Ghost

Overview

Ghost is the open-source publishing platform for professional blogs, newsletters, and paid memberships, with a first-class editor and REST Content/Admin APIs. This template deploys a single stateful Ghost workload backed by a bundled MySQL 8 database, with durable content storage, an HTTPS public site, optional SMTP email, and optional scheduled database backups to object storage.

Architecture

Ghost — Stateful, single-replica workload serving the site, editor, and Content/Admin APIs on port 2368. Boots through a startup script that sets the public url from the canonical endpoint.
MySQL 8 — Backing database provisioned from the mysql template as a subchart (image pinned to mysql:8 — the only database Ghost supports) and connected to Ghost automatically.

What Gets Created

Stateful Ghost Workload — The Ghost server with configurable CPU and memory.
Stateful MySQL Workload — Single-replica MySQL 8, automatically connected to Ghost.
Volume Sets — A persistent volume set for Ghost content (/var/lib/ghost/content: uploaded images, themes, logs, adapters) and one for MySQL data.
Secrets — An opaque secret holding the startup script and the MySQL credentials secret.
Identity & Policy — An identity bound to the Ghost workload with reveal access scoped to exactly the secrets it mounts (plus your SMTP secret when mail is enabled).
Cron Backup Workload (optional) — Scheduled MySQL dumps to object storage, created only when mysql.backup.enabled is true.

This template does not create a GVC. You must deploy it into an existing GVC.

Prerequisites

None for a default install — it deploys with a working MySQL 8 backend and an auto-assigned HTTPS endpoint. Two optional features need setup before installing:

SMTP email — for member sign-in links and newsletters, create a dictionary secret with keys user and password first (see Mail).
Database backups — an AWS S3 or GCS bucket plus a Control Plane Cloud Account (see Backing Up).

Install using your preferred method:

UI

Browse, install, and manage templates visually

CLI

Manage templates from your terminal

Terraform

Declare templates in your Terraform configurations

Pulumi

Declare templates in your Pulumi programs

Configuration

Key configuration values (see the template’s values.yaml for the complete set):

image: ghost:6.54.1-alpine # official Docker Hub image (library/ghost)

resources: # Ghost (Node) app — single instance
  cpu: 500m
  memory: 1024Mi
  minCpu: 250m
  minMemory: 512Mi

# Persistent content: uploaded images, themes, logs, adapters
volumeset:
  capacity: 10 # initial capacity in GiB (minimum is 10)

# Public URL Ghost uses to build links and emails. Leave empty to auto-derive
# the canonical *.cpln.app endpoint. Set to your custom domain once attached.
publicUrl: "" # e.g. https://blog.example.com

# Mail (SMTP) — optional. DISABLED while secretName is empty (email off).
mail:
  secretName: "" # e.g. my-ghost-smtp (dictionary secret with keys: user, password)
  host: ""       # e.g. smtp.mailgun.org
  port: 587      # 465 = SSL, 587 = STARTTLS
  secure: false  # true for port 465
  from: ""       # e.g. "Ghost <noreply@example.com>"

publicAccess:
  enabled: true # HTTPS site via the canonical *.cpln.app endpoint

internalAccess:
  type: same-gvc # options: none, same-gvc, same-org, workload-list
  workloads: []  # only used when type is same-gvc or workload-list

# Backing database: MySQL 8 (bundled via the mysql template)
mysql:
  image: mysql:8 # Ghost supports ONLY MySQL 8 — do not change to 9 or MariaDB
  enablePhpMyAdmin: false
  config:
    db: ghost
    user: ghost
    password: change-me-ghost-db       # change before installing
    rootPassword: change-me-mysql-root # change before installing
  resources:
    minCpu: 150m
    maxCpu: 500m
    minMemory: 256Mi
    maxMemory: 1024Mi
  volumeset:
    capacity: 10 # initial capacity in GiB (minimum is 10)
  internalAccess:
    type: same-gvc
  backup:
    enabled: false        # scheduled DB dumps to object storage — see Backing Up
    schedule: "0 2 * * *" # daily at 2am UTC
    provider: aws         # aws or gcp
    aws:
      bucket: my-backup-bucket
      region: us-east-1
      cloudAccountName: my-backup-cloudaccount
      policyName: my-backup-policy
      prefix: ghost/backups
    gcp:
      bucket: my-backup-bucket
      cloudAccountName: my-backup-cloudaccount
      prefix: ghost/backups

Ghost Application

image — The official Ghost image from Docker Hub (library/ghost, Alpine variant).
resources — CPU and memory bounds for the Ghost workload.
volumeset.capacity — Initial content volume size in GiB (minimum 10). Holds uploaded images, themes, logs, and adapters at /var/lib/ghost/content.

Site URL

publicUrl — The public URL Ghost uses to build page links and email links. Leave empty (default) to auto-derive the canonical *.cpln.app endpoint at boot. Set it to your custom domain (e.g. https://blog.example.com) once you attach one, so links and emails point at the right host.

Mail (SMTP)

Email powers member sign-in links, staff invitations, and newsletters. It is off by default — the entire mail configuration is gated on mail.secretName being non-empty. To enable it, create a dictionary secret with your SMTP credentials before installing:

cpln secret create --name my-ghost-smtp --type dictionary \
  --data 'user=smtp-username,password=smtp-password'

Then set:

mail.secretName — The name of the dictionary secret (keys user and password). The template grants the Ghost identity reveal on exactly this secret.
mail.host — Your SMTP server hostname (e.g. smtp.mailgun.org).
mail.port / mail.secure — 587 with secure: false for STARTTLS (default), or 465 with secure: true for SSL.
mail.from — The From address for outgoing mail (e.g. "Ghost <noreply@example.com>").

Access

publicAccess.enabled — Serve the site and admin over HTTPS on the auto-assigned *.cpln.app canonical endpoint (default). Set to false for an internal-only instance — Ghost then derives its URL from the internal DNS name.
internalAccess.type — Controls which workloads can reach Ghost over the internal network:

Type	Description
`none`	No internal access.
`same-gvc`	Allow access from all workloads in the same GVC (default).
`same-org`	Allow access from all workloads in the same organization.
`workload-list`	Allow access only from workloads listed in `internalAccess.workloads`.

Backing Database

mysql.image — Pinned to mysql:8. Ghost supports only MySQL 8 — not MySQL 9 and not MariaDB. Do not change this.
mysql.config.db / user / password / rootPassword — Credentials for the bundled MySQL, applied on first startup. Change both passwords before installing.
mysql.resources / mysql.volumeset.capacity — CPU/memory bounds and initial volume size for the MySQL workload.
mysql.internalAccess.type — Controls which workloads can reach MySQL directly.
mysql.enablePhpMyAdmin — Off by default to keep the footprint to Ghost plus its database.

MySQL credentials are only applied on first startup when the data directory is empty. Changing them in values after the initial deployment has no effect on the running database. To fully reset, helm uninstall (which deletes the volume sets) and reinstall.

Connecting

Access	Endpoint	Notes
Public site	`https://<canonical>.cpln.app`	Auto-assigned when `publicAccess.enabled`. Find it under `status.canonicalEndpoint` (`cpln workload get <release>-ghost -o yaml`).
Admin panel	`https://<canonical>.cpln.app/ghost`	The Ghost editor and settings.
Owner account	First visit to `/ghost`	Created via the setup wizard on first visit — there are no bootstrap credentials.
Internal (in-GVC)	`http://<release>-ghost.<gvc>.cpln.local:2368`	Reachable from other workloads per `internalAccess.type`. Send an `X-Forwarded-Proto: https` header — Ghost redirects plain-HTTP requests to its configured URL.
Database	`<release>-mysql.<gvc>.cpln.local:3306`	Credentials live in the `<release>-mysql-config` secret.

After deploy, open https://<canonical>.cpln.app/ghost in a browser to create the owner account, then start publishing. Until the owner exists, the site serves the default theme with no admin user.

Backing Up

Database backups are optional and disabled by default. When enabled, a cron workload runs a scheduled mysqldump of the Ghost database and uploads it (gzipped) to your bucket under the configured prefix. Enable with mysql.backup.enabled: true, pick a mysql.backup.provider, and complete the storage setup below before installing.

AWS S3
Google Cloud Storage

Create a bucket

Create an S3 bucket. Set mysql.backup.aws.bucket and mysql.backup.aws.region to match.

Set up a Cloud Account

If you do not have one, create a Cloud Account for your AWS account. Set mysql.backup.aws.cloudAccountName to its name.

Create a bucket-scoped IAM policy

Create an IAM policy granting the required S3 actions on the bucket, and set mysql.backup.aws.policyName to its name:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": "arn:aws:s3:::my-backup-bucket" },
    { "Effect": "Allow", "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"], "Resource": "arn:aws:s3:::my-backup-bucket/*" }
  ]
}

Create a bucket

Create a GCS bucket. Set mysql.backup.gcp.bucket to its name.

Set up a Cloud Account

If you do not have one, create a Cloud Account for your GCP project and grant its service account Storage Object Admin (roles/storage.objectAdmin) on the bucket. Set mysql.backup.gcp.cloudAccountName to its name.

Restoring a Backup

Backups are standard gzipped mysqldump archives named mysql-<timestamp>.sql.gz. To restore, download the archive from your bucket and load it into a MySQL 8 instance:

gunzip -c mysql-<timestamp>.sql.gz | mysql -u root -p

The dump recreates the full ghost database — posts, members, settings, and users. Uploaded images and themes live on the Ghost content volume set, not in the database, so a database restore covers content and configuration but not media files.

Important Notes

Single replica by design. Ghost has no upstream clustering support, so there is no replicas knob. Durability comes from the MySQL backend, the content volume set, and optional scheduled backups. Put a CDN in front of a busy public site to absorb the brief blip during a restart or upgrade.
MySQL 8 only. Ghost does not support MySQL 9 or MariaDB — keep mysql.image: mysql:8.
Create the owner account first. After deploy, visit /ghost to run the setup wizard. Until then the site is public with the default theme and no admin exists.
Change both database passwords before installing. They seed the database on first boot and cannot be changed by editing values afterward — uninstalling (which deletes the volume sets) and reinstalling is the reset path.
SMTP is a prerequisite secret, not a value. Create the dictionary secret (keys user, password) before install and reference it via mail.secretName. Leaving it empty keeps email fully off.
Set publicUrl when using a custom domain so page links and emails point at the right host. Empty auto-derives the canonical *.cpln.app endpoint.
Content survives redeploys under the same release name — posts and settings in MySQL, media on the content volume set. Uninstalling deletes both volume sets and all data.

External References

Ghost Documentation

Official Ghost product documentation

Configuration Reference

Full reference of Ghost configuration options

Supported Databases

Why Ghost requires MySQL 8

Official Docker Image

The library/ghost image on Docker Hub

Ghost Template

View the source files, default values, and chart definition

Template Catalog

Templates

Overview

Architecture

What Gets Created

Prerequisites

UI

CLI

Terraform

Pulumi

Configuration

Ghost Application

Site URL

Mail (SMTP)

Access

Backing Database

Connecting

Backing Up

Restoring a Backup

Important Notes

External References

Ghost Documentation

Configuration Reference

Supported Databases

Official Docker Image

Ghost Template

​Overview

​Architecture

​What Gets Created

​Prerequisites

UI

CLI

Terraform

Pulumi

​Configuration

​Ghost Application

​Site URL

​Mail (SMTP)

​Access

​Backing Database

​Connecting

​Backing Up

​Restoring a Backup

​Important Notes

​External References

Ghost Documentation

Configuration Reference

Supported Databases

Official Docker Image

Ghost Template

Overview

Architecture

What Gets Created

Prerequisites

Configuration

Ghost Application

Site URL

Mail (SMTP)

Access

Backing Database

Connecting

Backing Up

Restoring a Backup

Important Notes

External References