feat(charts): add br-sta chart

charts/br-sta/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: postgresql
+  repository: https://charts.bitnami.com/bitnami
+  version: 16.3.5
+- name: valkey
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 2.4.7
+- name: rabbitmq
+  repository: https://groundhog2k.github.io/helm-charts
+  version: 2.1.11
+digest: sha256:930a2d793fd5205d6a265b344f6785f4727059476f40bc0dac54350d02ba601a
+generated: "2026-07-01T19:53:22.540418-03:00"

charts/br-sta/Chart.yaml

@@ -0,0 +1,50 @@
+apiVersion: v2
+name: br-sta-helm
+description: A Helm chart for br-sta, a Lerian Studio Go/Fiber HTTP service
+  (manager) plus its background worker, backed by PostgreSQL and Redis/Valkey.
+type: application
+annotations:
+  lerian.studio/chart-type: multi-component
+home: https://github.com/LerianStudio/br-sta
+sources:
+  - https://github.com/LerianStudio/helm/tree/main/charts/br-sta
+  - https://github.com/LerianStudio/br-sta
+maintainers:
+  - name: "Lerian Studio"
+    email: "support@lerian.studio"
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+version: 1.0.0-beta.5
+
+# This is the version number of the application being deployed.
+appVersion: "1.0.0-beta.32"
+
+# A list of keywords about the chart. This helps others discover the chart.
+keywords:
+  - br-sta
+  - lerian
+  - go
+  - fiber
+  - service
+
+# The URL to an icon file for this chart.
+icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4
+
+# Dependencies — br-sta requires PostgreSQL (SQL migrations) and Redis/Valkey
+# (caching + rate limiting). RabbitMQ is OPTIONAL and bundled only when
+# rabbitmq.enabled=true (disabled by default). All subcharts are gated by
+# their `.enabled` condition.
+dependencies:
+  - name: postgresql
+    version: "16.3.5"
+    repository: "https://charts.bitnami.com/bitnami"
+    condition: postgresql.enabled
+  - name: valkey
+    version: "2.4.7"
+    repository: "oci://registry-1.docker.io/bitnamicharts"
+    condition: valkey.enabled
+  - name: rabbitmq
+    version: "2.1.11"
+    repository: "https://groundhog2k.github.io/helm-charts"
+    condition: rabbitmq.enabled

charts/br-sta/README.md

@@ -0,0 +1,149 @@
+# br-sta-helm
+
+## Chart Contract
+
+- Chart type: `multi-component`
+- Required secrets: `None for default render`. With the bundled PostgreSQL and Valkey subcharts the database and Redis passwords are auto-generated and read via `secretKeyRef`. Only supply `br-sta.secrets.POSTGRES_PASSWORD` / `br-sta.secrets.REDIS_PASSWORD` for external infra without `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`. `br-sta.secrets.MULTI_TENANT_SERVICE_API_KEY` is required only when `MULTI_TENANT_ENABLED=true`.
+- Dependency notes: Bundles two local subcharts — Bitnami `postgresql` (`postgresql.enabled`, default `true`) and Bitnami `valkey` (`valkey.enabled`, default `true`). RabbitMQ is optional, config-only, and NOT bundled (`RABBITMQ_ENABLED=false`). All can be pointed at external services.
+- Production overrides: Disable the bundled subcharts and point `POSTGRES_HOST` / `REDIS_HOST` at managed services; supply credentials via chart secrets or an existing Secret; override image tag, ingress, resources, and persistence.
+- Source/license: Source is in `github.com/LerianStudio/br-sta`; chart license is Apache-2.0.
+
+A Helm chart for [br-sta](https://github.com/LerianStudio/br-sta) — a Lerian Studio Go/Fiber HTTP service. It ships a manager Deployment running the `/service` binary and an optional worker Deployment running background jobs, backed by PostgreSQL (SQL migrations applied at startup) and Redis/Valkey (caching + rate limiting).
+
+## TL;DR
+
+```bash
+helm repo add lerian https://lerianstudio.github.io/helm
+helm install my-br-sta lerian/br-sta-helm \
+  --namespace br-sta --create-namespace
+```
+
+The default render brings up br-sta plus an in-cluster PostgreSQL and Valkey, with no operator-provided secrets required.
+
+## Prerequisites
+
+- Kubernetes 1.23+
+- Helm 3.10+
+- Either the bundled PostgreSQL/Valkey subcharts (default) or externally managed PostgreSQL 16+ and Redis/Valkey.
+
+## Architecture
+
+The chart deploys a **manager Deployment** (`/service`, a Go/Fiber HTTP server) and an optional **worker Deployment** (`/worker`, background jobs):
+
+- HTTP API served on port `8080` (`/health`, `/api/v1/...`).
+- PostgreSQL is the primary datastore; SQL migrations are applied at startup from `MIGRATIONS_PATH` (`migrations`).
+- Redis/Valkey provides caching and rate limiting (`REDIS_*`).
+
+### Optional integrations (disabled by default)
+
+| Toggle | Default | Purpose |
+|--------|---------|---------|
+| `RABBITMQ_ENABLED` | `"false"` | Event-driven starter (config-only; broker not bundled). |
+| `OUTBOX_ENABLED` | `"false"` | Transactional outbox dispatcher. |
+| `PLUGIN_AUTH_ENABLED` | `"false"` | lib-auth / plugin-auth integration. |
+| `MULTI_TENANT_ENABLED` | `"false"` | Multi-tenant mode via tenant-manager. |
+| `ENABLE_TELEMETRY` | `"false"` | OpenTelemetry OTLP export. |
+
+## Storage
+
+- **PostgreSQL** — application data + SQL migrations.
+- **Redis/Valkey** — cache + rate-limiting counters.
+
+## Single-source infra credentials
+
+Following [`docs/helm-chart-standard.md`](../../docs/helm-chart-standard.md):
+
+- With the bundled **PostgreSQL** subchart (default), the password is auto-generated into the subchart's own Secret and read by the app via `secretKeyRef` (key `password`) — leave `br-sta.secrets.POSTGRES_PASSWORD` empty.
+- With the bundled **Valkey** subchart (default), the password is auto-generated into the subchart's own Secret and read via `secretKeyRef` (key `valkey-password`) — leave `br-sta.secrets.REDIS_PASSWORD` empty.
+- For external infra (subchart disabled), supply `br-sta.secrets.POSTGRES_PASSWORD` / `br-sta.secrets.REDIS_PASSWORD`, or set `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`.
+
+## Required configuration
+
+The chart **fails fast** on `helm install` only when an enabled optional integration is missing its inputs:
+
+| Field | When required |
+|-------|---------------|
+| `br-sta.configmap.MULTI_TENANT_URL` | `MULTI_TENANT_ENABLED=true` |
+| `br-sta.secrets.MULTI_TENANT_SERVICE_API_KEY` | `MULTI_TENANT_ENABLED=true` |
+
+## Probes
+
+| Probe | Path | Notes |
+|-------|------|-------|
+| Liveness | `/health` | HTTP self-probe. |
+| Readiness | `/health` | br-sta exposes a single `/health` endpoint. |
+
+## Common values
+
+| Key | Default | Description |
+|-----|---------|-------------|
+| `br-sta.replicaCount` | `2` | Number of replicas. |
+| `br-sta.image.repository` | `ghcr.io/lerianstudio/br-sta` | Container image. |
+| `br-sta.image.tag` | `""` (Chart `appVersion`) | Image tag. |
+| `br-sta.service.port` | `8080` | Service port. |
+| `br-sta.ingress.enabled` | `false` | Expose via Ingress. |
+| `br-sta.autoscaling.enabled` | `true` | Enable HPA. |
+| `postgresql.enabled` | `true` | Deploy the in-cluster PostgreSQL subchart. |
+| `postgresql.architecture` | `replication` | Primary + read replica. |
+| `valkey.enabled` | `true` | Deploy the in-cluster Valkey subchart. |
+| `valkey.architecture` | `standalone` | Single Valkey primary. |
+| `global.externalPostgresDefinitions.enabled` | `false` | Run a bootstrap Job against an external PostgreSQL. |
+| `otel-collector-lerian.enabled` | `false` | Inject host-level OTLP endpoint env vars. |
+
+See [`values.yaml`](./values.yaml) for the full list, and [`values-template.yaml`](./values-template.yaml) for a production overlay starter.
+
+## Production layout
+
+1. **Disable the bundled infra** and point at managed services:
+   ```yaml
+   postgresql:
+     enabled: false
+   valkey:
+     enabled: false
+   br-sta:
+     configmap:
+       POSTGRES_HOST: my-rds-instance.example.com
+       POSTGRES_SSLMODE: require
+       REDIS_HOST: my-redis.example.com:6379
+     secrets:
+       POSTGRES_PASSWORD: <db password>
+       REDIS_PASSWORD: <redis password>
+   ```
+
+2. **Use an existing Secret** instead of inline values:
+   ```yaml
+   br-sta:
+     useExistingSecret: true
+     existingSecretName: br-sta-secrets
+   ```
+
+3. **Optional bootstrap** for a fresh external Postgres (creates DB + role + grants, idempotent):
+   ```yaml
+   global:
+     externalPostgresDefinitions:
+       enabled: true
+       connection:
+         host: my-rds-instance.example.com
+         port: "5432"
+       postgresAdminLogin:
+         username: postgres
+         password: <admin password>
+       appCredentials:
+         password: <br_sta role password>
+   ```
+
+## Uninstall
+
+```bash
+helm uninstall my-br-sta -n br-sta
+```
+
+If the bundled PostgreSQL was used, its PVCs are NOT deleted automatically:
+
+```bash
+kubectl delete pvc -n br-sta -l app.kubernetes.io/instance=my-br-sta
+```
+
+## License
+
+[Apache 2.0](../../LICENSE) (chart).

charts/br-sta/templates/NOTES.txt

@@ -0,0 +1,92 @@
+{{- $component := index .Values "br-sta" -}}
+# br-sta
+
+Thank you for installing {{ .Chart.Name }} v{{ .Chart.Version }}!
+
+## Deployment Status
+
+{{ if .Release.IsUpgrade }}
+The chart has been UPGRADED to version {{ .Chart.Version }} (appVersion {{ .Chart.AppVersion }}).
+{{ else }}
+The chart has been INSTALLED at version {{ .Chart.Version }} (appVersion {{ .Chart.AppVersion }}).
+{{ end }}
+
+## Component Deployed
+
+Manager Deployment ({{ $component.replicaCount }} replica(s)) running the /service binary
+(Go/Fiber HTTP server).
+
+  Service: {{ include "br-sta.fullname" . }}.{{ include "global.namespace" . }}.svc.cluster.local:{{ $component.service.port }}
+  Health:  /health
+  API:     /api/v1/...
+
+{{- if eq (include "br-sta.worker.enabled" .) "true" }}
+
+Worker Deployment ({{ (.Values.worker | default dict).replicaCount | default 1 }} replica(s)) running the /service binary
+(background jobs: audit outbox publisher/consumer, leader-gated scheduler, credential-recovery-on-boot).
+{{- end }}
+
+## Dependencies
+
+{{- if eq (include "postgresql.enabled" .) "true" }}
+1. PostgreSQL (in-cluster, Bitnami subchart)
+   - Primary: {{ include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" (index .Values "postgresql") "context" .) }}-primary.{{ include "global.namespace" . }}.svc.cluster.local:5432
+   - Database: {{ .Values.postgresql.auth.database }}
+   - User:     {{ .Values.postgresql.auth.username }}
+{{- else if .Values.global.externalPostgresDefinitions.enabled }}
+1. PostgreSQL (external, bootstrapped by Helm)
+   - Host: {{ .Values.global.externalPostgresDefinitions.connection.host }}:{{ .Values.global.externalPostgresDefinitions.connection.port }}
+   - Database/Role: br_sta
+{{- else }}
+1. PostgreSQL (external, expected to be pre-provisioned)
+   - Configure POSTGRES_HOST/POSTGRES_PORT/POSTGRES_USER/POSTGRES_NAME/POSTGRES_PASSWORD before installing.
+{{- end }}
+
+{{- if eq (include "valkey.enabled" .) "true" }}
+2. Redis/Valkey (in-cluster, Bitnami subchart)
+   - Host: {{ include "common.names.dependency.fullname" (dict "chartName" "valkey" "chartValues" (index .Values "valkey") "context" .) }}-primary.{{ include "global.namespace" . }}.svc.cluster.local:6379
+{{- else }}
+2. Redis/Valkey (external, expected to be pre-provisioned)
+   - Configure REDIS_HOST (host:port) and REDIS_PASSWORD before installing.
+{{- end }}
+
+## Optional Integrations (disabled by default)
+
+  - RabbitMQ           (RABBITMQ_ENABLED)         — event-driven starter (config-only; not bundled)
+  - Outbox             (OUTBOX_ENABLED)           — transactional outbox dispatcher
+  - plugin-auth        (PLUGIN_AUTH_ENABLED)      — lib-auth integration
+  - Multi-tenant       (MULTI_TENANT_ENABLED)     — tenant-manager (requires MULTI_TENANT_URL + MULTI_TENANT_SERVICE_API_KEY)
+  - Telemetry          (ENABLE_TELEMETRY)         — OpenTelemetry OTLP export
+
+## Required Configuration
+
+The default render (bundled PostgreSQL + Valkey) requires no operator secrets —
+the infra passwords are auto-generated by the subcharts and read via secretKeyRef.
+
+When MULTI_TENANT_ENABLED=true, the following become required:
+  - br-sta.configmap.MULTI_TENANT_URL
+  - br-sta.secrets.MULTI_TENANT_SERVICE_API_KEY
+
+For an EXTERNAL PostgreSQL / Redis (subchart disabled), supply the passwords via
+br-sta.secrets.POSTGRES_PASSWORD / br-sta.secrets.REDIS_PASSWORD (or existingSecret).
+
+## Accessing the API
+
+{{- if contains "ClusterIP" $component.service.type }}
+
+Port-forward locally:
+
+  kubectl port-forward -n {{ include "global.namespace" . }} svc/{{ include "br-sta.fullname" . }} {{ $component.service.port }}:{{ $component.service.port }}
+
+Then access: http://localhost:{{ $component.service.port }}/health
+{{- end }}
+
+## Useful Commands
+
+  kubectl get pods -n {{ include "global.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }}
+  kubectl logs   -n {{ include "global.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }} --tail=200
+
+## Source
+
+  - Service source: https://github.com/LerianStudio/br-sta
+  - Chart source:   https://github.com/LerianStudio/helm/tree/main/charts/br-sta