Tight-Line · nickmarden · Dec 20, 2025 · Dec 16, 2025 · Dec 20, 2025 · Dec 20, 2025
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -112,9 +112,9 @@ See @docs/firecrawl-setup.md
 
 See @docs/phases.md for full roadmap.
 
-**Completed**: Setup, Core Models, Auth, Q&A, Spaces, UI, LDAP SSO, Search, Articles, Bookmarks, RAG/Chunking
+**Completed**: Setup, Core Models, Auth, Q&A, Spaces, UI, LDAP SSO, Search, Articles, Bookmarks, RAG/Chunking, Helm Chart
 **In Progress**: Email digests, Q&A Wizard enhancements
-**Not Started**: REST API, MCP Server, Helm Chart, Social SSO
+**Not Started**: REST API, MCP Server, Social SSO
 
 ---
 

diff --git a/README.md b/README.md
@@ -115,7 +115,7 @@ We require 100% test coverage for all code.
 | `make lint-fix` | Auto-fix lint issues |
 | `make security` | Run security scans |
 
-### Helm (Coming Soon)
+### Helm
 
 | Command | Description |
 |---------|-------------|
@@ -136,15 +136,32 @@ make ci  # Run full CI pipeline (lint, security, test, helm)
 docker-compose up -d
 ```
 
-### Kubernetes (Helm) - Coming Soon
+### Kubernetes (Helm)
 
 ```bash
+# Install with internal PostgreSQL and Valkey
 helm install brimming helm/brimming \
-  -f values.yaml \
+  --set rails.secretKeyBase="$(openssl rand -hex 64)" \
+  --set postgresql.auth.password="$(openssl rand -hex 32)" \
+  -n brimming \
+  --create-namespace
+
+# Or use custom values file
+helm install brimming helm/brimming \
+  -f my-values.yaml \
   -n brimming \
   --create-namespace
 ```
 
+The Helm chart supports:
+- Internal or external PostgreSQL (with pgvector)
+- Internal Valkey subchart or external Redis
+- Horizontal Pod Autoscaling
+- Ingress with TLS
+- Pod Disruption Budget for high availability
+
+See `helm/brimming/values.yaml` for all configuration options.
+
 ## Configuration
 
 ### Environment Variables

diff --git a/docs/phases.md b/docs/phases.md
@@ -53,6 +53,22 @@ Content chunking, chunk embeddings, RAG query pipeline, citation support, prompt
 - [ ] Import from external FAQ sources
 - [ ] Special FAQ styling/badge in UI
 
+### Phase 18: Helm Chart Foundation `[x]`
+- [x] Chart structure with Chart.yaml, values.yaml, templates
+- [x] App deployment with replicas, HPA, health probes, PDB
+- [x] Sidekiq worker deployment with memory optimization
+- [x] Database migration job (Helm hook, runs before app)
+- [x] Seed job (creates single admin user on fresh install)
+- [x] Internal PostgreSQL StatefulSet with pgvector/pg_trgm
+- [x] External PostgreSQL support
+- [x] Valkey subchart integration
+- [x] External Valkey/Redis support
+- [x] ConfigMaps and Secrets with checksum annotations
+- [x] Ingress configuration with TLS support
+- [x] Service Account and RBAC
+- [x] helm-unittest test suites
+- [~] Firecrawl deployment (templates exist but disabled - requires RabbitMQ)
+
 ## Not Started
 
 ### Phase 16: REST API & Swagger
@@ -61,8 +77,5 @@ API namespace with versioning, token auth, Swagger/OpenAPI docs.
 ### Phase 17: MCP Server
 Brimming as knowledge base backend for AI assistants. Tools: `retrieve()`, `ask()`, `list_spaces()`.
 
-### Phase 18: Helm Chart Foundation
-Kubernetes deployment with helm-unittest, PostgreSQL/Valkey subcharts.
-
 ### Phase 19: SSO - Social Providers
 Google, Facebook, LinkedIn, GitHub, GitLab via OmniAuth.
diff --git a/helm/brimming/.gitignore b/helm/brimming/.gitignore
@@ -0,0 +1,2 @@
+charts/*.tgz
+values.yaml.testing
diff --git a/helm/brimming/Chart.lock b/helm/brimming/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: valkey
+  repository: https://valkey.io/valkey-helm/
+  version: 0.9.2
+digest: sha256:65961c380608e26ca8da18a3b386a7a59bf7d98ad2152fe41f3a99328bf58ff5
+generated: "2025-12-19T18:07:06.519743-05:00"
diff --git a/helm/brimming/Chart.yaml b/helm/brimming/Chart.yaml
@@ -0,0 +1,22 @@
+apiVersion: v2
+name: brimming
+description: A Stack Overflow-style Q&A platform with AI-powered search
+type: application
+version: 0.1.0
+appVersion: "0.1.0"
+home: https://github.com/tightline/brimming
+maintainers:
+  - name: Tight Line LLC
+    url: https://www.tightlinesoftware.com
+keywords:
+  - knowledge-base
+  - postgresql
+  - pgvector
+  - questions-and-answers
+  - rails
+
+dependencies:
+  - name: valkey
+    version: "~0.9.0"
+    repository: "https://valkey.io/valkey-helm/"
+    condition: valkey.enabled
diff --git a/helm/brimming/templates/NOTES.txt b/helm/brimming/templates/NOTES.txt
@@ -0,0 +1,51 @@
+Brimming has been installed!
+
+{{- if .Values.ingress.enabled }}
+Application URL:
+{{- range $host := .Values.ingress.hosts }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ (first $host.paths).path }}
+{{- end }}
+{{- else if contains "NodePort" .Values.app.service.type }}
+Get the application URL by running these commands:
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "brimming.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.app.service.type }}
+Get the application URL by running these commands:
+  NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+  kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "brimming.fullname" . }}
+{{- else if contains "ClusterIP" .Values.app.service.type }}
+Get the application URL by running these commands:
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "brimming.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=app" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+
+Components deployed:
+  - App (Rails web server): {{ .Values.app.replicaCount }} replica(s)
+  - Worker (Sidekiq): {{ .Values.worker.replicaCount }} replica(s)
+{{- if .Values.postgresql.enabled }}
+  - PostgreSQL: Internal (pgvector/pgvector:{{ .Values.postgresql.image.tag }})
+{{- else }}
+  - PostgreSQL: External ({{ .Values.externalPostgresql.host }}:{{ .Values.externalPostgresql.port }})
+{{- end }}
+{{- if .Values.valkey.enabled }}
+  - Valkey: Internal
+{{- else }}
+  - Valkey: External ({{ .Values.externalValkey.host }}:{{ .Values.externalValkey.port }})
+{{- end }}
+{{- if .Values.firecrawl.enabled }}
+  - Firecrawl: Enabled ({{ .Values.firecrawl.replicaCount }} replica(s))
+{{- end }}
+
+{{- if .Values.postgresql.enabled }}
+
+PostgreSQL connection:
+  Host: {{ include "brimming.postgresql.host" . }}
+  Port: 5432
+  Database: {{ .Values.postgresql.auth.database }}
+  Username: {{ .Values.postgresql.auth.username }}
+{{- end }}
+
+For more information, visit: https://github.com/tightline/brimming