#Configuration and upgrades

#URLs and hostnames

#Database

On Helm, the chart constructs both URLs in templates/secrets.yaml using the PostgreSQL Service name. DATABASE_URL routes to the PgBouncer Service; DATABASE_DIRECT_URL routes to the PostgreSQL Service directly.

On Docker Compose, DATABASE_URL points to pgbouncer and DATABASE_DIRECT_URL points to the db service.

#Authentication

Helm sets config.authEnabled: "true" by default. Authentication also requires logto.publicUrl to be a browser-reachable Logto origin and a frontend image built with the matching VITE_* values. OIDC redirects happen in the browser, so an in-cluster Logto endpoint does not work.

Docker Compose sets VITE_AUTH_ENABLED: false for the frontend by default. To enable authentication in Compose, set AUTH_ENABLED=true in .env and rebuild the frontend image.

#Models

Model values must be provider-qualified (<provider>/<model>) so the AI gateway routes the request. A bare model name causes the gateway to return "could not auto resolve a provider for the request".

#Sandbox

#Storage and external S3

SeaweedFS runs in-chart by default. To replace it with AWS S3, set seaweedfs.enabled: false alongside:

#Email

In Docker Compose, Mailpit catches all outbound SMTP on port 1025 regardless of these settings. No real email is sent in development.

#Upgrading

#1. Update the image tag

On Helm, set the new tag at upgrade time:

helm upgrade sdlc-platform deploy/helm \
  -n sdlc-platform \
  -f deploy/helm/values-production.yaml \
  --set global.imageTag=<new-tag>

On Compose, update the image tag in .env (or your build pipeline) and run docker compose pull && docker compose up -d.

#2. Database migrations

On Kubernetes the db-migrate Job runs automatically as a post-upgrade hook; no manual step is needed. It runs alembic upgrade head with the new backend image and waits up to 600 seconds.

On Compose, the backend container runs alembic upgrade head on startup.

#3. Restart workers after task or prompt-template changes

Celery workers do not hot-reload code. After any change to backend tasks, skills, or persona files, restart the affected workers:

# Compose
docker compose restart workflow-worker generation-worker rag-worker

# Kubernetes
kubectl -n sdlc-platform rollout restart deployment \
  sdlc-platform-workflow-worker \
  sdlc-platform-generation-worker \
  sdlc-platform-rag-worker

#4. Reload marketplace prompts

Prompt templates hot-reload without a worker restart. After updating a pack, POST to the marketplace reload endpoint with the auto-generated reload secret:

curl -X POST http://localhost:8100/api/reload \
  -H "X-Reload-Secret: <MARKETPLACE_RELOAD_SECRET>"

The MARKETPLACE_RELOAD_SECRET value is in the <release>-secrets Kubernetes Secret, or in .env on Compose.

#5. Rebuild sandbox images after harness changes

After changes to harness/ (the omp-bridge adapter, bundled CLI, or a plugin), rebuild and push the sandbox images:

# Compose
devenv docker-build

# Kubernetes: rebuild and push to your registry, then update the tag in values
docker build -t "$REGISTRY/sandbox:$TAG" -f backend/Dockerfile.sandbox .
docker push "$REGISTRY/sandbox:$TAG"

#6. Preserve Vault state through upgrades

Preserve the Vault PVC and the <release>-vault-unseal-keys bootstrap Secret together through every upgrade. Deleting the PVC to work around a recovery error destroys the unseal material and locks Vault permanently. If the bootstrap Secret is lost, restore it from a secured backup before rerunning the bootstrap Job.

#Next steps

• AI providers and models
• Settings overview
• Deployment overview