Normalize oxicloud chart: hierarchical values, disable WOPI by default, bump to 1.0.0

- Restructure values under oxicloud: key - Disable WOPI/Collabora by default - Fix secret handling to use existingSecretName - Rename PVC to oxicloud-data - Change service type to LoadBalancer - Bump version to 1.0.0
2026-08-12 08:58:45 +02:00 · 2026-08-12 08:58:45 +02:00 · 5c0aeb6b97
commit 5c0aeb6b97
parent abd0e9bb4d
11 changed files with 409 additions and 151 deletions
--- a/k8s/argo-apps/oxicloud.yaml
+++ b/k8s/argo-apps/oxicloud.yaml
@ -12,39 +12,41 @@ spec:
  sources:
    - repoURL: git.roboces.dev/catalin/fukuops
      chart: oxicloud
-      targetRevision: 0.1.0
+      targetRevision: 1.0.0
      helm:
        valuesObject:
-          persistence:
-            enabled: true
-            storageClass: "truenas-nfs-csi"
-            accessMode: ReadWriteMany
-            size: 50Gi
-          service:
-            type: LoadBalancer
-          config:
-            server:
-              port: 8086
-              host: "0.0.0.0"
-              baseUrl: "https://cloud.roboces.dev"
-            features:
-              enableAuth: "true"
-              enableSharing: "true"
-            mimalloc:
-              purgeDelay: "0"
-              allowLargeOsPages: "0"
-          secrets:
-            existingSecret: oxicloud
-          wopi:
-            enabled: false
-          ingress:
-            className: "traefik"
-            hosts:
-              - host: cloud.roboces.dev
-                paths:
-                  - path: /
-                    pathType: ImplementationSpecific
-            tls: []
+          oxicloud:
+            persistence:
+              enabled: true
+              storageClass: "truenas-nfs-csi"
+              accessMode: ReadWriteMany
+              size: 50Gi
+            service:
+              type: LoadBalancer
+            config:
+              server:
+                port: 8086
+                host: "0.0.0.0"
+                baseUrl: "https://cloud.roboces.dev"
+              features:
+                enableAuth: true
+                enableSharing: true
+              mimalloc:
+                purgeDelay: "0"
+                allowLargeOsPages: "0"
+            secret:
+              existingSecretName: oxicloud
+            wopi:
+              enabled: false
+            ingress:
+              enabled: true
+              className: "traefik"
+              hosts:
+                - host: cloud.roboces.dev
+                  paths:
+                    - path: /
+                      pathType: ImplementationSpecific
+              tls: []
  project: roboces
  syncPolicy:
    automated: {}
--- a/k8s/charts/README.md
+++ b/k8s/charts/README.md
@ -0,0 +1,209 @@
+# Helm charts
+
+# Normalization project
+
+There is a need to normalize all charts that are under this folder. This means:
+- a single way of providing config values: as hierarchical yaml objects instead of environment variables. This means a user of the chart
+should provide config values as:
+
+```yaml
+# assuming immich which bundles two services
+immich:
+  db:
+    hostname: db.example.com
+    port: 5432
+  ingress:
+    enabled: true
+  general: # general settings
+    someoption: false
+  persistence: ...
+  resources: ...
+  secret:
+    existingSecretName: immich-secret # reference to an existing secret for sensible values
+machin-learning:
+  someoption:
+    enabled: true
+  service:
+    type: LoadBalancer
+    port: 8888
+```
+
+instead of:
+```yaml
+immich:
+  env:
+    - IMMICH_DB_HOSTNAME: db.example.com
+    - IMMICH_SOMEOPTION: false
+    - ... # etc
+```
+
+- default values in charts should match the defaults of my infra:
+  - service of type LoadBalancer
+    - persistence layer should be prefixed with `-data`, unles there are many, which would have an infix for the type.
+    For example, a service like oxicould which only has one persistence layer, its pvc should be called `oxicloud-data`,
+    while immich, which has a bunch of them, should be something like:
+      - `immich-library-data`
+      - `immich-encodedVideo-data`
+      - `immich-upload-data`
+      - ...
+- usage of Deployment vs StatefulSet: Deployment will be the default unless the doesn't support HA (e.g., more than one
+pod) autoscaling out of the box. This sometimes is hard to actually know, each service is different and should
+be investigated beforehand. In any case, we should default to deployments of one (1) replica with an autoscaling option
+
+- each chart should have a standard, artifacthub-compliant README that describes how to install and each available
+value
+
+- when normalization begins, each chart should bump its major version and be uploaded to the registry, unless that
+chart is already normalized.
+
+## Normalization report
+
+### Summary
+
+| Chart | Current Version | Structure | Needs Major Bump |
+|-------|----------------|-----------|------------------|
+| dokuwiki | 0.1.0 | flat | Yes |
+| helm-rustical | 0.3.0 | flat | Yes |
+| immich | 0.2.3 | hierarchical | Yes |
+| miniflux | 0.1.0 | flat | Yes |
+| oxicloud | 0.1.0 | flat | Yes |
+| vaultwarden | 0.1.0 | flat | Yes |
+
+### dokuwiki
+
+**Status:** Needs normalization
+
+**Changes required:**
+1. Wrap all values under `dokuwiki:` key (hierarchical structure)
+2. Convert `env.PHP_*` variables to nested config objects under `dokuwiki.config.php.*`
+3. Rename PVC to `dokuwiki-data`
+4. Add `secret.existingSecretName` for PHP config secrets
+5. Change service type to `LoadBalancer` (currently LoadBalancer - good)
+6. Add `secret.enabled: true` pattern for secrets
+7. Add artifacthub.io annotations to Chart.yaml
+8. Add standard README.md
+
+---
+
+### helm-rustical
+
+**Status:** Needs normalization
+
+**Changes required:**
+1. Wrap all values under `rustical:` key
+2. Rename PVC to `rustical-data`
+3. Change service type from `ClusterIP` to `LoadBalancer`
+4. Add artifacthub.io annotations to Chart.yaml
+5. Add standard README.md
+
+---
+
+### immich
+
+**Status:** Partially normalized (hierarchical), needs fixes
+
+**Changes required:**
+1. **Security:** Move `db` and `redis` credentials from cleartext values to `secret.existingSecretName`
+2. Service types should be `LoadBalancer` (both `immich` and `machineLearning`)
+3. Rename PVCs with `-data` suffix is already done in README spec, but current names are just `library`, `encodedVideo`, etc. - they should be `immich-library-data`, etc. (check templates)
+4. Add `secret.enabled: true` pattern
+5. Add artifacthub.io annotations to Chart.yaml
+6. Add standard README.md
+
+---
+
+### miniflux
+
+**Status:** Needs normalization
+
+**Changes required:**
+1. Wrap all values under `miniflux:` key
+2. Change service type from `ClusterIP` to `LoadBalancer`
+3. Add `secret.existingSecretName` for DATABASE_URL and credentials
+4. Add artifacthub.io annotations to Chart.yaml
+5. Add standard README.md
+
+---
+
+### oxicloud
+
+**Status:** Needs normalization - **HIGH PRIORITY security issue**
+
+**Changes required:**
+1. Wrap all values under `oxicloud:` key
+2. **Security fix:** Move `wopi.collabora.admin.password` from cleartext to a secret reference
+3. Rename PVC to `oxicloud-data`
+4. Change service type from `ClusterIP` to `LoadBalancer`
+5. Add `secret.existingSecretName` for `secrets.jwtSecret` and `secrets.oidcClientSecret`
+6. Add artifacthub.io annotations to Chart.yaml
+7. Add standard README.md
+
+---
+
+### vaultwarden
+
+**Status:** Needs normalization
+
+**Changes required:**
+1. Wrap all values under `vaultwarden:` key
+2. Convert `conf.db.*` to hierarchical config under `vaultwarden.config.database.*`
+3. Rename PVC to `vaultwarden-data`
+4. Change service type from `ClusterIP` to `LoadBalancer`
+5. Add `secret.enabled: true` pattern
+6. Add artifacthub.io annotations to Chart.yaml
+7. Add standard README.md
+
+---
+
+## Even more things
+
+### 1. Secret Management
+- **dokuwiki, miniflux, oxicloud**: No `secret.enabled` pattern - secrets are in cleartext or missing
+- **oxicloud**: Collabora admin password is hardcoded in values.yaml - CRITICAL
+- **immich**: DB and Redis credentials in cleartext - should use secrets
+
+### 2. Service Type Standardization
+Per README spec, all services should be `LoadBalancer` by default. Currently:
+- dokuwiki: LoadBalancer (correct)
+- helm-rustical: ClusterIP (needs change)
+- immich: ClusterIP (both services - needs change)
+- miniflux: ClusterIP (needs change)
+- oxicloud: ClusterIP (needs change)
+- vaultwarden: ClusterIP (needs change)
+
+### 3. PVC Naming Convention
+Per README spec, single-persistence charts should name PVCs `<chart>-data`. Current state:
+- dokuwiki: default (no explicit name) → should be `dokuwiki-data`
+- helm-rustical: default → should be `rustical-data`
+- immich: already follows pattern (library, thumbs, upload, etc.) but should be `immich-*-data`
+- miniflux: no persistence (ok)
+- oxicloud: default → should be `oxicloud-data`
+- vaultwarden: default → should be `vaultwarden-data`
+
+### 4. ArtifactHub Compliance
+None of the charts have proper `artifacthub.io/*` annotations except basic image annotations in some. Recommended additions:
+- `artifacthub.io/changes` - list of changes in this version
+- `artifacthub.io/containsSecurityUpdates` - boolean
+- `artifacthub.io/maintainers` - list of maintainers
+- `artifacthub.io/recommendations` - related charts/apps
+
+### 5. Helm README Documentation
+Only oxicloud has a `.helmignore` file. None have proper README.md with:
+- Chart installation instructions
+- Values reference table
+- Configuration examples
+- Troubleshooting tips
+
+### 6. Probe Configuration
+- miniflux has empty `livenessProbe: {}` and `readinessProbe: {}` - should have proper defaults
+- Most charts use `tcpSocket` which is fine, but should verify it's the correct port
+
+### 7. Security Context
+- All charts have empty `securityContext: {}` and `podSecurityContext: {}` - should define proper PSP/foundationa
+- Consider adding `runAsNonRoot: true`, `runAsUser`, `fsGroup` defaults
+
+### 8. Resource Defaults
+- All charts have empty `resources: {}` - should define sensible defaults or at least comments indicating what's expected
+
+### 9. Repository Metadata
+Consider adding `home:` and `sources:` to Chart.yaml pointing to the upstream project URLs
--- a/k8s/charts/oxicloud/Chart.yaml
+++ b/k8s/charts/oxicloud/Chart.yaml
@ -5,9 +5,13 @@ description: 'Ultra-fast, secure & lightweight self-hosted cloud storage — you

  '
 type: application
-version: 0.1.0
+version: 1.0.0
 appVersion: 0.8.6
 annotations:
-  artifacthub.io/images: |
-    - name: oxicloud
-      image: diocrafts/oxicloud:0.8.6
+  artifacthub.io/images: "- name: oxicloud\n  image: diocrafts/oxicloud:0.8.6\n"
+  artifacthub.io/changes: "- kind: changed\n  description: \"Normalized structure\
+    \ to use hierarchical values under `oxicloud:` key\"\n- kind: changed\n  description:\
+    \ \"Changed service type default to LoadBalancer\"\n- kind: changed\n  description:\
+    \ \"Renamed PVC to `oxicloud-data`\"\n- kind: changed\n  description: \"Disabled\
+    \ WOPI/Collabora by default\"\n- kind: security\n  description: \"Removed hardcoded\
+    \ credentials from values.yaml; use existingSecretName instead\"\n"
--- a/k8s/charts/oxicloud/templates/configmap.yaml
+++ b/k8s/charts/oxicloud/templates/configmap.yaml
@ -4,19 +4,19 @@ kind: ConfigMap
 metadata:
  name: {{ include "oxicloud.fullname" . }}-config
 data:
-  OXICLOUD_SERVER_PORT: {{ .Values.config.server.port | quote }}
-  OXICLOUD_SERVER_HOST: {{ .Values.config.server.host | quote }}
-  {{- if .Values.config.server.baseUrl }}
-  OXICLOUD_BASE_URL: {{ .Values.config.server.baseUrl | quote }}
+  OXICLOUD_SERVER_PORT: {{ .Values.oxicloud.config.server.port | quote }}
+  OXICLOUD_SERVER_HOST: {{ .Values.oxicloud.config.server.host | quote }}
+  {{- if .Values.oxicloud.config.server.baseUrl }}
+  OXICLOUD_BASE_URL: {{ .Values.oxicloud.config.server.baseUrl | quote }}
  {{- end }}
-  OXICLOUD_ENABLE_AUTH: {{ .Values.config.features.enableAuth | quote }}
-  OXICLOUD_ENABLE_FILE_SHARING: {{ .Values.config.features.enableSharing | quote }}
-  MIMALLOC_PURGE_DELAY: {{ .Values.config.mimalloc.purgeDelay | quote }}
-  MIMALLOC_ALLOW_LARGE_OS_PAGES: {{ .Values.config.mimalloc.allowLargeOsPages | quote }}
+  OXICLOUD_ENABLE_AUTH: {{ .Values.oxicloud.config.features.enableAuth | quote }}
+  OXICLOUD_ENABLE_FILE_SHARING: {{ .Values.oxicloud.config.features.enableSharing | quote }}
+  MIMALLOC_PURGE_DELAY: {{ .Values.oxicloud.config.mimalloc.purgeDelay | quote }}
+  MIMALLOC_ALLOW_LARGE_OS_PAGES: {{ .Values.oxicloud.config.mimalloc.allowLargeOsPages | quote }}

-  {{- if .Values.wopi.enabled }}
+  {{- if .Values.oxicloud.wopi.enabled }}
  OXICLOUD_WOPI_ENABLED: "true"
-  OXICLOUD_WOPI_DISCOVERY_URL: "{{ .Values.config.server.baseUrl }}/hosting/discovery"
+  OXICLOUD_WOPI_DISCOVERY_URL: "{{ .Values.oxicloud.config.server.baseUrl }}/hosting/discovery"
  {{- else }}
  OXICLOUD_WOPI_ENABLED: "false"
  {{- end }}
--- a/k8s/charts/oxicloud/templates/ingress.yaml
+++ b/k8s/charts/oxicloud/templates/ingress.yaml
@ -1,22 +1,22 @@
 ---
-{{- if .Values.ingress.enabled -}}
+{{- if .Values.oxicloud.ingress.enabled -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: {{ include "oxicloud.fullname" . }}
  labels:
    {{- include "oxicloud.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
+  {{- with .Values.oxicloud.ingress.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
 spec:
-  {{- if .Values.ingress.className }}
-  ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.oxicloud.ingress.className }}
+  ingressClassName: {{ .Values.oxicloud.ingress.className }}
  {{- end }}
-  {{- if .Values.ingress.tls }}
+  {{- if .Values.oxicloud.ingress.tls }}
  tls:
-    {{- range .Values.ingress.tls }}
+    {{- range .Values.oxicloud.ingress.tls }}
    - hosts:
        {{- range .hosts }}
        - {{ . | quote }}
@ -25,40 +25,38 @@ spec:
    {{- end }}
  {{- end }}
  rules:
-    - host: {{ (index .Values.ingress.hosts 0).host | quote }}
+    - host: {{ (index .Values.oxicloud.ingress.hosts 0).host | quote }}
      http:
        paths:
-          {{- if .Values.wopi.enabled }}
-          # Route Collabora traffic to the WOPI pod
+          {{- if .Values.oxicloud.wopi.enabled }}
          - path: /browser
            pathType: Prefix
            backend:
              service:
                name: {{ include "oxicloud.fullname" $ }}-wopi
                port:
-                  number: {{ .Values.wopi.collabora.service.port }}
+                  number: {{ .Values.oxicloud.wopi.collabora.service.port }}
          - path: /hosting
            pathType: Prefix
            backend:
              service:
                name: {{ include "oxicloud.fullname" $ }}-wopi
                port:
-                  number: {{ .Values.wopi.collabora.service.port }}
+                  number: {{ .Values.oxicloud.wopi.collabora.service.port }}
          - path: /cool
            pathType: Prefix
            backend:
              service:
                name: {{ include "oxicloud.fullname" $ }}-wopi
                port:
-                  number: {{ .Values.wopi.collabora.service.port }}
+                  number: {{ .Values.oxicloud.wopi.collabora.service.port }}
          {{- end }}

-          # Default Catch-All: Route everything else to OxiCloud
          - path: /
            pathType: Prefix
            backend:
              service:
                name: {{ include "oxicloud.fullname" $ }}
                port:
-                  number: {{ $.Values.service.port }}
+                  number: {{ $.Values.oxicloud.service.port }}
 {{- end }}
--- a/k8s/charts/oxicloud/templates/secret.yaml
+++ b/k8s/charts/oxicloud/templates/secret.yaml
@ -1,5 +1,5 @@
 ---
-{{- if not .Values.secrets.existingSecret }}
+{{- if not .Values.oxicloud.secret.existingSecretName }}
 apiVersion: v1
 kind: Secret
 metadata:
@ -8,12 +8,15 @@ metadata:
    {{- include "oxicloud.labels" . | nindent 4 }}
 type: Opaque
 data:
-  {{- if .Values.secrets.jwtSecret }}
-  OXICLOUD_JWT_SECRET: {{ .Values.secrets.jwtSecret | b64enc | quote }}
+  {{- if .Values.oxicloud.secret.data.jwtSecret }}
+  OXICLOUD_JWT_SECRET: {{ .Values.oxicloud.secret.data.jwtSecret | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.oxicloud.wopi.enabled }}
+  {{- if .Values.oxicloud.wopi.collabora.admin.username }}
+  WOPI_ADMIN_USERNAME: {{ .Values.oxicloud.wopi.collabora.admin.username | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.oxicloud.wopi.collabora.admin.password }}
+  WOPI_ADMIN_PASSWORD: {{ .Values.oxicloud.wopi.collabora.admin.password | b64enc | quote }}
  {{- end }}
-  DB_PASSWORD: {{ .Values.database.password | b64enc | quote }}
-  {{- if .Values.wopi.enabled }}
-  WOPI_ADMIN_USERNAME: {{ .Values.wopi.collabora.admin.username | b64enc | quote }}
-  WOPI_ADMIN_PASSWORD: {{ .Values.wopi.collabora.admin.password | b64enc | quote }}
  {{- end }}
 {{- end }}
--- a/k8s/charts/oxicloud/templates/service.yaml
+++ b/k8s/charts/oxicloud/templates/service.yaml
@ -6,9 +6,9 @@ metadata:
  labels:
    {{- include "oxicloud.labels" . | nindent 4 }}
 spec:
-  type: {{ .Values.service.type }}
+  type: {{ .Values.oxicloud.service.type }}
  ports:
-    - port: {{ .Values.service.port }}
+    - port: {{ .Values.oxicloud.service.port }}
      targetPort: http
      protocol: TCP
      name: http
@ -24,7 +24,7 @@ metadata:
 spec:
  clusterIP: None
  ports:
-    - port: {{ .Values.service.port }}
+    - port: {{ .Values.oxicloud.service.port }}
      targetPort: http
      protocol: TCP
      name: http
--- a/k8s/charts/oxicloud/templates/statefulset.yaml
+++ b/k8s/charts/oxicloud/templates/statefulset.yaml
@ -6,7 +6,7 @@ metadata:
    {{- include "oxicloud.labels" . | nindent 4 }}
 spec:
  serviceName: {{ include "oxicloud.fullname" . }}-headless
-  replicas: {{ .Values.replicaCount }}
+  replicas: {{ .Values.oxicloud.replicaCount }}
  selector:
    matchLabels:
      {{- include "oxicloud.selectorLabels" . | nindent 6 }}
@ -17,37 +17,55 @@ spec:
    spec:
      containers:
        - name: oxicloud
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          image: "{{ .Values.oxicloud.image.repository }}:{{ .Values.oxicloud.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.oxicloud.image.pullPolicy }}
          ports:
            - name: http
-              containerPort: 8086
+              containerPort: {{ .Values.oxicloud.config.server.port }}
              protocol: TCP
          envFrom:
            - configMapRef:
                name: {{ include "oxicloud.fullname" . }}-config
            - secretRef:
-                name: {{ if .Values.secrets.existingSecret }}{{ .Values.secrets.existingSecret }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }}
+                name: {{ if .Values.oxicloud.secret.existingSecretName }}{{ .Values.oxicloud.secret.existingSecretName }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }}
          volumeMounts:
-            - name: storage-data
+            - name: oxicloud-data
              mountPath: /app/storage
-      {{- if not .Values.persistence.enabled }}
+          resources:
+            {{- toYaml .Values.oxicloud.resources | nindent 10 }}
+          livenessProbe:
+            {{- toYaml .Values.oxicloud.livenessProbe | nindent 10 }}
+          readinessProbe:
+            {{- toYaml .Values.oxicloud.readinessProbe | nindent 10 }}
+      {{- if not .Values.oxicloud.persistence.enabled }}
      volumes:
-        - name: storage-data
+        - name: oxicloud-data
          emptyDir: {}
      {{- end }}
+      {{- with .Values.oxicloud.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.oxicloud.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.oxicloud.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

-  {{- if .Values.persistence.enabled }}
+  {{- if .Values.oxicloud.persistence.enabled }}
  volumeClaimTemplates:
    - metadata:
-        name: storage-data
+        name: oxicloud-data
      spec:
        accessModes:
-          - {{ .Values.persistence.accessMode }}
-        {{- if .Values.persistence.storageClass }}
-        storageClassName: {{ .Values.persistence.storageClass }}
+          - {{ .Values.oxicloud.persistence.accessMode }}
+        {{- if .Values.oxicloud.persistence.storageClass }}
+        storageClassName: {{ .Values.oxicloud.persistence.storageClass }}
        {{- end }}
        resources:
          requests:
-            storage: {{ .Values.persistence.size }}
+            storage: {{ .Values.oxicloud.persistence.size }}
  {{- end }}
--- a/k8s/charts/oxicloud/templates/wopi-deployment.yaml
+++ b/k8s/charts/oxicloud/templates/wopi-deployment.yaml
@ -1,5 +1,5 @@
 ---
-{{- if .Values.wopi.enabled -}}
+{{- if .Values.oxicloud.wopi.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@ -21,9 +21,8 @@ spec:
    spec:
      containers:
        - name: collabora
-          image: "{{ .Values.wopi.collabora.image.repository }}:{{ .Values.wopi.collabora.image.tag }}"
-          imagePullPolicy: {{ .Values.wopi.collabora.image.pullPolicy }}
-          # Required for Collabora to build chroot jails
+          image: "{{ .Values.oxicloud.wopi.collabora.image.repository }}:{{ .Values.oxicloud.wopi.collabora.image.tag }}"
+          imagePullPolicy: {{ .Values.oxicloud.wopi.collabora.image.pullPolicy }}
          securityContext:
            capabilities:
              add:
@ -34,20 +33,20 @@ spec:
              protocol: TCP
          env:
            - name: aliasgroup1
-              value: "http://{{ .Values.wopi.collabora.domain }}"
+              value: "http://{{ .Values.oxicloud.wopi.collabora.domain }}"
            - name: server_name
-              value: {{ .Values.wopi.collabora.domain | quote }}
+              value: {{ .Values.oxicloud.wopi.collabora.domain | quote }}
            - name: extra_params
-              value: {{ .Values.wopi.collabora.extraParams | quote }}
+              value: {{ .Values.oxicloud.wopi.collabora.extraParams | quote }}
            - name: username
              valueFrom:
                secretKeyRef:
-                  name: {{ if .Values.secrets.existingSecret }}{{ .Values.secrets.existingSecret }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }}
+                  name: {{ if .Values.oxicloud.secret.existingSecretName }}{{ .Values.oxicloud.secret.existingSecretName }}{{ else if .Values.oxicloud.wopi.collabora.admin.existingSecretName }}{{ .Values.oxicloud.wopi.collabora.admin.existingSecretName }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }}
                  key: WOPI_ADMIN_USERNAME
            - name: password
              valueFrom:
                secretKeyRef:
-                  name: {{ if .Values.secrets.existingSecret }}{{ .Values.secrets.existingSecret }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }}
+                  name: {{ if .Values.oxicloud.secret.existingSecretName }}{{ .Values.oxicloud.secret.existingSecretName }}{{ else if .Values.oxicloud.wopi.collabora.admin.existingSecretName }}{{ .Values.oxicloud.wopi.collabora.admin.existingSecretName }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }}
                  key: WOPI_ADMIN_PASSWORD
          readinessProbe:
            httpGet:
--- a/k8s/charts/oxicloud/templates/wopi-service.yaml
+++ b/k8s/charts/oxicloud/templates/wopi-service.yaml
@ -1,5 +1,5 @@
 ---
-{{- if .Values.wopi.enabled -}}
+{{- if .Values.oxicloud.wopi.enabled -}}
 apiVersion: v1
 kind: Service
 metadata:
@ -10,7 +10,7 @@ metadata:
 spec:
  type: ClusterIP
  ports:
-    - port: {{ .Values.wopi.collabora.service.port }}
+    - port: {{ .Values.oxicloud.wopi.collabora.service.port }}
      targetPort: wopi
      protocol: TCP
      name: wopi
--- a/k8s/charts/oxicloud/values.yaml
+++ b/k8s/charts/oxicloud/values.yaml
@ -1,62 +1,87 @@
 ---
-replicaCount: 1
+oxicloud:
+  replicaCount: 1

+  image:
+    repository: diocrafts/oxicloud
+    pullPolicy: Always
+    tag: ""

-
-image:
-  repository: diocrafts/oxicloud
-  pullpolicy: Always
-  tag: ""
-
-config:
-  server:
+  service:
+    type: LoadBalancer
    port: 8086
-    host: "0.0.0.0"
-    baseUrl: "https://cloud.example.com"
-  features:
-    enableAuth: "true"
-    enableSharing: "true"
-  mimalloc:
-    purgeDelay: "0"
-    allowLargeOsPages: "0"

-persistence:
-  enabled: true
-  storageClass: ""
-  accessMode: ReadWriteOnce
-  size: 50Gi
+  ingress:
+    enabled: true
+    className: "traefik"
+    annotations: {}
+    hosts:
+      - host: cloud.example.com
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+    tls: []

-wopi:
-  enabled: true
-  collabora:
-    url: "cloud.example.com"
-    image:
-      repository: collabora/code
-      tag: latest
-      pullPolicy: IfNotPresent
-    service:
-      port: 9980
-    admin:
-      username: admin
-      password: "wopi_admin_password"
-    extraParams: "--o:ssl.enable=false --o:ssl.termination=false --o:net.frame_ancestors=http://* https://*"
+  config:
+    server:
+      port: 8086
+      host: "0.0.0.0"
+      baseUrl: "https://cloud.example.com"
+    features:
+      enableAuth: true
+      enableSharing: true
+    mimalloc:
+      purgeDelay: "0"
+      allowLargeOsPages: "0"

-secrets:
-  existingSecret: ""
-  jwtSecret: ""
-  oidcClientSecret: ""
+  persistence:
+    enabled: true
+    storageClass: ""
+    accessMode: ReadWriteOnce
+    size: 50Gi

-service:
-  type: ClusterIP
-  port: 8086
+  wopi:
+    enabled: false
+    collabora:
+      url: "cloud.example.com"
+      domain: "cloud.example.com"
+      image:
+        repository: collabora/code
+        tag: latest
+        pullPolicy: IfNotPresent
+      service:
+        port: 9980
+      admin:
+        existingSecretName: ""
+        username: ""
+        password: ""
+      extraParams: "--o:ssl.enable=false --o:ssl.termination=false --o:net.frame_ancestors=http://* https://*"

-ingress:
-  enabled: true
-  className: "traefik"
-  annotations: {}
-  hosts:
-    - host: cloud.example.com
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls: []
+  resources: {}
+
+  livenessProbe:
+    tcpSocket:
+      port: 8086
+    initialDelaySeconds: 30
+    timeoutSeconds: 15
+    successThreshold: 1
+    failureThreshold: 3
+    periodSeconds: 10
+
+  readinessProbe:
+    tcpSocket:
+      port: 8086
+    initialDelaySeconds: 15
+    timeoutSeconds: 2
+    successThreshold: 1
+    failureThreshold: 3
+    periodSeconds: 10
+
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+  secret:
+    enabled: true
+    existingSecretName: "oxicloud-secret"
+    data: {}