Helm

Install Memchentic on Kubernetes with the chart in this repository. The chart can run its own Postgres with vector search, or point at a database you already have.

Default image: ghcr.io/memchentic/memchentic:latest

Install

helm upgrade --install memchentic ./helm \
  -n memchentic --create-namespace \
  -f my-values.yaml

Set config.baseUrl and config.corsOrigins to the public URL people open in the browser. The Service listens on port 8080. Ingress is off by default.

Postgres

Mode	Values
In-cluster	`postgres.enabled: true` (default) — includes storage
External	`postgres.enabled: false` and `config.postgresHostname: my.db.example`

The database password always comes from the resolved Secret.

Secret modes

Set secrets.mode to exactly one of:

Mode	Behavior
`inline`	Chart creates a Secret from `secrets.inline.*` (fine for quick trials).
`existing`	Use `secrets.existingSecret` (any secret sync you already run).
`externalSecret`	Chart creates an ExternalSecret; your cluster needs External Secrets Operator and a SecretStore.

Required Secret keys:

ADMIN_PASSWORD
ADMIN_API_KEY
POSTGRES_PASSWORD
OAUTH_CLIENT_SECRET (may be empty when using built-in email/password login)

Admin password and API key must be at least 16 characters.

External Secrets example

Vault (KV v2 path example secret/k8s/memchentic):

secrets:
  mode: externalSecret
  externalSecret:
    secretStoreRef:
      name: memchentic-vault
      kind: SecretStore
    data:
      ADMIN_PASSWORD:
        key: k8s/memchentic
        property: ADMIN_PASSWORD
      ADMIN_API_KEY:
        key: k8s/memchentic
        property: ADMIN_API_KEY
      POSTGRES_PASSWORD:
        key: k8s/memchentic
        property: POSTGRES_PASSWORD
      OAUTH_CLIENT_SECRET:
        key: k8s/memchentic
        property: OAUTH_CLIENT_SECRET

AWS Secrets Manager and 1Password use the same idea with their own provider fields. See helm/README.md in the repository for more.

Useful settings

config.* covers the public URL, login provider (default built-in), admin email, database name, search defaults, session lifetimes, CORS, and log level. Details: Environment Variables.

Prefer Compose instead? See Docker.