From 7aa2f6e4f22eefdbed6192d983654f1f1959cde1 Mon Sep 17 00:00:00 2001
From: yael-tramier <tramier.yael@gmail.com>
Date: Sun, 28 Jun 2026 16:52:40 +0200
Subject: [PATCH] feat(helm): Add existingClaim variable for custom PVC usage.

---
 charts/README.md                      | 1 +
 charts/trek/templates/NOTES.txt       | 1 +
 charts/trek/templates/deployment.yaml | 4 ++--
 charts/trek/templates/pvc.yaml        | 4 +++-
 charts/trek/values.yaml               | 3 +++
 5 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/charts/README.md b/charts/README.md
index 6de5de278..5d6cb8123 100644
--- a/charts/README.md
+++ b/charts/README.md
@@ -40,6 +40,7 @@ See `values.yaml` for more options.
 ## Notes
 - Ingress is off by default. Enable and configure hosts for your domain.
 - PVCs use the cluster's default StorageClass. Set `persistence.data.storageClassName` and/or `persistence.uploads.storageClassName` to bind a specific class.
+- If you want to use your own PVCs, set `persistence.data.existingClaim` or `persistence.uploads.existingClaim` to bind it. The other PVCs values ​​will be ignored (size, storageClassName, annotations).
 - `JWT_SECRET` is managed entirely by the server — auto-generated into the data PVC on first start and rotatable via the admin panel (Settings → Danger Zone). No Helm configuration needed.
 - `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via `secretEnv.ENCRYPTION_KEY` or `existingSecret`. If left empty, the server falls back automatically: existing installs use `data/.jwt_secret` (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
 - If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
diff --git a/charts/trek/templates/NOTES.txt b/charts/trek/templates/NOTES.txt
index 0e258f437..0c7d2111c 100644
--- a/charts/trek/templates/NOTES.txt
+++ b/charts/trek/templates/NOTES.txt
@@ -18,6 +18,7 @@
    - Generate a random key at install: `--set generateEncryptionKey=true`
    - Use an existing secret: `--set existingSecret=my-k8s-secret`
    - Use a custom key name in the existing secret: `--set existingSecret=my-k8s-secret --set existingSecretKey=MY_ENC_KEY`
+   - Use your own PVCs, set `persistence.data.existingClaim` or `persistence.uploads.existingClaim` to bind it. The other PVCs values ​​will be ignored (size, storageClassName, annotations).
 
 4. Only one method should be used at a time. If both `generateEncryptionKey` and `existingSecret` are
    set, `existingSecret` takes precedence. Ensure the referenced secret and key exist in the namespace.
diff --git a/charts/trek/templates/deployment.yaml b/charts/trek/templates/deployment.yaml
index d79ae3441..5fe9914c8 100644
--- a/charts/trek/templates/deployment.yaml
+++ b/charts/trek/templates/deployment.yaml
@@ -83,7 +83,7 @@ spec:
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: {{ include "trek.fullname" . }}-data
+            claimName: {{ default (printf "%s-data" (include "trek.fullname" .)) .Values.persistence.data.existingClaim }}
         - name: uploads
           persistentVolumeClaim:
-            claimName: {{ include "trek.fullname" . }}-uploads
+            claimName: {{ default (printf "%s-uploads" (include "trek.fullname" .)) .Values.persistence.uploads.existingClaim }}
diff --git a/charts/trek/templates/pvc.yaml b/charts/trek/templates/pvc.yaml
index b3a069064..5e6872dea 100644
--- a/charts/trek/templates/pvc.yaml
+++ b/charts/trek/templates/pvc.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.persistence.enabled }}
+{{- if and .Values.persistence.enabled (not .Values.persistence.data.existingClaim) }}
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
@@ -18,7 +18,9 @@ spec:
   resources:
     requests:
       storage: {{ .Values.persistence.data.size }}
+{{- end }}
 ---
+{{- if and .Values.persistence.enabled (not .Values.persistence.uploads.existingClaim) }}
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
diff --git a/charts/trek/values.yaml b/charts/trek/values.yaml
index a87a4665d..e01bb7d58 100644
--- a/charts/trek/values.yaml
+++ b/charts/trek/values.yaml
@@ -106,10 +106,13 @@ persistence:
     size: 1Gi
     # Leave empty to use the cluster's default StorageClass; set to bind a specific class.
     storageClassName: ""
+    # Specify an existing PVC to use. The other values ​​will be ignored.
+    existingClaim: ""
     annotations: {}
   uploads:
     size: 1Gi
     storageClassName: ""
+    existingClaim: ""
     annotations: {}
 
 resources: