Mi
+    limits:
+      cpu: 500m
+      memory: 2048Mi
+  service:
+    port: 6379
+  persistence:
+    enabled: false
+    size: 1Gi
+    storageClass: ""
+    existingClaim: ""
+    accessModes:
+      - ReadWriteOnce
+
+# External Redis (when redisInternal.enabled=false)
+redis:
+  external:
+    host: ""
+    port: 6379
+    password: ""
+    secretName: ""
+    passwordKey: ""

packages/twenty-docker/k8s/README.md

@@ -0,0 +1,132 @@
+# Kubernetes for Twenty CRM (Helm)
+DISCLAIMER: The k8s and podman deployments are not maintained by the core team.
+These files are provided and maintained by the community. Twenty core team
+maintains support for docker deployment.
+
+## Overview
+
+This repository contains a world-class Helm chart and (legacy) raw Kubernetes manifests plus Terraform files to help you deploy and manage the Twenty CRM application. The chart is located at `packages/twenty-docker/helm/twenty` and supersedes the manifests in `packages/twenty-docker/k8s/manifests`.
+
+## Prerequisites
+
+Before using these files, ensure you have the following installed and configured on your system:
+
+- Kubernetes cluster (e.g., Minikube, EKS, GKE)
+- kubectl
+- Helm 3
+- Terraform
+- Docker
+
+## Helm Chart (Recommended)
+
+**Quick install:**
+```bash
+export DOMAIN=your-domain.com
+helm install my-twenty packages/twenty-docker/helm/twenty \
+  --namespace twentycrm --create-namespace --wait \
+  --set server.ingress.hosts[0].host=$DOMAIN \
+  --set server.ingress.hosts[0].paths[0].path=/ \
+  --set server.ingress.hosts[0].paths[0].pathType=Prefix \
+  --set server.ingress.tls[0].hosts[0]=$DOMAIN
+```
+
+See [QUICKSTART](../helm/twenty/QUICKSTART.md) and [chart README](../helm/twenty/README.md) for details.
+
+## Setup Instructions
+
+### Step 1: Clone the Repository
+
+Clone the repository to your local machine:
+
+``` bash
+git clone https://github.com/twentyhq/twenty.git
+cd twenty/packages/twenty-docker/k8s
+```
+
+### Step 2: Customize the Manifests and Terraform Files
+
+**Important:** These files require customization for your specific implementation. Update the placeholders and configurations according to your environment and requirements.
+
+### Step 3: Deploy with Terraform
+
+1. Navigate to the Terraform directory:
+
+    ```bash
+    cd terraform
+    ```
+
+2. Initialize Terraform:
+
+    ```bash
+    terraform init
+    ```
+
+3. Plan the deployment:
+
+    ```bash
+    terraform plan
+    ```
+
+4. Apply the deployment:
+
+    ```bash
+    terraform apply
+    ```
+
+## OR
+
+### Step 3 (Alternative): Deploy with Kubernetes Manifests
+
+1. Navigate to the Kubernetes manifests directory:
+
+    ```bash
+    cd ../k8s
+    ```
+
+2. Create Server Secret
+
+    ``` bash
+    kubectl create secret generic -n twentycrm tokens --from-literal accessToken=changeme --from-literal loginToken="changeme" --from-literal refreshToken="changeme" --from-literal fileToken="changeme"
+    ```
+
+3. Apply the manifests:
+
+    ```bash
+    kubectl apply -f .
+    ```
+
+## Customization
+
+### Kubernetes Manifests
+
+- **Namespace:** Update the `namespace` in the manifests as needed.
+- **Resource Limits:** Adjust the resource limits and requests according to your application's requirements.
+- **Environment Variables:** Configure server tokens in the `Secret` command above.
+
+### Terraform Files
+
+- **Variables:** Update the variables in the `variables.tf` file to match your environment.
+- **Locals:** Update the locals in the `main.tf` file to match your environment.
+- **Providers:** Ensure the provider configurations (e.g., AWS, GCP) are correct for your setup.
+- **Resources:** Modify the resource definitions as needed to fit your infrastructure.
+
+## Troubleshooting
+
+### Common Issues
+
+- **Connectivity:** Ensure your Kubernetes cluster is accessible and configured correctly.
+- **Permissions:** Verify that you have the necessary permissions to deploy resources in your cloud provider.
+- **Resource Limits:** Adjust resource limits if you encounter issues related to insufficient resources.
+
+### Logs and Debugging
+
+- Use `kubectl logs` to check the logs of your Kubernetes pods.
+- Use `terraform show` and `terraform state` to inspect your Terraform state and configurations.
+
+## Conclusion
+
+This setup provides a basic structure for deploying the TwentyCRM application using Kubernetes and Terraform. Ensure you thoroughly customize the manifests and Terraform files to suit your specific needs. For any issues or questions, please refer to the official documentation of Kubernetes and Terraform or seek support from your cloud provider.
+
+---
+
+Feel free to contribute and improve this repository by submitting pull requests or opening issues. Happy deploying!

packages/twenty-docker/k8s/manifests/deployment-db.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: twentycrm-db
+  name: twentycrm-db
+  namespace: twentycrm
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: twentycrm-db
+  template:
+    metadata:
+      labels:
+        app: twentycrm-db
+    spec:
+      volumes:
+        - name: twentycrm-db-data
+          persistentVolumeClaim:
+            claimName: twentycrm-db-pvc
+      containers:
+        - name: twentycrm
+          image: twentycrm/twenty-postgres-spilo:latest
+          imagePullPolicy: Always
+          env:
+            - name: PGUSER_SUPERUSER
+              value: "postgres"
+            - name: PGPASSWORD_SUPERUSER
+              value: "postgres"
+            - name: SPILO_PROVIDER
+              value: "local"
+            - name: ALLOW_NOSSL
+              value: "true"
+          ports:
+            - containerPort: 5432
+              name: tcp
+              protocol: TCP
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "1024Mi"
+              cpu: "1000m"
+          stdin: true
+          tty: true
+          volumeMounts:
+            - mountPath: /home/postgres/pgdata
+              name: twentycrm-db-data
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always

packages/twenty-docker/k8s/manifests/deployment-redis.yaml

@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: twentycrm-redis
+  name: twentycrm-redis
+  namespace: twentycrm
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: twentycrm-redis
+  template:
+    metadata:
+      labels:
+        app: twentycrm-redis
+    spec:
+      containers:
+        - name: redis
+          image: redis/redis-stack-server:latest
+          imagePullPolicy: Always
+          args: ["--maxmemory-policy", "noeviction"]
+          env:
+            - name: PORT
+              value: "6379"
+          ports:
+            - containerPort: 6379
+              name: redis
+              protocol: TCP
+          resources:
+            requests:
+              memory: "1024Mi"
+              cpu: "250m"
+            limits:
+              memory: "2048Mi"
+              cpu: "500m"
+
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always

packages/twenty-docker/k8s/manifests/deployment-server.yaml

@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: twentycrm-server
+  name: twentycrm-server
+  namespace: twentycrm
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: twentycrm-server
+  template:
+    metadata:
+      labels:
+        app: twentycrm-server
+    spec:
+      volumes:
+        - name: twentycrm-server-data
+          persistentVolumeClaim:
+            claimName: twentycrm-server-pvc
+        - name: twentycrm-docker-data
+          persistentVolumeClaim:
+            claimName: twentycrm-docker-data-pvc
+      containers:
+        - name: twentycrm
+          image: twentycrm/twenty:latest
+          imagePullPolicy: Always
+          env:
+            - name: NODE_PORT
+              value: 3000
+            - name: SERVER_URL
+              value: "https://crm.example.com:443"
+            - name: "PG_DATABASE_URL"
+              value: "postgres://postgres:postgres@twentycrm-db.twentycrm.svc.cluster.local/default"
+            - name: "REDIS_URL"
+              value: "redis://twentycrm-redis.twentycrm.svc.cluster.local:6379"
+            - name: SIGN_IN_PREFILLED
+              value: "false"
+            - name: STORAGE_TYPE
+              value: "local"
+            - name: "ACCESS_TOKEN_EXPIRES_IN"
+              value: "7d"
+            - name: "LOGIN_TOKEN_EXPIRES_IN"
+              value: "1h"
+            - name: APP_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: tokens
+                  key: accessToken
+          ports:
+            - containerPort: 3000
+              name: http-tcp
+              protocol: TCP
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "1024Mi"
+              cpu: "1000m"
+          stdin: true
+          tty: true
+          volumeMounts:
+            - mountPath: /app/docker-data
+              name: twentycrm-docker-data
+            - mountPath: /app/packages/twenty-server/.local-storage
+              name: twentycrm-server-data
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always

packages/twenty-docker/k8s/manifests/deployment-worker.yaml

@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: twentycrm-worker
+  name: twentycrm-worker
+  namespace: twentycrm
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: twentycrm-worker
+  template:
+    metadata:
+      labels:
+        app: twentycrm-worker
+    spec:
+      containers:
+        - name: twentycrm
+          image: twentycrm/twenty:latest
+          imagePullPolicy: Always
+          env:
+            - name: SERVER_URL
+              value: "https://crm.example.com:443"
+            - name: PG_DATABASE_URL
+              value: "postgres://postgres:postgres@twentycrm-db.twentycrm.svc.cluster.local/default"
+            - name: DISABLE_DB_MIGRATIONS
+              value: "false" # it already runs on the server
+            - name: STORAGE_TYPE
+              value: "local"
+            - name: "REDIS_URL"
+              value: "redis://twentycrm-redis.twentycrm.svc.cluster.local:6379"
+            - name: APP_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: tokens
+                  key: accessToken
+          command:
+            - yarn
+            - worker:prod
+          resources:
+            requests:
+              memory: "1024Mi"
+              cpu: "250m"
+            limits:
+              memory: "2048Mi"
+              cpu: "1000m"
+          stdin: true
+          tty: true
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always

packages/twenty-docker/k8s/manifests/ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: twentycrm
+  namespace: twentycrm
+  annotations:
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      more_set_headers "X-Forwarded-For $http_x_forwarded_for";
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
+    kubernetes.io/ingress.class: "nginx"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: crm.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: twentycrm-server
+                port:
+                  name: http-tcp

packages/twenty-docker/k8s/manifests/pv-db.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: twentycrm-db-pv
+spec:
+  storageClassName: default
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain

packages/twenty-docker/k8s/manifests/pv-docker-data.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: twentycrm-docker-data-pv
+spec:
+  storageClassName: default
+  capacity:
+    storage: 100Mi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain

packages/twenty-docker/k8s/manifests/pv-server.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: twentycrm-server-pv
+  namespace: twentycrm
+spec:
+  storageClassName: default
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain

packages/twenty-docker/k8s/manifests/pvc-db.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: twentycrm-db-pvc
+  namespace: twentycrm
+spec:
+  storageClassName: default
+  volumeName: twentycrm-db-pv
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

packages/twenty-docker/k8s/manifests/pvc-docker-data.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: twentycrm-docker-data-pvc
+  namespace: twentycrm
+spec:
+  storageClassName: default
+  volumeName: twentycrm-docker-data-pv
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Mi

packages/twenty-docker/k8s/manifests/pvc-server.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: twentycrm-server-pvc
+  namespace: twentycrm
+spec:
+  storageClassName: default
+  volumeName: twentycrm-server-pv
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

packages/twenty-docker/k8s/manifests/service-db.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: twentycrm-db
+  namespace: twentycrm
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - port: 5432
+      protocol: TCP
+      targetPort: 5432
+  selector:
+    app: twentycrm-db
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 10800
+  type: ClusterIP

packages/twenty-docker/k8s/manifests/service-redis.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: twentycrm-redis
+  namespace: twentycrm
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - port: 6379
+      protocol: TCP
+      targetPort: 6379
+  selector:
+    app: twentycrm-redis
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 10800
+  type: ClusterIP

packages/twenty-docker/k8s/manifests/service-server.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: twentycrm-server
+  namespace: twentycrm
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http-tcp
+      port: 3000
+      protocol: TCP
+      targetPort: 3000
+  selector:
+    app: twentycrm-server
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 10800
+  type: ClusterIP

packages/twenty-docker/k8s/terraform/.terraform-docs.yml

@@ -0,0 +1,48 @@
+formatter: "markdown table" # this is required
+
+version: ""
+
+header-from: main.tf
+
+recursive:
+  enabled: false
+  path: modules
+
+output:
+  file: "README.md"
+  mode: inject
+  template: |-
+    <!-- BEGIN_TF_DOCS -->
+    # TwentyCRM Terraform Docs
+
+    This file was generated by [terraform-docs](https://terraform-docs.io/), for more information on how to install, configure, and use visit their website.
+
+    To update this `README.md` after changes to the Terraform code in this folder, run: `terraform-docs -c `./.terraform-docs.yml .`
+
+    To make configuration changes to how this doc is generated, see `./.terraform-docs.yml`
+
+    {{ .Content }}
+    <!-- END_TF_DOCS -->
+
+output-values:
+  enabled: false
+  from: "outputs.tf"
+
+sort:
+  enabled: true
+  by: required
+
+settings:
+  anchor: true
+  color: true
+  default: true
+  description: true
+  escape: true
+  hide-empty: true
+  html: true
+  indent: 2
+  lockfile: true
+  read-comments: true
+  required: true
+  sensitive: true
+  type: true

packages/twenty-docker/k8s/terraform/README.md

@@ -0,0 +1,73 @@
+<!-- BEGIN_TF_DOCS -->
+# TwentyCRM Terraform Docs
+
+This file was generated by [terraform-docs](https://terraform-docs.io/), for more information on how to install, configure, and use visit their website.
+
+To update this `README.md` after changes to the Terraform code in this folder, run: `terraform-docs -c `./.terraform-docs.yml .`
+
+To make configuration changes to how this doc is generated, see `./.terraform-docs.yml`
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.2 |
+| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.32.0 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.6.3 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 2.32.0 |
+| <a name="provider_random"></a> [random](#provider\_random) | >= 3.6.3 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [kubernetes_deployment.twentycrm_db](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/deployment) | resource |
+| [kubernetes_deployment.twentycrm_redis](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/deployment) | resource |
+| [kubernetes_deployment.twentycrm_server](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/deployment) | resource |
+| [kubernetes_deployment.twentycrm_worker](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/deployment) | resource |
+| [kubernetes_ingress.twentycrm](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/ingress) | resource |
+| [kubernetes_namespace.twentycrm](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
+| [kubernetes_persistent_volume.db](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume) | resource |
+| [kubernetes_persistent_volume.docker_data](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume) | resource |
+| [kubernetes_persistent_volume.server](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume) | resource |
+| [kubernetes_persistent_volume_claim.db](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume_claim) | resource |
+| [kubernetes_persistent_volume_claim.docker_data](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume_claim) | resource |
+| [kubernetes_persistent_volume_claim.server](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume_claim) | resource |
+| [kubernetes_secret.twentycrm_tokens](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
+| [kubernetes_service.twentycrm_db](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service) | resource |
+| [kubernetes_service.twentycrm_redis](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service) | resource |
+| [kubernetes_service.twentycrm_server](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service) | resource |
+| [random_bytes.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/bytes) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_twentycrm_app_hostname"></a> [twentycrm\_app\_hostname](#input\_twentycrm\_app\_hostname) | The protocol, DNS fully qualified hostname, and port used to access TwentyCRM in your environment. Ex: https://crm.example.com:443 | `string` | n/a | yes |
+| <a name="input_twentycrm_pgdb_admin_password"></a> [twentycrm\_pgdb\_admin\_password](#input\_twentycrm\_pgdb\_admin\_password) | TwentyCRM password for postgres database. | `string` | n/a | yes |
+| <a name="input_twentycrm_app_name"></a> [twentycrm\_app\_name](#input\_twentycrm\_app\_name) | A friendly name prefix to use for every component deployed. | `string` | `"twentycrm"` | no |
+| <a name="input_twentycrm_db_image"></a> [twentycrm\_db\_image](#input\_twentycrm\_db\_image) | TwentyCRM image for database deployment. This defaults to latest. | `string` | `"twentycrm/twenty-postgres-spilo:latest"` | no |
+| <a name="input_twentycrm_db_pv_capacity"></a> [twentycrm\_db\_pv\_capacity](#input\_twentycrm\_db\_pv\_capacity) | Storage capacity provisioned for database persistent volume. | `string` | `"10Gi"` | no |
+| <a name="input_twentycrm_db_pv_path"></a> [twentycrm\_db\_pv\_path](#input\_twentycrm\_db\_pv\_path) | Local path to use to store the physical volume if using local storage on nodes. | `string` | `""` | no |
+| <a name="input_twentycrm_db_pvc_requests"></a> [twentycrm\_db\_pvc\_requests](#input\_twentycrm\_db\_pvc\_requests) | Storage capacity reservation for database persistent volume claim. | `string` | `"10Gi"` | no |
+| <a name="input_twentycrm_db_replicas"></a> [twentycrm\_db\_replicas](#input\_twentycrm\_db\_replicas) | Number of replicas for the TwentyCRM database deployment. This defaults to 1. | `number` | `1` | no |
+| <a name="input_twentycrm_docker_data_mount_path"></a> [twentycrm\_docker\_data\_mount\_path](#input\_twentycrm\_docker\_data\_mount\_path) | TwentyCRM mount path for servers application data. Defaults to '/app/docker-data'. | `string` | `"/app/docker-data"` | no |
+| <a name="input_twentycrm_docker_data_pv_capacity"></a> [twentycrm\_docker\_data\_pv\_capacity](#input\_twentycrm\_docker\_data\_pv\_capacity) | Storage capacity provisioned for server persistent volume. | `string` | `"10Gi"` | no |
+| <a name="input_twentycrm_docker_data_pv_path"></a> [twentycrm\_docker\_data\_pv\_path](#input\_twentycrm\_docker\_data\_pv\_path) | Local path to use to store the physical volume if using local storage on nodes. | `string` | `""` | no |
+| <a name="input_twentycrm_docker_data_pvc_requests"></a> [twentycrm\_docker\_data\_pvc\_requests](#input\_twentycrm\_docker\_data\_pvc\_requests) | Storage capacity reservation for server persistent volume claim. | `string` | `"10Gi"` | no |
+| <a name="input_twentycrm_namespace"></a> [twentycrm\_namespace](#input\_twentycrm\_namespace) | Namespace for all TwentyCRM resources | `string` | `"twentycrm"` | no |
+| <a name="input_twentycrm_redis_image"></a> [twentycrm\_redis\_image](#input\_twentycrm\_redis\_image) | TwentyCRM image for Redis deployment. This defaults to latest. | `string` | `"redis/redis-stack-server:latest"` | no |
+| <a name="input_twentycrm_redis_replicas"></a> [twentycrm\_redis\_replicas](#input\_twentycrm\_redis\_replicas) | Number of replicas for the TwentyCRM Redis deployment. This defaults to 1. | `number` | `1` | no |
+| <a name="input_twentycrm_server_data_mount_path"></a> [twentycrm\_server\_data\_mount\_path](#input\_twentycrm\_server\_data\_mount\_path) | TwentyCRM mount path for servers application data. Defaults to '/app/packages/twenty-server/.local-storage'. | `string` | `"/app/packages/twenty-server/.local-storage"` | no |
+| <a name="input_twentycrm_server_image"></a> [twentycrm\_server\_image](#input\_twentycrm\_server\_image) | TwentyCRM server image for the server deployment. This defaults to latest. This value is also used for the workers image. | `string` | `"twentycrm/twenty:latest"` | no |
+| <a name="input_twentycrm_server_pv_capacity"></a> [twentycrm\_server\_pv\_capacity](#input\_twentycrm\_server\_pv\_capacity) | Storage capacity provisioned for server persistent volume. | `string` | `"10Gi"` | no |
+| <a name="input_twentycrm_server_pv_path"></a> [twentycrm\_server\_pv\_path](#input\_twentycrm\_server\_pv\_path) | Local path to use to store the physical volume if using local storage on nodes. | `string` | `""` | no |
+| <a name="input_twentycrm_server_pvc_requests"></a> [twentycrm\_server\_pvc\_requests](#input\_twentycrm\_server\_pvc\_requests) | Storage capacity reservation for server persistent volume claim. | `string` | `"10Gi"` | no |
+| <a name="input_twentycrm_server_replicas"></a> [twentycrm\_server\_replicas](#input\_twentycrm\_server\_replicas) | Number of replicas for the TwentyCRM server deployment. This defaults to 1. | `number` | `1` | no |
+| <a name="input_twentycrm_worker_replicas"></a> [twentycrm\_worker\_replicas](#input\_twentycrm\_worker\_replicas) | Number of replicas for the TwentyCRM worker deployment. This defaults to 1. | `number` | `1` | no |
+<!-- END_TF_DOCS -->

packages/twenty-docker/k8s/terraform/deployment-db.tf

@@ -0,0 +1,87 @@
+resource "kubernetes_deployment" "twentycrm_db" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-db"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+    labels = {
+      app = "${var.twentycrm_app_name}-db"
+    }
+  }
+
+  spec {
+    replicas = var.twentycrm_db_replicas
+    selector {
+      match_labels = {
+        app = "${var.twentycrm_app_name}-db"
+      }
+    }
+
+    strategy {
+      type = "RollingUpdate"
+      rolling_update {
+        max_surge       = "1"
+        max_unavailable = "1"
+      }
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "${var.twentycrm_app_name}-db"
+        }
+      }
+
+      spec {
+        container {
+          image = var.twentycrm_db_image
+          name  = var.twentycrm_app_name
+          stdin = true
+          tty   = true
+          security_context {
+            allow_privilege_escalation = true
+          }
+
+          env {
+            name  = "POSTGRES_PASSWORD"
+            value = var.twentycrm_pgdb_admin_password
+          }
+          env {
+            name  = "BITNAMI_DEBUG"
+            value = true
+          }
+
+          port {
+            container_port = 5432
+            protocol       = "TCP"
+          }
+
+          resources {
+            requests = {
+              cpu    = "250m"
+              memory = "256Mi"
+            }
+            limits = {
+              cpu    = "1000m"
+              memory = "1024Mi"
+            }
+          }
+
+          volume_mount {
+            name       = "db-data"
+            mount_path = "/bitnami/postgresql"
+          }
+        }
+
+        volume {
+          name = "db-data"
+
+          persistent_volume_claim {
+            claim_name = kubernetes_persistent_volume_claim.db.metadata.0.name
+          }
+        }
+
+        dns_policy     = "ClusterFirst"
+        restart_policy = "Always"
+      }
+    }
+  }
+}

packages/twenty-docker/k8s/terraform/deployment-redis.tf

@@ -0,0 +1,60 @@
+resource "kubernetes_deployment" "twentycrm_redis" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-redis"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+
+    labels = {
+      app = "${var.twentycrm_app_name}-redis"
+    }
+  }
+
+  spec {
+    replicas = var.twentycrm_redis_replicas
+    selector {
+      match_labels = {
+        app = "${var.twentycrm_app_name}-redis"
+      }
+    }
+
+    strategy {
+      type = "RollingUpdate"
+      rolling_update {
+        max_surge       = "1"
+        max_unavailable = "1"
+      }
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "${var.twentycrm_app_name}-redis"
+        }
+      }
+
+      spec {
+        container {
+          image = var.twentycrm_redis_image
+          name  = "redis"
+
+          port {
+            container_port = 6379
+            protocol       = "TCP"
+          }
+
+          resources {
+            requests = {
+              cpu    = "250m"
+              memory = "1024Mi"
+            }
+            limits = {
+              cpu    = "500m"
+              memory = "2048Mi"
+            }
+          }
+        }
+        dns_policy     = "ClusterFirst"
+        restart_policy = "Always"
+      }
+    }
+  }
+}

packages/twenty-docker/k8s/terraform/deployment-server.tf

@@ -0,0 +1,138 @@
+resource "kubernetes_deployment" "twentycrm_server" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-server"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+    labels = {
+      app = "${var.twentycrm_app_name}-server"
+    }
+  }
+
+  spec {
+    replicas = var.twentycrm_server_replicas
+    selector {
+      match_labels = {
+        app = "${var.twentycrm_app_name}-server"
+      }
+    }
+
+    strategy {
+      type = "RollingUpdate"
+      rolling_update {
+        max_surge       = "1"
+        max_unavailable = "1"
+      }
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "${var.twentycrm_app_name}-server"
+        }
+      }
+
+      spec {
+        container {
+          image = var.twentycrm_server_image
+          name  = var.twentycrm_app_name
+          stdin = true
+          tty   = true
+
+          env {
+            name  = "NODE_PORT"
+            value = "3000"
+          }
+
+          env {
+            name  = "SERVER_URL"
+            value = var.twentycrm_app_hostname
+          }
+
+          env {
+            name  = "PG_DATABASE_URL"
+            value = "postgres://twenty:${var.twentycrm_pgdb_admin_password}@${kubernetes_service.twentycrm_db.metadata.0.name}.${kubernetes_namespace.twentycrm.metadata.0.name}.svc.cluster.local/default"
+          }
+          env {
+            name  = "REDIS_URL"
+            value = "redis://${kubernetes_service.twentycrm_redis.metadata.0.name}.${kubernetes_namespace.twentycrm.metadata.0.name}.svc.cluster.local:6379"
+          }
+          env {
+            name  = "DISABLE_DB_MIGRATIONS"
+            value = "false"
+          }
+
+          env {
+            name  = "STORAGE_TYPE"
+            value = "local"
+          }
+          env {
+            name  = "ACCESS_TOKEN_EXPIRES_IN"
+            value = "7d"
+          }
+          env {
+            name  = "LOGIN_TOKEN_EXPIRES_IN"
+            value = "1h"
+          }
+          env {
+            name = "APP_SECRET"
+            value_from {
+              secret_key_ref {
+                name = "tokens"
+                key  = "accessToken"
+              }
+            }
+          }
+
+          port {
+            container_port = 3000
+            protocol       = "TCP"
+          }
+
+          resources {
+            requests = {
+              cpu    = "250m"
+              memory = "256Mi"
+            }
+            limits = {
+              cpu    = "1000m"
+              memory = "1024Mi"
+            }
+          }
+
+          volume_mount {
+            name       = "server-data"
+            mount_path = var.twentycrm_server_data_mount_path
+          }
+
+          volume_mount {
+            name       = "docker-data"
+            mount_path = var.twentycrm_docker_data_mount_path
+          }
+        }
+
+        volume {
+          name = "server-data"
+
+          persistent_volume_claim {
+            claim_name = kubernetes_persistent_volume_claim.server.metadata.0.name
+          }
+        }
+
+        volume {
+          name = "docker-data"
+
+          persistent_volume_claim {
+            claim_name = kubernetes_persistent_volume_claim.docker_data.metadata.0.name
+          }
+        }
+
+        dns_policy     = "ClusterFirst"
+        restart_policy = "Always"
+      }
+    }
+  }
+  depends_on = [
+    kubernetes_deployment.twentycrm_db,
+    kubernetes_deployment.twentycrm_redis,
+    kubernetes_secret.twentycrm_tokens
+  ]
+}

packages/twenty-docker/k8s/terraform/deployment-worker.tf

@@ -0,0 +1,99 @@
+resource "kubernetes_deployment" "twentycrm_worker" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-worker"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+    labels = {
+      app = "${var.twentycrm_app_name}-worker"
+    }
+  }
+
+  spec {
+    replicas = var.twentycrm_worker_replicas
+    selector {
+      match_labels = {
+        app = "${var.twentycrm_app_name}-worker"
+      }
+    }
+
+    strategy {
+      type = "RollingUpdate"
+      rolling_update {
+        max_surge       = "1"
+        max_unavailable = "1"
+      }
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "${var.twentycrm_app_name}-worker"
+        }
+      }
+
+      spec {
+        container {
+          image   = var.twentycrm_server_image
+          name    = var.twentycrm_app_name
+          stdin   = true
+          tty     = true
+          command = ["yarn", "worker:prod"]
+
+          env {
+            name  = "SERVER_URL"
+            value = var.twentycrm_app_hostname
+          }
+
+          env {
+            name  = "PG_DATABASE_URL"
+            value = "postgres://twenty:${var.twentycrm_pgdb_admin_password}@${kubernetes_service.twentycrm_db.metadata.0.name}.${kubernetes_namespace.twentycrm.metadata.0.name}.svc.cluster.local/default"
+          }
+
+          env {
+            name  = "REDIS_URL"
+            value = "redis://${kubernetes_service.twentycrm_redis.metadata.0.name}.${kubernetes_namespace.twentycrm.metadata.0.name}.svc.cluster.local:6379"
+          }
+
+          env {
+            name  = "DISABLE_DB_MIGRATIONS"
+            value = "true" #it already runs on the server
+          }
+
+          env {
+            name  = "STORAGE_TYPE"
+            value = "local"
+          }
+
+          env {
+            name = "APP_SECRET"
+            value_from {
+              secret_key_ref {
+                name = "tokens"
+                key  = "accessToken"
+              }
+            }
+          }
+
+          resources {
+            requests = {
+              cpu    = "250m"
+              memory = "1024Mi"
+            }
+            limits = {
+              cpu    = "1000m"
+              memory = "2048Mi"
+            }
+          }
+        }
+
+        dns_policy     = "ClusterFirst"
+        restart_policy = "Always"
+      }
+    }
+  }
+  depends_on = [
+    kubernetes_deployment.twentycrm_db,
+    kubernetes_deployment.twentycrm_redis,
+    kubernetes_deployment.twentycrm_server,
+    kubernetes_secret.twentycrm_tokens,
+  ]
+}

packages/twenty-docker/k8s/terraform/ingress.tf

@@ -0,0 +1,30 @@
+resource "kubernetes_ingress" "twentycrm" {
+  wait_for_load_balancer = true
+  metadata {
+    name      = "${var.twentycrm_app_name}-ingress"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+    annotations = {
+      "kubernetes.io/ingress.class"                       = "nginx"
+      "nginx.ingress.kubernetes.io/configuration-snippet" = <<EOF
+      more_set_headers "X-Forwarded-For $http_x_forwarded_for";
+      EOF
+      "nginx.ingress.kubernetes.io/force-ssl-redirect"    = "false"
+      "nginx.ingress.kubernetes.io/backend-protocol"      = "HTTP"
+    }
+  }
+  spec {
+    ingress_class_name = "nginx"
+    rule {
+      host = var.twentycrm_app_hostname
+      http {
+        path {
+          path = "/*"
+          backend {
+            service_name = kubernetes_service.twentycrm_server.metadata.0.name
+            service_port = kubernetes_service.twentycrm_server.spec.0.port.0.port
+          }
+        }
+      }
+    }
+  }
+}

packages/twenty-docker/k8s/terraform/main.tf

@@ -0,0 +1,23 @@
+#############
+# Providers #
+#############
+provider "kubernetes" {
+  config_path = "~/.kube/config"
+}
+
+####################
+# Terraform Config #
+####################
+terraform {
+  required_version = ">= 1.9.2"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.32.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.6.3"
+    }
+  }
+}

packages/twenty-docker/k8s/terraform/namespace.tf

@@ -0,0 +1,9 @@
+resource "kubernetes_namespace" "twentycrm" {
+  metadata {
+    annotations = {
+      name = var.twentycrm_namespace
+    }
+
+    name = var.twentycrm_namespace
+  }
+}

packages/twenty-docker/k8s/terraform/pv-db.tf

@@ -0,0 +1,19 @@
+resource "kubernetes_persistent_volume" "db" {
+  metadata {
+    name = "${var.twentycrm_app_name}-db-pv"
+  }
+  spec {
+    storage_class_name = "default"
+    capacity = {
+      storage = var.twentycrm_db_pv_capacity
+    }
+    access_modes = ["ReadWriteOnce"]
+    # refer to Terraform Docs for your specific implementation requirements
+    # https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume
+    persistent_volume_source {
+      local {
+        path = var.twentycrm_db_pv_path
+      }
+    }
+  }
+}

packages/twenty-docker/k8s/terraform/pv-docker-data.tf

@@ -0,0 +1,19 @@
+resource "kubernetes_persistent_volume" "docker_data" {
+  metadata {
+    name = "${var.twentycrm_app_name}-docker-data-pv"
+  }
+  spec {
+    storage_class_name = "default"
+    capacity = {
+      storage = var.twentycrm_docker_data_pv_capacity
+    }
+    access_modes = ["ReadWriteOnce"]
+    # refer to Terraform Docs for your specific implementation requirements
+    # https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume
+    persistent_volume_source {
+      local {
+        path = var.twentycrm_docker_data_pv_path
+      }
+    }
+  }
+}

packages/twenty-docker/k8s/terraform/pv-server.tf

@@ -0,0 +1,19 @@
+resource "kubernetes_persistent_volume" "server" {
+  metadata {
+    name = "${var.twentycrm_app_name}-server-pv"
+  }
+  spec {
+    storage_class_name = "default"
+    capacity = {
+      storage = var.twentycrm_server_pv_capacity
+    }
+    access_modes = ["ReadWriteOnce"]
+    # refer to Terraform Docs for your specific implementation requirements
+    # https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume
+    persistent_volume_source {
+      local {
+        path = var.twentycrm_server_pv_path
+      }
+    }
+  }
+}

packages/twenty-docker/k8s/terraform/pvc-db.tf

@@ -0,0 +1,15 @@
+resource "kubernetes_persistent_volume_claim" "db" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-db-pvc"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+  }
+  spec {
+    access_modes = ["ReadWriteOnce"]
+    resources {
+      requests = {
+        storage = var.twentycrm_db_pvc_requests
+      }
+    }
+    volume_name = kubernetes_persistent_volume.db.metadata.0.name
+  }
+}

packages/twenty-docker/k8s/terraform/pvc-docker-data.tf

@@ -0,0 +1,15 @@
+resource "kubernetes_persistent_volume_claim" "docker_data" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-docker-data-pvc"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+  }
+  spec {
+    access_modes = ["ReadWriteOnce"]
+    resources {
+      requests = {
+        storage = var.twentycrm_docker_data_pvc_requests
+      }
+    }
+    volume_name = kubernetes_persistent_volume.docker_data.metadata.0.name
+  }
+}

packages/twenty-docker/k8s/terraform/pvc-server.tf

@@ -0,0 +1,15 @@
+resource "kubernetes_persistent_volume_claim" "server" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-server-pvc"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+  }
+  spec {
+    access_modes = ["ReadWriteOnce"]
+    resources {
+      requests = {
+        storage = var.twentycrm_server_pvc_requests
+      }
+    }
+    volume_name = kubernetes_persistent_volume.server.metadata.0.name
+  }
+}

packages/twenty-docker/k8s/terraform/secret.tf

@@ -0,0 +1,28 @@
+locals {
+  tokens = [
+    "accessToken",
+    "loginToken",
+    "refreshToken",
+    "fileToken"
+  ]
+}
+
+resource "random_bytes" "this" {
+  for_each = toset(local.tokens)
+
+  length = 32
+}
+
+resource "kubernetes_secret" "twentycrm_tokens" {
+  metadata {
+    name      = "tokens"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+  }
+
+  data = {
+    accessToken  = random_bytes.this["accessToken"].base64
+    loginToken   = random_bytes.this["loginToken"].base64
+    refreshToken = random_bytes.this["refreshToken"].base64
+    fileToken    = random_bytes.this["fileToken"].base64
+  }
+}

packages/twenty-docker/k8s/terraform/service-db.tf

@@ -0,0 +1,18 @@
+resource "kubernetes_service" "twentycrm_db" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-db"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+  }
+  spec {
+    selector = {
+      app = "${var.twentycrm_app_name}-db"
+    }
+    session_affinity = "ClientIP"
+    port {
+      port        = 5432
+      target_port = 5432
+    }
+
+    type = "ClusterIP"
+  }
+}

packages/twenty-docker/k8s/terraform/service-redis.tf

@@ -0,0 +1,18 @@
+resource "kubernetes_service" "twentycrm_redis" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-redis"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+  }
+  spec {
+    selector = {
+      app = "${var.twentycrm_app_name}-redis"
+    }
+    session_affinity = "ClientIP"
+    port {
+      port        = 6379
+      target_port = 6379
+    }
+
+    type = "ClusterIP"
+  }
+}

packages/twenty-docker/k8s/terraform/service-server.tf

@@ -0,0 +1,19 @@
+resource "kubernetes_service" "twentycrm_server" {
+  metadata {
+    name      = "${var.twentycrm_app_name}-server"
+    namespace = kubernetes_namespace.twentycrm.metadata.0.name
+  }
+  spec {
+    selector = {
+      app = "${var.twentycrm_app_name}-server"
+    }
+    session_affinity = "ClientIP"
+    port {
+      name        = "http-tcp"
+      port        = 3000
+      target_port = 3000
+    }
+
+    type = "ClusterIP"
+  }
+}

packages/twenty-docker/k8s/terraform/variables.tf

@@ -0,0 +1,136 @@
+######################
+# Required Variables #
+######################
+variable "twentycrm_pgdb_admin_password" {
+  type        = string
+  description = "TwentyCRM password for postgres database."
+  sensitive   = true
+}
+
+variable "twentycrm_app_hostname" {
+  type        = string
+  description = "The protocol, DNS fully qualified hostname, and port used to access TwentyCRM in your environment. Ex: https://crm.example.com:443"
+}
+
+######################
+# Optional Variables #
+######################
+variable "twentycrm_app_name" {
+  type        = string
+  default     = "twentycrm"
+  description = "A friendly name prefix to use for every component deployed."
+}
+
+variable "twentycrm_server_image" {
+  type        = string
+  default     = "twentycrm/twenty:latest"
+  description = "TwentyCRM server image for the server deployment. This defaults to latest. This value is also used for the workers image."
+}
+
+variable "twentycrm_db_image" {
+  type        = string
+  default     = "twentycrm/twenty-postgres-spilo:latest"
+  description = "TwentyCRM image for database deployment. This defaults to latest."
+}
+
+variable "twentycrm_server_replicas" {
+  type        = number
+  default     = 1
+  description = "Number of replicas for the TwentyCRM server deployment. This defaults to 1."
+}
+
+variable "twentycrm_worker_replicas" {
+  type        = number
+  default     = 1
+  description = "Number of replicas for the TwentyCRM worker deployment. This defaults to 1."
+}
+
+variable "twentycrm_db_replicas" {
+  type        = number
+  default     = 1
+  description = "Number of replicas for the TwentyCRM database deployment. This defaults to 1."
+}
+
+variable "twentycrm_server_data_mount_path" {
+  type        = string
+  default     = "/app/packages/twenty-server/.local-storage"
+  description = "TwentyCRM mount path for servers application data. Defaults to '/app/packages/twenty-server/.local-storage'."
+}
+
+variable "twentycrm_db_pv_path" {
+  type        = string
+  default     = ""
+  description = "Local path to use to store the physical volume if using local storage on nodes."
+}
+
+variable "twentycrm_server_pv_path" {
+  type        = string
+  default     = ""
+  description = "Local path to use to store the physical volume if using local storage on nodes."
+}
+
+variable "twentycrm_db_pv_capacity" {
+  type        = string
+  default     = "10Gi"
+  description = "Storage capacity provisioned for database persistent volume."
+}
+
+variable "twentycrm_db_pvc_requests" {
+  type        = string
+  default     = "10Gi"
+  description = "Storage capacity reservation for database persistent volume claim."
+}
+
+variable "twentycrm_server_pv_capacity" {
+  type        = string
+  default     = "10Gi"
+  description = "Storage capacity provisioned for server persistent volume."
+}
+
+variable "twentycrm_server_pvc_requests" {
+  type        = string
+  default     = "10Gi"
+  description = "Storage capacity reservation for server persistent volume claim."
+}
+
+variable "twentycrm_namespace" {
+  type        = string
+  default     = "twentycrm"
+  description = "Namespace for all TwentyCRM resources"
+}
+
+variable "twentycrm_redis_replicas" {
+  type        = number
+  default     = 1
+  description = "Number of replicas for the TwentyCRM Redis deployment. This defaults to 1."
+}
+
+variable "twentycrm_redis_image" {
+  type        = string
+  default     = "redis/redis-stack-server:latest"
+  description = "TwentyCRM image for Redis deployment. This defaults to latest."
+}
+
+variable "twentycrm_docker_data_mount_path" {
+  type        = string
+  default     = "/app/docker-data"
+  description = "TwentyCRM mount path for servers application data. Defaults to '/app/docker-data'."
+}
+
+variable "twentycrm_docker_data_pv_path" {
+  type        = string
+  default     = ""
+  description = "Local path to use to store the physical volume if using local storage on nodes."
+}
+
+variable "twentycrm_docker_data_pv_capacity" {
+  type        = string
+  default     = "100Mi"
+  description = "Storage capacity provisioned for server persistent volume."
+}
+
+variable "twentycrm_docker_data_pvc_requests" {
+  type        = string
+  default     = "100Mi"
+  description = "Storage capacity reservation for server persistent volume claim."
+}

packages/twenty-docker/otel-collector/otel-collector-config.yaml

@@ -0,0 +1,24 @@
+receivers:
+  otlp:
+    protocols:
+      http:
+        endpoint: "0.0.0.0:4318"
+
+exporters:
+  clickhouse:
+    endpoint: tcp://twenty_clickhouse:9000
+    database: twenty_dev
+    username: default
+    password: devPassword
+  debug:
+    verbosity: detailed
+
+processors:
+  batch:
+
+service:
+  pipelines:
+    metrics:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [clickhouse, debug]

packages/twenty-docker/podman/README.md

@@ -0,0 +1,48 @@
+# How to deploy twenty on podman
+
+DISCLAIMER: The k8s and podman deployments are not maintained by the core team.
+These files are provided and maintained by the community. Twenty core team
+maintains support for docker deployment.
+
+
+## How to use
+
+1. Edit `.env` file. At the minimum set `POSTGRES_PASSWORD`, `SERVER_URL`, and `APP_SECRET`.
+2. Start twenty by running `podman-compose up -d`.
+
+If you need to stop twenty, you can do so by running `podman-compose down`.
+
+
+### Install systemd service (optional)
+
+If you want to install a systemd service to run twenty, you can use the provided systemd service. 
+
+Edit `twentycrm.service` and change these two variables:
+
+
+	WorkingDirectory=/opt/apps/twenty
+	EnvironmentFile=/opt/apps/twenty/.env
+
+`WorkingDirectory` should be changed to the path in which `podman-compose.yml` is located.
+
+`EnvironmentFile` should be changed to the path in which your `.env`file is located.
+
+You can run the script `install-systemd-user-service` to install the systemd service under the current user.
+
+
+	./install-systemd-user-service
+
+Note: this script will enable the service and also start it. So it will assume that twenty is not currently running.
+If you started it previously, bring it down using:
+
+	podman-compose down
+
+
+
+## Compatibility
+
+These files should be compatible with podman 4.3+.
+
+I have tested this on Debian GNU/Linux 12 (bookworm) and with the podman that is distributed with the official Debian stable mirrors (podman v4.3.1+ds1-8+deb12u1, podman-compose v1.0.3-3).
+
+

packages/twenty-docker/podman/install-systemd-user-service

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+
+mkdir -p ~/.config/systemd/user
+[ -f twentycrm.service ] || { echo "Error: twentycrm.service not found"; exit 1; }
+cp twentycrm.service ~/.config/systemd/user
+
+
+systemctl --user daemon-reload
+systemctl --user enable twentycrm.service
+systemctl --user start twentycrm.service

packages/twenty-docker/podman/manual-steps-to-deploy-twenty-on-podman

@@ -0,0 +1,71 @@
+#!/bin/bash
+set -e
+if [ ! -f "$(dirname "$0")/.env" ]; then
+    echo "Error: .env file not found"
+    exit 1
+fi
+source "$(dirname "$0")/.env"
+
+## steps to cleanup and start over from scratch - useful when testing
+#podman pod stop twenty-pod
+#podman pod rm twenty-pod
+#podman volume rm twenty-db-data twenty-server-data twenty-redis-data
+# end of cleanup
+
+podman volume create twenty-db-data
+podman volume create twenty-server-data
+podman volume create twenty-redis-data
+
+podman pod create --name twenty-pod -p 127.0.0.1:8080:3000
+
+podman run -d --pod twenty-pod --name twenty-db \
+  -e POSTGRES_DB=twenty \
+  -e POSTGRES_USER=twenty \
+  -e POSTGRES_PASSWORD="$POSTGRES_PASSWORD" \
+  -v twenty-db-data:/var/lib/postgresql/data:Z \
+  docker.io/library/postgres:16
+
+podman run -d --pod twenty-pod --name twenty-redis \
+  -v twenty-redis-data:/data:Z \
+  docker.io/library/redis:latest
+
+podman run -d --pod twenty-pod --name twenty-server \
+  -e NODE_PORT=3000 \
+  -e SERVER_URL="$SERVER_URL" \
+  -e PG_DATABASE_URL="postgresql://twenty:$POSTGRES_PASSWORD@twenty-db:5432/twenty" \
+  -e REDIS_URL="redis://twenty-redis:6379" \
+  -e APP_SECRET="$APP_SECRET" \
+  -e NODE_ENV=production \
+  -e LOG_LEVEL=info \
+  -v twenty-server-data:/app/docker-data:Z \
+  docker.io/twentycrm/twenty:latest
+
+podman run -d --pod twenty-pod --name twenty-worker \
+  --init \
+  -e SERVER_URL="$SERVER_URL" \
+  -e PG_DATABASE_URL="postgresql://twenty:$POSTGRES_PASSWORD@twenty-db:5432/twenty" \
+  -e REDIS_URL="redis://twenty-redis:6379" \
+  -e APP_SECRET="$APP_SECRET" \
+  -e DISABLE_DB_MIGRATIONS=true \
+  -e NODE_ENV=production \
+  -e LOG_LEVEL=info \
+  -v twenty-server-data:/app/docker-data:Z \
+  docker.io/twentycrm/twenty:latest \
+  yarn worker:prod
+
+# wait some time, check status
+sleep 30
+podman ps --pod -f name=twenty-pod
+
+
+mkdir -p ~/.config/systemd/user
+if [ ! -f "twentycrm.service" ]; then
+    echo "Error: twentycrm.service file not found"
+    exit 1
+fi
+cp twentycrm.service ~/.config/systemd/user
+
+systemctl --user daemon-reload
+systemctl --user enable twentycrm.service
+systemctl --user start twentycrm.service
+

packages/twenty-docker/podman/podman-compose.yml

@@ -0,0 +1,56 @@
+version: "3.8"
+
+services:
+  db:
+    container_name: twenty-db
+    image: postgres:16
+    environment:
+      POSTGRES_DB: twenty
+      POSTGRES_USER: twenty
+      POSTGRES_PASSWORD: ${PG_DATABASE_PASSWORD}
+    volumes:
+      - twenty-db-data:/var/lib/postgresql/data:Z
+
+  redis:
+    container_name: twenty-redis
+    image: redis:latest
+    command: ["--maxmemory-policy", "noeviction"]
+    volumes:
+      - twenty-redis-data:/data:Z
+
+  server:
+    container_name: twenty-server
+    image: twentycrm/twenty:latest
+    environment:
+      NODE_PORT: "3000"
+      SERVER_URL: ${SERVER_URL}
+      PG_DATABASE_URL: "postgresql://twenty:${PG_DATABASE_PASSWORD}@twenty-db:5432/twenty"
+      REDIS_URL: "redis://twenty-redis:6379"
+      APP_SECRET: ${APP_SECRET}
+      NODE_ENV: production
+      LOG_LEVEL: info
+    volumes:
+      - twenty-server-data:/app/docker-data:Z
+    ports:
+      - 127.0.0.1:8080:3000
+
+  worker:
+    container_name: twenty-worker
+    image: twentycrm/twenty:latest
+    command: yarn worker:prod
+    environment:
+      SERVER_URL: ${SERVER_URL}
+      PG_DATABASE_URL: "postgresql://twenty:${PG_DATABASE_PASSWORD}@twenty-db:5432/twenty"
+      REDIS_URL: "redis://twenty-redis:6379"
+      APP_SECRET: ${APP_SECRET}
+      DISABLE_DB_MIGRATIONS: "true"
+      NODE_ENV: production
+      LOG_LEVEL: info
+    volumes:
+      - twenty-server-data:/app/docker-data:Z
+    init: true
+
+volumes:
+  twenty-db-data:
+  twenty-server-data:
+  twenty-redis-data:

packages/twenty-docker/podman/twentycrm.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=TwentyCRM Container Stack via Podman-Compose
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/apps/twenty
+EnvironmentFile=/opt/apps/twenty/.env
+ExecStart=/usr/bin/podman-compose -f podman-compose.yml up -d
+ExecStop=/usr/bin/podman-compose -f podman-compose.yml down
+RemainAfterExit=yes
+
+[Install]
+WantedBy=default.target
+

packages/twenty-docker/scripts/1-click.sh

@@ -0,0 +1,31 @@
+release_tag_pattern='^v[0-9]+\.[0-9]+\.[0-9]+$'
+if [[ -n "$VERSION" && ! "$VERSION" =~ $release_tag_pattern ]]; then
+  echo "Error: VERSION must be a full release tag such as v2.38.1, omit it to install the latest release."
+  exit 1
+fi
+
+pull_version=${VERSION:-$(curl -fsS --retry 3 --retry-delay 2 "https://hub.docker.com/v2/repositories/twentycrm/twenty/tags?page_size=100" | grep -o '"name":"[^"]*"' | cut -d'"' -f4 | grep -E "$release_tag_pattern" | sort -V | tail -n1)}
+
+if [[ -z "$pull_version" ]]; then
+  echo "Error: Unable to fetch the latest version tag. Please check your network connection or the Docker Hub API response."
+  exit 1
+fi
+pull_branch=${BRANCH:-twenty/$pull_version}
+
+install_url="https://raw.githubusercontent.com/twentyhq/twenty/$pull_branch/packages/twenty-docker/scripts/install.sh"
+
+if ! curl -fsSL --retry 3 --retry-delay 2 -o twenty_install.sh.tmp "$install_url"; then
+  rm -f twenty_install.sh.tmp
+  echo "Error: Failed to download the install script from $install_url"
+  echo "If this is a 404, the twenty/<version> ref does not exist: releases that predate the twenty/ tag namespace (v2.9.0 and older) are not supported."
+  echo "Anything else is usually GitHub rate limiting your network, in which case retrying in a minute will work."
+  exit 1
+fi
+mv twenty_install.sh.tmp twenty_install.sh
+
+chmod +x twenty_install.sh
+VERSION="$pull_version" BRANCH="$pull_branch" ./twenty_install.sh
+install_status=$?
+
+rm twenty_install.sh
+exit $install_status

packages/twenty-docker/scripts/install.sh

@@ -0,0 +1,192 @@
+#!/bin/bash
+
+echo "🔧 Checking dependencies..."
+if ! command -v docker &>/dev/null; then
+  echo -e "\t❌ Docker is not installed or not in PATH. Please install Docker first.\n\t\tSee https://docs.docker.com/get-docker/"
+  exit 1
+fi
+# Check if docker compose plugin is installed
+if ! docker compose version &>/dev/null; then
+  echo -e "\t❌ Docker Compose is not installed or not in PATH (n.b. docker-compose is deprecated)\n\t\tUpdate docker or install docker-compose-plugin\n\t\tOn Linux: sudo apt-get install docker-compose-plugin\n\t\tSee https://docs.docker.com/compose/install/"
+  exit 1
+fi
+# Check if docker is started
+if ! docker info &>/dev/null; then
+  echo -e "\t❌ Docker is not running.\n\t\tPlease start Docker Desktop, Docker or check documentation at https://docs.docker.com/config/daemon/start/"
+  exit 1
+fi
+if ! command -v curl &>/dev/null; then
+  echo -e "\t❌ Curl is not installed or not in PATH.\n\t\tOn macOS: brew install curl\n\t\tOn Linux: sudo apt install curl"
+  exit 1
+fi
+
+# Check if docker compose version is >= 2
+if [ "$(docker compose version --short | cut -d' ' -f3 | cut -d'.' -f1)" -lt 2 ]; then
+  echo -e "\t❌ Docker Compose is outdated. Please update Docker Compose to version 2 or higher.\n\t\tSee https://docs.docker.com/compose/install/linux/"
+  exit 1
+fi
+# Check if docker-compose is installed, if so issue a warning if version is < 2
+if command -v docker-compose &>/dev/null; then
+  if [ "$(docker-compose version --short | cut -d' ' -f3 | cut -d'.' -f1)" -lt 2 ]; then
+    echo -e "\n\t⚠️ 'docker-compose' is installed but outdated. Make sure to use 'docker compose' or to upgrade 'docker-compose' to version 2.\n\t\tSee https://docs.docker.com/compose/install/standalone/\n"
+  fi
+fi
+
+# Catch errors
+set -e
+function on_exit {
+  # $? is the exit status of the last command executed
+  local exit_status=$?
+  if [ $exit_status -ne 0 ]; then
+    echo "❌ Something went wrong, exiting: $exit_status"
+  fi
+}
+trap on_exit EXIT
+
+# Download a file, failing loudly instead of writing an HTTP error page to disk.
+# curl retries 429/5xx on its own; raw.githubusercontent.com throttles by IP.
+function download {
+  local url=$1
+  local dest=$2
+  if ! curl -fsSL --retry 3 --retry-delay 2 -o "$dest.tmp" "$url"; then
+    rm -f "$dest.tmp"
+    echo -e "\t❌ Failed to download $url"
+    echo -e "\t\tIf this is a 404, the twenty/<version> ref does not exist: releases that predate the twenty/ tag namespace (v2.9.0 and older) are not supported."
+    echo -e "\t\tAnything else is usually GitHub rate limiting your network, in which case retrying in a minute will work."
+    exit 1
+  fi
+  mv "$dest.tmp" "$dest"
+}
+
+# Use environment variables VERSION and BRANCH, with defaults if not set
+release_tag_pattern='^v[0-9]+\.[0-9]+\.[0-9]+$'
+if [[ -n "$VERSION" && ! "$VERSION" =~ $release_tag_pattern ]]; then
+  echo -e "\t❌ VERSION must be a full release tag such as v2.38.1, omit it to install the latest release."
+  exit 1
+fi
+version=${VERSION:-$(curl -fsS --retry 3 --retry-delay 2 "https://hub.docker.com/v2/repositories/twentycrm/twenty/tags?page_size=100" | grep -o '"name":"[^"]*"' | cut -d'"' -f4 | grep -E "$release_tag_pattern" | sort -V | tail -n1)}
+if [ -z "$version" ]; then
+  echo -e "\t❌ Unable to resolve the latest release from Docker Hub. Check your network, or set VERSION explicitly."
+  exit 1
+fi
+# Deriving the branch from the image tag keeps docker-compose.yml and the image in lockstep.
+branch=${BRANCH:-twenty/$version}
+
+echo "🚀 Using docker version $version and Github branch $branch"
+
+dir_name="twenty"
+function ask_directory {
+  read -p "📁 Enter the directory name to setup the project (default: $dir_name): " answer
+  if [ -n "$answer" ]; then
+    dir_name=$answer
+  fi
+}
+
+ask_directory
+
+while [ -d "$dir_name" ]; do
+  read -p "🚫 Directory '$dir_name' already exists. Do you want to overwrite it? (y/N) " answer
+  if [ "$answer" = "y" ]; then
+    break
+  else
+    ask_directory
+  fi
+done
+
+# Create a directory named twenty
+echo "📁 Creating directory '$dir_name'"
+mkdir -p "$dir_name" && cd "$dir_name" || { echo "❌ Failed to create/access directory '$dir_name'"; exit 1; }
+
+# Copy twenty/packages/twenty-docker/docker-compose.yml in it
+echo -e "\t• Copying docker-compose.yml"
+download "https://raw.githubusercontent.com/twentyhq/twenty/$branch/packages/twenty-docker/docker-compose.yml" docker-compose.yml
+
+# Copy twenty/packages/twenty-docker/.env.example to .env
+echo -e "\t• Setting up .env file"
+download "https://raw.githubusercontent.com/twentyhq/twenty/$branch/packages/twenty-docker/.env.example" .env
+
+# Replace TAG=latest by TAG=<latest_release or version input>
+if [[ $(uname) == "Darwin" ]]; then
+  # Running on macOS
+  sed -i '' "s/TAG=latest/TAG=$version/g" .env
+else
+  # Assuming Linux
+  sed -i'' "s/TAG=latest/TAG=$version/g" .env
+fi
+
+# Generate random strings for secrets
+echo "# === Randomly generated secret ===" >> .env
+echo "ENCRYPTION_KEY=$(openssl rand -base64 32)" >> .env
+
+echo "" >> .env
+echo "PG_DATABASE_PASSWORD=$(openssl rand -hex 32)" >> .env
+
+echo -e "\t• .env configuration completed"
+
+port=3000
+# Check if command nc is available
+if command -v nc &> /dev/null; then
+  # Check if port 3000 is already in use, propose to change it
+  while nc -zv localhost $port &>/dev/null; do
+    read -p "🚫 Port $port is already in use. Do you want to use another port? (Y/n) " answer
+    if [ "$answer" = "n" ]; then
+      continue
+    fi
+    read -p "Enter a new port number: " new_port
+    if [[ $(uname) == "Darwin" ]]; then
+      sed -i '' "s/$port:$port/$new_port:$port/g" docker-compose.yml
+      sed -E -i '' "s|^SERVER_URL=http://localhost:[0-9]+|SERVER_URL=http://localhost:$new_port|g" .env
+    else
+      sed -i'' "s/$port:$port/$new_port:$port/g" docker-compose.yml
+      sed -E -i'' "s|^SERVER_URL=http://localhost:[0-9]+|SERVER_URL=http://localhost:$new_port|g" .env
+    fi
+    port=$new_port
+  done
+fi
+
+# Ask user if they want to start the project
+read -p "🚀 Do you want to start the project now? (Y/n) " answer
+if [ "$answer" = "n" ]; then
+  echo "✅ Project setup completed. Run 'docker compose up -d' to start."
+  exit 0
+else
+  echo "🐳 Starting Docker containers..."
+  docker compose up -d
+  # Check if port is listening
+  echo "Waiting for server to be healthy, it might take a few minutes while we initialize the database..."
+  # Tail logs of the server until it's ready
+  docker compose logs -f server &
+  pid=$!
+  while [ ! $(docker inspect --format='{{.State.Health.Status}}' twenty-server-1) = "healthy" ]; do
+    sleep 1
+  done
+  kill $pid
+  echo ""
+  echo "✅ Server is up and running"
+fi
+
+function ask_open_browser {
+  read -p "🌐 Do you want to open the project in your browser? (Y/n) " answer
+  if [ "$answer" = "n" ]; then
+    echo "✅ Setup completed. Access your project at http://localhost:$port"
+    exit 0
+  fi
+}
+
+# Ask user if they want to open the project
+# Running on macOS
+if [[ $(uname) == "Darwin" ]]; then
+  ask_open_browser
+
+  open "http://localhost:$port"
+# Assuming Linux
+else
+  # xdg-open is not installed, we could be running in a non gui environment
+  if command -v xdg-open >/dev/null 2>&1; then
+    ask_open_browser
+
+    xdg-open "http://localhost:$port"
+  else
+    echo "✅ Setup completed. Your project is available at http://localhost:$port"
+  fi
+fi

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/init-db/type

@@ -0,0 +1 @@
+oneshot

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/init-db/up

@@ -0,0 +1 @@
+/bin/sh /etc/s6-overlay/scripts/init-db.sh

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/postgres/run

@@ -0,0 +1,13 @@
+#!/bin/sh
+# Initialize PostgreSQL data directory if empty
+if [ ! -f /data/postgres/PG_VERSION ]; then
+  echo "Initializing PostgreSQL data directory..."
+  su-exec postgres initdb -D /data/postgres --auth=trust --encoding=UTF8
+  # Allow local connections without password
+  echo "host all all 127.0.0.1/32 trust" >> /data/postgres/pg_hba.conf
+  echo "host all all ::1/128 trust" >> /data/postgres/pg_hba.conf
+fi
+
+exec su-exec postgres postgres -D /data/postgres \
+  -c listen_addresses=localhost \
+  -c unix_socket_directories=/tmp

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/postgres/type

@@ -0,0 +1 @@
+longrun

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/redis/run

@@ -0,0 +1,6 @@
+#!/bin/sh
+exec redis-server \
+  --dir /data/redis \
+  --maxmemory-policy noeviction \
+  --bind 127.0.0.1 \
+  --protected-mode yes

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/redis/type

@@ -0,0 +1 @@
+longrun

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/register-crons/type

@@ -0,0 +1 @@
+oneshot

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/register-crons/up

@@ -0,0 +1 @@
+/bin/sh /etc/s6-overlay/scripts/register-crons.sh

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/twenty-server/run

@@ -0,0 +1,3 @@
+#!/bin/sh
+cd /app/packages/twenty-server
+exec yarn start:prod

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/twenty-server/type

@@ -0,0 +1 @@
+longrun

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/twenty-worker/run

@@ -0,0 +1,3 @@
+#!/bin/sh
+cd /app/packages/twenty-server
+exec yarn worker:prod

packages/twenty-docker/twenty-app-dev/rootfs/etc/s6-overlay/s6-rc.d/twenty-worker/type

@@ -0,0 +1 @@
+longrun