🎃 Add a Helm chart for self-hosted Kubernetes installs

Start with docker-compose.yml:36–110 and Dockerfile:158–175 to map the app’s environment, ports, and runtime, then read the secret validation and health endpoint references. Build and validate the chart under deploy/helm/anythingmcp with helm lint and helm template, then test installation and upgrade on kind or minikube. Done means the acceptance criteria pass, including stable generated secrets and the Helm documentation.

Part of the October Challenge #846.

Why

Companies that self-host AnythingMCP increasingly run everything on Kubernetes (AKS, EKS, OpenShift, k3s) and do not want to translate docker-compose.yml by hand. A maintained chart in the repo is the standard entry point (n8n, Langfuse, Flowise and Dify all ship one). This issue is the first step: a single-replica chart that mirrors the Compose stack and passes helm lint.

Self-hosted vs Cloud

• Self-hosted: this is the whole point. Works for Community and Business; the license key is entered in the UI as today, nothing edition-specific in the chart.
• Cloud (DEPLOYMENT_MODE=cloud): not affected. AnythingMCP Cloud is deployed by docker-compose.cloud.yml + deploy/cloud/; do not change those files, and the chart must not expose DEPLOYMENT_MODE as a value (it is our operating mode, not a user option).
• Who can use it: cluster operators. No app roles involved; the first user who registers becomes ADMIN as with Compose.

What to build

deploy/helm/anythingmcp/ with Chart.yaml (apiVersion v2, appVersion = root package.json version, currently 0.18.0), values.yaml, templates/, README.md.

1. App — one Deployment from helpcodeai/anythingmcp:<appVersion> running the default ./start.sh (backend + frontend in one container, migrations on start). replicas: 1 and strategy: Recreate in this first version (see Out of scope for why). Ports 3000 (http) and 4000 (api), one Service.
2. Env — everything the app service sets in docker-compose.yml:50–99, as values. Required secrets in a chart-managed Secret or existingSecret: JWT_SECRET, ENCRYPTION_KEY (min. 32 chars; must never change after install), MCP_API_KEY/MCP_BEARER_TOKEN, DB password. Do not ship defaults: the backend refuses placeholder values at startup (secrets.util.ts:41); use required in templates, or generate with randAlphaNum and keep them stable across upgrades with lookup.
3. PostgreSQL — postgresql.enabled: true deploys a simple StatefulSet of postgres:17-alpine with a PVC (no third-party subchart). externalDatabase.url / existingSecret when enabled: false → builds DATABASE_URL.
4. Redis — optional (redis.enabled: false by default, like Compose); when on, a small redis:7-alpine Deployment and REDIS_URL set. externalRedis.url alternative.
5. MOTIS — optional (motis.enabled: false); when on, also add motis to SSRF_ALLOWED_HOSTS and set MOTIS_INTERNAL_URL (docker-compose.yml:77–85, :135).
6. Ingress — optional, className, hosts, tls. Route the backend paths to port 4000 and everything else to 3000. Take the list from the rewrites() in packages/frontend/next.config.ts:19 (the Cloud Caddyfile says it must match it): /api, /health, /mcp, /.well-known, /auth, /sso, /authorize, /callback, /token, /register, /userinfo, plus /revoke from setup.sh:463. (setup.sh:455–467 is older and misses /sso and /userinfo.) Document nginx annotations for SSE/streaming (proxy-buffering: off, long proxy-read-timeout). Set SERVER_URL, FRONTEND_URL, CORS_ORIGIN, NEXT_PUBLIC_API_URL from the first host.
7. Probes — startupProbe HTTP GET /health on 4000 with a generous failureThreshold (migrations run first); readinessProbe GET /health; livenessProbe tcpSocket 4000, not /health (it checks the database, and a DB blip must not restart the app — health.controller.ts:74).
8. securityContext: non-root (the image runs as appuser, Dockerfile:158), resources, nodeSelector/tolerations/affinity, podAnnotations, serviceAccount.
9. CI (optional but welcome): a job in .github/workflows/ci.yml running helm lint and helm template (or chart-testing ct lint).

Where to look

• docker-compose.yml:36–110 (app), :113 (postgres), :135 (motis), :156 (commented redis) — source of truth for services and env.
• start.sh:57, :64 — frontend/all modes; run_migrations at the top.
• Dockerfile:158–175 — user, ports, healthcheck, CMD.
• packages/backend/src/health/health.controller.ts:74 — /health (DB, Redis, heap).
• packages/backend/src/common/secrets.util.ts:41 — startup secret validation.
• setup.sh:455 — path routing the Compose Caddy setup uses.
• deploy/cloud/Caddyfile:76–123 — explains why a split frontend/backend needs explicit backend routes (Next rewrites are baked with localhost:4000).
• docs/deployment.md:159 — production deployment docs to extend.

Acceptance criteria

• helm lint deploy/helm/anythingmcp passes with default values and with postgresql.enabled=false,externalDatabase.url=….
• helm install on kind/minikube: pod becomes Ready, UI reachable via port-forward/Ingress, registration works, /mcp/<serverId> answers with an API key. Put the exact commands you ran in the PR.
• helm upgrade keeps generated secrets (no new ENCRYPTION_KEY, which would make stored credentials unreadable).
• No secret value appears in helm template output unless the user passed it.
• Docs: deploy/helm/anythingmcp/README.md (values table) + a "Kubernetes (Helm)" section in docs/deployment.md.

Out of scope

• Multiple replicas / HPA / split frontend+backend pods. Needs Redis for shared rate limits, MCP_STATEFUL_SESSIONS off or sticky sessions (mcp-session.manager.ts:67), and migrations moved to a Job — follow-up issue.
• Publishing the chart to a Helm repo / OCI registry, Artifact Hub listing.
• Operator, Kustomize, Terraform.
• Prometheus ServiceMonitor (comes after the metrics endpoint in #854).

Size

L (several days, may be split: chart + lint first, Ingress/MOTIS second).

How to claim

Comment "I'd like to work on this" and we'll assign you. Rules in #846.