Twenty

cpln helm install RELEASE_NAME oci://ghcr.io/controlplane-com/templates/twenty \
  --version 1.3.0 --gvc GVC_NAME \
  --set secrets.name=APP_KEY_SECRET_NAME \
  --set postgres.credentials.password='YOUR-STRONG-DB-PASSWORD' \
  --set redis.auth.password='YOUR-STRONG-REDIS-PASSWORD'

twenty:
  # One image serves the React front end and the NestJS API on :3000.
  # Docker tag keeps the leading "v"; Chart appVersion drops it.
  image: twentycrm/twenty:v2.26.1
  # Stateless web tier. >1 REQUIRES storage.type: s3 and moves boot migrations
  # to the worker (they must run in exactly one container).
  replicas: 1
  # Public base URL. MUST match the URL browsers use or auth/CORS fail with
  # opaque errors. Empty = the platform canonical endpoint. Set WITH https://
  # only for a custom domain.
  serverUrl: ""
  # Postgres connections per pool, per process. Raise replicas and this together
  # with care — the database has a finite connection limit.
  dbPoolMaxConnections: 10
  resources:
    minCpu: 250m
    maxCpu: 1000m
    minMemory: 512Mi
    maxMemory: 2Gi   # headroom for first-boot migrations and upgrade backfills

# Same image, `yarn worker:prod`. Always exactly one replica: it owns cron
# registration, and boot migrations when twenty.replicas > 1.
worker:
  resources:
    minCpu: 250m
    maxCpu: 1000m
    minMemory: 512Mi
    maxMemory: 2Gi

cpln logs '{gvc="GVC_NAME", workload="RELEASE_NAME-twenty-worker"}' --limit 50 --since 10m

secrets:
  name: my-twenty-app-secret
  # Optional: opaque secret holding the PREVIOUS key, only during a rotation
  # (e.g. my-twenty-app-secret-old). Empty = no fallback.
  fallbackName: ""

storage:
  # local uses a SHARED (read-write-many) volumeset mounted by both the server
  # and the worker, so file-maintenance jobs see uploads. Shared volumes support
  # expand only — no snapshots — and live in one location, so s3 is still the
  # durable choice for production and is required for twenty.replicas > 1.
  type: local                 # local | s3
  local:
    volumeset:
      capacity: 10            # GiB (minimum 10); mounted at /app/packages/twenty-server/.local-storage
  s3:
    bucket: my-twenty-bucket
    region: us-east-1
    endpoint: ""              # set for S3-compatible servers (e.g. http://my-minio:9000)
    # Keyless auth (AWS, preferred): Control Plane cloud account + your
    # pre-created IAM policy scoped to the bucket (JSON below).
    # Used only when auth.secretName is empty.
    cloudAccountName: my-s3-cloud-account
    policyName: my-twenty-s3-policy
    auth:
      # Static-key dictionary secret (STORAGE_S3_ACCESS_KEY_ID +
      # STORAGE_S3_SECRET_ACCESS_KEY) — ONLY for S3-compatible servers
      # (requires endpoint set). AWS S3 is always keyless via the cloud account.
      secretName: ""

publicAccess:
  enabled: true               # HTTPS UI + API on the auto *.cpln.app endpoint; false = internal-only
internalAccess:
  type: same-gvc              # none | same-gvc | same-org | workload-list
  workloads: []               # used only with workload-list
  # workloads:
  #   - //gvc/GVC_NAME/workload/WORKLOAD_NAME

redis:
  image: redis:8.10.0
  auth:
    password: change-me-twenty-redis   # template-managed; wired into REDIS_URL — letters/digits/-/_ only
  resources:
    minCpu: 100m
    maxCpu: 400m
    minMemory: 256Mi
    maxMemory: 512Mi
  volumeset:
    capacity: 10              # GiB (minimum 10); AOF at /data

# ─── Database: Single-instance PostgreSQL 18 (default) ────────────
# One Postgres workload — the light default. Disable this and enable postgresHA
# for a redundant database tier.
postgres:
  enabled: true
  image: postgres:18          # PostgreSQL 18 (the HA path below runs 17 — the majors differ)
  # Credentials for the bundled database — internal plumbing no human types elsewhere.
  # Twenty CREATES the dictionary secret named by config.credentialsSecretName below out
  # of these three values, so there is nothing for you to create before installing.
  credentials:
    username: twenty
    password: change-me-twenty-db     # change before install; letters/digits/-/_ only (it is embedded in a URL)
    database: twenty
  config:
    # Name of the dictionary secret this chart creates and the bundled postgres reads.
    # Secret names are org-wide: give each twenty release its own name. A second
    # release left on this name is REFUSED at install (it is owned by the first
    # release) — nothing is shared, overwritten or deleted.
    credentialsSecretName: my-twenty-db-credentials
  resources:
    minCpu: 250m
    maxCpu: 1000m
    minMemory: 512Mi
    maxMemory: 1Gi
  volumeset:
    capacity: 10              # GiB (minimum 10)

  backup:                     # optional database backups — see Backing Up
    enabled: false
    image: ghcr.io/controlplane-com/backup-images/postgres-backup:18.1.0   # tag must match the postgres major above
    schedule: "0 2 * * *"
    resources:
      cpu: 100m
      memory: 128Mi
    provider: aws             # options: aws, gcp, minio
    aws:
      bucket: my-twenty-pg-backup-bucket
      region: us-east-1
      cloudAccountName: my-s3-cloud-account
      policyName: my-twenty-pg-backup-policy
      prefix: postgres/backups
    gcp:
      bucket: my-twenty-pg-backup-bucket
      cloudAccountName: my-gcs-cloud-account
      prefix: postgres/backups
    minio:
      endpoint: http://my-minio-workload:9000
      bucket: my-twenty-pg-backup-bucket
      # REQUIRED prerequisite dictionary secret holding `accessKey` and `secretKey`,
      # only when this backup is enabled with provider: minio. See Backing Up.
      credentialsSecretName: my-twenty-minio-credentials
      prefix: postgres/backups

# ─── Database: Highly Available PostgreSQL 17 (opt-in) ────────────
# Deploys the postgres-highly-available template: 3 Patroni replicas, 3 etcd
# replicas, and an HAProxy leader endpoint Twenty connects to. Enable this and
# set postgres.enabled: false.
postgresHA:
  enabled: false
  config:
    # Name of the dictionary secret this chart creates and the bundled
    # postgres-highly-available reads. Since pgHA 2.5.0 the subchart creates no
    # credentials secret of its own, so both stores are fed the same one, built
    # from postgres.credentials.* above.
    credentialsSecretName: my-twenty-db-credentials
  replicas: 3
  resources:
    minCpu: 500m
    maxCpu: 1000m
    minMemory: 1Gi
    maxMemory: 2Gi
  volumeset:
    capacity: 10              # GiB per replica (minimum 10)

  backup:                     # optional database backups — see Backing Up
    enabled: false
    mode: logical             # logical or wal-g
    resources:
      cpu: 100m
      memory: 128Mi
    logical:
      image: ghcr.io/controlplane-com/backup-images/postgres-backup:17.1.0
      schedule: "0 2 * * *"
    walg:
      intervalSeconds: 21600
    provider: aws             # options: aws, gcp, minio
    aws:
      bucket: my-twenty-pg-backup-bucket
      region: us-east-1
      cloudAccountName: my-s3-cloud-account
      policyName: my-twenty-pg-backup-policy
      prefix: postgres/backups
    gcp:
      bucket: my-twenty-pg-backup-bucket
      cloudAccountName: my-gcs-cloud-account
      prefix: postgres/backups
    minio:
      endpoint: http://my-minio-workload:9000
      bucket: my-twenty-pg-backup-bucket
      # REQUIRED PREREQUISITE SECRET when provider is `minio` — a `dictionary`
      # secret holding exactly `accessKey` and `secretKey`. See Backing Up.
      credentialsSecretName: my-twenty-minio-credentials
      prefix: postgres/backups

cpln workload get RELEASE_NAME-twenty --gvc GVC_NAME -o yaml        # status.canonicalEndpoint
cpln secret reveal DB_CREDENTIALS_SECRET_NAME -o yaml               # the name you set in *.config.credentialsSecretName
cpln secret reveal RELEASE_NAME-twenty-creds -o yaml                # redisPassword

cpln port-forward RELEASE_NAME-twenty 3000:3000 --gvc GVC_NAME
curl -s http://localhost:3000/healthz