@voltro/cli 0.1.0

package/templates/baselines/helm/charts/voltro-app/templates/deployment-api.yaml

@@ -0,0 +1,120 @@
+{{- if .Values.api.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "voltro-app.fullname" . }}-api
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+    app.kubernetes.io/component: api
+spec:
+  replicas: {{ .Values.api.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: api
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: api
+    spec:
+      serviceAccountName: {{ include "voltro-app.serviceAccountName" . }}
+      containers:
+        - name: api
+          image: "{{ if .Values.global.imageRegistry }}{{ .Values.global.imageRegistry }}/{{ end }}{{ .Values.api.image.repository }}:{{ .Values.api.image.tag }}"
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.api.port }}
+          env:
+            # ── Per-pod identity (K8s downward API) ──────────────────
+            # POD_NAME → a unique CDC binlog `server_id` per replica (the
+            # app derives it via FNV-1a; duplicate server_ids silently
+            # break binlog streams). POD_IP → the routable workflow-runner
+            # host so a workflow can resume on another pod after a
+            # reschedule (the runner defaults to localhost = unreachable
+            # cross-pod). Both are MANDATORY at api.replicaCount > 1.
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: VOLTRO_WORKFLOW_RUNNER_HOST
+              value: "$(POD_IP)"
+            {{- if eq .Values.db.dialect "mariadb" }}
+            # ── MariaDB (binlog CDC) ─────────────────────────────────
+            - name: DB_DIALECT
+              value: "mariadb"
+            - name: CDC
+              value: {{ .Values.db.mariadb.cdc | quote }}
+            - name: DB_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ required "db.mariadb.urlSecretName is required when db.dialect=mariadb" .Values.db.mariadb.urlSecretName }}
+                  key: url
+            {{- else }}
+            # ── Postgres ─────────────────────────────────────────────
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-postgres" (include "voltro-app.fullname" .)) .Values.postgres.passwordSecretName }}
+                  key: POSTGRES_PASSWORD
+            - name: DB_URL
+              {{- if .Values.postgres.embedded }}
+              value: "postgres://{{ .Values.postgres.user }}:$(POSTGRES_PASSWORD)@{{ include "voltro-app.fullname" . }}-postgres:5432/{{ .Values.postgres.database }}"
+              {{- else }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.postgres.passwordSecretName }}
+                  key: url
+              {{- end }}
+            {{- end }}
+            - name: VOLTRO_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "voltro-app.fullname" . }}-session
+                  key: VOLTRO_SESSION_SECRET
+            {{- if .Values.storage.enabled }}
+            # ── Object storage (S3 / MinIO) ──────────────────────────
+            - name: STORAGE_PROVIDER
+              value: {{ .Values.storage.provider | quote }}
+            - name: S3_ENDPOINT
+              value: {{ .Values.storage.endpoint | quote }}
+            - name: S3_BUCKET
+              value: {{ .Values.storage.bucket | quote }}
+            - name: S3_FORCE_PATH_STYLE
+              value: {{ .Values.storage.forcePathStyle | quote }}
+            - name: S3_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ required "storage.credentialsSecretName is required when storage.enabled" .Values.storage.credentialsSecretName }}
+                  key: accessKeyId
+            - name: S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.storage.credentialsSecretName }}
+                  key: secretAccessKey
+            {{- end }}
+          envFrom:
+            - configMapRef:
+                name: {{ include "voltro-app.fullname" . }}-config
+          resources:
+            {{- toYaml .Values.api.resources | nindent 12 }}
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 20
+{{- end }}

package/templates/baselines/helm/charts/voltro-app/templates/deployment-web.yaml

@@ -0,0 +1,45 @@
+{{- if .Values.web.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "voltro-app.fullname" . }}-web
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+    app.kubernetes.io/component: web
+spec:
+  replicas: {{ .Values.web.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: web
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: web
+    spec:
+      serviceAccountName: {{ include "voltro-app.serviceAccountName" . }}
+      containers:
+        - name: web
+          image: "{{ if .Values.global.imageRegistry }}{{ .Values.global.imageRegistry }}/{{ end }}{{ .Values.web.image.repository }}:{{ .Values.web.image.tag }}"
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.web.port }}
+          resources:
+            {{- toYaml .Values.web.resources | nindent 12 }}
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 20
+{{- end }}

package/templates/baselines/helm/charts/voltro-app/templates/ingress.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "voltro-app.fullname" . }}
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "voltro-app.fullname" $ }}-{{ .service }}
+                port:
+                  number: {{ if eq .service "api" }}{{ $.Values.api.port }}{{ else }}{{ $.Values.web.port }}{{ end }}
+          {{- end }}
+    {{- end }}
+{{- end }}

package/templates/baselines/helm/charts/voltro-app/templates/postgres-service.yaml

@@ -0,0 +1,19 @@
+{{- if and (eq .Values.db.dialect "postgres") .Values.postgres.embedded -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "voltro-app.fullname" . }}-postgres
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  type: ClusterIP
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
+  selector:
+    app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: postgres
+{{- end }}

package/templates/baselines/helm/charts/voltro-app/templates/postgres-statefulset.yaml

@@ -0,0 +1,73 @@
+{{- if and (eq .Values.db.dialect "postgres") .Values.postgres.embedded -}}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "voltro-app.fullname" . }}-postgres
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+    app.kubernetes.io/component: postgres
+spec:
+  serviceName: {{ include "voltro-app.fullname" . }}-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/component: postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/component: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: "{{ .Values.postgres.image.repository }}:{{ .Values.postgres.image.tag }}"
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          ports:
+            - name: postgres
+              containerPort: 5432
+          args:
+            - "postgres"
+            - "-c"
+            - "wal_level=logical"
+            - "-c"
+            - "max_wal_senders=4"
+            - "-c"
+            - "max_replication_slots=4"
+          env:
+            - name: POSTGRES_USER
+              value: {{ .Values.postgres.user | quote }}
+            - name: POSTGRES_DB
+              value: {{ .Values.postgres.database | quote }}
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ default (printf "%s-postgres" (include "voltro-app.fullname" .)) .Values.postgres.passwordSecretName }}
+                  key: POSTGRES_PASSWORD
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "{{ .Values.postgres.user }}", "-d", "{{ .Values.postgres.database }}"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          livenessProbe:
+            exec:
+              command: ["pg_isready", "-U", "{{ .Values.postgres.user }}", "-d", "{{ .Values.postgres.database }}"]
+            initialDelaySeconds: 30
+            periodSeconds: 10
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        {{- if .Values.postgres.storageClassName }}
+        storageClassName: {{ .Values.postgres.storageClassName }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.postgres.storageSize }}
+{{- end }}

package/templates/baselines/helm/charts/voltro-app/templates/secret.yaml

@@ -0,0 +1,33 @@
+{{/*
+EXAMPLE Secret. In real deploys, manage the session secret and the
+Postgres credentials via a secret store (Sealed Secrets, External
+Secrets Operator, SOPS+helm-secrets). NEVER commit real secrets.
+
+This Secret is created only when sessionSecret is set inline (dev/staging
+convenience). In prod, set passwordSecretName / sessionSecret via a
+pre-existing Secret you reference; values-prod.yaml leaves sessionSecret
+empty so this resource skips itself.
+*/}}
+{{- if .Values.sessionSecret -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "voltro-app.fullname" . }}-session
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  VOLTRO_SESSION_SECRET: {{ .Values.sessionSecret | quote }}
+{{- end }}
+---
+{{- if and .Values.postgres.embedded (not .Values.postgres.passwordSecretName) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "voltro-app.fullname" . }}-postgres
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  POSTGRES_PASSWORD: {{ default "change-me-in-dev" .Values.postgres.password | quote }}
+{{- end }}

package/templates/baselines/helm/charts/voltro-app/templates/service-api.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.api.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "voltro-app.fullname" . }}-api
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+    app.kubernetes.io/component: api
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: {{ .Values.api.port }}
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: api
+{{- end }}

package/templates/baselines/helm/charts/voltro-app/templates/service-web.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.web.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "voltro-app.fullname" . }}-web
+  labels:
+    {{- include "voltro-app.labels" . | nindent 4 }}
+    app.kubernetes.io/component: web
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: {{ .Values.web.port }}
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: {{ include "voltro-app.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: web
+{{- end }}

package/templates/baselines/helm/charts/voltro-app/values-dev.yaml

@@ -0,0 +1,21 @@
+# Dev cluster overrides for {{projectName}}.
+# Use: pnpm helm:install:dev (which adds -f charts/voltro-app/values-dev.yaml).
+
+api:
+  replicaCount: 1
+  resources:
+    requests: { cpu: 50m, memory: 128Mi }
+    limits:   { cpu: 250m, memory: 256Mi }
+
+web:
+  replicaCount: 1
+  resources:
+    requests: { cpu: 50m, memory: 128Mi }
+    limits:   { cpu: 250m, memory: 256Mi }
+
+postgres:
+  embedded: true
+  storageSize: 1Gi
+
+ingress:
+  enabled: false   # use port-forward in dev clusters

package/templates/baselines/helm/charts/voltro-app/values-prod.yaml

@@ -0,0 +1,58 @@
+# Production overrides for {{projectName}}.
+# REVIEW EVERY VALUE before applying to prod — defaults are conservative
+# but every cluster is different.
+
+api:
+  replicaCount: 4   # CDC fan-out + cluster workflows scale horizontally
+  resources:
+    requests: { cpu: 250m, memory: 512Mi }
+    limits:   { cpu: 1000m, memory: 1Gi }
+
+web:
+  replicaCount: 3
+  resources:
+    requests: { cpu: 250m, memory: 512Mi }
+    limits:   { cpu: 1000m, memory: 1Gi }
+
+# ── Database: MariaDB (the company cluster, externally managed) ──────────
+# The MariaDB server MUST run binlog_format=ROW + binlog_row_image=FULL and
+# the DB user MUST hold REPLICATION SLAVE, REPLICATION CLIENT — the binlog
+# reader tails the log for cross-replica real-time. Per-pod POD_NAME/POD_IP
+# (→ unique CDC server_id + routable workflow-runner host) is injected
+# automatically by deployment-api.yaml at replicaCount > 1.
+db:
+  dialect: mariadb
+  mariadb:
+    urlSecretName: {{projectName}}-mariadb   # Secret, key 'url' = mysql://…
+    cdc: "1"
+
+# Embedded Postgres is off under db.dialect=mariadb (kept for the postgres
+# path). NEVER run an embedded DB in prod for a real load.
+postgres:
+  embedded: false
+
+# ── Object storage ──────────────────────────────────────────────────────
+storage:
+  enabled: true
+  provider: s3                                # or 'minio' for in-cluster MinIO
+  bucket: {{projectNameSnake}}
+  # endpoint: https://s3.eu-central-1.amazonaws.com   # for non-AWS / MinIO
+  credentialsSecretName: {{projectName}}-s3   # Secret: accessKeyId + secretAccessKey
+
+# Set via a real secret — see templates/secret.yaml comment.
+sessionSecret: ""   # MUST come from a Secret
+
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: {{projectName}}.example.com
+      paths:
+        - path: /api
+          service: api
+        - path: /
+          service: web
+  tls:
+    - secretName: {{projectName}}-prod-tls
+      hosts:
+        - {{projectName}}.example.com

package/templates/baselines/helm/charts/voltro-app/values-staging.yaml

@@ -0,0 +1,25 @@
+# Staging overrides for {{projectName}}.
+
+api:
+  replicaCount: 2
+
+web:
+  replicaCount: 2
+
+postgres:
+  embedded: true
+  storageSize: 10Gi
+
+ingress:
+  enabled: true
+  hosts:
+    - host: staging.{{projectName}}.example.com
+      paths:
+        - path: /api
+          service: api
+        - path: /
+          service: web
+  tls:
+    - secretName: {{projectName}}-staging-tls
+      hosts:
+        - staging.{{projectName}}.example.com

package/templates/baselines/helm/charts/voltro-app/values.yaml

@@ -0,0 +1,109 @@
+# Default values for the {{projectName}} chart.
+# Override these per-env in values-dev.yaml / values-staging.yaml / values-prod.yaml.
+
+global:
+  imagePullPolicy: IfNotPresent
+  imageRegistry: ""     # e.g. ghcr.io/your-org — empty means use local image
+
+# ---------- API service ----------
+api:
+  enabled: true
+  image:
+    repository: {{projectName}}-api
+    tag: latest
+  replicaCount: 1
+  port: 4000
+  resources:
+    requests: { cpu: 100m, memory: 256Mi }
+    limits:   { cpu: 500m, memory: 512Mi }
+  env: {}
+  # env:
+  #   LOG_LEVEL: info
+
+# ---------- Web service ----------
+web:
+  enabled: true
+  image:
+    repository: {{projectName}}-web
+    tag: latest
+  replicaCount: 1
+  port: 5173
+  resources:
+    requests: { cpu: 100m, memory: 256Mi }
+    limits:   { cpu: 500m, memory: 512Mi }
+
+# ---------- Database dialect switch ----------
+# 'postgres' uses the postgres block below (embedded StatefulSet or
+# external). 'mariadb' uses an EXTERNALLY-managed MariaDB (the company
+# cluster) reached via a Secret holding the connection url — no embedded
+# DB is shipped to prod. MariaDB turns on binlog CDC; it REQUIRES
+# binlog_format=ROW + binlog_row_image=FULL + a replication grant on the
+# server, and api.replicaCount > 1 needs the per-pod POD_NAME/POD_IP
+# downward-API injection (wired in deployment-api.yaml).
+db:
+  dialect: postgres   # postgres | mariadb
+  mariadb:
+    # Secret with key `url` = mysql://user:pass@host:3306/dbname.
+    # The DB user must hold REPLICATION SLAVE, REPLICATION CLIENT.
+    urlSecretName: ""
+    cdc: "1"
+
+# ---------- Postgres (used when db.dialect=postgres) ----------
+postgres:
+  # Embedded = StatefulSet inside the cluster (fine for dev, not for prod).
+  # Set false to point at an externally-managed Postgres.
+  embedded: true
+
+  # Used when embedded: true.
+  image:
+    repository: postgres
+    tag: 17-alpine
+  storageSize: 5Gi
+  storageClassName: ""
+
+  # Connection details (used by api as DB_URL).
+  user: app
+  database: {{projectNameSnake}}
+  # passwordSecretName: existing-secret    # use an existing Secret in prod
+
+  # Used when embedded: false. Point at your managed Postgres URL.
+  externalUrl: ""
+
+# ---------- Object storage (S3 / MinIO) ----------
+# Blobs (avatars, AI-analysis artifacts) live in object storage; the DB
+# holds only refs (_voltro_storage_refs). Disabled by default; enable +
+# point at S3 or an in-cluster MinIO.
+storage:
+  enabled: false
+  provider: s3            # s3 | minio | filesystem
+  endpoint: ""            # required for minio / non-AWS S3
+  bucket: {{projectNameSnake}}
+  forcePathStyle: "0"     # "1" for MinIO / path-style endpoints
+  # Secret with keys `accessKeyId` + `secretAccessKey`.
+  credentialsSecretName: ""
+
+# ---------- Session signing secret ----------
+# Set via Secret in prod (see templates/secret.yaml).
+sessionSecret: "change-me-in-prod"
+
+# ---------- Ingress ----------
+ingress:
+  enabled: false
+  className: nginx
+  hosts:
+    - host: {{projectName}}.example.com
+      paths:
+        - path: /api
+          service: api
+        - path: /
+          service: web
+  tls: []
+  # tls:
+  #   - secretName: {{projectName}}-tls
+  #     hosts:
+  #       - {{projectName}}.example.com
+
+# ---------- Service account ----------
+serviceAccount:
+  create: true
+  name: ""

package/templates/baselines/helm/deploy/README.md

@@ -0,0 +1,94 @@
+# Deploy notes — helm baseline
+
+This baseline ships a Helm chart at `charts/voltro-app/` with
+per-env overlays. Deploy is `helm upgrade --install` against the
+right cluster + values file.
+
+## Pre-deploy checklist
+
+- [ ] Container images built + pushed to your registry
+- [ ] kubeconfig points at the right cluster
+- [ ] Namespace exists OR `--create-namespace` is in the command
+- [ ] Secrets in place (sealed-secrets / external-secrets / SOPS)
+- [ ] Ingress controller installed (nginx / Traefik / istio)
+- [ ] cert-manager installed if using `tls:` in values
+- [ ] (Prod only) Managed Postgres ready; `postgres.externalUrl` set
+
+## Pushing images
+
+The chart references images by `repository:tag`. Build + push from
+the project root:
+
+```sh
+docker build -f docker/api.Dockerfile -t ghcr.io/you/{{projectName}}-api:0.1.0 .
+docker build -f docker/web.Dockerfile -t ghcr.io/you/{{projectName}}-web:0.1.0 .
+docker push ghcr.io/you/{{projectName}}-api:0.1.0
+docker push ghcr.io/you/{{projectName}}-web:0.1.0
+```
+
+Then set the registry in values:
+
+```yaml
+global:
+  imageRegistry: ghcr.io/you
+api:
+  image: { tag: "0.1.0" }
+web:
+  image: { tag: "0.1.0" }
+```
+
+Note: the Dockerfiles ship as part of the `compose` baseline. If
+you switched away from compose and need them back without enabling
+the full docker-compose pipeline, run `voltro baseline set compose`
+once, copy the `docker/` dir, then `voltro baseline set helm` to
+restore the helm baseline.
+
+## Per-env install
+
+```sh
+# Dev cluster (kind / minikube / k3d)
+pnpm helm:install:dev
+
+# Staging
+pnpm helm:install:staging
+
+# Production
+pnpm helm:install:prod
+```
+
+Each wraps `helm upgrade --install ... -f charts/voltro-app/values-<env>.yaml`.
+
+## GitOps
+
+The CLI helpers above are fine for prototyping. For prod, hand the
+chart to ArgoCD / Flux:
+
+```yaml
+# argocd Application
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{projectName}}-prod
+spec:
+  source:
+    repoURL: https://github.com/you/{{projectName}}
+    path: charts/voltro-app
+    helm:
+      valueFiles: [values.yaml, values-prod.yaml]
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: {{projectName}}-prod
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+```
+
+## Rollback
+
+```sh
+helm rollback {{projectName}}-prod --namespace {{projectName}}-prod
+```
+
+GitOps does the same automatically when you revert the values
+commit. Prefer that path in prod.