Helm values reference | Tines 3B Docs

The most relevant values when installing 3B with the Helm chart. To see every value with its default for a given release:

helm show values oci://oci.tines.com/3b/charts/3b --version <VERSION>

(On the single-server install, don’t set these directly — the installer generates the values from /opt/3b/.env. Use EXTRA_VALUES_FILE there if you need chart settings the .env doesn’t expose.)

Core

Value	Description
`stackName`	Required. Stable unique identifier for this deployment. Do not change after first install.
`license`	The signed 3B license token (`3bl_v1_…`) from Tines. See applying a license.
`externalUrls.ui`	Address users open in the browser.
`externalUrls.api`	Address of the API. May share the UI hostname.
`externalUrls.public`	Address 3B shares externally (webhooks and public links). Its own hostname.
`externalUrls.zeroSync`	Real-time sync address. Must be `http(s)` — the Zero client upgrades to `wss` internally. May share the UI hostname.
`cookies.domain`	Parent domain shared by the URLs, for sign-in cookies.
`cookies.secure`	`true` with HTTPS; `false` only for plain HTTP.
`imagePullSecrets`	List containing the name of the registry pull secret you created (e.g. `tines-registry`).

You do not need to configure images — the published chart pins every image to the tags for its release.

Secrets

Value	Default	Description
`secrets.generate`	`true`	When `true`, the chart generates every application secret (`db-credentials`, `auth-secrets`, `worker-secrets`, `api-secrets`, `credential-keys`) on first install and preserves them across upgrades, so `helm upgrade` never rotates a key or the database password. Set `false` only when an external provisioner (like the single-server installer) creates the secrets first — Helm won’t adopt secrets it didn’t create, and an upgrade would abort with an “invalid ownership metadata” error.

Identity

Value	Default	Description
`builtInIdp.enabled`	`true`	The built-in identity provider, so a fresh install is immediately usable without external SSO.

Database and storage

Value	Default	Description
`postgres.enabled`	`true`	Run Postgres in-cluster. Set `false` for an external database (e.g. Aurora) and create `db-credentials` yourself — see the installation guide appendix. External databases need `wal_level=logical`.
`postgres.storage.size`	`10Gi`	Size of the Postgres persistent volume.
`postgres.storage.storageClass`	`""`	StorageClass for Postgres (empty = cluster default).
`blobstore.storage.size`	`50Gi`	Size of the blob storage persistent volume.
`blobstore.storage.storageClass`	`""`	StorageClass for the blobstore (empty = cluster default).

Networking and TLS

Value	Default	Description
`nginx.enabled`	`true`	The chart’s built-in reverse proxy and front door.
`nginx.nodePort`	`30080`	NodePort for HTTP.
`nginx.hostPort`	`0`	Bind the node’s port directly (e.g. `80`) so an external load balancer lands on nginx without a NodePort hop.
`nginx.tls.enabled`	`false`	Terminate TLS at nginx with the certificate in `nginx.tls.secretName`. See TLS termination.
`nginx.tls.secretName`	`nginx-tls`	Kubernetes TLS secret holding the certificate and key.
`nginx.tls.nodePort`	`30443`	NodePort for HTTPS.
`ingress.enabled`	`false`	Create Ingress resources (for ALB, nginx-ingress, Traefik, etc.) instead of fronting the `nginx` service yourself; see `ingress.className`, `ingress.annotations`, and the per-host `ingress.api` / `ingress.zero` / `ingress.public` blocks.
`httpProxy.http`, `httpProxy.https`, `httpProxy.noProxy`	`""`	Outbound proxy settings, injected into the application services.
`allowedCidrBlocks`	`""`	Comma-separated CIDR blocks workflow code may reach on internal networks. Bypasses the SSRF guard — see the warning in the environment variable reference.
`publicDomain.wildcard`	`""`	Wildcard domain for public-facing pages, if used.

Nodes and scheduling

Value	Default	Description
`usernsbox.enabled`	`false`	Privileged per-node DaemonSet that raises the user-namespace sysctls gVisor workers need on hardened nodes (e.g. EKS Auto Mode). See the AWS EKS guide.
`usernsbox.nodeSelector`	`{}`	Scope the DaemonSet to a node pool.
`scheduling.worker.nodeSelector`, `scheduling.worker.tolerations`	`{}` / `[]`	Pin the worker to a dedicated node pool.
`serviceAccountName`	`""`	Kubernetes ServiceAccount used by every pod; `api`, `worker`, and `blobstore` accept per-service overrides for cloud workload identities.

Replicas and resources

Each service (api, orchestrator, public, worker, zero, blobstore) exposes replicas and resources blocks with sensible single-node defaults. Leave them alone for a first install; raise them when scaling out.

Email

Value	Default	Description
`emailFromAddress`	`""`	The “from” address on emails 3B sends.

The SMTP connection string itself lives on the api-secrets secret (smtp-url), not in values — see the installation guide appendix.