源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

packaging/helm/openwork-ee/examples/values.aws-load-balancer-http-smoke.yaml

@@ -0,0 +1,88 @@
+# AWS EKS Auto Mode HTTP smoke-test values for a first OpenWork EE install when
+# DNS and ACM TLS are not ready yet.
+#
+# Copy this file, replace every REPLACE_* value, and install with:
+#
+#   helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
+#     --version REPLACE_OPENWORK_VERSION \
+#     --namespace openwork-ee \
+#     --create-namespace \
+#     -f values.aws-http-smoke.yaml
+#
+# This creates two public AWS Network Load Balancers on clear HTTP ports. After
+# the first successful install, replace the pending origins with the real NLB
+# hostnames, run helm upgrade again, and then validate browser auth. Prefer the
+# HTTPS/ACM example for production.
+
+image:
+  tag: "REPLACE_OPENWORK_VERSION"
+  pullPolicy: IfNotPresent
+
+config:
+  tenancy:
+    mode: single_org
+    singleOrgName: "REPLACE_COMPANY_NAME"
+    singleOrgSlug: "REPLACE_COMPANY_SLUG"
+    ownerEmails: "REPLACE_ADMIN_EMAIL"
+    allowPublicSignup: "false"
+    requireEmailVerification: "false"
+  auth:
+    passwordBreachScreeningEnabled: "false"
+  public:
+    webOrigin: "http://pending-web-nlb:3005"
+    apiOrigin: "http://pending-api-nlb:8788"
+    mcpResourceUrl: "http://pending-api-nlb:8788/mcp"
+    mcpClaimNamespace: "http://pending-web-nlb:3005"
+    desktopDenBaseUrl: "http://pending-web-nlb:3005"
+    corsOrigins: "http://pending-web-nlb:3005,http://pending-api-nlb:8788"
+    betterAuthTrustedOrigins: "http://pending-web-nlb:3005"
+    webAppHosts: "pending-web-nlb"
+    bootstrapAdminEmails: "REPLACE_ADMIN_EMAIL"
+    authCallbackUrl: "http://pending-web-nlb:3005"
+  provisioner:
+    mode: stub
+
+secret:
+  create: true
+  values:
+    # RDS MySQL private-network smoke path. sslaccept=accept preserves TLS but
+    # does not require the RDS CA chain to be mounted into the image.
+    databaseUrl: "mysql://openwork:REPLACE_DB_PASSWORD@REPLACE_RDS_ENDPOINT:3306/openwork_den?sslaccept=accept"
+    # Generate with: openssl rand -base64 48
+    betterAuthSecret: "REPLACE_BETTER_AUTH_SECRET"
+    # Generate separately with: openssl rand -base64 48
+    denDbEncryptionKey: "REPLACE_DEN_DB_ENCRYPTION_KEY"
+
+denApi:
+  replicaCount: 1
+  service:
+    type: LoadBalancer
+    port: 8788
+    loadBalancerClass: eks.amazonaws.com/nlb
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: HTTP
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /ready
+
+denWeb:
+  replicaCount: 1
+  service:
+    type: LoadBalancer
+    port: 3005
+    loadBalancerClass: eks.amazonaws.com/nlb
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: HTTP
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /api/ready
+
+inference:
+  enabled: false
+
+migrations:
+  enabled: true
+  hook: true
+
+ingress:
+  enabled: false

packaging/helm/openwork-ee/examples/values.aws-load-balancer.yaml

@@ -0,0 +1,94 @@
+# AWS EKS Auto Mode starter values for a first OpenWork EE self-host install.
+#
+# Copy this file, replace every REPLACE_* value, and install with:
+#
+#   helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
+#     --version REPLACE_OPENWORK_VERSION \
+#     --namespace openwork-ee \
+#     --create-namespace \
+#     -f values.aws.yaml
+#
+# This example exposes Den Web and Den API through separate AWS Network Load
+# Balancers created from Kubernetes Services. Use it for the first AWS smoke
+# test and for installs where separate web/API hostnames are acceptable.
+
+image:
+  tag: "REPLACE_OPENWORK_VERSION"
+  pullPolicy: IfNotPresent
+
+config:
+  tenancy:
+    mode: single_org
+    singleOrgName: "REPLACE_COMPANY_NAME"
+    singleOrgSlug: "REPLACE_COMPANY_SLUG"
+    ownerEmails: "REPLACE_ADMIN_EMAIL"
+    allowPublicSignup: "false"
+    requireEmailVerification: "false"
+  auth:
+    passwordBreachScreeningEnabled: "false"
+  public:
+    webOrigin: "https://REPLACE_WEB_HOST"
+    # Split-origin compatibility override for this two-load-balancer example.
+    # Leave blank in single-origin deployments so Den derives it from webOrigin.
+    apiOrigin: "https://REPLACE_API_HOST"
+    mcpResourceUrl: "https://REPLACE_API_HOST/mcp"
+    mcpClaimNamespace: "https://REPLACE_WEB_HOST"
+    desktopDenBaseUrl: ""
+    corsOrigins: "https://REPLACE_WEB_HOST,https://REPLACE_API_HOST"
+    betterAuthTrustedOrigins: "https://REPLACE_WEB_HOST"
+    webAppHosts: "REPLACE_WEB_HOST"
+    bootstrapAdminEmails: "REPLACE_ADMIN_EMAIL"
+    authCallbackUrl: "https://REPLACE_WEB_HOST"
+  provisioner:
+    mode: stub
+
+secret:
+  create: true
+  values:
+    # RDS MySQL private-network smoke path. sslaccept=accept preserves TLS but
+    # does not require the RDS CA chain to be mounted into the image.
+    databaseUrl: "mysql://openwork:REPLACE_DB_PASSWORD@REPLACE_RDS_ENDPOINT:3306/openwork_den?sslaccept=accept"
+    # Generate with: openssl rand -base64 48
+    betterAuthSecret: "REPLACE_BETTER_AUTH_SECRET"
+    # Generate separately with: openssl rand -base64 48
+    denDbEncryptionKey: "REPLACE_DEN_DB_ENCRYPTION_KEY"
+    # One-time /setup code. Generate a unique value and keep it out of source control.
+    initialAdminBootstrapCode: "REPLACE_BOOTSTRAP_CODE"
+
+denApi:
+  replicaCount: 1
+  service:
+    type: LoadBalancer
+    port: 443
+    loadBalancerClass: eks.amazonaws.com/nlb
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: HTTP
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /ready
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: REPLACE_ACM_CERT_ARN
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
+
+denWeb:
+  replicaCount: 1
+  service:
+    type: LoadBalancer
+    port: 443
+    loadBalancerClass: eks.amazonaws.com/nlb
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+      service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-protocol: HTTP
+      service.beta.kubernetes.io/aws-load-balancer-healthcheck-path: /api/ready
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: REPLACE_ACM_CERT_ARN
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
+
+inference:
+  enabled: false
+
+migrations:
+  enabled: true
+  hook: true
+
+ingress:
+  enabled: false

packaging/helm/openwork-ee/examples/values.azure-ingress.yaml

@@ -0,0 +1,99 @@
+# Azure AKS starter values for a first OpenWork EE self-host install.
+#
+# Follow docs/azure-aks-helm.md to create the VNet, AKS subnet, delegated
+# MySQL subnet, AKS cluster, and Azure Database for MySQL Flexible Server.
+# Then copy this file, replace every REPLACE_* value, and install with:
+#
+#   helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
+#     --version REPLACE_OPENWORK_VERSION \
+#     --namespace openwork-ee \
+#     --create-namespace \
+#     -f values.azure.yaml
+#
+# This example exposes Den Web and Den API through the AKS application routing
+# add-on's managed NGINX Ingress controller. Use it for production-like Azure
+# tests where browser auth and SSO need stable HTTPS hostnames.
+
+image:
+  tag: "REPLACE_OPENWORK_VERSION"
+  pullPolicy: IfNotPresent
+
+config:
+  tenancy:
+    mode: single_org
+    singleOrgName: "REPLACE_COMPANY_NAME"
+    singleOrgSlug: "REPLACE_COMPANY_SLUG"
+    ownerEmails: "REPLACE_ADMIN_EMAIL"
+    allowPublicSignup: "false"
+    requireEmailVerification: "false"
+  auth:
+    passwordBreachScreeningEnabled: "false"
+  public:
+    webOrigin: "https://REPLACE_WEB_HOST"
+    # Split-origin compatibility override for this two-host ingress example.
+    # Leave blank in single-origin deployments so Den derives it from webOrigin.
+    apiOrigin: "https://REPLACE_API_HOST"
+    mcpResourceUrl: "https://REPLACE_API_HOST/mcp"
+    mcpClaimNamespace: "https://REPLACE_WEB_HOST"
+    desktopDenBaseUrl: ""
+    corsOrigins: "https://REPLACE_WEB_HOST,https://REPLACE_API_HOST"
+    betterAuthTrustedOrigins: "https://REPLACE_WEB_HOST"
+    webAppHosts: "REPLACE_WEB_HOST"
+    bootstrapAdminEmails: "REPLACE_ADMIN_EMAIL"
+    authCallbackUrl: "https://REPLACE_WEB_HOST"
+  provisioner:
+    mode: stub
+
+secret:
+  create: true
+  values:
+    # Azure Database for MySQL Flexible Server private-network smoke path.
+    # sslaccept=accept preserves TLS without requiring a mounted CA bundle.
+    databaseUrl: "mysql://openwork:REPLACE_DB_PASSWORD@REPLACE_MYSQL_SERVER_NAME.mysql.database.azure.com:3306/openwork_den?sslaccept=accept"
+    # Generate with: openssl rand -base64 48
+    betterAuthSecret: "REPLACE_BETTER_AUTH_SECRET"
+    # Generate separately with: openssl rand -base64 48
+    denDbEncryptionKey: "REPLACE_DEN_DB_ENCRYPTION_KEY"
+    # One-time /setup code. Generate a unique value and keep it out of source control.
+    initialAdminBootstrapCode: "REPLACE_BOOTSTRAP_CODE"
+    # Optional SMTP settings for invitations and other transactional email.
+    # SMTP delivery requires both emailFrom and smtpHost.
+    emailFrom: "OpenWork <no-reply@example.com>"
+    smtpHost: ""
+    smtpPort: "587"
+    smtpUser: ""
+    smtpPass: ""
+    smtpSecure: "false"
+
+denApi:
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    port: 8788
+
+denWeb:
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    port: 3005
+
+inference:
+  enabled: false
+
+migrations:
+  enabled: true
+  hook: true
+
+ingress:
+  enabled: true
+  className: webapprouting.kubernetes.azure.com
+  web:
+    host: REPLACE_WEB_HOST
+  api:
+    enabled: true
+    host: REPLACE_API_HOST
+  tls:
+    - secretName: openwork-ee-tls
+      hosts:
+        - REPLACE_WEB_HOST
+        - REPLACE_API_HOST

packaging/helm/openwork-ee/examples/values.gcp-ingress.yaml

@@ -0,0 +1,94 @@
+# Google Cloud GKE starter values for a first OpenWork EE self-host install.
+#
+# Copy this file, replace every REPLACE_* value, and install with:
+#
+#   helm upgrade --install openwork-ee oci://ghcr.io/different-ai/charts/openwork-ee \
+#     --version REPLACE_OPENWORK_VERSION \
+#     --namespace openwork-ee \
+#     --create-namespace \
+#     -f values.gcp.yaml
+#
+# This example exposes Den Web and Den API through GKE Ingress with a reserved
+# global IP and Google-managed certificate. Apply the ManagedCertificate and
+# BackendConfig manifests from docs/gcp-gke-helm.md before installing.
+
+image:
+  tag: "REPLACE_OPENWORK_VERSION"
+  pullPolicy: IfNotPresent
+
+config:
+  tenancy:
+    mode: single_org
+    singleOrgName: "REPLACE_COMPANY_NAME"
+    singleOrgSlug: "REPLACE_COMPANY_SLUG"
+    ownerEmails: "REPLACE_ADMIN_EMAIL"
+    allowPublicSignup: "false"
+    requireEmailVerification: "false"
+  auth:
+    passwordBreachScreeningEnabled: "false"
+  public:
+    webOrigin: "https://REPLACE_WEB_HOST"
+    # Split-origin compatibility override for this two-host ingress example.
+    # Leave blank in single-origin deployments so Den derives it from webOrigin.
+    apiOrigin: "https://REPLACE_API_HOST"
+    mcpResourceUrl: "https://REPLACE_API_HOST/mcp"
+    mcpClaimNamespace: "https://REPLACE_WEB_HOST"
+    desktopDenBaseUrl: ""
+    corsOrigins: "https://REPLACE_WEB_HOST,https://REPLACE_API_HOST"
+    betterAuthTrustedOrigins: "https://REPLACE_WEB_HOST"
+    webAppHosts: "REPLACE_WEB_HOST"
+    bootstrapAdminEmails: "REPLACE_ADMIN_EMAIL"
+    authCallbackUrl: "https://REPLACE_WEB_HOST"
+  provisioner:
+    mode: stub
+
+secret:
+  create: true
+  values:
+    # Direct private IP Cloud SQL example. The current chart does not inject
+    # Cloud SQL Auth Proxy sidecars, so use a private IP reachable from GKE.
+    databaseUrl: "mysql://openwork:REPLACE_DB_PASSWORD@REPLACE_CLOUD_SQL_PRIVATE_IP:3306/openwork_den"
+    # Generate with: openssl rand -base64 48
+    betterAuthSecret: "REPLACE_BETTER_AUTH_SECRET"
+    # Generate separately with: openssl rand -base64 48
+    denDbEncryptionKey: "REPLACE_DEN_DB_ENCRYPTION_KEY"
+    # One-time /setup code. Generate a unique value and keep it out of source control.
+    initialAdminBootstrapCode: "REPLACE_BOOTSTRAP_CODE"
+
+denApi:
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    port: 8788
+    annotations:
+      cloud.google.com/backend-config: '{"default": "openwork-ee-den-api-backend"}'
+      cloud.google.com/neg: '{"ingress": true}'
+
+denWeb:
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    port: 3005
+    annotations:
+      cloud.google.com/backend-config: '{"default": "openwork-ee-den-web-backend"}'
+      cloud.google.com/neg: '{"ingress": true}'
+
+inference:
+  enabled: false
+
+migrations:
+  enabled: true
+  hook: true
+
+ingress:
+  enabled: true
+  className: ""
+  annotations:
+    kubernetes.io/ingress.class: gce
+    kubernetes.io/ingress.global-static-ip-name: REPLACE_GLOBAL_STATIC_IP_NAME
+    networking.gke.io/managed-certificates: REPLACE_MANAGED_CERTIFICATE_NAME
+  web:
+    host: REPLACE_WEB_HOST
+  api:
+    enabled: true
+    host: REPLACE_API_HOST