feat: add Helm chart for Kubernetes deployment

[pradeepbbl]

Overview

Adds a Helm chart at charts/terminus for deploying Terminus to Kubernetes, wrapping the manifests described in doc/kubernetes.adoc into a single configurable release. Also adds doc/helm.adoc and a Helm CI workflow.

The goal is to simplify Kubernetes deployment :)

Screenshots/Screencasts

$ helm list -n terminus
NAME    	NAMESPACE	REVISION	UPDATED                                 	STATUS  	CHART         	APP VERSION
terminus	terminus 	1       	2026-08-13 14:23:05.166851843 +0200 CEST	deployed	terminus-0.1.0	latest  

$ helm status terminus -n terminus
NAME: terminus
LAST DEPLOYED: Thu Aug 13 14:23:05 2026
NAMESPACE: terminus
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Terminus has been deployed successfully.

Web URL:
  export POD=$(kubectl get pods --namespace terminus -l "app.kubernetes.io/name=terminus,app.kubernetes.io/component=web" -o jsonpath="{.items[0].metadata.name}")
  kubectl --namespace terminus port-forward $POD 2345:2345
  Visit http://127.0.0.1:2345

Components deployed:
  - Deployment terminus-web
      - web    (Puma)
      - worker (Sidekiq sidecar)
  - Deployment terminus-database (bundled PostgreSQL, single instance)
  - Deployment terminus-keyvalue (bundled Valkey, single instance)

Bundled datastores have no replication, backups or failover. Take your own
backups, and prefer managed services for production.
Secrets: stored in Kubernetes Secret
  Name: terminus

Troubleshooting:
  kubectl logs -n terminus deployment/terminus-web -c web
  kubectl logs -n terminus deployment/terminus-web -c worker

$ kubectl get all -n terminus
NAME                                     READY   STATUS    RESTARTS       AGE
pod/terminus-database-7cc8d6cbfb-cn988   1/1     Running   0              161m
pod/terminus-keyvalue-5d57cbff9f-pnc4l   1/1     Running   0              161m
pod/terminus-web-766d9c8db-2h56v         2/2     Running   1 (159m ago)   161m

NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
service/terminus            ClusterIP   10.108.183.188   <none>        2345/TCP   161m
service/terminus-database   ClusterIP   10.109.6.234     <none>        5432/TCP   161m
service/terminus-keyvalue   ClusterIP   10.104.117.252   <none>        6379/TCP   161m

NAME                                READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/terminus-database   1/1     1            1           161m
deployment.apps/terminus-keyvalue   1/1     1            1           161m
deployment.apps/terminus-web        1/1     1            1           161m

NAME                                           DESIRED   CURRENT   READY   AGE
replicaset.apps/terminus-database-7cc8d6cbfb   1         1         1       161m
replicaset.apps/terminus-keyvalue-5d57cbff9f   1         1         1       161m
replicaset.apps/terminus-web-766d9c8db         1         1         1       161m

Details

• Core release — web (Puma) and worker (Sidekiq) as two containers in one
  pod, ClusterIP Service, ReadWriteOnce PVCs for uploads and fonts, optional
  HPA. Recreate strategy, since RWO volumes can't be held by two pods.
• Routing — optional Ingress or Gateway API HTTPRoute, mutually exclusive
  and enforced at template time.
• Secrets — Kubernetes Secret by default, or Vault Agent Injector via
  vault.enabled.
• Migrations — pre-install,pre-upgrade hook Job running hanami db migrate.
• Optional bundled datastores — single-instance PostgreSQL and Valkey behind
  database.enabled / keyvalue.enabled, both off by default, mirroring the
  services in compose.yml.
• CI — ct lint plus a render check on every chart change; tagged pushes
  package and push to oci://ghcr.io/usetrmnl/charts.

[bkuhlmann]

Hey. 👋 Thanks for this but am going to close since this adds a massive ~2,000 lines of new code that would need to be maintained (along with automated testing) to support.

Not saying this isn't out of the question in the future, but for now, use of Kubernetes for this project seems like complete overkill.