Kubernetes (Helm)

The nora-onprem Helm chart deploys the same five services as Docker Compose onto a Kubernetes cluster. The chart lives at infra/onprem/helm/nora-onprem in the platform repo.

Install

postgres.password is the only required value on a fresh install.

helm install nora ./nora-onprem \
  --namespace nora --create-namespace \
  --set postgres.password='CHANGE_ME' \
  --set publicUrl='http://nora.example.internal'

The chart provisions Deployments, StatefulSets, and Services under the release name. See What the chart creates for the exact resource list.

Common overrides

Enable ingress and TLS

--set ingress.enabled=true \
--set ingress.host=nora.example.internal \
--set ingress.className=nginx \
--set ingress.tlsSecret=nora-tls

Setting ingress.tlsSecret auto-enables NORA_COOKIE_SECURE=1 — browsers require the Secure attribute on session cookies over TLS.

Point at a private registry (air-gapped)

Load the tarball images into your own registry (see Air-gap tarball), then override each repository:

--set image.server.repository=registry.internal/nora-server \
--set image.server.tag=1.0.0 \
--set image.llmBridge.repository=registry.internal/nora-llm-bridge \
--set image.llmBridge.tag=1.0.0 \
--set imagePullSecrets[0].name=my-registry-secret

Turn on the air-gap boot probe

--set deploy.airgap=true

The server exits with code 78 at boot if the probe target (default 1.1.1.1:443) is still reachable — a smoke test for the operator’s egress isolation.

Attach an offline license

kubectl -n nora create secret generic nora-license \
  --from-file=license.json=./license.json

helm upgrade nora ./nora-onprem -n nora \
  --set license.fileSecret=nora-license --reuse-values

The chart mounts the secret at /etc/nora/license.json and sets NORA_LICENSE_FILE for the server.

Switch to Qdrant for retrieval

--set vectorStore.backend=qdrant

The default is pgvector (bundled with the Postgres pod). Flip to qdrant when you want vector search on a dedicated pod.

What the chart creates

Resource	Type	Purpose
`<release>-nora-onprem-server`	Deployment + Service	Rust API and SPA (port 8090)
`<release>-nora-onprem-llm-bridge`	Deployment + Service	LLM subprocess bridge (port 8091)
`<release>-nora-onprem-postgres`	StatefulSet + Service	Postgres with pgvector (one PVC per replica)
`<release>-nora-onprem-redis`	Deployment + Service	Cache
`<release>-nora-onprem-qdrant`	StatefulSet + Service	Vector store (optional)
`<release>-nora-onprem-secrets`	Secret	DB password and license key
`<release>-nora-onprem`	Ingress	Only when `ingress.enabled=true`

Not in scope yet

Multi-replica server. LLM subprocess HOME isolation hasn’t landed, so server pods run at concurrency=1.
HPA and autoscaling. Waits on the above.
Backup and restore jobs. Use standard Postgres tooling against the StatefulSet’s PVC.
Cert-manager Issuer wiring. Bring your own Issuer; the chart just consumes a Secret you point ingress.tlsSecret at.

Upgrade

helm upgrade nora ./nora-onprem -n nora \
  --set image.server.tag=1.2.0 \
  --set image.llmBridge.tag=1.2.0 \
  --reuse-values

Migrations run automatically on the first new server pod (NORA_RUN_MIGRATIONS=1).

Migrations are additive-only. Pin a matching database snapshot before downgrading across a schema advance.

Uninstall

helm uninstall nora -n nora
kubectl delete namespace nora   # drops the PVCs, too

helm uninstall alone keeps the PVCs, so your data survives an accidental delete. Drop the namespace when you’re sure.

Docker Compose

The same five services on a single host.

Air-gap tarball

Building the images you’d push into your private registry.

CLI

SDK

Local App

Kubernetes (Helm)

Install

Common overrides

Enable ingress and TLS

Point at a private registry (air-gapped)

Turn on the air-gap boot probe

Attach an offline license

Switch to Qdrant for retrieval

What the chart creates

Not in scope yet

Upgrade

Uninstall

Docker Compose

Air-gap tarball

​Install

​Common overrides

​Enable ingress and TLS

​Point at a private registry (air-gapped)

​Turn on the air-gap boot probe

​Attach an offline license

​Switch to Qdrant for retrieval

​What the chart creates

​Not in scope yet

​Upgrade

​Uninstall

​Related

Docker Compose

Air-gap tarball

Install

Common overrides

Enable ingress and TLS

Point at a private registry (air-gapped)

Turn on the air-gap boot probe

Attach an offline license

Switch to Qdrant for retrieval

What the chart creates

Not in scope yet

Upgrade

Uninstall

Related