update Bitnami Postgres subchart

.github/workflows/lint_charts.yml

@@ -0,0 +1,47 @@
+name: Lint Helm Charts
+
+on:
+  pull_request:
+    paths:
+      - 'charts/**'
+
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    runs-on: [self-hosted, Linux, X64]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+
+      - name: Lint Helm charts
+        run: |
+          for chart in charts/*/; do
+            if [ -f "$chart/Chart.yaml" ]; then
+              echo "Validating $chart"
+              helm lint "$chart"
+              helm template "$chart" --debug
+            fi
+          done
+
+      - name: Setup kubeconform
+        uses: alexellis/arkade-get@master
+        with:
+          kubeconform: latest
+
+      - name: Validate Kubernetes manifests
+        run: |
+          for chart in charts/*/; do
+            if [ -f "$chart/Chart.yaml" ]; then
+              echo "Validating Kubernetes manifests for $chart"
+              helm template "$chart" | kubeconform -strict -ignore-missing-schemas
+            fi
+          done

.github/workflows/release.yml

@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -21,9 +21,7 @@ jobs:
           git config user.email "[email protected]"
 
       - name: Install Helm
-        uses: azure/setup-helm@v3
-        with:
-          version: v3.14.0
+        uses: azure/setup-helm@v4
 
       # https://github.com/helm/chart-releaser-action/issues/74
       - name: Add repositories

.gitignore

@@ -5,3 +5,5 @@ terraform/**/terraform.tfstate
 terraform/**/terraform.tfstate.backup
 terraform/**/.*
 terraform/**/*.tfvars
+.direnv/
+.envrc

charts/defguard/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: postgresql
   repository: https://charts.bitnami.com/bitnami
-  version: 12.12.10
+  version: 18.0.8
 - name: defguard-proxy
   repository: https://defguard.github.io/deployment
   version: 0.7.1
 - name: defguard-gateway
   repository: https://defguard.github.io/deployment
   version: 0.4.1
-digest: sha256:7bb441a6a7ccae95df1f9647054809361a3d76b27a49633f3b6407b297780fc2
-generated: "2025-10-02T13:49:57.788416548+02:00"
+digest: sha256:f36d1a1caf0c7cc8305a9e50501e507b1bab8adeac8770b7873ea8359f6a35f6
+generated: "2025-10-09T12:08:15.737758702+02:00"

charts/defguard/Chart.yaml

@@ -3,13 +3,13 @@ name: defguard
 description: Defguard is an open-source enterprise WireGuard VPN with MFA and SSO
 
 type: application
-version: 0.12.4
-appVersion: 1.5.1
+version: 0.13.0
+appVersion: 1.5.2
 
 dependencies:
   - name: postgresql
     condition: postgresql.enabled
-    version: 12.12.10
+    version: 18.0.8
     repository: https://charts.bitnami.com/bitnami
   - name: defguard-proxy
     condition: defguard-proxy.enabled

charts/defguard/README.md

@@ -0,0 +1,20 @@
+ <p align="center">
+    <img src="docs/header.png" alt="defguard">
+ </p>
+
+# Defguard Helm chart
+
+This Helm chart can be used to deploy the whole [Defguard](https://defguard.net/) stack:
+
+- Defguard Core service
+- Postgres database
+- Defguard Gateway service 
+- public Defguard Proxy service
+
+Check our [documentation](https://docs.defguard.net/deployment-strategies/kubernetes) for deployment
+instructions.
+
+## ⚠️ Important: Postgres image tags 
+
+Due to changes in Bitnami policy the Postgres subchart now uses the `latest` tag by default.
+Remember to set a specific tag in your `values.yaml` to avoid issues with major version upgrades in production environments.

charts/defguard/values.yaml

@@ -93,6 +93,9 @@ postgresql:
     existingSecret: postgres-password
     existingSecretPasswordKey: "" # set if using external postgresql ~ enabled: false
     username: defguard
+  image:
+    repository: bitnami/postgresql
+    tag: latest # IMPORTANT: set to a specific tag to avoid issues with major version upgrades
 
 #
 # sub-chart defguard-proxy

flake.nix

@@ -0,0 +1,27 @@
+{
+  description = "Simple devshell flake";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = {
+    nixpkgs,
+    flake-utils,
+    ...
+  }:
+    flake-utils.lib.eachDefaultSystem (system: let
+      pkgs = import nixpkgs {
+        inherit system;
+      };
+    in {
+      devShells.default = pkgs.mkShell {
+        packages = with pkgs; [
+          kubectl
+          kubernetes-helm
+          kubeconform
+        ];
+      };
+    });
+}