Deploy on Kubernetes

For teams that need HA, multi-region, or aren't comfortable with a single host. We ship a complete Helm chart at deploy/helm/singlink/.

Architecture

        Ingress (nginx / Cloudflare)
                  │
       ┌──────────┼──────────┐
       │          │          │
    web (×N)   ws (×N)    worker (×N)
       │          │          │
       └────┬─────┴────┬─────┘
            │          │
        Postgres    Redis      S3
        (managed)  (managed)  (managed)

Install

helm install singlink ./deploy/helm/singlink \
  --namespace singlink --create-namespace \
  --set domain.app=chat.acme.com \
  --set secret.authSecret="$(openssl rand -base64 32)" \
  --set secret.postgresPassword="$(openssl rand -base64 24)" \
  --set secret.redisPassword="$(openssl rand -base64 24)" \
  --set s3.endpoint="https://s3.us-east-1.amazonaws.com" \
  --set s3.bucket="acme-singlink" \
  --set s3.accessKey="AKIA..." \
  --set s3.secretKey="..."

What gets created

• 3 Deployments: web, ws, worker
• 2 Services (web HTTP, ws sticky-session)
• 1 Ingress with WS upgrade rule
• Optional embedded postgres + redis StatefulSets
• Post-install Job that runs prisma migrate deploy
• ConfigMap + Secret for config and credentials

Production checklist

• Disable embedded databases and point at managed RDS / ElastiCache:--set embedded.postgres.enabled=false --set externalDatabaseUrl=...
• Enable autoscaling:--set autoscaling.enabled=true --set autoscaling.maxReplicas=20
• TLS at the ingress: install cert-manager and set ingress.tls.secretName="singlink-tls"
• Sticky session for WS is already configured at the Service level (sessionAffinity: ClientIP) — no extra ingress annotation needed
• Secrets management: use Sealed Secrets or External Secrets instead of passing values via CLI
• S3: AWS S3, R2, GCS, or a managed MinIO. The chart does not ship MinIO — running stateful object storage in K8s is no fun

Scaling

# Manual scale
kubectl -n singlink scale deploy singlink-web --replicas=5
kubectl -n singlink scale deploy singlink-worker --replicas=10

# With autoscaling.enabled=true, HPAs do this automatically based on CPU.

Upgrades

helm upgrade singlink ./deploy/helm/singlink -n singlink \
  --set image.tag=v0.2.0 \
  --reuse-values

# Helm hook runs the migrate Job post-upgrade automatically.

Observability

The Next.js healthcheck is at /api/healthz (already wired into the readiness/liveness probes). For metrics, point Prometheus at the standard sidecar of your choice. For tracing, set OTEL_EXPORTER_OTLP_ENDPOINT in the ConfigMap.

Enterprise

To enable EE features, pass the public key + customer's license:

helm upgrade singlink ./deploy/helm/singlink -n singlink \
  --reuse-values \
  --set secret.licensePublicKey="..." \
  --set secret.licenseKey="..."

See CE vs EE for the full licensing flow.