Phase 0 — Get a VM

Sizing

Here’s what the stack actually consumes, so the plan choice isn’t a guess:

1. Go to EVLBOX VPS
2. Click All Services in the nav, then click VPS
3. Choose the plan (highlighted above)
4. At checkout, apply code TOOBROKE20 for 20% off
5. After purchase, you’ll land in the VPS Builder:

6. SSH in: ssh root@YOUR_VM_IP

Disclosure: the EVLBOX link is an affiliate link and TOOBROKE20 is a referral code — I get a cut if you sign up. The guide works identically on any Ubuntu 24.04 box, or locally with kind create cluster for free.

Base packages + firewall

apt update && apt upgrade -y
apt install -y curl wget ufw jq

# Cluster-internal traffic — REQUIRED, k3s breaks without these
ufw allow from 10.42.0.0/16          # pod CIDR
ufw allow from 10.43.0.0/16          # service CIDR
ufw allow 8472/udp                   # flannel VXLAN overlay

# Public-facing
ufw allow 22/tcp                     # SSH
ufw allow 80/tcp                     # HTTP (also serves the ACME challenge)
ufw allow 443/tcp                    # HTTPS

# Kubernetes API — scope it to you, never the open internet.
ufw allow from YOUR_ADMIN_IP to any port 6443 proto tcp

ufw enable
ufw status verbose

Phase 1 — Install k3s + Helm

curl -sfL https://get.k3s.io | sh -

# Verify
kubectl get nodes
# Should show one node, Ready

# Make kubectl work without sudo
mkdir -p ~/.kube
cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
chmod 600 ~/.kube/config
kubectl get pods -A

# Confirm Traefik is running:
kubectl -n kube-system get pods -l app.kubernetes.io/name=traefik

Install the Helm CLI

curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
helm version

Configure Traefik for Let’s Encrypt

k3s auto-applies any manifest dropped in /var/lib/rancher/k3s/server/manifests/. No restart needed — the Helm controller watches that directory.

cat > /var/lib/rancher/k3s/server/manifests/traefik-config.yaml << 'EOF'
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    additionalArguments:
      - "--certificatesresolvers.default.acme.email=YOUR_REAL_EMAIL@example.com"
      - "--certificatesresolvers.default.acme.storage=/data/acme.json"
      - "--certificatesresolvers.default.acme.httpchallenge.entrypoint=web"
      # Uncomment while testing — staging certs are untrusted but unlimited:
      # - "--certificatesresolvers.default.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
    persistence:
      enabled: true
      name: data
      size: 128Mi
      storageClass: local-path
      path: /data
    deployment:
      initContainers:
        - name: volume-permissions
          image: busybox:1.36
          command: ["sh", "-c", "touch /data/acme.json && chmod 600 /data/acme.json"]
          volumeMounts:
            - name: data
              mountPath: /data
    ports:
      web:
        exposedPort: 80
        redirectTo:
          port: websecure
      websecure:
        exposedPort: 443
    logs:
      access:
        enabled: true
        format: json
EOF

# The config triggers a new helm-install job. Watch the job, not the deployment —
# `rollout status` can return against the old pods before the job even fires.
kubectl -n kube-system get jobs -l helmcharts.helm.cattle.io/chart=traefik -w
# Ctrl-C once it shows 1/1 Completions

kubectl -n kube-system rollout status deployment traefik --timeout=120s

# Confirm the storage volume bound:
kubectl -n kube-system get pvc

# Check logs for ACME registration:
kubectl -n kube-system logs -l app.kubernetes.io/name=traefik --tail=50 | grep -i acme
# Should see: "Registering with ACME server ..."

Phase 2 — Redis

mkdir -p ~/tbtq/manifests
cd ~/tbtq

manifests/namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: tbtq

Redis

manifests/redis.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: redis-data
  namespace: tbtq
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 2Gi
---
apiVersion: v1
kind: Service
metadata:
  name: redis
  namespace: tbtq
spec:
  selector: { app: redis }
  ports:
    - port: 6379
      targetPort: 6379
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
  namespace: tbtq
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels: { app: redis }
  template:
    metadata:
      labels: { app: redis }
    spec:
      securityContext:
        fsGroup: 999
      containers:
        - name: redis
          image: redis:7-alpine
          args: ["redis-server", "--appendonly", "yes", "--dir", "/data"]
          ports:
            - containerPort: 6379
          volumeMounts:
            - name: data
              mountPath: /data
          resources:
            requests: { cpu: 50m, memory: 64Mi }
            limits:   { cpu: 300m, memory: 256Mi }
          readinessProbe:
            exec:
              command: ["redis-cli", "ping"]
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: redis-data

kubectl apply -f manifests/namespace.yaml
kubectl apply -f manifests/redis.yaml
kubectl -n tbtq wait --for=condition=ready pod -l app=redis --timeout=60s

# Verify
kubectl -n tbtq exec deploy/redis -- redis-cli ping     # → PONG

# Write a key, kill the pod, confirm it survived
kubectl -n tbtq exec deploy/redis -- redis-cli set canary alive
kubectl -n tbtq delete pod -l app=redis
kubectl -n tbtq wait --for=condition=ready pod -l app=redis --timeout=60s
kubectl -n tbtq exec deploy/redis -- redis-cli get canary   # → "alive"

Phase 3 — Send (Encrypted File Transfer)

The flow:

1. User picks a file in the browser
2. Browser generates an AES-256-GCM key via the Web Crypto API
3. File is encrypted client-side
4. Encrypted blob streams up over a WebSocket
5. Server returns a URL with the key in the fragment (#key=...)
6. Recipient opens the link — the browser decrypts locally
7. One download or expiry → file deleted

manifests/send.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: send-data
  namespace: tbtq
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 20Gi
---
apiVersion: v1
kind: Service
metadata:
  name: send
  namespace: tbtq
spec:
  selector: { app: send }
  ports:
    - port: 80
      targetPort: 1443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: send
  namespace: tbtq
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels: { app: send }
  template:
    metadata:
      labels: { app: send }
    spec:
      containers:
        - name: send
          image: registry.gitlab.com/timvisee/send:latest
          ports:
            - containerPort: 1443
          env:
            - name: BASE_URL
              value: https://drop.example.com
            - name: REDIS_HOST
              value: redis.tbtq.svc.cluster.local
            - name: REDIS_PORT
              value: "6379"
            - name: FILE_DIR
              value: /uploads
            - name: MAX_FILE_SIZE
              value: "5368709120"
            - name: MAX_EXPIRE_SECONDS
              value: "86400"
            - name: DEFAULT_DOWNLOADS
              value: "1"
          volumeMounts:
            - name: data
              mountPath: /uploads
          resources:
            requests: { cpu: 100m, memory: 128Mi }
            limits:   { cpu: 500m, memory: 512Mi }
          startupProbe:
            httpGet: { path: /__heartbeat__, port: 1443 }
            periodSeconds: 5
            failureThreshold: 12
          readinessProbe:
            httpGet: { path: /__heartbeat__, port: 1443 }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /__lbheartbeat__, port: 1443 }
            periodSeconds: 15
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: send-data

kubectl apply -f manifests/send.yaml
kubectl -n tbtq wait --for=condition=ready pod -l app=send --timeout=120s

kubectl -n tbtq port-forward svc/send 1443:80 &
curl -s http://localhost:1443/__heartbeat__
# → {"status":"ok"}

# Open http://localhost:1443 — upload a file, test the share link.

Phase 4 — PrivateBin (Encrypted Notes)

manifests/privatebin.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: privatebin-data
  namespace: tbtq
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: privatebin
  namespace: tbtq
spec:
  selector: { app: privatebin }
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: privatebin
  namespace: tbtq
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels: { app: privatebin }
  template:
    metadata:
      labels: { app: privatebin }
    spec:
      securityContext:
        fsGroup: 82
      containers:
        - name: privatebin
          image: privatebin/nginx-fpm-alpine:stable
          ports:
            - containerPort: 8080
          volumeMounts:
            - name: data
              mountPath: /srv/data
          resources:
            requests: { cpu: 50m, memory: 64Mi }
            limits:   { cpu: 200m, memory: 128Mi }
          livenessProbe:
            httpGet: { path: /, port: 8080 }
            initialDelaySeconds: 5
            periodSeconds: 15
          readinessProbe:
            httpGet: { path: /, port: 8080 }
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: privatebin-data

kubectl apply -f manifests/privatebin.yaml
kubectl -n tbtq wait --for=condition=ready pod -l app=privatebin --timeout=120s

kubectl -n tbtq port-forward svc/privatebin 8080:80 &
curl -sI http://localhost:8080 | head -3
# → HTTP/1.1 200 OK

# Open http://localhost:8080 — paste text, set "Burn after reading," send,
# then open the URL in incognito to confirm it self-destructs.

Phase 5 — Ingress + DNS

Swap in your domain

export DOMAIN=yourdomain.tld          # ← your actual domain

sed -i "s/example\.com/$DOMAIN/g" ~/tbtq/manifests/*.yaml

# Confirm nothing was missed:
grep -rn "example.com" ~/tbtq/manifests/ && echo "STILL PLACEHOLDERS ABOVE" \
  || echo "all replaced"

kubectl apply -f ~/tbtq/manifests/send.yaml
kubectl -n tbtq rollout restart deploy/send

DNS records

drop.example.com   →  A  →  YOUR_VM_IP
secret.example.com →  A  →  YOUR_VM_IP

# Confirm propagation before continuing:
dig +short drop.example.com
dig +short secret.example.com
# All must return YOUR_VM_IP

manifests/ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: send-ingress
  namespace: tbtq
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls.certresolver: default
spec:
  ingressClassName: traefik
  rules:
    - host: drop.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service: { name: send, port: { number: 80 } }
  tls:
    - hosts: [drop.example.com]
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: privatebin-ingress
  namespace: tbtq
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls.certresolver: default
spec:
  ingressClassName: traefik
  rules:
    - host: secret.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service: { name: privatebin, port: { number: 80 } }
  tls:
    - hosts: [secret.example.com]

kubectl apply -f manifests/ingress.yaml

# Watch issuance:
kubectl -n kube-system logs -f -l app.kubernetes.io/name=traefik | grep -i acme

# Verify (30–60s per host):
curl -sI https://drop.example.com/__heartbeat__ | head -3   # → HTTP/2 200
curl -sI https://secret.example.com/            | head -3   # → HTTP/2 200

# Confirm the cert is real, not Traefik's built-in placeholder:
echo | openssl s_client -connect drop.example.com:443 -servername drop.example.com 2>/dev/null \
  | openssl x509 -noout -issuer -dates
# Issuer should read Let's Encrypt, not TRAEFIK DEFAULT CERT

Phase 6 — Observability + Scaling

Metrics Server

kubectl top nodes
kubectl -n tbtq top pods
# If empty, wait 30s for the first scrape: sleep 30 && kubectl top nodes

# Confirm you have the headroom first:
free -h
kubectl top nodes

kubectl -n tbtq scale deploy/privatebin --replicas=2

kubectl -n tbtq autoscale deployment privatebin --cpu-percent=70 --min=2 --max=3
kubectl -n tbtq get hpa

Access logs

# All 4xx/5xx across the cluster:
kubectl -n kube-system logs -l app.kubernetes.io/name=traefik --tail=500 \
  | jq -c 'select(.DownstreamStatus >= 400)
           | {t:.StartUTC, host:.RequestHost, path:.RequestPath,
              s:.DownstreamStatus, ms:(.Duration/1000000)}'

# p95 latency by service:
kubectl -n kube-system logs -l app.kubernetes.io/name=traefik --tail=2000 \
  | jq -s 'map(select(.ServiceName)) | group_by(.ServiceName)
           | map({svc:.[0].ServiceName, n:length,
                  p95:(sort_by(.Duration)[(length*0.95|floor)].Duration/1000000)})'

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

helm install monitoring prometheus-community/kube-prometheus-stack \
  -n monitoring --create-namespace \
  --set grafana.adminPassword="$(openssl rand -hex 16)" \
  --set prometheus.prometheusSpec.retention=7d \
  --set prometheus.prometheusSpec.resources.limits.memory=1Gi \
  --set alertmanager.enabled=false

# Retrieve the generated password:
kubectl -n monitoring get secret monitoring-grafana \
  -o jsonpath='{.data.admin-password}' | base64 -d; echo

kubectl -n monitoring port-forward svc/monitoring-grafana 3000:80
# Open http://localhost:3000 → admin / (the password above)

Phase 7 — Network Policies

manifests/netpol.yaml

# 1. Default deny, both directions
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: tbtq
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
# 2. DNS egress — UDP and TCP. Large responses fall back to TCP.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: tbtq
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - { port: 53, protocol: UDP }
        - { port: 53, protocol: TCP }
---
# 3. Egress from any pod in tbtq to Redis
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-redis-egress
  namespace: tbtq
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
    - to:
        - podSelector:
            matchLabels: { app: redis }
      ports:
        - { port: 6379, protocol: TCP }
---
# 4. The matching ingress half, on Redis
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-redis-ingress
  namespace: tbtq
spec:
  podSelector:
    matchLabels: { app: redis }
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector: {}
      ports:
        - { port: 6379, protocol: TCP }
---
# 5. Ingress from Traefik to the two web apps
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-traefik-ingress
  namespace: tbtq
spec:
  podSelector:
    matchExpressions:
      - { key: app, operator: In, values: [send, privatebin] }
  policyTypes: [Ingress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system

kubectl apply -f manifests/netpol.yaml

# --- Verify the policies do what you think ---

# Send CAN still reach Redis:
kubectl -n tbtq exec deploy/send -- \
  node -e 'require("net").connect(6379,"redis.tbtq.svc.cluster.local").on("connect",()=>{console.log("OPEN");process.exit(0)}).setTimeout(3000).on("timeout",()=>{console.log("BLOCKED");process.exit(0)}).on("error",()=>{console.log("BLOCKED");process.exit(0)})'
# → OPEN

# Send CANNOT reach PrivateBin:
kubectl -n tbtq exec deploy/send -- \
  node -e 'require("net").connect(80,"privatebin.tbtq.svc.cluster.local").on("connect",()=>{console.log("OPEN");process.exit(0)}).setTimeout(3000).on("timeout",()=>{console.log("BLOCKED");process.exit(0)}).on("error",()=>{console.log("BLOCKED");process.exit(0)})'
# → BLOCKED

# PrivateBin CANNOT reach the internet:
kubectl -n tbtq exec deploy/privatebin -- \
  timeout 3 wget -q -O- https://example.com || echo "BLOCKED (correct)"

# Public traffic unaffected:
curl -sI https://drop.example.com/__heartbeat__ | head -1
# → HTTP/2 200

Phase 8 — Helm Chart Optional

Step 1 — Save anything you care about

Step 2 — Scaffold the chart

cd ~/tbtq
helm create tbtq-chart

# The scaffold ships a sample nginx app. Clear it out, keep Chart.yaml.
rm -rf tbtq-chart/templates/*
: > tbtq-chart/values.yaml

tree tbtq-chart
# tbtq-chart/
# ├── Chart.yaml     ← name, version, appVersion
# ├── charts/        ← subcharts, unused here
# ├── templates/     ← now empty; your manifests go here
# └── values.yaml    ← now empty; your knobs go here

Step 3 — Decide what does not go in the chart

So the split is:

• Stays as a plain manifest: namespace.yaml
• Becomes a template: redis, send, privatebin, both ingresses, the network policies, the cleanup cronjob

Step 4 — The worked example

Here’s Send converted in full — the more interesting of the two, since it has a volume and real configuration. Compare it against manifests/send.yaml from Phase 3; the only differences are the substituted values and the removed namespace.

# tbtq-chart/templates/send.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: send-data
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: {{ .Values.send.storage }}
---
apiVersion: v1
kind: Service
metadata:
  name: send
  labels: { app: send }
spec:
  selector: { app: send }
  ports:
    - port: 80
      targetPort: 1443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: send
  labels: { app: send }
spec:
  replicas: {{ .Values.send.replicas }}
  strategy:
    type: Recreate
  selector:
    matchLabels: { app: send }
  template:
    metadata:
      labels: { app: send }
    spec:
      containers:
        - name: send
          image: "{{ .Values.send.image }}:{{ .Values.send.tag }}"
          ports:
            - containerPort: 1443
          env:
            - name: BASE_URL
              value: "https://{{ .Values.send.domain }}"
            - name: REDIS_HOST
              value: redis.{{ .Release.Namespace }}.svc.cluster.local
            - name: REDIS_PORT
              value: "6379"
            - name: FILE_DIR
              value: /uploads
            - name: MAX_FILE_SIZE
              value: {{ .Values.send.maxFileSize | quote }}
            - name: MAX_EXPIRE_SECONDS
              value: {{ .Values.send.maxExpireSeconds | quote }}
            - name: DEFAULT_DOWNLOADS
              value: {{ .Values.send.defaultDownloads | quote }}
          volumeMounts:
            - name: data
              mountPath: /uploads
          resources:
            {{- toYaml .Values.send.resources | nindent 12 }}
          startupProbe:
            httpGet: { path: /__heartbeat__, port: 1443 }
            periodSeconds: 5
            failureThreshold: 12
          readinessProbe:
            httpGet: { path: /__heartbeat__, port: 1443 }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /__lbheartbeat__, port: 1443 }
            periodSeconds: 15
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: send-data

Step 5 — values.yaml

# tbtq-chart/values.yaml
podCidr: "10.42.0.0/16"

send:
  replicas: 1              # ReadWriteOnce volume — do not raise
  image: registry.gitlab.com/timvisee/send
  tag: latest
  domain: drop.example.com
  maxFileSize: "5368709120"
  maxExpireSeconds: 86400
  defaultDownloads: 1
  storage: 20Gi
  resources:
    requests: { cpu: 100m, memory: 128Mi }
    limits:   { cpu: 500m, memory: 512Mi }

privatebin:
  replicas: 1
  image: privatebin/nginx-fpm-alpine
  tag: stable
  domain: secret.example.com
  storage: 1Gi
  resources:
    requests: { cpu: 50m, memory: 64Mi }
    limits:   { cpu: 200m, memory: 128Mi }

redis:
  image: redis
  tag: 7-alpine
  storage: 2Gi

# tbtq-chart/values.yaml
podCidr: "10.42.0.0/16"

send:
  replicas: 1              # ReadWriteOnce volume — do not raise
  image: registry.gitlab.com/timvisee/send
  tag: latest
  domain: drop.example.com
  maxFileSize: "5368709120"
  maxExpireSeconds: 86400
  defaultDownloads: 1
  storage: 20Gi
  resources:
    requests: { cpu: 100m, memory: 128Mi }
    limits:   { cpu: 500m, memory: 512Mi }

privatebin:
  replicas: 2
  image: privatebin/nginx-fpm-alpine
  tag: stable
  domain: secret.example.com
  storage: 1Gi
  resources:
    requests: { cpu: 50m, memory: 64Mi }
    limits:   { cpu: 200m, memory: 128Mi }

redis:
  image: redis
  tag: 7-alpine
  storage: 2Gi

Step 6 — Inspect before you apply

# 1. Syntax and best-practice check — never touches the cluster
helm lint ./tbtq-chart

# 2. Render templates to stdout. This is the single most useful Helm command.
#    If a value is missing, you see <no value> here instead of a broken pod later.
helm template tbtq ./tbtq-chart -n tbtq | less

# Render one file only:
helm template tbtq ./tbtq-chart -n tbtq -s templates/send.yaml

# Catch unrendered values before they reach the cluster:
helm template tbtq ./tbtq-chart -n tbtq | grep -n "<no value>"
# No output = good

# 3. Full server-side validation, still applies nothing
helm install tbtq ./tbtq-chart -n tbtq --dry-run --debug

Step 7 — Tear down and reinstall

kubectl delete namespace tbtq
kubectl get ns tbtq
# → NotFound. Takes 30–60s; PVCs are reclaimed with it.

# Secrets and namespace first — the chart depends on them existing
kubectl apply -f manifests/secrets.yaml

# Now the chart
helm install tbtq ./tbtq-chart -n tbtq

helm list -n tbtq
kubectl -n tbtq get pods -w

Step 8 — Break it on purpose, then roll back

# Revision 1 is the install. Look at it:
helm history tbtq -n tbtq
helm get values tbtq -n tbtq

# Break it — a tag that doesn't exist
helm upgrade tbtq ./tbtq-chart -n tbtq --set privatebin.tag=this-tag-does-not-exist

helm history tbtq -n tbtq
# Revision 2, status "deployed" — Helm thinks it worked

kubectl -n tbtq get pods -l app=privatebin
# → ImagePullBackOff. The rollout is stuck but the old pod is still serving.

curl -sI https://drop.example.com/__heartbeat__ | head -1
# → HTTP/2 200  — the deployment's maxUnavailable kept the old pod alive

# Roll back to revision 1
helm rollback tbtq 1 -n tbtq
helm history tbtq -n tbtq
# Revision 3, recorded as a rollback to 1

kubectl -n tbtq get pods -l app=privatebin
# Healthy again

# The version you actually want in automation:
helm upgrade tbtq ./tbtq-chart -n tbtq --atomic --wait --timeout 5m

Alternative — adopting instead of rebuilding

for kind in deployment service ingress pvc cronjob networkpolicy; do
  for obj in $(kubectl -n tbtq get $kind -o name 2>/dev/null); do
    kubectl -n tbtq annotate $obj \
      meta.helm.sh/release-name=tbtq \
      meta.helm.sh/release-namespace=tbtq --overwrite
    kubectl -n tbtq label $obj app.kubernetes.io/managed-by=Helm --overwrite
  done
done

# StatefulSet and its PVCs need care — adopt the StatefulSet only:

Check yourself

Phase 9 — Cleanup + CI/CD Optional

kubectl -n tbtq exec deploy/redis -- redis-cli BGREWRITEAOF
kubectl -n tbtq cp redis-<pod-suffix>:/data ./redis-snapshot

Orphan cleanup CronJob

# manifests/cleanup.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: send-orphan-cleanup
  namespace: tbtq
spec:
  schedule: "17 * * * *"
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app: send-orphan-cleanup
        spec:
          containers:
            - name: cleanup
              image: alpine:3.20
              command: ["/bin/sh", "-c"]
              args:
                - |
                  # MAX_EXPIRE_SECONDS is 86400, so anything past 48h is dead.
                  find /uploads -type f -mmin +2880 -print -delete
              volumeMounts:
                - name: send-data
                  mountPath: /uploads
          restartPolicy: OnFailure
          volumes:
            - name: send-data
              persistentVolumeClaim:
                claimName: send-data

GitHub Actions CI/CD

# .github/workflows/deploy.yml
name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Deploy to k3s
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.VM_HOST }}
          username: root
          key: ${{ secrets.VM_SSH_KEY }}
          script: |
            set -euo pipefail
            cd ~/tbtq
            git pull --ff-only
            kubectl apply -f manifests/
            kubectl -n tbtq rollout status deployment/send       --timeout=120s
            kubectl -n tbtq rollout status deployment/privatebin --timeout=120s

Troubleshooting