From 612b5ffb28e45e91f78698c53a1a67aae569f875 Mon Sep 17 00:00:00 2001
From: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>
Date: Tue, 19 May 2026 16:07:08 +0200
Subject: [PATCH] chibisafe

---
 docs/REFERENCE.md                             | 43 ++++++++++++++++++
 .../overlays/upc-dev/chibisafe/chibisafe.yaml | 43 ++++++++++++++++++
 .../upc-dev/chibisafe/kustomization.yaml      |  4 ++
 infra/overlays/upc-dev/kustomization.yaml     |  1 +
 infra/values/base/chibisafe-values.yaml       | 45 +++++++++++++++++++
 infra/values/upc-dev/chibisafe-values.yaml    | 20 +++++++++
 6 files changed, 156 insertions(+)
 create mode 100644 infra/overlays/upc-dev/chibisafe/chibisafe.yaml
 create mode 100644 infra/overlays/upc-dev/chibisafe/kustomization.yaml
 create mode 100644 infra/values/base/chibisafe-values.yaml
 create mode 100644 infra/values/upc-dev/chibisafe-values.yaml

diff --git a/docs/REFERENCE.md b/docs/REFERENCE.md
index 04b3d23..c21a986 100644
--- a/docs/REFERENCE.md
+++ b/docs/REFERENCE.md
@@ -1109,6 +1109,49 @@ storage:
 - `vaultwarden-oidc-credentials` (registrar-managed) — OIDC client ID + secret
 - `vaultwarden-tls` — auto-managed by cert-manager
 
+### Chibisafe
+
+**Chart**: `l4gdev/chibisafe`
+**Version**: 0.1.1 (app latest)
+**Namespace**: `chibisafe`
+
+**Purpose**: Self-hosted file upload and sharing service.
+
+**Configuration**:
+```yaml
+# infra/overlays/upc-dev/chibisafe/ + infra/values/
+ingress:
+  enabled: true
+  className: "traefik"
+  hosts:
+  - host: chibisafe.forteapps.net
+    paths:
+    - path: /
+      pathType: Prefix
+  tls:
+  - secretName: chibisafe-tls
+    hosts:
+    - chibisafe.forteapps.net
+
+persistence:
+  database:
+    enabled: true   # SQLite, 1Gi
+  uploads:
+    enabled: true   # User files, 10Gi
+```
+
+**Architecture**: Three-container pod — frontend (Next.js :8001), backend (API :8000), Caddy (reverse proxy :80).
+
+**TLS**: cert-manager auto-provisions Let's Encrypt certificate via `letsencrypt-prod` ClusterIssuer.
+
+**Storage**: SQLite database (1Gi PVC) + uploads (10Gi PVC), both ReadWriteOnce — single replica only.
+
+**Endpoints**:
+- Web UI: `https://chibisafe.forteapps.net`
+
+**Secrets**:
+- `chibisafe-tls` — auto-managed by cert-manager
+
 ### AI Code Review (ai-review)
 
 **Type**: Gitea Actions workflow (`.gitea/workflows/ai-review.yaml`)
diff --git a/infra/overlays/upc-dev/chibisafe/chibisafe.yaml b/infra/overlays/upc-dev/chibisafe/chibisafe.yaml
new file mode 100644
index 0000000..586c454
--- /dev/null
+++ b/infra/overlays/upc-dev/chibisafe/chibisafe.yaml
@@ -0,0 +1,43 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: chibisafe
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  labels:
+    app.kubernetes.io/name: chibisafe
+    app.kubernetes.io/part-of: storage
+    app.kubernetes.io/managed-by: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  sources:
+  - repoURL: https://l4gdev.github.io/helm-charts
+    chart: chibisafe
+    targetRevision: "0.1.1"
+    helm:
+      releaseName: chibisafe
+      valueFiles:
+      - $values/infra/values/base/chibisafe-values.yaml
+      - $values/infra/values/upc-dev/chibisafe-values.yaml
+
+  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+    targetRevision: feature/chibisafe
+    ref: values
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: chibisafe
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+    syncOptions:
+    - CreateNamespace=true
+    - Validate=true
+    - ServerSideApply=true
diff --git a/infra/overlays/upc-dev/chibisafe/kustomization.yaml b/infra/overlays/upc-dev/chibisafe/kustomization.yaml
new file mode 100644
index 0000000..d664466
--- /dev/null
+++ b/infra/overlays/upc-dev/chibisafe/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- chibisafe.yaml
diff --git a/infra/overlays/upc-dev/kustomization.yaml b/infra/overlays/upc-dev/kustomization.yaml
index fac7510..9580dff 100644
--- a/infra/overlays/upc-dev/kustomization.yaml
+++ b/infra/overlays/upc-dev/kustomization.yaml
@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ../../base
+- chibisafe
 - vaultwarden-postgresql
 - vaultwarden
 
diff --git a/infra/values/base/chibisafe-values.yaml b/infra/values/base/chibisafe-values.yaml
new file mode 100644
index 0000000..b22a71a
--- /dev/null
+++ b/infra/values/base/chibisafe-values.yaml
@@ -0,0 +1,45 @@
+replicaCount: 1
+
+frontend:
+  image:
+    repository: chibisafe/chibisafe
+    tag: "latest"
+    pullPolicy: IfNotPresent
+
+backend:
+  image:
+    repository: chibisafe/chibisafe-server
+    tag: "latest"
+    pullPolicy: IfNotPresent
+
+caddy:
+  image:
+    repository: caddy
+    tag: "2-alpine"
+    pullPolicy: IfNotPresent
+
+persistence:
+  database:
+    enabled: true
+    size: 1Gi
+    accessModes:
+    - ReadWriteOnce
+
+  uploads:
+    enabled: true
+    size: 10Gi
+    accessModes:
+    - ReadWriteOnce
+
+  logs:
+    enabled: false
+
+service:
+  type: ClusterIP
+  port: 80
+
+networkPolicy:
+  enabled: false
+
+podDisruptionBudget:
+  enabled: false
diff --git a/infra/values/upc-dev/chibisafe-values.yaml b/infra/values/upc-dev/chibisafe-values.yaml
new file mode 100644
index 0000000..894b233
--- /dev/null
+++ b/infra/values/upc-dev/chibisafe-values.yaml
@@ -0,0 +1,20 @@
+ingress:
+  enabled: true
+  className: "traefik"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    gethomepage.dev/enabled: "true"
+    gethomepage.dev/name: "Chibisafe"
+    gethomepage.dev/description: "File upload & sharing"
+    gethomepage.dev/group: "Storage"
+    gethomepage.dev/icon: "chibisafe"
+    gethomepage.dev/href: "https://chibisafe.forteapps.net"
+  hosts:
+  - host: chibisafe.forteapps.net
+    paths:
+    - path: /
+      pathType: Prefix
+  tls:
+  - secretName: chibisafe-tls
+    hosts:
+    - chibisafe.forteapps.net