From a23f0cecf343b0dfc415aa98971d5601eee810e3 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 14:25:42 +0200
Subject: [PATCH 01/15] add spacer in all ressources, remove not required
 bitnami-common dependency (apps/v1 is default)

---
 charts/cryptpad/Chart.lock                    | 6 ------
 charts/cryptpad/Chart.yaml                    | 4 ----
 charts/cryptpad/templates/configmap.yaml      | 1 +
 charts/cryptpad/templates/cryptpad.yaml       | 4 ++--
 charts/cryptpad/templates/hpa.yaml            | 5 +++--
 charts/cryptpad/templates/ingress.yaml        | 1 +
 charts/cryptpad/templates/service.yaml        | 1 +
 charts/cryptpad/templates/serviceaccount.yaml | 1 +
 8 files changed, 9 insertions(+), 14 deletions(-)
 delete mode 100644 charts/cryptpad/Chart.lock

diff --git a/charts/cryptpad/Chart.lock b/charts/cryptpad/Chart.lock
deleted file mode 100644
index d8806b0..0000000
--- a/charts/cryptpad/Chart.lock
+++ /dev/null
@@ -1,6 +0,0 @@
-dependencies:
-- name: common
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 2.40.0
-digest: sha256:af8359af8251da7f04304b76fd4ca78ecbbb3b5ccd3c4c6fec5021afef95e894
-generated: "2026-05-29T08:49:08.5066264+02:00"
diff --git a/charts/cryptpad/Chart.yaml b/charts/cryptpad/Chart.yaml
index d646437..4660ecb 100644
--- a/charts/cryptpad/Chart.yaml
+++ b/charts/cryptpad/Chart.yaml
@@ -33,7 +33,3 @@ maintainers:
     email: guilherme.sautner@xwiki.com
   - name: Arsène Fougerouse
     email: arsene.fougerouse@xwiki.com
-dependencies:
-  - name: common
-    repository: oci://registry-1.docker.io/bitnamicharts
-    version: 2.x.x
diff --git a/charts/cryptpad/templates/configmap.yaml b/charts/cryptpad/templates/configmap.yaml
index 6422de7..f3c2922 100644
--- a/charts/cryptpad/templates/configmap.yaml
+++ b/charts/cryptpad/templates/configmap.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: ConfigMap
 metadata:
diff --git a/charts/cryptpad/templates/cryptpad.yaml b/charts/cryptpad/templates/cryptpad.yaml
index 0c1ecd4..40c52f2 100644
--- a/charts/cryptpad/templates/cryptpad.yaml
+++ b/charts/cryptpad/templates/cryptpad.yaml
@@ -1,8 +1,8 @@
+---
+apiVersion: apps/v1
 {{- if .Values.workloadStateful }}
-apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
 kind: StatefulSet
 {{- else }}
-apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
 kind: Deployment
 {{- end }}
 metadata:
diff --git a/charts/cryptpad/templates/hpa.yaml b/charts/cryptpad/templates/hpa.yaml
index 4ff6f4c..efef71d 100644
--- a/charts/cryptpad/templates/hpa.yaml
+++ b/charts/cryptpad/templates/hpa.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.autoscaling.enabled }}
+---
 apiVersion: autoscaling/v2beta1
 kind: HorizontalPodAutoscaler
 metadata:
@@ -8,10 +9,10 @@ metadata:
 spec:
   scaleTargetRef:
     {{- if .Values.workloadStateful }}
-    apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
+    apiVersion: apps/v1
     kind: StatefulSet
     {{- else }}
-    apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+    apiVersion: apps/v1
     kind: Deployment
     {{- end }}
     name: {{ include "cryptpad-helm.fullname" . }}
diff --git a/charts/cryptpad/templates/ingress.yaml b/charts/cryptpad/templates/ingress.yaml
index dd07365..d4f4a87 100644
--- a/charts/cryptpad/templates/ingress.yaml
+++ b/charts/cryptpad/templates/ingress.yaml
@@ -2,6 +2,7 @@
 {{- $fullName := include "cryptpad-helm.fullname" . -}}
 {{- $svcPort := .Values.service.externalPort -}}
 {{- $svcWsPort := .Values.service.websocket.externalPort -}}
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
diff --git a/charts/cryptpad/templates/service.yaml b/charts/cryptpad/templates/service.yaml
index 5974768..535bb95 100644
--- a/charts/cryptpad/templates/service.yaml
+++ b/charts/cryptpad/templates/service.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/charts/cryptpad/templates/serviceaccount.yaml b/charts/cryptpad/templates/serviceaccount.yaml
index 99b8ee8..9c7da56 100644
--- a/charts/cryptpad/templates/serviceaccount.yaml
+++ b/charts/cryptpad/templates/serviceaccount.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.serviceAccount.create -}}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

From a8b1d1ab55e14e3e9926f179eea4819b30b85ff0 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 14:31:00 +0200
Subject: [PATCH 02/15] add httpRoute resource for GatewayApi Config
 (alternative to nginx ingress)

---
 charts/cryptpad/templates/httpRoute.yaml | 55 ++++++++++++++++++++++++
 charts/cryptpad/values.yaml              | 15 +++++++
 2 files changed, 70 insertions(+)
 create mode 100644 charts/cryptpad/templates/httpRoute.yaml

diff --git a/charts/cryptpad/templates/httpRoute.yaml b/charts/cryptpad/templates/httpRoute.yaml
new file mode 100644
index 0000000..420bb13
--- /dev/null
+++ b/charts/cryptpad/templates/httpRoute.yaml
@@ -0,0 +1,55 @@
+{{- if .Values.httpRoute.enabled -}}
+{{- $fullName := include "cryptpad-helm.fullname" . -}}
+{{- $svcPort := .Values.service.externalPort -}}
+{{- $svcWsPort := .Values.service.websocket.externalPort -}}
+{{- if not .Values.httpRoute.parentRefs }}
+    {{- fail "A valid .Values.httpRoute.parentRefs entry is required when httpRoute.enabled is true" }}
+{{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "cryptpad-helm.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.httpRoute.parentRefs }}
+  parentRefs:
+  {{- . | toYaml | nindent 2 }}
+  {{- end }}
+  {{- with .Values.httpRoute.hosts }}
+  hostnames:
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+  rules:
+  - matches:
+    - path:
+        value: /
+        type: PathPrefix
+    backendRefs:
+    - group: ''
+      kind: Service 
+      name: {{ $fullName }}
+      port: {{ $svcPort }}
+    {{- with .Values.httpRoute.timeouts }}
+    timeouts:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  - matches:
+    - path:
+        value: /cryptpad_websocket
+        type: PathPrefix
+    backendRefs:
+    - group: ''
+      kind: Service 
+      name: {{ $fullName }}
+      port: {{ $svcWsPort }}
+    {{- with .Values.httpRoute.timeouts }}
+    timeouts:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+{{- end }}
diff --git a/charts/cryptpad/values.yaml b/charts/cryptpad/values.yaml
index 43615d4..3260a92 100644
--- a/charts/cryptpad/values.yaml
+++ b/charts/cryptpad/values.yaml
@@ -202,6 +202,21 @@ ingress:
   tls: []
   #  - secretName: secret-tls
 
+httpRoute:
+  enabled: false
+  annotations: {}
+  labels: {}
+  parentRefs: []
+  # -- requires cluster enabled default gateway (here envoy as example)
+  #- name: default-gateway
+  #  namespace: infrastructure-envoy-gateway-default
+  #  sectionName: default
+  hosts:
+  - localhost
+  timeouts: {}
+    # backendRequest: 120s
+
+
 # -- Specify default resources.
 # We usually recommend not to specify default resources and to leave this as a conscious
 # choice for the user. This also increases chances charts run on environments with little

From 98bde65f3ccf2c6dddb2c745ed54626728e4ebfb Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 14:43:02 +0200
Subject: [PATCH 03/15] fix bug with double entries of Origin keys and also
 ensure strings are quoted but bool, float and int not

---
 charts/cryptpad/templates/configmap.yaml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/charts/cryptpad/templates/configmap.yaml b/charts/cryptpad/templates/configmap.yaml
index f3c2922..fe2cc79 100644
--- a/charts/cryptpad/templates/configmap.yaml
+++ b/charts/cryptpad/templates/configmap.yaml
@@ -42,12 +42,14 @@ data:
           {{- end}}
 
           {{- range $key, $value := .Values.config }}
-            {{- if and (or (ne $key "httpUnsafeOrigin") (ne $key "httpSafeOrigin")) (ne $key "adminKeys")  (ne $key "maxUploadSize")}}
-            {{ $key }}: {{ $value | quote }},
+            {{- if and (ne $key "httpUnsafeOrigin") (ne $key "httpSafeOrigin") (ne $key "adminKeys") (ne $key "maxUploadSize") }}
+              {{- if or (kindIs "bool" $value) (kindIs "float64" $value) (kindIs "int64" $value) }}
+              {{ $key }}: {{ $value }},
+              {{- else }}
+              {{ $key }}: {{ $value | quote }},
+              {{- end }}
             {{- end }}
           {{- end }}
-
-
         };
   application_config.js: |
     /*

From 812dc9c26984c3758e95b7b7707dc4c53c4ca3fc Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 14:53:22 +0200
Subject: [PATCH 04/15] fix hpa - field name change

---
 charts/cryptpad/templates/hpa.yaml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/charts/cryptpad/templates/hpa.yaml b/charts/cryptpad/templates/hpa.yaml
index efef71d..74ac02a 100644
--- a/charts/cryptpad/templates/hpa.yaml
+++ b/charts/cryptpad/templates/hpa.yaml
@@ -1,6 +1,6 @@
 {{- if .Values.autoscaling.enabled }}
 ---
-apiVersion: autoscaling/v2beta1
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "cryptpad-helm.fullname" . }}
@@ -23,12 +23,16 @@ spec:
     - type: Resource
       resource:
         name: cpu
-        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
     {{- end }}
     {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
-        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
     {{- end }}
 {{- end }}

From 072d8342ae1632701db3e10b9453d2819a53a94f Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 15:34:25 +0200
Subject: [PATCH 05/15] fix ingress sandboxHost (safe/unsafeOrigin)
 configuration

---
 charts/cryptpad/templates/_helpers.tpl   | 13 ++++++++++++-
 charts/cryptpad/templates/configmap.yaml | 14 ++++++++++++--
 charts/cryptpad/templates/httpRoute.yaml |  5 +++--
 charts/cryptpad/templates/ingress.yaml   | 19 +++++++++++++++++++
 charts/cryptpad/values.yaml              | 10 +++++++++-
 5 files changed, 55 insertions(+), 6 deletions(-)

diff --git a/charts/cryptpad/templates/_helpers.tpl b/charts/cryptpad/templates/_helpers.tpl
index 4cfae12..d6a5e8e 100644
--- a/charts/cryptpad/templates/_helpers.tpl
+++ b/charts/cryptpad/templates/_helpers.tpl
@@ -75,11 +75,22 @@ http://localhost:3000
 {{- end }}
 
 {{/*
-Define sandbox subdomain. Or use first ingress host defined as main domain.
+Define sandbox domain (httpSafeOrigin). Uses ingress.sandboxHost or httpRoute.sandboxHost when set,
+falling back to the main host only as a last resort (which is insecure for CryptPad).
 */}}
 {{- define "cryptpad-helm.sandboxDomain" -}}
 {{- if .Values.ingress.enabled }}
+{{- if .Values.ingress.sandboxHost }}
+https://{{ .Values.ingress.sandboxHost }}
+{{- else }}
 https://{{ (index .Values.ingress.hosts 0).host }}
+{{- end }}
+{{- else if .Values.httpRoute.enabled }}
+{{- if .Values.httpRoute.sandboxHost }}
+https://{{ .Values.httpRoute.sandboxHost }}
+{{- else }}
+https://{{ index .Values.httpRoute.hosts 0 }}
+{{- end }}
 {{- else if .Values.config.httpSafeOrigin }}
 {{- .Values.config.httpSafeOrigin }}
 {{- else }}
diff --git a/charts/cryptpad/templates/configmap.yaml b/charts/cryptpad/templates/configmap.yaml
index fe2cc79..3c60ffd 100644
--- a/charts/cryptpad/templates/configmap.yaml
+++ b/charts/cryptpad/templates/configmap.yaml
@@ -19,9 +19,19 @@ data:
           {{- end}}
        
           {{- if .Values.ingress.enabled }}
+            {{- if .Values.ingress.sandboxHost }}
+            httpSafeOrigin: 'https://{{ .Values.ingress.sandboxHost }}',
+            {{- else }}
             httpSafeOrigin: 'https://{{ (index .Values.ingress.hosts 0).host }}',
-          {{- else if .Values.config.httpSafeOrigin }}  
-            httpSafeOrigin: {{ .Values.config.httpSafeOrigin | quote }}, 
+            {{- end }}
+          {{- else if .Values.httpRoute.enabled }}
+            {{- if .Values.httpRoute.sandboxHost }}
+            httpSafeOrigin: 'https://{{ .Values.httpRoute.sandboxHost }}',
+            {{- else }}
+            httpSafeOrigin: 'https://{{ index .Values.httpRoute.hosts 0 }}',
+            {{- end }}
+          {{- else if .Values.config.httpSafeOrigin }}
+            httpSafeOrigin: {{ .Values.config.httpSafeOrigin | quote }},
           {{- else }}
             httpSafeOrigin: 'http://localhost:3000',
           {{- end}}
diff --git a/charts/cryptpad/templates/httpRoute.yaml b/charts/cryptpad/templates/httpRoute.yaml
index 420bb13..500ad02 100644
--- a/charts/cryptpad/templates/httpRoute.yaml
+++ b/charts/cryptpad/templates/httpRoute.yaml
@@ -21,9 +21,10 @@ spec:
   parentRefs:
   {{- . | toYaml | nindent 2 }}
   {{- end }}
-  {{- with .Values.httpRoute.hosts }}
   hostnames:
-  {{- toYaml . | nindent 2 }}
+  {{- toYaml .Values.httpRoute.hosts | nindent 2 }}
+  {{- if .Values.httpRoute.sandboxHost }}
+  - {{ .Values.httpRoute.sandboxHost | quote }}
   {{- end }}
   rules:
   - matches:
diff --git a/charts/cryptpad/templates/ingress.yaml b/charts/cryptpad/templates/ingress.yaml
index d4f4a87..d90dbd2 100644
--- a/charts/cryptpad/templates/ingress.yaml
+++ b/charts/cryptpad/templates/ingress.yaml
@@ -47,4 +47,23 @@ spec:
                 port:
                   number: {{ $svcWsPort }}
     {{- end }}
+    {{- if .Values.ingress.sandboxHost }}
+    - host: {{ .Values.ingress.sandboxHost | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+          - path: /cryptpad_websocket
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcWsPort }}
+    {{- end }}
 {{- end }}
diff --git a/charts/cryptpad/values.yaml b/charts/cryptpad/values.yaml
index 3260a92..327bbe0 100644
--- a/charts/cryptpad/values.yaml
+++ b/charts/cryptpad/values.yaml
@@ -197,8 +197,13 @@ ingress:
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
   hosts:
-    # if the ingress is enabled, this hostname will be used for httpUnsafeOrigin and httpSafeOrigin
+    # if the ingress is enabled, this hostname will be used for httpUnsafeOrigin
     - host: localhost
+  # -- Separate origin for the CryptPad sandbox iframe (httpSafeOrigin).
+  # CryptPad requires this to be a *different* domain or subdomain from the main host
+  # for security isolation. If left empty, the main host is reused (insecure).
+  # Example: sandbox.cryptpad.example.org
+  sandboxHost: ""
   tls: []
   #  - secretName: secret-tls
 
@@ -213,6 +218,9 @@ httpRoute:
   #  sectionName: default
   hosts:
   - localhost
+  # -- Separate origin for the CryptPad sandbox iframe (httpSafeOrigin).
+  # Must be a different domain or subdomain from the main host. If empty, main host is reused.
+  sandboxHost: ""
   timeouts: {}
     # backendRequest: 120s
 

From 26f04364606734e1cbc722f4addc2f808ceeaee9 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 15:51:38 +0200
Subject: [PATCH 06/15] fix wrong rendering of mainPage config setting

---
 charts/cryptpad/templates/configmap.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/charts/cryptpad/templates/configmap.yaml b/charts/cryptpad/templates/configmap.yaml
index 3c60ffd..9c9722a 100644
--- a/charts/cryptpad/templates/configmap.yaml
+++ b/charts/cryptpad/templates/configmap.yaml
@@ -55,6 +55,8 @@ data:
             {{- if and (ne $key "httpUnsafeOrigin") (ne $key "httpSafeOrigin") (ne $key "adminKeys") (ne $key "maxUploadSize") }}
               {{- if or (kindIs "bool" $value) (kindIs "float64" $value) (kindIs "int64" $value) }}
               {{ $key }}: {{ $value }},
+              {{- else if or (kindIs "slice" $value) (kindIs "map" $value) }}
+              {{ $key }}: {{ $value | toJson }},
               {{- else }}
               {{ $key }}: {{ $value | quote }},
               {{- end }}

From 1cab7fdf770490402c9c82d23e355e2b21cff495 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 16:00:30 +0200
Subject: [PATCH 07/15] refactor ingress/httproute config to centralize it,
 also having clearer sandboxDomain config

---
 charts/cryptpad/templates/_helpers.tpl   | 26 ++++++++---------------
 charts/cryptpad/templates/configmap.yaml | 27 ++----------------------
 charts/cryptpad/templates/httpRoute.yaml |  6 +++---
 charts/cryptpad/templates/ingress.yaml   | 15 ++++++++-----
 charts/cryptpad/values.yaml              | 23 +++++++++-----------
 5 files changed, 34 insertions(+), 63 deletions(-)

diff --git a/charts/cryptpad/templates/_helpers.tpl b/charts/cryptpad/templates/_helpers.tpl
index d6a5e8e..7358650 100644
--- a/charts/cryptpad/templates/_helpers.tpl
+++ b/charts/cryptpad/templates/_helpers.tpl
@@ -62,11 +62,11 @@ Create the name of the service account to use
 {{- end }}
 
 {{/*
-Define main domain. Or use first ingress host defined as main domain.
+Define main domain (httpUnsafeOrigin / CPAD_MAIN_DOMAIN).
 */}}
 {{- define "cryptpad-helm.mainDomain" -}}
-{{- if .Values.ingress.enabled }}
-https://{{ (index .Values.ingress.hosts 0).host }}
+{{- if .Values.mainDomain }}
+https://{{ .Values.mainDomain }}
 {{- else if .Values.config.httpUnsafeOrigin }}
 {{- .Values.config.httpUnsafeOrigin }}
 {{- else }}
@@ -75,22 +75,14 @@ http://localhost:3000
 {{- end }}
 
 {{/*
-Define sandbox domain (httpSafeOrigin). Uses ingress.sandboxHost or httpRoute.sandboxHost when set,
-falling back to the main host only as a last resort (which is insecure for CryptPad).
+Define sandbox domain (httpSafeOrigin / CPAD_SANDBOX_DOMAIN).
+Falls back to mainDomain when sandboxDomain is unset (insecure — same origin).
 */}}
 {{- define "cryptpad-helm.sandboxDomain" -}}
-{{- if .Values.ingress.enabled }}
-{{- if .Values.ingress.sandboxHost }}
-https://{{ .Values.ingress.sandboxHost }}
-{{- else }}
-https://{{ (index .Values.ingress.hosts 0).host }}
-{{- end }}
-{{- else if .Values.httpRoute.enabled }}
-{{- if .Values.httpRoute.sandboxHost }}
-https://{{ .Values.httpRoute.sandboxHost }}
-{{- else }}
-https://{{ index .Values.httpRoute.hosts 0 }}
-{{- end }}
+{{- if .Values.sandboxDomain }}
+https://{{ .Values.sandboxDomain }}
+{{- else if .Values.mainDomain }}
+https://{{ .Values.mainDomain }}
 {{- else if .Values.config.httpSafeOrigin }}
 {{- .Values.config.httpSafeOrigin }}
 {{- else }}
diff --git a/charts/cryptpad/templates/configmap.yaml b/charts/cryptpad/templates/configmap.yaml
index 9c9722a..d531e16 100644
--- a/charts/cryptpad/templates/configmap.yaml
+++ b/charts/cryptpad/templates/configmap.yaml
@@ -10,31 +10,8 @@ data:
     /* globals module */
 
     module.exports = {
-          {{- if .Values.ingress.enabled}}  
-            httpUnsafeOrigin: 'https://{{ (index .Values.ingress.hosts 0).host }}',
-          {{- else if .Values.config.httpUnsafeOrigin }}
-            httpUnsafeOrigin: {{ .Values.config.httpUnsafeOrigin | quote }}, 
-          {{- else }}
-            httpUnsafeOrigin: 'http://localhost:3000',
-          {{- end}}
-       
-          {{- if .Values.ingress.enabled }}
-            {{- if .Values.ingress.sandboxHost }}
-            httpSafeOrigin: 'https://{{ .Values.ingress.sandboxHost }}',
-            {{- else }}
-            httpSafeOrigin: 'https://{{ (index .Values.ingress.hosts 0).host }}',
-            {{- end }}
-          {{- else if .Values.httpRoute.enabled }}
-            {{- if .Values.httpRoute.sandboxHost }}
-            httpSafeOrigin: 'https://{{ .Values.httpRoute.sandboxHost }}',
-            {{- else }}
-            httpSafeOrigin: 'https://{{ index .Values.httpRoute.hosts 0 }}',
-            {{- end }}
-          {{- else if .Values.config.httpSafeOrigin }}
-            httpSafeOrigin: {{ .Values.config.httpSafeOrigin | quote }},
-          {{- else }}
-            httpSafeOrigin: 'http://localhost:3000',
-          {{- end}}
+          httpUnsafeOrigin: '{{ include "cryptpad-helm.mainDomain" . | trim }}',
+          httpSafeOrigin: '{{ include "cryptpad-helm.sandboxDomain" . | trim }}',
 
           {{- if .Values.config.adminKeys }}
             adminKeys: [
diff --git a/charts/cryptpad/templates/httpRoute.yaml b/charts/cryptpad/templates/httpRoute.yaml
index 500ad02..0d69308 100644
--- a/charts/cryptpad/templates/httpRoute.yaml
+++ b/charts/cryptpad/templates/httpRoute.yaml
@@ -22,9 +22,9 @@ spec:
   {{- . | toYaml | nindent 2 }}
   {{- end }}
   hostnames:
-  {{- toYaml .Values.httpRoute.hosts | nindent 2 }}
-  {{- if .Values.httpRoute.sandboxHost }}
-  - {{ .Values.httpRoute.sandboxHost | quote }}
+  - {{ .Values.mainDomain | quote }}
+  {{- if .Values.sandboxDomain }}
+  - {{ .Values.sandboxDomain | quote }}
   {{- end }}
   rules:
   - matches:
diff --git a/charts/cryptpad/templates/ingress.yaml b/charts/cryptpad/templates/ingress.yaml
index d90dbd2..c2b2289 100644
--- a/charts/cryptpad/templates/ingress.yaml
+++ b/charts/cryptpad/templates/ingress.yaml
@@ -21,15 +21,21 @@ spec:
   tls:
     {{- range .Values.ingress.tls }}
     - hosts:
+        {{- if .hosts }}
         {{- range .hosts }}
         - {{ . | quote }}
         {{- end }}
+        {{- else }}
+        - {{ $.Values.mainDomain | quote }}
+        {{- if $.Values.sandboxDomain }}
+        - {{ $.Values.sandboxDomain | quote }}
+        {{- end }}
+        {{- end }}
       secretName: {{ .secretName }}
     {{- end }}
   {{- end }}
   rules:
-    {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
+    - host: {{ .Values.mainDomain | quote }}
       http:
         paths:
           - path: /
@@ -46,9 +52,8 @@ spec:
                 name: {{ $fullName }}
                 port:
                   number: {{ $svcWsPort }}
-    {{- end }}
-    {{- if .Values.ingress.sandboxHost }}
-    - host: {{ .Values.ingress.sandboxHost | quote }}
+    {{- if .Values.sandboxDomain }}
+    - host: {{ .Values.sandboxDomain | quote }}
       http:
         paths:
           - path: /
diff --git a/charts/cryptpad/values.yaml b/charts/cryptpad/values.yaml
index 327bbe0..9fb536f 100644
--- a/charts/cryptpad/values.yaml
+++ b/charts/cryptpad/values.yaml
@@ -5,6 +5,15 @@
 # -- Number of replicas
 replicaCount: 1
 
+# -- Primary hostname for CryptPad (no scheme). Used for httpUnsafeOrigin, CPAD_MAIN_DOMAIN,
+# and ingress/httpRoute host rules. Example: cryptpad.example.org
+mainDomain: ""
+
+# -- Sandbox hostname for CryptPad security isolation (no scheme). Used for httpSafeOrigin and
+# CPAD_SANDBOX_DOMAIN. Must be a *different* domain or subdomain from mainDomain.
+# If empty, mainDomain is reused (insecure). Example: sandbox.cryptpad.example.org
+sandboxDomain: ""
+
 # -- Enable to choose witch kind of workload will be used: (true) StatefulSet or (false) for Deployment
 workloadStateful: true
 
@@ -196,16 +205,9 @@ ingress:
   annotations: {}
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
-  hosts:
-    # if the ingress is enabled, this hostname will be used for httpUnsafeOrigin
-    - host: localhost
-  # -- Separate origin for the CryptPad sandbox iframe (httpSafeOrigin).
-  # CryptPad requires this to be a *different* domain or subdomain from the main host
-  # for security isolation. If left empty, the main host is reused (insecure).
-  # Example: sandbox.cryptpad.example.org
-  sandboxHost: ""
   tls: []
   #  - secretName: secret-tls
+  #    hosts: []  # auto-populated from mainDomain/sandboxDomain when empty
 
 httpRoute:
   enabled: false
@@ -216,11 +218,6 @@ httpRoute:
   #- name: default-gateway
   #  namespace: infrastructure-envoy-gateway-default
   #  sectionName: default
-  hosts:
-  - localhost
-  # -- Separate origin for the CryptPad sandbox iframe (httpSafeOrigin).
-  # Must be a different domain or subdomain from the main host. If empty, main host is reused.
-  sandboxHost: ""
   timeouts: {}
     # backendRequest: 120s
 

From 81eb219da05ba7464dd77f1f39613f9e8e35c2a0 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 16:14:07 +0200
Subject: [PATCH 08/15] fix readiness probe using wrong path

---
 charts/cryptpad/templates/cryptpad.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/cryptpad/templates/cryptpad.yaml b/charts/cryptpad/templates/cryptpad.yaml
index 40c52f2..04b800d 100644
--- a/charts/cryptpad/templates/cryptpad.yaml
+++ b/charts/cryptpad/templates/cryptpad.yaml
@@ -132,7 +132,7 @@ spec:
           readinessProbe:
           {{- if .Values.probes.readiness.httpGet.enabled }}
             httpGet:
-              path: {{ .Values.probes.liveness.httpGet.path }}
+              path: {{ .Values.probes.readiness.httpGet.path }}
               port: {{ .Values.service.containerPort }}
           {{- else }}
             tcpSocket:

From 7d7a372f6d00f5f29fe1e94e6dafd73feb05251c Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 16:15:51 +0200
Subject: [PATCH 09/15] fix useless condition, should always be there anyway

---
 charts/cryptpad/templates/cryptpad.yaml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/charts/cryptpad/templates/cryptpad.yaml b/charts/cryptpad/templates/cryptpad.yaml
index 04b800d..0d421bd 100644
--- a/charts/cryptpad/templates/cryptpad.yaml
+++ b/charts/cryptpad/templates/cryptpad.yaml
@@ -147,16 +147,9 @@ spec:
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
-          {{- if .Values.persistence.enabled }}
           {{- range $dir, $dirvalues := .Values.persistence.cryptpad }}
             - name: cryptpad-{{ $dir | replace "/" "-" }}
               mountPath: /cryptpad/{{ $dir }}
-          {{- end }}
-          {{- else if not .Values.workloadStateful }}
-          {{- range $dir, $dirvalues := .Values.persistence.cryptpad }}
-            - name: cryptpad-{{ $dir | replace "/" "-" }}
-              mountPath: /cryptpad/{{ $dir }}
-          {{- end }}
           {{- end }}
             - name: configmaps
               mountPath: {{ .Values.cpadConfig }}

From 47952d0e24630e40b4604e3ef13cf7ed90738041 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 16:20:16 +0200
Subject: [PATCH 10/15] use default indents to be conform with other ressources

---
 charts/cryptpad/templates/pvc.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/charts/cryptpad/templates/pvc.yaml b/charts/cryptpad/templates/pvc.yaml
index 89dbdc1..88b2e09 100644
--- a/charts/cryptpad/templates/pvc.yaml
+++ b/charts/cryptpad/templates/pvc.yaml
@@ -7,11 +7,11 @@ metadata:
   name: cryptpad-{{ $dir | replace "/" "-" }}
   {{- with $dirvalues.annotations }}
   annotations:
-    {{- toYaml . | nindent 10 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   {{- with $dirvalues.labels }}
   labels:
-    {{- toYaml . | nindent 10 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
   accessModes:
@@ -23,14 +23,14 @@ spec:
   {{- end }}
   {{- with $dirvalues.dataSource }}
   dataSource: 
-    {{- toYaml . | nindent 10 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   resources:
     requests:
       storage: {{ $dirvalues.size | quote }}
   {{- with $dirvalues.selector }}
   selector: 
-    {{- toYaml . | nindent 10 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   {{- end }}
 {{- end }}

From 44190927f7887e176d9662213b229c18be83d1b9 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 16:22:31 +0200
Subject: [PATCH 11/15] fix showing correct domains in NOTES.txt

---
 charts/cryptpad/templates/NOTES.txt | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/charts/cryptpad/templates/NOTES.txt b/charts/cryptpad/templates/NOTES.txt
index f585c94..3310189 100644
--- a/charts/cryptpad/templates/NOTES.txt
+++ b/charts/cryptpad/templates/NOTES.txt
@@ -1,10 +1,14 @@
 1. Get the application URL by running these commands:
 {{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.mainDomain }}
+  {{- if .Values.sandboxDomain }}
+  http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.sandboxDomain }} (sandbox)
+  {{- end }}
+{{- else if .Values.httpRoute.enabled }}
+  https://{{ .Values.mainDomain }}
+  {{- if .Values.sandboxDomain }}
+  https://{{ .Values.sandboxDomain }} (sandbox)
   {{- end }}
-{{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
   export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "cryptpad-helm.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")

From e789a2f8c365d0811a3203b13aa0916b5abe5f45 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 16:25:46 +0200
Subject: [PATCH 12/15] fix - high maxReplicas not feasable, also cryptpad does
 not support more than one instance anyway?

---
 charts/cryptpad/values.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/charts/cryptpad/values.yaml b/charts/cryptpad/values.yaml
index 9fb536f..df2cd1e 100644
--- a/charts/cryptpad/values.yaml
+++ b/charts/cryptpad/values.yaml
@@ -242,7 +242,8 @@ autoscaling:
   # -- Minimal numbers of replicas
   minReplicas: 1
   # -- Maximum numbers of replicas
-  maxReplicas: 100
+  # TODO: does cryptpad support HA?
+  maxReplicas: 1
   # -- Percentage of the targeted CPU Utilization
   targetCPUUtilizationPercentage: 80
   # -- Percentage of the targeted Memory Utilization

From 34a6546e2315059a08151c61ee53a7dd5b99278d Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 16:26:37 +0200
Subject: [PATCH 13/15] remove unused labels in httproute

---
 charts/cryptpad/values.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/charts/cryptpad/values.yaml b/charts/cryptpad/values.yaml
index df2cd1e..b3911a2 100644
--- a/charts/cryptpad/values.yaml
+++ b/charts/cryptpad/values.yaml
@@ -212,7 +212,6 @@ ingress:
 httpRoute:
   enabled: false
   annotations: {}
-  labels: {}
   parentRefs: []
   # -- requires cluster enabled default gateway (here envoy as example)
   #- name: default-gateway

From dcc65557f5994c4631cea82f058ab76ab2c04507 Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 16:40:07 +0200
Subject: [PATCH 14/15] fix - when using extraVolumeMounts and extraVolumes,
 then dont create emptyDirs or VolClaims

---
 charts/cryptpad/templates/cryptpad.yaml | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/charts/cryptpad/templates/cryptpad.yaml b/charts/cryptpad/templates/cryptpad.yaml
index 0d421bd..2370ec1 100644
--- a/charts/cryptpad/templates/cryptpad.yaml
+++ b/charts/cryptpad/templates/cryptpad.yaml
@@ -148,8 +148,15 @@ spec:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
           {{- range $dir, $dirvalues := .Values.persistence.cryptpad }}
+            {{- $mountPath := printf "/cryptpad/%s" $dir }}
+            {{- $skip := false }}
+            {{- range $.Values.extraVolumeMounts }}
+              {{- if eq .mountPath $mountPath }}{{- $skip = true }}{{- end }}
+            {{- end }}
+            {{- if not $skip }}
             - name: cryptpad-{{ $dir | replace "/" "-" }}
-              mountPath: /cryptpad/{{ $dir }}
+              mountPath: {{ $mountPath }}
+            {{- end }}
           {{- end }}
             - name: configmaps
               mountPath: {{ .Values.cpadConfig }}
@@ -232,7 +239,14 @@ spec:
     {{- end }}
   {{- else }}
     {{- range $dir, $dirvalues := .Values.persistence.cryptpad }}
-        - name: cryptpad-{{ $dir | replace "/" "-" }}
+      {{- $volName := printf "cryptpad-%s" ($dir | replace "/" "-") }}
+      {{- $skip := false }}
+      {{- range $.Values.extraVolumes }}
+        {{- if eq .name $volName }}{{- $skip = true }}{{- end }}
+      {{- end }}
+      {{- if not $skip }}
+        - name: {{ $volName }}
           emptyDir: {}
-  {{- end }}
+      {{- end }}
+    {{- end }}
 {{- end }}

From 307174222c6d5164cd12a594e138955ee13ae9ef Mon Sep 17 00:00:00 2001
From: karl Einziger <227763633+carl-unique@users.noreply.github.com>
Date: Thu, 28 May 2026 20:24:22 +0200
Subject: [PATCH 15/15] fix startup problem /tmp not writeable (readonly fs)

---
 charts/cryptpad/templates/cryptpad.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/charts/cryptpad/templates/cryptpad.yaml b/charts/cryptpad/templates/cryptpad.yaml
index 2370ec1..e1d14a7 100644
--- a/charts/cryptpad/templates/cryptpad.yaml
+++ b/charts/cryptpad/templates/cryptpad.yaml
@@ -50,6 +50,8 @@ spec:
           volumeMounts:
             - name: cryptpad-data
               mountPath: /cryptpad/data
+            - mountPath: /tmp
+              name: tmp
           args:
             - |
               FILE=/cryptpad/data/decrees/decree.ndjson
@@ -164,6 +166,8 @@ spec:
             - name: configmaps
               mountPath: /cryptpad/customize/application_config.js
               subPath: application_config.js
+            - mountPath: /tmp
+              name: tmp
             {{- with .Values.extraVolumeMounts }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
@@ -183,6 +187,8 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
+        - name: tmp
+          emptyDir: {}
         - name: configmaps
           configMap:
             name: {{ include "cryptpad-helm.fullname" . }}