Helm values reference | Tines 3B Docs

The most relevant values when installing 3B with the Helm chart. To see every value with its default for a given release:

helm show values oci://oci.tines.com/3b/charts/3b --version <VERSION>

(On the single-server install, don’t set these directly — the installer generates the values from /opt/3b/.env. Use EXTRA_VALUES_FILE there if you need chart settings the .env doesn’t expose.)

Core

Value	Description
`stackName`	Required. Stable unique identifier for this deployment. Do not change after first install.
`license`	The signed 3B license token (`3bl_v1_…`) from Tines. See applying a license.
`externalUrls.ui`	Address users open in the browser. The app hostname.
`externalUrls.api`	Optional. The API is served by path on the app hostname, so it follows `externalUrls.ui` when unset.
`externalUrls.edge`	Address 3B shares externally (webhooks and edge links). Its own hostname.
`externalUrls.zeroSync`	Must match `externalUrls.ui`. Must be `http(s)` — the Zero client upgrades to `wss` internally.
`cookies.domain`	Parent domain shared by the URLs, for sign-in cookies.
`cookies.secure`	`true` with HTTPS; `false` only for plain HTTP.
`imagePullSecrets`	List containing the name of the registry pull secret you created (e.g. `tines-registry`).

You need two hostnames: the app (UI, API, and Zero sync) and edge. You do not need to configure images — the published chart pins every image to the tags for its release.

Rename externalUrls.public to externalUrls.edge in existing values files. The old key remains supported for upgrades; externalUrls.edge takes precedence when both are set. If neither is set, the edge URL is http://localhost:30080.

The legacy publicDomain, stackPublicBaseDomain, and ingress.public values also remain supported. Use edgeDomain, stackEdgeBaseDomain, and ingress.edge for new configuration. New values take precedence, including explicit false or empty values. Keep the new mapping empty or omit a new value to use its legacy counterpart.

Secrets

Value	Default	Description
`secrets.generate`	`true`	When `true`, the chart generates every application secret (`db-credentials`, `auth-secrets`, `worker-secrets`, `api-secrets`, `credential-keys`) on first install and preserves them across upgrades, so `helm upgrade` never rotates a key or the database password. Set `false` only when an external provisioner (like the single-server installer) creates the secrets first — Helm won’t adopt secrets it didn’t create, and an upgrade would abort with an “invalid ownership metadata” error.

Identity

Value	Default	Description
`builtInIdp.enabled`	`true`	The built-in identity provider, so a fresh install is immediately usable without external SSO.

Database and storage

Value	Default	Description
`postgres.enabled`	`true`	Run Postgres in-cluster. Set `false` for an external database (e.g. Aurora) and create `db-credentials` yourself — see the installation guide appendix. External databases need PostgreSQL 18 and `wal_level=logical`.
`postgres.storage.size`	`10Gi`	Size of the Postgres persistent volume.
`postgres.storage.storageClass`	`""`	StorageClass for Postgres (empty = cluster default). Must allow volume expansion.
`blobstore.storage.size`	`50Gi`	Size of the blob storage persistent volume.
`blobstore.storage.storageClass`	`""`	StorageClass for the blobstore (empty = cluster default). Must allow volume expansion. See Blobstore disk.

Networking and TLS

Value	Default	Description
`nginx.enabled`	`true`	The chart’s built-in reverse proxy and front door.
`nginx.nodePort`	`30080`	NodePort for HTTP.
`nginx.hostPort`	`0`	Bind the node’s port directly (e.g. `80`) so an external load balancer lands on nginx without a NodePort hop.
`nginx.tls.enabled`	`false`	Terminate TLS at nginx with the certificate in `nginx.tls.secretName`. See TLS termination.
`nginx.tls.secretName`	`nginx-tls`	Kubernetes TLS secret holding the certificate and key.
`nginx.tls.nodePort`	`30443`	NodePort for HTTPS.
`ingress.enabled`	`false`	Create Ingress resources (for ALB, nginx-ingress, Traefik, etc.) instead of fronting the `nginx` service yourself; see `ingress.className`, `ingress.annotations`, and the per-host `ingress.api` / `ingress.zero` / `ingress.edge` blocks.
`httpProxy.http`, `httpProxy.https`, `httpProxy.noProxy`	`""`	Outbound proxy settings, injected into the application services.
`allowedCidrBlocks`	`""`	Comma-separated CIDR blocks workflow code may reach on internal networks. Bypasses the SSRF guard — see the warning in the environment variable reference.
`edgeDomain.wildcard`	`""`	Enables space-specific edge hosts. Set it to the parent of the `externalUrls.edge` hostname. For `apps.corp.example`, edge URLs and inbound email use `<space>--apps.corp.example`, covered by `*.corp.example`. An existing value is retained as a legacy custom domain.

Nodes and scheduling

Value	Default	Description
`usernsbox.enabled`	`false`	Privileged per-node DaemonSet that raises the user-namespace sysctls gVisor workers need on hardened nodes (e.g. EKS Auto Mode). See the AWS EKS guide.
`usernsbox.nodeSelector`	`{}`	Scope the DaemonSet to a node pool.
`scheduling.worker.nodeSelector`, `scheduling.worker.tolerations`	`{}` / `[]`	Pin the worker to a dedicated node pool.
`serviceAccountName`	`""`	Kubernetes ServiceAccount used by every pod; `api`, `worker`, and `blobstore` accept per-service overrides for cloud workload identities.

Replicas and resources

Each service (api, orchestrator, edge, worker, zero, blobstore) exposes replicas and resources blocks with sensible single-node defaults. Leave them alone for a first install; raise them when scaling out.

blobstore.resources defaults to a request of 2 CPU and 4 GiB of memory, a memory limit of 4 GiB, and no CPU limit. This is the serving Blobstore baseline. Increase it for workloads that need more CPU or memory, and ensure the node has capacity for the requests before upgrading.

Email

Value	Default	Description
`emailFromAddress`	`""`	The “from” address on emails 3B sends.

The SMTP connection string itself lives on the api-secrets secret (smtp-url), not in values — see the installation guide appendix.