From 26cc42ace2e8312c1e92444c0f381b91bf4d4e0a Mon Sep 17 00:00:00 2001
From: Robert Bill <robert.bill@closure.ch>
Date: Wed, 29 Jul 2026 08:45:07 +0200
Subject: [PATCH 1/8] Update application version

---
 CHANGELOG.md | 4 ++++
 Chart.yaml   | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ca66f1..9baec11 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.3.0] - to be released
+- Support for memos version 0.30.0
+
+
 ## [0.2.1] - 2025-12-07
 
 ### Fixed
diff --git a/Chart.yaml b/Chart.yaml
index 1e9b0a4..f28d228 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.1
+version: 0.3.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "0.25.2"
+appVersion: "0.30.0"
 home: https://github.com/usememos/helm
 sources:
   - https://github.com/usememos/memos

From 75e81018d52e6081b4652b47e5424f6271065d15 Mon Sep 17 00:00:00 2001
From: Robert Bill <robert.bill@closure.ch>
Date: Wed, 29 Jul 2026 09:02:08 +0200
Subject: [PATCH 2/8] Add HTTPRoute support

---
 CHANGELOG.md             |  2 +-
 templates/httproute.yaml | 38 ++++++++++++++++++++++++++++++++++++++
 values.yaml              | 31 +++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 templates/httproute.yaml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9baec11..50b78ac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@ All notable changes to this project will be documented in this file.
 
 ## [0.3.0] - to be released
 - Support for memos version 0.30.0
-
+- Add HTTPRoute support
 
 ## [0.2.1] - 2025-12-07
 
diff --git a/templates/httproute.yaml b/templates/httproute.yaml
new file mode 100644
index 0000000..c37f98b
--- /dev/null
+++ b/templates/httproute.yaml
@@ -0,0 +1,38 @@
+{{- if .Values.httpRoute.enabled -}}
+{{- $fullName := include "memos.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "memos.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRefs:
+    {{- with .Values.httpRoute.parentRefs }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.httpRoute.rules }}
+    {{- with .matches }}
+    - matches:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .filters }}
+      filters:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+      backendRefs:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+          weight: 1
+    {{- end }}
+{{- end }}
diff --git a/values.yaml b/values.yaml
index d1a8706..337ad66 100644
--- a/values.yaml
+++ b/values.yaml
@@ -71,6 +71,37 @@ ingress:
   #    hosts:
   #      - chart-example.local
 
+httpRoute:
+  enabled: false
+  annotations: {}
+  parentRefs:
+  - name: gateway
+    sectionName: http
+    # namespace: default
+  # hostnames:
+  # - chart-example.local
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+  #   filters:
+  #   - type: RequestHeaderModifier
+  #     requestHeaderModifier:
+  #       set:
+  #       - name: My-Overwrite-Header
+  #         value: this-is-the-only-value
+  #       remove:
+  #       - User-Agent
+  # - matches:
+  #   - path:
+  #       type: PathPrefix
+  #       value: /echo
+  #     headers:
+  #     - name: version
+  #       value: v2
+
+
 resources:
   limits:
     cpu: 500m

From f86fdb38772a54cfd8efb77b69e1dca2596dae3a Mon Sep 17 00:00:00 2001
From: Robert Bill <robert.bill@closure.ch>
Date: Wed, 29 Jul 2026 09:19:28 +0200
Subject: [PATCH 3/8] Don't pull latest per default

---
 values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/values.yaml b/values.yaml
index 337ad66..865dc59 100644
--- a/values.yaml
+++ b/values.yaml
@@ -9,7 +9,7 @@ image:
   imageName: usememos/memos
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: "latest"
+  tag: ""
 
 imagePullSecrets: []
 nameOverride: ""

From 0579b67e2847480d44cb15f790685e2ca03a0815 Mon Sep 17 00:00:00 2001
From: Robert Bill <robert.bill@closure.ch>
Date: Wed, 29 Jul 2026 10:12:36 +0200
Subject: [PATCH 4/8] Choose database

---
 templates/NOTES.txt       | 15 ++++++++++++++-
 templates/deployment.yaml | 25 +++++++++++++++++++++++++
 values.yaml               | 15 +++++++++++++++
 3 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/templates/NOTES.txt b/templates/NOTES.txt
index 8a45931..a8f846a 100644
--- a/templates/NOTES.txt
+++ b/templates/NOTES.txt
@@ -1,5 +1,18 @@
 1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
+{{- if .Values.httpRoute.enabled }}
+{{- if .Values.httpRoute.hostnames }}
+    export APP_HOSTNAME={{ .Values.httpRoute.hostnames | first }}
+{{- else }}
+    export APP_HOSTNAME=$(kubectl get --namespace {{(first .Values.httpRoute.parentRefs).namespace | default .Release.Namespace }} gateway/{{ (first .Values.httpRoute.parentRefs).name }} -o jsonpath="{.spec.listeners[0].hostname}")
+  {{- end }}
+{{- if and .Values.httpRoute.rules (first .Values.httpRoute.rules).matches (first (first .Values.httpRoute.rules).matches).path.value }}
+    echo "Visit https://$APP_HOSTNAME{{ (first (first .Values.httpRoute.rules).matches).path.value }} to use your application"
+
+    NOTE: Your HTTPRoute depends on the listener configuration of your gateway and your HTTPRoute rules.
+    The rules can be set for path, method, header and query parameters.
+    You can check the gateway configuration with 'kubectl get --namespace {{(first .Values.httpRoute.parentRefs).namespace | default .Release.Namespace }} gateway/{{ (first .Values.httpRoute.parentRefs).name }} -o yaml'
+{{- end }}
+{{- else if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}
   {{- range .paths }}
   http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
diff --git a/templates/deployment.yaml b/templates/deployment.yaml
index 7b287cd..599bff7 100644
--- a/templates/deployment.yaml
+++ b/templates/deployment.yaml
@@ -36,6 +36,9 @@ spec:
         {{- else }}
           emptyDir: { }
         {{ end }}
+        - name: settings
+          configMap:
+            name: usememos-settings
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
@@ -57,10 +60,32 @@ spec:
           volumeMounts:
             - name: memos-data
               mountPath: /var/opt/memos
+            - name: settings
+              mountPath: /etc/secrets
+              readOnly: true
           # avoid * cannot parse 'Port' as int: strconv.ParseInt: parsing "tcp://10.233.40.219:5230": invalid syntax
           env:
             - name: MEMOS_PORT
               value: "{{ .Values.service.port }}"
+            - name: MEMOS_LOG_LEVEL
+              value: {{ .Values.instance.logLevel | quote }}
+            - name: MEMOS_DRIVER
+              value: {{ .Values.database.driver | quote }}
+            {{- if .Values.database.connectionString }}
+            - name: MEMOS_DSN
+              value: {{ .Values.database.connectionString }}
+            {{- end }}
+            {{- if .Values.database.existingSecret }}
+            - name: MEMOS_DSN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.database.existingSecret.name }}
+                  key: {{ .Values.database.existingSecret.key }}
+            {{- end }}
+            {{- if .Values.instance.url }}
+            - name: MEMOS_INSTANCE_URL
+              value: {{ .Values.instance.url }}
+            {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
diff --git a/values.yaml b/values.yaml
index 865dc59..b09de65 100644
--- a/values.yaml
+++ b/values.yaml
@@ -24,6 +24,21 @@ persistence:
   accessMode: ReadWriteOnce
   size: 10Gi
 
+instance:
+  # Public instance URL, e.g. https://memos.example.com; empty enables private
+  url: ""
+  # Log verbosity (debug, info, warn, error)
+  logLevel: "info"
+
+database:
+  # sqlite, mysql, postgres
+  driver: sqlite
+  # define database connection string or use an existing secret (recommended)
+  connectionString: ""
+  # existingSecret:
+  #   name:
+  #   key:
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true

From 93f151b2e48cf9501dbd3536026aa6533c3c4d33 Mon Sep 17 00:00:00 2001
From: Robert Bill <robert.bill@closure.ch>
Date: Wed, 29 Jul 2026 11:29:47 +0200
Subject: [PATCH 5/8] Application configuration

---
 CHANGELOG.md              |  1 +
 README.md                 | 84 +++++++++++++++++++++++++++++++++++++++
 templates/deployment.yaml | 11 +++--
 templates/settings.yaml   | 35 ++++++++++++++++
 values.yaml               |  9 +++++
 5 files changed, 137 insertions(+), 3 deletions(-)
 create mode 100644 templates/settings.yaml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 50b78ac..49f06da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file.
 ## [0.3.0] - to be released
 - Support for memos version 0.30.0
 - Add HTTPRoute support
+- Support Deployment-Managed Configuration
 
 ## [0.2.1] - 2025-12-07
 
diff --git a/README.md b/README.md
index 2ceef56..0cdc341 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,90 @@ when `enabled` is `false` use `emptyDir`,
 1. If has created `pvc`, Please change `enabled` to `true`, and change`existPersistClaim`to your `pvc` name.
 2. If `enabled` is `true` but `existPersistClaim` is empty,if will create a new `pvc` by `accessMode` `storageClass` `size`
 
+## Database
+
+Edit `values.yaml`
+
+~~~yaml
+database:
+  driver: postgres
+  existingSecret:
+    name: memos-cluster-app
+    key: fqdn-uri
+~~~
+
+[Databases](https://usememos.com/docs/configuration/database) configuration can be done with an existing secret (recommended) or by a `database.connectionString`.
+
+## Application Configuration
+
+Edit `values.yaml`
+
+~~~yaml
+settings:
+  enabled: true
+  general:
+    {
+      "key": "GENERAL",
+      "generalSetting":
+        {
+          "disallowUserRegistration": false,
+          "disallowPasswordAuth": false,
+          "additionalScript": "",
+          "additionalStyle": "",
+          "weekStartDayOffset": 1,
+          "disallowChangeUsername": false,
+          "disallowChangeNickname": false,
+        },
+    }
+~~~
+
+when `enabled` is `true` the [configuration](https://usememos.com/docs/configuration/deployment-configuration) is generated in `/etc/secrets`.
+
+All configuration resources are supported.
+
+~~~yaml
+settings:
+  enabled: false
+  general: {}
+  idps: []
+  storage: {}
+  memo: {}
+  notification: {}
+  ai: {}
+~~~
+
+For OAuth2 identity provider use for example:
+
+~~~yaml
+settings:
+  enabled: true
+  idps:
+    - name: primary-sso
+      config:
+        {
+          "uid": "primary-sso",
+          "name": "Company SSO",
+          "type": "OAUTH2",
+          "identifierFilter": "",
+          "config": {
+            "oauth2Config": {
+              "clientId": "client-id",
+              "clientSecret": "client-secret",
+              "authUrl": "https://idp.example.com/oauth/authorize",
+              "tokenUrl": "https://idp.example.com/oauth/token",
+              "userInfoUrl": "https://idp.example.com/oauth/userinfo",
+              "scopes": ["openid", "profile", "email"],
+              "fieldMapping": {
+                "identifier": "sub",
+                "displayName": "name",
+                "email": "email",
+                "avatarUrl": "picture"
+              }
+            }
+          }
+        }
+~~~
+
 ## Security
 
 The chart includes secure defaults:
diff --git a/templates/deployment.yaml b/templates/deployment.yaml
index 599bff7..340a8b1 100644
--- a/templates/deployment.yaml
+++ b/templates/deployment.yaml
@@ -14,8 +14,9 @@ spec:
       {{- include "memos.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.podAnnotations }}
       annotations:
+        checksum/settings: {{ include (print $.Template.BasePath "/settings.yaml") . | sha256sum }}
+      {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
@@ -35,10 +36,12 @@ spec:
             claimName: {{ .Values.persistence.existPersistClaim | default (include "memos.fullname" .) }}
         {{- else }}
           emptyDir: { }
-        {{ end }}
+        {{- end }}
+        {{- if .Values.settings.enabled }}
         - name: settings
           configMap:
-            name: usememos-settings
+            name: {{ include "memos.fullname" . }}
+        {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
@@ -60,9 +63,11 @@ spec:
           volumeMounts:
             - name: memos-data
               mountPath: /var/opt/memos
+            {{- if .Values.settings.enabled }}
             - name: settings
               mountPath: /etc/secrets
               readOnly: true
+            {{- end }}
           # avoid * cannot parse 'Port' as int: strconv.ParseInt: parsing "tcp://10.233.40.219:5230": invalid syntax
           env:
             - name: MEMOS_PORT
diff --git a/templates/settings.yaml b/templates/settings.yaml
new file mode 100644
index 0000000..8604f8f
--- /dev/null
+++ b/templates/settings.yaml
@@ -0,0 +1,35 @@
+{{- if .Values.settings.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "memos.fullname" . }}
+  labels:
+    {{- include "memos.labels" . | nindent 4 }}
+data:
+{{- if .Values.settings.general }}
+  memos-instance-setting-general.json: >
+  {{- .Values.settings.general | toJson | nindent 4 }}
+{{- end }}
+{{- if .Values.settings.idps }}
+{{- range $idp := .Values.settings.idps }}
+  memos-idp-{{- $idp.name -}}.json: >
+  {{- $idp.config | toJson | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- if .Values.settings.storage }}
+  memos-instance-setting-storage.json: >
+  {{- .Values.settings.storage | toJson | nindent 4 }}
+{{- end }}
+{{- if .Values.settings.memo }}
+  memos-instance-setting-memo-related.json: >
+  {{- .Values.settings.memo | toJson | nindent 4 }}
+{{- end }}
+{{- if .Values.settings.notification }}
+  memos-instance-setting-notification.json: >
+  {{- .Values.settings.notification | toJson | nindent 4 }}
+{{- end }}
+{{- if .Values.settings.ai }}
+  memos-instance-setting-ai.json: >
+  {{- .Values.settings.ai | toJson | nindent 4 }}
+{{- end }}
+{{- end }}
diff --git a/values.yaml b/values.yaml
index b09de65..72a298c 100644
--- a/values.yaml
+++ b/values.yaml
@@ -39,6 +39,15 @@ database:
   #   name:
   #   key:
 
+settings:
+  enabled: false
+  general: {}
+  idps: []
+  storage: {}
+  memo: {}
+  notification: {}
+  ai: {}
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true

From d29bae0ce671c69cc3ce42f9e29418859d1d332e Mon Sep 17 00:00:00 2001
From: Robert Bill <robert.bill@closure.ch>
Date: Sat, 8 Aug 2026 14:16:59 +0200
Subject: [PATCH 6/8] fix: backticks and MEMOS_DNS mutually exclusive

---
 README.md                 | 16 ++++++++--------
 templates/deployment.yaml |  7 +++----
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index 0cdc341..cb72c5b 100644
--- a/README.md
+++ b/README.md
@@ -50,13 +50,13 @@ when `enabled` is `false` use `emptyDir`,
 
 Edit `values.yaml`
 
-~~~yaml
+```yaml
 database:
   driver: postgres
   existingSecret:
     name: memos-cluster-app
     key: fqdn-uri
-~~~
+```
 
 [Databases](https://usememos.com/docs/configuration/database) configuration can be done with an existing secret (recommended) or by a `database.connectionString`.
 
@@ -64,7 +64,7 @@ database:
 
 Edit `values.yaml`
 
-~~~yaml
+```yaml
 settings:
   enabled: true
   general:
@@ -81,13 +81,13 @@ settings:
           "disallowChangeNickname": false,
         },
     }
-~~~
+```
 
 when `enabled` is `true` the [configuration](https://usememos.com/docs/configuration/deployment-configuration) is generated in `/etc/secrets`.
 
 All configuration resources are supported.
 
-~~~yaml
+```yaml
 settings:
   enabled: false
   general: {}
@@ -96,11 +96,11 @@ settings:
   memo: {}
   notification: {}
   ai: {}
-~~~
+```
 
 For OAuth2 identity provider use for example:
 
-~~~yaml
+```yaml
 settings:
   enabled: true
   idps:
@@ -128,7 +128,7 @@ settings:
             }
           }
         }
-~~~
+```
 
 ## Security
 
diff --git a/templates/deployment.yaml b/templates/deployment.yaml
index 340a8b1..01e6474 100644
--- a/templates/deployment.yaml
+++ b/templates/deployment.yaml
@@ -76,16 +76,15 @@ spec:
               value: {{ .Values.instance.logLevel | quote }}
             - name: MEMOS_DRIVER
               value: {{ .Values.database.driver | quote }}
-            {{- if .Values.database.connectionString }}
-            - name: MEMOS_DSN
-              value: {{ .Values.database.connectionString }}
-            {{- end }}
             {{- if .Values.database.existingSecret }}
             - name: MEMOS_DSN
               valueFrom:
                 secretKeyRef:
                   name: {{ .Values.database.existingSecret.name }}
                   key: {{ .Values.database.existingSecret.key }}
+            {{- else if .Values.database.connectionString }}
+            - name: MEMOS_DSN
+              value: {{ .Values.database.connectionString }}
             {{- end }}
             {{- if .Values.instance.url }}
             - name: MEMOS_INSTANCE_URL

From dbb5a4cebd8ea9e61774ea787c20e6363a9a42c0 Mon Sep 17 00:00:00 2001
From: Robert Bill <robert.bill@closure.ch>
Date: Sat, 8 Aug 2026 16:36:30 +0200
Subject: [PATCH 7/8] fix: Allow existing secrets for application settings

---
 README.md                 | 122 ++++++++++++++++++++++----------------
 templates/NOTES.txt       |   4 +-
 templates/deployment.yaml |  40 ++++++++++---
 templates/settings.yaml   |  41 +++++--------
 values.yaml               |  31 +++++++---
 5 files changed, 144 insertions(+), 94 deletions(-)

diff --git a/README.md b/README.md
index cb72c5b..062f999 100644
--- a/README.md
+++ b/README.md
@@ -66,70 +66,92 @@ Edit `values.yaml`
 
 ```yaml
 settings:
-  enabled: true
   general:
-    {
-      "key": "GENERAL",
-      "generalSetting":
-        {
-          "disallowUserRegistration": false,
-          "disallowPasswordAuth": false,
-          "additionalScript": "",
-          "additionalStyle": "",
-          "weekStartDayOffset": 1,
-          "disallowChangeUsername": false,
-          "disallowChangeNickname": false,
-        },
-    }
+    config:
+      {
+        "key": "GENERAL",
+        "generalSetting":
+          {
+            "disallowUserRegistration": false,
+            "disallowPasswordAuth": false,
+            "additionalScript": "",
+            "additionalStyle": "",
+            "weekStartDayOffset": 1,
+            "disallowChangeUsername": false,
+            "disallowChangeNickname": false
+          }
+      }
 ```
+The [configuration](https://usememos.com/docs/configuration/deployment-configuration) is generated in `/etc/secrets`.
 
-when `enabled` is `true` the [configuration](https://usememos.com/docs/configuration/deployment-configuration) is generated in `/etc/secrets`.
-
-All configuration resources are supported.
+All configuration resources are supported. Use either config or an existing secret.
 
 ```yaml
 settings:
-  enabled: false
-  general: {}
-  idps: []
-  storage: {}
-  memo: {}
-  notification: {}
-  ai: {}
+  general:
+    config: {}
+    existingSecret: ""
+  idp-<uid>:
+    config: {}
+    existingSecret: ""
+  storage:
+    config: {}
+    existingSecret: ""
+  memo:
+    config: {}
+    existingSecret: ""
+  notification:
+    config: {}
+    existingSecret: ""
+  ai:
+    config: {}
+    existingSecret: ""
 ```
 
-For OAuth2 identity provider use for example:
+An existing secret must have one key named `setting` which contains the configuration as JSON.
+As example for an OAuth2 identity provider named `primary-sso` create a secret similar to:
 
 ```yaml
-settings:
-  enabled: true
-  idps:
-    - name: primary-sso
-      config:
-        {
-          "uid": "primary-sso",
-          "name": "Company SSO",
-          "type": "OAUTH2",
-          "identifierFilter": "",
-          "config": {
-            "oauth2Config": {
-              "clientId": "client-id",
-              "clientSecret": "client-secret",
-              "authUrl": "https://idp.example.com/oauth/authorize",
-              "tokenUrl": "https://idp.example.com/oauth/token",
-              "userInfoUrl": "https://idp.example.com/oauth/userinfo",
-              "scopes": ["openid", "profile", "email"],
-              "fieldMapping": {
-                "identifier": "sub",
-                "displayName": "name",
-                "email": "email",
-                "avatarUrl": "picture"
-              }
-            }
+apiVersion: v1
+kind: Secret
+metadata:
+  name: primary-sso-secret
+type: Opaque
+stringData:
+  setting: >
+    {
+      "uid": "primary-sso",
+      "name": "Company SSO",
+      "type": "OAUTH2",
+      "identifierFilter": "",
+      "config": {
+        "oauth2Config": {
+          "clientId": "client-id",
+          "clientSecret": "client-secret",
+          "authUrl": "https://idp.example.com/oauth/authorize",
+          "tokenUrl": "https://idp.example.com/oauth/token",
+          "userInfoUrl": "https://idp.example.com/oauth/userinfo",
+          "scopes": ["openid", "profile", "email"],
+          "fieldMapping": {
+            "identifier": "sub",
+            "displayName": "name",
+            "email": "email",
+            "avatarUrl": "picture"
           }
         }
+      }
+    }
 ```
 
+and define in `values.yaml`:
+
+```yaml
+settings:
+  idp-primary-sso:
+    existingSecret: primary-sso-secret
+```
+
+
 ## Security
 
 The chart includes secure defaults:
diff --git a/templates/NOTES.txt b/templates/NOTES.txt
index a8f846a..ef29462 100644
--- a/templates/NOTES.txt
+++ b/templates/NOTES.txt
@@ -6,7 +6,7 @@
     export APP_HOSTNAME=$(kubectl get --namespace {{(first .Values.httpRoute.parentRefs).namespace | default .Release.Namespace }} gateway/{{ (first .Values.httpRoute.parentRefs).name }} -o jsonpath="{.spec.listeners[0].hostname}")
   {{- end }}
 {{- if and .Values.httpRoute.rules (first .Values.httpRoute.rules).matches (first (first .Values.httpRoute.rules).matches).path.value }}
-    echo "Visit https://$APP_HOSTNAME{{ (first (first .Values.httpRoute.rules).matches).path.value }} to use your application"
+    echo "Visit http(s)://$APP_HOSTNAME{{ (first (first .Values.httpRoute.rules).matches).path.value }} to use your application"
 
     NOTE: Your HTTPRoute depends on the listener configuration of your gateway and your HTTPRoute rules.
     The rules can be set for path, method, header and query parameters.
@@ -24,7 +24,7 @@
   echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "memos.fullname" . }}'
+           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "memos.fullname" . }}'
   export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "memos.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
diff --git a/templates/deployment.yaml b/templates/deployment.yaml
index 01e6474..e959c51 100644
--- a/templates/deployment.yaml
+++ b/templates/deployment.yaml
@@ -1,7 +1,8 @@
+{{- $fullName := include "memos.fullname" . -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "memos.fullname" . }}
+  name: {{ $fullName }}
   labels:
     {{- include "memos.labels" . | nindent 4 }}
 spec:
@@ -33,14 +34,26 @@ spec:
         - name: memos-data
         {{- if .Values.persistence.enabled }}
           persistentVolumeClaim:
-            claimName: {{ .Values.persistence.existPersistClaim | default (include "memos.fullname" .) }}
+            claimName: {{ .Values.persistence.existPersistClaim | default ($fullName) }}
         {{- else }}
           emptyDir: { }
         {{- end }}
-        {{- if .Values.settings.enabled }}
-        - name: settings
+        {{- range $key, $section := .Values.settings }}
+        {{- $hasConfig := and (hasKey $section "config") (not (empty $section.config)) }}
+        {{- $hasSecret := and (hasKey $section "existingSecret") (not (empty $section.existingSecret)) }}
+        {{- if or $hasConfig $hasSecret }}
+        - name: setting-{{ $key }}
+        {{- if $section.config }}
           configMap:
-            name: {{ include "memos.fullname" . }}
+            name: {{ $fullName -}}-{{- $key }}
+        {{- else if $section.existingSecret }}
+          secret:
+            secretName: {{ $section.existingSecret }}
+        {{- end }}
+            items:
+              - key: setting
+                path: setting
+        {{- end }}
         {{- end }}
       containers:
         - name: {{ .Chart.Name }}
@@ -63,11 +76,22 @@ spec:
           volumeMounts:
             - name: memos-data
               mountPath: /var/opt/memos
-            {{- if .Values.settings.enabled }}
-            - name: settings
-              mountPath: /etc/secrets
+            {{- range $key, $section := .Values.settings }}
+            {{- $hasConfig := and (hasKey $section "config") (not (empty $section.config)) }}
+            {{- $hasSecret := and (hasKey $section "existingSecret") (not (empty $section.existingSecret)) }}
+            {{- if or $hasConfig $hasSecret }}
+            {{- $fn := "" -}}
+            {{- if hasPrefix "idp-" $key -}}
+              {{- $fn = printf "memos-%s.json" $key -}}
+            {{- else -}}
+              {{- $fn = printf "memos-instance-setting-%s.json" $key -}}
+            {{- end }}
+            - name: setting-{{ $key }}
+              mountPath: /etc/secrets/{{- $fn }}
+              subPath: setting
               readOnly: true
             {{- end }}
+            {{- end }}
           # avoid * cannot parse 'Port' as int: strconv.ParseInt: parsing "tcp://10.233.40.219:5230": invalid syntax
           env:
             - name: MEMOS_PORT
diff --git a/templates/settings.yaml b/templates/settings.yaml
index 8604f8f..91c516e 100644
--- a/templates/settings.yaml
+++ b/templates/settings.yaml
@@ -1,35 +1,22 @@
-{{- if .Values.settings.enabled -}}
+{{- if .Values.settings -}}
+{{- $fullName := include "memos.fullname" . -}}
+{{- $labels := include "memos.labels" . | nindent 4 -}}
+{{- range $key, $section := .Values.settings }}
+{{- $hasConfig := and (hasKey $section "config") (not (empty $section.config)) }}
+{{- $hasSecret := and (hasKey $section "existingSecret") (not (empty $section.existingSecret)) }}
+{{- if and $hasConfig $hasSecret }}
+  {{ fail (printf "Setting '%s' requires either config or existingSecret, not both" $key) }}
+{{- else if $hasConfig }}
+---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "memos.fullname" . }}
+  name: {{ $fullName -}}-{{- $key }}
   labels:
-    {{- include "memos.labels" . | nindent 4 }}
+    {{- $labels }}
 data:
-{{- if .Values.settings.general }}
-  memos-instance-setting-general.json: >
-  {{- .Values.settings.general | toJson | nindent 4 }}
+  setting: >
+  {{- $section.config | toJson | nindent 4 -}}
 {{- end }}
-{{- if .Values.settings.idps }}
-{{- range $idp := .Values.settings.idps }}
-  memos-idp-{{- $idp.name -}}.json: >
-  {{- $idp.config | toJson | nindent 4 }}
-{{- end }}
-{{- end }}
-{{- if .Values.settings.storage }}
-  memos-instance-setting-storage.json: >
-  {{- .Values.settings.storage | toJson | nindent 4 }}
-{{- end }}
-{{- if .Values.settings.memo }}
-  memos-instance-setting-memo-related.json: >
-  {{- .Values.settings.memo | toJson | nindent 4 }}
-{{- end }}
-{{- if .Values.settings.notification }}
-  memos-instance-setting-notification.json: >
-  {{- .Values.settings.notification | toJson | nindent 4 }}
-{{- end }}
-{{- if .Values.settings.ai }}
-  memos-instance-setting-ai.json: >
-  {{- .Values.settings.ai | toJson | nindent 4 }}
 {{- end }}
 {{- end }}
diff --git a/values.yaml b/values.yaml
index 72a298c..ae58d81 100644
--- a/values.yaml
+++ b/values.yaml
@@ -40,13 +40,30 @@ database:
   #   key:
 
 settings:
-  enabled: false
-  general: {}
-  idps: []
-  storage: {}
-  memo: {}
-  notification: {}
-  ai: {}
+  # See https://usememos.com/docs/configuration/deployment-configuration#general
+  general:
+    config: {}
+    existingSecret: null
+  # See https://usememos.com/docs/configuration/deployment-configuration#oauth2-identity-provider
+  #   idp-<oidc-client-name>:
+  #     config: {}
+  #     existingSecret:
+  # See https://usememos.com/docs/configuration/deployment-configuration#storage
+  storage:
+    config: {}
+    existingSecret: null
+  # See https://usememos.com/docs/configuration/deployment-configuration#memo-behavior
+  memo:
+    config: {}
+    existingSecret: null
+  # See https://usememos.com/docs/configuration/deployment-configuration#ai-providers
+  notification:
+    config: {}
+    existingSecret: null
+  # See https://usememos.com/docs/configuration/deployment-configuration#ai-providers
+  ai:
+    config: {}
+    existingSecret: ""
 
 serviceAccount:
   # Specifies whether a service account should be created

From cb7354aeba5f1c7f91e45523b2cc2de420c7159a Mon Sep 17 00:00:00 2001
From: Robert Bill <147130488+RobSlgm@users.noreply.github.com>
Date: Mon, 10 Aug 2026 07:20:54 +0200
Subject: [PATCH 8/8] fix: Quote connectionstring

---
 templates/deployment.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/deployment.yaml b/templates/deployment.yaml
index e959c51..d7799b5 100644
--- a/templates/deployment.yaml
+++ b/templates/deployment.yaml
@@ -108,7 +108,7 @@ spec:
                   key: {{ .Values.database.existingSecret.key }}
             {{- else if .Values.database.connectionString }}
             - name: MEMOS_DSN
-              value: {{ .Values.database.connectionString }}
+              value: {{ .Values.database.connectionString | quote }}
             {{- end }}
             {{- if .Values.instance.url }}
             - name: MEMOS_INSTANCE_URL