Kubernetes example

This page is a reference example. Docker Compose remains the recommended install. There is no official Helm chart.

Keep one replica. Proval stores SQLite and workspaces under /data. Use Recreate so two pods never share the volume. Pin an image tag instead of latest.

Contract

Item	Value
Image	ghcr.io/seoes/proval:<tag>
Ports	7900 dashboard, 7901 webhooks
Volume	/data
Env	ENCRYPTION_KEY, DB_FILE_NAME=/data/app.db. Optional COOKIE_SECURE=true when the dashboard is served over HTTPS
Health	GET /api/health on port 7900

Generate ENCRYPTION_KEY with openssl rand -base64 32.

Example manifests

Replace the encryption key and pin an image tag before you apply this in a real cluster.

apiVersion: v1
kind: Secret
metadata:
  name: proval
type: Opaque
stringData:
  encryption-key: "[Encryption Key]"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: proval-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: proval
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: proval
  template:
    metadata:
      labels:
        app: proval
    spec:
      containers:
        - name: proval
          image: ghcr.io/seoes/proval:latest
          ports:
            - name: dashboard
              containerPort: 7900
            - name: webhook
              containerPort: 7901
          env:
            - name: ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: proval
                  key: encryption-key
            - name: DB_FILE_NAME
              value: /data/app.db
          volumeMounts:
            - name: data
              mountPath: /data
          readinessProbe:
            httpGet:
              path: /api/health
              port: 7900
          livenessProbe:
            httpGet:
              path: /api/health
              port: 7900
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: proval-data
---
apiVersion: v1
kind: Service
metadata:
  name: proval
spec:
  selector:
    app: proval
  ports:
    - name: dashboard
      port: 7900
      targetPort: dashboard
    - name: webhook
      port: 7901
      targetPort: webhook

HTTPS

Put an Ingress (or another reverse proxy) in front of ports 7900 and 7901. Ingress annotations depend on your cluster. This example does not include them.

When the dashboard is reached over HTTPS, add COOKIE_SECURE=true to the Deployment so the session cookie is marked Secure.

- name: COOKIE_SECURE
  value: "true"

Webhook URLs still use the paths from Quick Start.

What's next

1. Set LLM, or OpenRouter / llama.cpp for example endpoint values
2. Your Git provider: GitLab · Forgejo · GitHub