Helm chart for OpenWA — WhatsApp API.

Single instance only. A session lease stops two pods from launching the same session, but API keys and the audit log live in each pod's own main.sqlite (a key revoked or narrowed on one pod stays valid on the others), and WS rate-limit buckets and in-flight bulk batches are process-local. Keep replicaCount: 1. See docs/13-horizontal-scaling.md.

helm install openwa ./charts/openwa \
  --set secretEnv.API_MASTER_KEY=$(openssl rand -base64 32)

With secretEnv.API_MASTER_KEY left empty the app bootstraps a key into /app/data/.api-key on the PVC; the post-install NOTES show how to read it.

env (→ ConfigMap) and secretEnv (→ Secret) are free-form maps: any variable from the repo's .env.example works, e.g.:

helm install openwa ./charts/openwa \
  --set env.DATABASE_TYPE=postgres \
  --set env.DATABASE_HOST=postgres.default.svc \
  --set secretEnv.DATABASE_USERNAME=openwa \
  --set secretEnv.DATABASE_PASSWORD=...

Or bring your own Secret: --set existingSecret=my-openwa-secret.

The container port is fixed at 2785; do not set PORT in env (probes and the Service targetPort are pinned to it) — service.port changes the Service port.

All other values (persistence, resources, ingress, serviceMonitor, …) are documented inline in values.yaml. The chart does NOT bundle PostgreSQL/Redis/MinIO — point env at your own, or stay on the SQLite default.