@libredb/studio 0.9.7

package/bunfig.toml

@@ -0,0 +1,3 @@
+[test]
+preload = ["./tests/setup-dom.ts", "./tests/setup.ts", "./tests/helpers/mock-sonner.ts", "./tests/helpers/mock-navigation.ts"]
+root = "tests"

package/charts/libredb-studio/.helmignore

@@ -0,0 +1,11 @@
+.git
+.gitignore
+.github
+.vscode
+.idea
+*.swp
+*.bak
+*.tmp
+*.orig
+.DS_Store
+ci/

package/charts/libredb-studio/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: postgresql
+  repository: https://charts.bitnami.com/bitnami
+  version: 16.7.27
+digest: sha256:e8b999a3aaad6328a13d0c666207650897b69c61367c947d363b2acbe0ea1b42
+generated: "2026-03-13T22:39:25.224637014+03:00"

package/charts/libredb-studio/Chart.yaml

@@ -0,0 +1,50 @@
+apiVersion: v2
+name: libredb-studio
+description: Web-based SQL IDE for cloud-native teams supporting PostgreSQL, MySQL, SQLite, Oracle, SQL Server, MongoDB, and Redis
+type: application
+version: 0.1.0
+appVersion: "0.8.10"
+kubeVersion: ">=1.26.0-0"
+home: https://github.com/libredb/libredb-studio
+icon: https://raw.githubusercontent.com/libredb/libredb-studio/main/public/logo.svg
+sources:
+  - https://github.com/libredb/libredb-studio
+keywords:
+  - sql
+  - ide
+  - database
+  - postgresql
+  - mysql
+  - mongodb
+  - redis
+  - sqlite
+  - oracle
+  - mssql
+  - web-ide
+maintainers:
+  - name: cevheri
+    url: https://github.com/cevheri
+annotations:
+  artifacthub.io/category: database
+  artifacthub.io/license: MIT
+  artifacthub.io/prerelease: "true"
+  artifacthub.io/containsSecurityUpdates: "false"
+  artifacthub.io/images: |
+    - name: libredb-studio
+      image: ghcr.io/libredb/libredb-studio:0.8.10
+      platforms:
+        - linux/amd64
+  artifacthub.io/links: |
+    - name: Documentation
+      url: https://github.com/libredb/libredb-studio#readme
+    - name: Container Image
+      url: https://github.com/libredb/libredb-studio/pkgs/container/libredb-studio
+    - name: Source
+      url: https://github.com/libredb/libredb-studio
+  artifacthub.io/changes: |
+    - Initial Helm chart release
+dependencies:
+  - name: postgresql
+    version: "16.x.x"
+    repository: https://charts.bitnami.com/bitnami
+    condition: postgresql.enabled

package/charts/libredb-studio/README.md

@@ -0,0 +1,206 @@
+# LibreDB Studio Helm Chart
+
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/libredb-studio)](https://artifacthub.io/packages/search?repo=libredb-studio)
+
+Web-based SQL IDE for cloud-native teams supporting PostgreSQL, MySQL, SQLite, Oracle, SQL Server, MongoDB, and Redis.
+
+## Prerequisites
+
+- Kubernetes >= 1.26
+- Helm >= 3.12
+
+## Quick Start
+
+```bash
+# Add the Helm repository
+helm repo add libredb https://libredb.github.io/libredb-studio
+helm repo update
+
+# Install with minimal configuration
+helm install libredb libredb/libredb-studio \
+  --set secrets.jwtSecret=$(openssl rand -base64 32) \
+  --set secrets.adminPassword=MyAdmin123 \
+  --set secrets.userPassword=MyUser123
+
+# Access via port-forward
+kubectl port-forward svc/libredb-libredb-studio 3000:80
+# Open http://localhost:3000
+```
+
+### OCI Registry Install
+
+```bash
+helm install libredb oci://ghcr.io/libredb/charts/libredb-studio \
+  --version 0.1.0 \
+  --set secrets.jwtSecret=$(openssl rand -base64 32) \
+  --set secrets.adminPassword=MyAdmin123 \
+  --set secrets.userPassword=MyUser123
+```
+
+## Storage Modes
+
+### Local (default)
+
+Browser localStorage. No server-side persistence. Suitable for single-user testing.
+
+### SQLite
+
+Persistent file-based storage. A PVC is automatically created.
+
+```bash
+helm install libredb libredb/libredb-studio \
+  --set config.storageProvider=sqlite \
+  --set secrets.jwtSecret=$(openssl rand -base64 32) \
+  --set secrets.adminPassword=MyAdmin123 \
+  --set secrets.userPassword=MyUser123
+```
+
+> **Note:** SQLite is single-writer. Do not use with multiple replicas.
+
+### PostgreSQL (built-in subchart)
+
+Deploys a Bitnami PostgreSQL instance alongside LibreDB Studio.
+
+```bash
+helm install libredb libredb/libredb-studio \
+  --set postgresql.enabled=true \
+  --set postgresql.auth.password=pg-secret \
+  --set secrets.jwtSecret=$(openssl rand -base64 32) \
+  --set secrets.adminPassword=MyAdmin123 \
+  --set secrets.userPassword=MyUser123
+```
+
+Storage provider is automatically set to `postgres` when the subchart is enabled.
+
+### PostgreSQL (external)
+
+```bash
+helm install libredb libredb/libredb-studio \
+  --set config.storageProvider=postgres \
+  --set secrets.storagePostgresUrl="postgresql://user:pass@host:5432/libredb" \
+  --set secrets.jwtSecret=$(openssl rand -base64 32) \
+  --set secrets.adminPassword=MyAdmin123 \
+  --set secrets.userPassword=MyUser123
+```
+
+## OIDC SSO
+
+```bash
+helm install libredb libredb/libredb-studio \
+  --set authProvider=oidc \
+  --set config.oidcIssuer=https://dev-xxx.auth0.com \
+  --set secrets.oidcClientId=your-client-id \
+  --set secrets.oidcClientSecret=your-client-secret \
+  --set secrets.jwtSecret=$(openssl rand -base64 32) \
+  --set secrets.adminPassword=MyAdmin123 \
+  --set secrets.userPassword=MyUser123
+```
+
+## AI Configuration
+
+```bash
+helm install libredb libredb/libredb-studio \
+  --set config.llmProvider=openai \
+  --set config.llmModel=gpt-4o \
+  --set secrets.llmApiKey=sk-your-key \
+  --set secrets.jwtSecret=$(openssl rand -base64 32) \
+  --set secrets.adminPassword=MyAdmin123 \
+  --set secrets.userPassword=MyUser123
+```
+
+## Production Setup (Ingress + HA)
+
+```bash
+helm install libredb libredb/libredb-studio \
+  --set secrets.jwtSecret=$(openssl rand -base64 32) \
+  --set secrets.adminPassword=StrongPass123 \
+  --set secrets.userPassword=StrongPass456 \
+  --set postgresql.enabled=true \
+  --set postgresql.auth.password=pg-secret \
+  --set ingress.enabled=true \
+  --set ingress.className=nginx \
+  --set "ingress.hosts[0].host=libredb.example.com" \
+  --set "ingress.hosts[0].paths[0].path=/" \
+  --set "ingress.hosts[0].paths[0].pathType=Prefix" \
+  --set "ingress.tls[0].secretName=libredb-tls" \
+  --set "ingress.tls[0].hosts[0]=libredb.example.com" \
+  --set autoscaling.enabled=true \
+  --set podDisruptionBudget.enabled=true
+```
+
+### Traefik Ingress
+
+```bash
+helm install libredb libredb/libredb-studio \
+  --set ingress.enabled=true \
+  --set ingress.className=traefik \
+  --set "ingress.annotations.traefik\.ingress\.kubernetes\.io/router\.entrypoints=websecure" \
+  --set "ingress.hosts[0].host=libredb.example.com" \
+  --set "ingress.hosts[0].paths[0].path=/" \
+  --set "ingress.hosts[0].paths[0].pathType=Prefix" \
+  # ... secrets omitted for brevity
+```
+
+## External Secrets
+
+Use `secrets.existingSecret` to reference a secret managed by External Secrets Operator, Sealed Secrets, or Vault:
+
+```bash
+helm install libredb libredb/libredb-studio \
+  --set secrets.existingSecret=my-libredb-secret
+```
+
+Your external secret must contain these keys (customizable via `secrets.existingSecretKeys`):
+- `jwt-secret`
+- `admin-email`, `admin-password`
+- `user-email`, `user-password`
+- Optional: `llm-api-key`, `oidc-client-id`, `oidc-client-secret`, `storage-postgres-url`
+
+## Upgrading
+
+```bash
+helm repo update
+helm upgrade libredb libredb/libredb-studio
+```
+
+## Uninstalling
+
+```bash
+helm uninstall libredb
+```
+
+> **Note:** PVCs are not deleted automatically. To remove persistent data:
+> ```bash
+> kubectl delete pvc -l app.kubernetes.io/instance=libredb
+> ```
+
+## Configuration Reference
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `replicaCount` | Number of replicas | `1` |
+| `image.repository` | Container image | `ghcr.io/libredb/libredb-studio` |
+| `image.tag` | Image tag | `""` (Chart appVersion) |
+| `image.pullPolicy` | Pull policy | `IfNotPresent` |
+| `authProvider` | Auth mode: local or oidc | `local` |
+| `secrets.jwtSecret` | JWT signing secret | `""` |
+| `secrets.adminEmail` | Admin email | `admin@libredb.org` |
+| `secrets.adminPassword` | Admin password | `""` |
+| `secrets.userEmail` | User email | `user@libredb.org` |
+| `secrets.userPassword` | User password | `""` |
+| `secrets.existingSecret` | Use existing Secret | `""` |
+| `config.storageProvider` | Storage: local, sqlite, postgres | `local` |
+| `config.llmProvider` | AI provider | `""` |
+| `persistence.enabled` | Enable PVC | `false` |
+| `persistence.size` | PVC size | `1Gi` |
+| `service.type` | Service type | `ClusterIP` |
+| `service.port` | Service port | `80` |
+| `ingress.enabled` | Enable Ingress | `false` |
+| `autoscaling.enabled` | Enable HPA | `false` |
+| `autoscaling.minReplicas` | Min replicas | `2` |
+| `autoscaling.maxReplicas` | Max replicas | `10` |
+| `podDisruptionBudget.enabled` | Enable PDB | `false` |
+| `networkPolicy.enabled` | Enable NetworkPolicy | `false` |
+| `postgresql.enabled` | Deploy PostgreSQL subchart | `false` |
+
+See [values.yaml](values.yaml) for the complete list of configurable parameters.

package/charts/libredb-studio/templates/NOTES.txt

@@ -0,0 +1,59 @@
+LibreDB Studio has been deployed successfully!
+
+{{- if .Values.ingress.enabled }}
+
+Access LibreDB Studio via Ingress:
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+
+{{- else if contains "NodePort" .Values.service.type }}
+
+Access LibreDB Studio via NodePort:
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "libredb-studio.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo "http://${NODE_IP}:${NODE_PORT}"
+
+{{- else if contains "LoadBalancer" .Values.service.type }}
+
+Access LibreDB Studio via LoadBalancer:
+  NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+  Watch status with: kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "libredb-studio.fullname" . }}
+
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "libredb-studio.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo "http://${SERVICE_IP}:{{ .Values.service.port }}"
+
+{{- else }}
+
+Access LibreDB Studio via port-forward:
+  kubectl --namespace {{ .Release.Namespace }} port-forward svc/{{ include "libredb-studio.fullname" . }} {{ .Values.service.targetPort }}:{{ .Values.service.port }}
+  Open http://localhost:{{ .Values.service.targetPort }}
+
+{{- end }}
+
+Configuration:
+  Auth Provider:    {{ .Values.authProvider }}
+  Storage Provider: {{ include "libredb-studio.storageProvider" . }}
+{{- if .Values.postgresql.enabled }}
+  PostgreSQL:       Built-in (subchart)
+{{- end }}
+{{- if .Values.autoscaling.enabled }}
+  Autoscaling:      {{ .Values.autoscaling.minReplicas }}-{{ .Values.autoscaling.maxReplicas }} replicas
+{{- end }}
+
+Health check:
+  kubectl --namespace {{ .Release.Namespace }} exec deploy/{{ include "libredb-studio.fullname" . }} -- wget -qO- http://localhost:{{ .Values.service.targetPort }}/api/db/health
+
+{{- if and (not .Values.secrets.jwtSecret) (not .Values.secrets.existingSecret) }}
+
+WARNING: No JWT secret was provided. Please set secrets.jwtSecret to a strong random value (min 32 chars):
+  helm upgrade {{ .Release.Name }} libredb/libredb-studio --set secrets.jwtSecret=$(openssl rand -base64 32)
+{{- end }}
+
+{{- if and (eq (include "libredb-studio.storageProvider" .) "sqlite") (gt (int .Values.replicaCount) 1) }}
+
+WARNING: SQLite storage with multiple replicas is not recommended.
+SQLite is a single-writer database. Consider using storageProvider=postgres for multi-replica setups.
+{{- end }}

package/charts/libredb-studio/templates/_helpers.tpl

@@ -0,0 +1,135 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "libredb-studio.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "libredb-studio.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "libredb-studio.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "libredb-studio.labels" -}}
+helm.sh/chart: {{ include "libredb-studio.chart" . }}
+{{ include "libredb-studio.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "libredb-studio.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "libredb-studio.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "libredb-studio.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "libredb-studio.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return the secret name (existing or generated)
+*/}}
+{{- define "libredb-studio.secretName" -}}
+{{- if .Values.secrets.existingSecret }}
+{{- .Values.secrets.existingSecret }}
+{{- else }}
+{{- include "libredb-studio.fullname" . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return the configmap name
+*/}}
+{{- define "libredb-studio.configMapName" -}}
+{{- printf "%s-config" (include "libredb-studio.fullname" .) }}
+{{- end }}
+
+{{/*
+Return the PVC name (existing or generated)
+*/}}
+{{- define "libredb-studio.pvcName" -}}
+{{- if .Values.persistence.existingClaim }}
+{{- .Values.persistence.existingClaim }}
+{{- else }}
+{{- printf "%s-data" (include "libredb-studio.fullname" .) }}
+{{- end }}
+{{- end }}
+
+{{/*
+Determine if persistence should be enabled.
+Returns "true" if persistence.enabled OR storageProvider is sqlite.
+*/}}
+{{- define "libredb-studio.persistenceEnabled" -}}
+{{- if or .Values.persistence.enabled (eq .Values.config.storageProvider "sqlite") }}
+{{- true }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return the effective storage provider.
+If postgresql subchart is enabled and storageProvider is "local", auto-switch to "postgres".
+*/}}
+{{- define "libredb-studio.storageProvider" -}}
+{{- if and .Values.postgresql.enabled (eq .Values.config.storageProvider "local") }}
+{{- "postgres" }}
+{{- else }}
+{{- .Values.config.storageProvider }}
+{{- end }}
+{{- end }}
+
+{{/*
+Return the full image reference (repository:tag)
+*/}}
+{{- define "libredb-studio.image" -}}
+{{- $tag := default .Chart.AppVersion .Values.image.tag }}
+{{- printf "%s:%s" .Values.image.repository $tag }}
+{{- end }}
+
+{{/*
+Return the PostgreSQL subchart fullname.
+Bitnami subchart names resources as: <release>-postgresql (not <release>-<chart>-postgresql).
+*/}}
+{{- define "libredb-studio.postgresql.fullname" -}}
+{{- printf "%s-postgresql" .Release.Name }}
+{{- end }}
+
+{{/*
+Return the PostgreSQL URL when subchart is enabled
+*/}}
+{{- define "libredb-studio.postgresql.url" -}}
+{{- printf "postgresql://%s:$(POSTGRES_PASSWORD)@%s:5432/%s" .Values.postgresql.auth.username (include "libredb-studio.postgresql.fullname" .) .Values.postgresql.auth.database }}
+{{- end }}

package/charts/libredb-studio/templates/configmap.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "libredb-studio.configMapName" . }}
+  labels:
+    {{- include "libredb-studio.labels" . | nindent 4 }}
+data:
+  NODE_ENV: "production"
+  PORT: {{ .Values.service.targetPort | quote }}
+  HOSTNAME: "0.0.0.0"
+  NEXT_TELEMETRY_DISABLED: "1"
+  NODE_OPTIONS: "--max-old-space-size=384"
+  NEXT_PUBLIC_AUTH_PROVIDER: {{ .Values.authProvider | quote }}
+  LOG_LEVEL: {{ .Values.config.logLevel | quote }}
+  STORAGE_PROVIDER: {{ include "libredb-studio.storageProvider" . | quote }}
+  {{- if eq (include "libredb-studio.storageProvider" .) "sqlite" }}
+  STORAGE_SQLITE_PATH: {{ .Values.config.storageSqlitePath | quote }}
+  {{- end }}
+  {{- if .Values.config.llmProvider }}
+  LLM_PROVIDER: {{ .Values.config.llmProvider | quote }}
+  {{- end }}
+  {{- if .Values.config.llmModel }}
+  LLM_MODEL: {{ .Values.config.llmModel | quote }}
+  {{- end }}
+  {{- if .Values.config.llmApiUrl }}
+  LLM_API_URL: {{ .Values.config.llmApiUrl | quote }}
+  {{- end }}
+  {{- if eq .Values.authProvider "oidc" }}
+  {{- if .Values.config.oidcIssuer }}
+  OIDC_ISSUER: {{ .Values.config.oidcIssuer | quote }}
+  {{- end }}
+  OIDC_SCOPE: {{ .Values.config.oidcScope | quote }}
+  {{- if .Values.config.oidcRoleClaim }}
+  OIDC_ROLE_CLAIM: {{ .Values.config.oidcRoleClaim | quote }}
+  {{- end }}
+  OIDC_ADMIN_ROLES: {{ .Values.config.oidcAdminRoles | quote }}
+  {{- end }}

package/charts/libredb-studio/templates/deployment.yaml

@@ -0,0 +1,184 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "libredb-studio.fullname" . }}
+  labels:
+    {{- include "libredb-studio.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "libredb-studio.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "libredb-studio.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "libredb-studio.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: {{ include "libredb-studio.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.targetPort }}
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: {{ include "libredb-studio.configMapName" . }}
+            {{- with .Values.extraEnvFrom }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          env:
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.jwtSecret }}
+            - name: ADMIN_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.adminEmail }}
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.adminPassword }}
+            - name: USER_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.userEmail }}
+            - name: USER_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.userPassword }}
+            {{- if or .Values.secrets.llmApiKey .Values.secrets.existingSecret }}
+            - name: LLM_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.llmApiKey }}
+                  optional: true
+            {{- end }}
+            {{- if or .Values.secrets.oidcClientId .Values.secrets.existingSecret }}
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.oidcClientId }}
+                  optional: true
+            {{- end }}
+            {{- if or .Values.secrets.oidcClientSecret .Values.secrets.existingSecret }}
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.oidcClientSecret }}
+                  optional: true
+            {{- end }}
+            {{- if .Values.postgresql.enabled }}
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.postgresql.fullname" . }}
+                  key: password
+            - name: STORAGE_POSTGRES_URL
+              value: {{ include "libredb-studio.postgresql.url" . | quote }}
+            {{- else if or .Values.secrets.storagePostgresUrl .Values.secrets.existingSecret }}
+            - name: STORAGE_POSTGRES_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "libredb-studio.secretName" . }}
+                  key: {{ .Values.secrets.existingSecretKeys.storagePostgresUrl }}
+                  optional: true
+            {{- end }}
+            {{- if .Values.seedConnections.enabled }}
+            - name: SEED_CONFIG_PATH
+              value: "/app/config/{{ .Values.seedConnections.configMapKey | default "seed-connections.yaml" }}"
+            - name: SEED_CACHE_TTL_MS
+              value: {{ .Values.seedConnections.cacheTTL | default 60000 | quote }}
+            {{- end }}
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- with .Values.startupProbe }}
+          startupProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: next-cache
+              mountPath: /app/.next/cache
+            - name: tmp
+              mountPath: /tmp
+            {{- if include "libredb-studio.persistenceEnabled" . }}
+            - name: data
+              mountPath: /app/data
+            {{- end }}
+            {{- if .Values.seedConnections.enabled }}
+            - name: seed-config
+              mountPath: /app/config
+              readOnly: true
+            {{- end }}
+      volumes:
+        - name: next-cache
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+        {{- if include "libredb-studio.persistenceEnabled" . }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "libredb-studio.pvcName" . }}
+        {{- end }}
+        {{- if .Values.seedConnections.enabled }}
+        - name: seed-config
+          configMap:
+            name: {{ .Values.seedConnections.existingConfigMap | default (printf "%s-seed-connections" (include "libredb-studio.fullname" .)) }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}