feat!: Appwrite 2.5.0, built-in object storage, Functions and Sites on by default

.github/workflows/e2e-nightly.yaml

@@ -1,8 +1,8 @@
 name: Nightly end-to-end
 
 # Functions built and executed in the cluster (the executor on
-# Docker-in-Docker), with every optional component, which takes longer than
-# PR checks should.
+# Docker-in-Docker, the built-in object storage), with every optional
+# component, which takes longer than PR checks should.
 on:
   schedule:
     - cron: "17 3 * * *"
@@ -42,10 +42,8 @@ jobs:
           kubectl apply --server-side -f "https://github.com/kubernetes-sigs/gateway-api/releases/download/${GATEWAY_API_VERSION}/standard-install.yaml"
           helm upgrade --install traefik traefik --repo https://traefik.github.io/charts --version "${TRAEFIK_CHART_VERSION}" \
             -n traefik --create-namespace -f hack/fixtures/traefik-values.yaml --wait --timeout 5m
-      - name: Start the compute plane
-        run: hack/compute-plane.sh "${RUNNER_TEMP}/compute-values.yaml"
       - name: Install with every optional component
-        run: make install VALUES="charts/appwrite/ci/full-values.yaml ${RUNNER_TEMP}/compute-values.yaml"
+        run: make install VALUES=charts/appwrite/ci/full-values.yaml
       - name: helm test
         run: make helm-test
       - name: Smoke test (includes a screenshot through the browser service)
@@ -73,6 +71,3 @@ jobs:
           kubectl -n appwrite-executor logs deploy/appwrite-executor --all-containers --prefix --tail=200 || true
           kubectl -n appwrite-executor exec deploy/appwrite-executor -c dind -- docker ps -a || true
           echo "::endgroup::"
-          echo "::group::aw-s3"
-          docker logs aw-s3 --tail=200 || true
-          echo "::endgroup::"

.github/workflows/test-install.yaml

@@ -29,7 +29,7 @@ concurrency:
 
 jobs:
   install:
-    name: ${{ matrix.scenario }} (k8s ${{ matrix.kubernetes }})${{ matrix.upgrade-from && format(' upgrade from {0}', matrix.upgrade-from) || '' }}
+    name: ${{ matrix.scenario }} (k8s ${{ matrix.kubernetes }})${{ matrix.upgrade-from && format(' upgrade from chart {0}', matrix.upgrade-from) || '' }}
     runs-on: >-
       ${{ (github.event_name != 'pull_request'
       || github.event.pull_request.head.repo.full_name == github.repository)
@@ -52,10 +52,12 @@ jobs:
             kubernetes: v1.37.0
           - scenario: grouped-workers
             kubernetes: v1.37.0
-          # Install the previous Appwrite release, then upgrade to the chart's.
+          # Install a published chart release with its own defaults and
+          # Appwrite version, then upgrade to this chart's: the chart upgrade
+          # and Appwrite's data migration.
           - scenario: default
             kubernetes: v1.37.0
-            upgrade-from: 2.2.0
+            upgrade-from: 1.0.0
           # PostgreSQL, Redis and ClickHouse outside the release.
           - scenario: external-dbs
             kubernetes: v1.37.0
@@ -106,21 +108,21 @@ jobs:
         # instead of as a 15-minute install timeout.
         run: |
           # shellcheck disable=SC2016 # expanded inside the pod
-          kubectl -n appwrite run dns-check --rm -i --restart=Never --image=docker.io/appwrite/appwrite:2.3.0 --command -- sh -c '
+          kubectl -n appwrite run dns-check --rm -i --restart=Never --image=docker.io/appwrite/appwrite:2.5.0 --command -- sh -c '
             cat /etc/resolv.conf
             ok=0
             for host in postgres.external-dbs.svc.cluster.local postgres.external-dbs.svc postgres.external-dbs; do
               if getent hosts "$host"; then echo "resolved $host"; else echo "FAILED $host"; ok=1; fi
             done
             exit $ok'
-      - name: Install Appwrite ${{ matrix.upgrade-from }}
+      - name: Install chart ${{ matrix.upgrade-from }}
         if: matrix.upgrade-from
         env:
           SCENARIO: ${{ matrix.scenario }}
           UPGRADE_FROM: ${{ matrix.upgrade-from }}
         run: |
-          helm upgrade --install appwrite charts/appwrite -n appwrite --create-namespace \
-            -f "charts/appwrite/ci/${SCENARIO}-values.yaml" --set "image.tag=${UPGRADE_FROM}" --wait --timeout 15m
+          helm upgrade --install appwrite oci://ghcr.io/appwrite/charts/appwrite --version "${UPGRADE_FROM}" \
+            -n appwrite --create-namespace -f "charts/appwrite/ci/${SCENARIO}-values.yaml" --wait --timeout 15m
           make smoke
       - name: Install
         env:

.gitignore

@@ -12,3 +12,4 @@ charts/*/tests/__snapshot__/*.tmp
 .idea/
 .vscode/
 .variables.php
+.env-defaults.yaml

CHANGELOG.md

@@ -8,6 +8,46 @@ annotation in `charts/appwrite/Chart.yaml`.
 
 ## [Unreleased]
 
+### Changed
+
+- Functions and Sites are on by default: `compute.enabled` and
+  `compute.executor.privileged` default to `true`, so a plain install runs
+  the executor as a privileged pod in a namespace of its own. Set
+  `compute.enabled: false` on clusters that forbid privileged pods.
+- Files are stored in object storage by default: `storage.device` defaults
+  to `s3`, served by the built-in SeaweedFS. To keep 1.0.0's behaviour, set
+  `storage.device: local` and `compute.enabled: false`.
+- Appwrite 2.5.0, with console 1.2.74, executor 1.1.2, browser 0.3.6 and
+  geo 0.3.2, and the new trusted-proxy, internal-address and DNS settings in
+  the environment defaults ([networking.md](docs/networking.md#tls-and-forcehttps)).
+- External S3 settings move to `storage.s3.external.endpoint` and
+  `storage.s3.external.region`, with `storage.s3.mode: external`. Setting
+  the old keys fails with where they went.
+- ClickHouse drops its per-second metric, trace and text logs and gives
+  tables left behind by a config change a TTL, as Appwrite 2.4.0 does.
+- CI upgrades from the published chart 1.0.0 with default values.
+
+### Added
+
+- Built-in object storage: SeaweedFS as a single-replica StatefulSet
+  (`storage.s3.mode: builtin`), with generated keys, the bucket created on
+  start, and a NetworkPolicy that admits only Appwrite, the orchestrator,
+  builds and the executor ([storage.md](docs/storage.md#built-in-object-storage)).
+- Troubleshooting for deployments that fail with an internal error while
+  Functions and Sites are off.
+
+### Removed
+
+- The assistant: Appwrite removed it in 2.4.0. Setting `assistant.*` fails
+  with that message.
+
+### Fixed
+
+- Site screenshots: the browser gets the API Service in `ALLOWED_HOSTS`, as
+  browser 0.3.5 and later require for private addresses.
+- `make env-defaults` works with Appwrite 2.4.0 and later, and no longer
+  leaves an error message in `files/env-defaults.yaml` when it fails.
+
 ## [1.0.0] - 2026-10-13
 
 First release of the chart, for Appwrite 2.3.0.

CONTRIBUTING.md

@@ -80,12 +80,11 @@ make install VALUES="charts/appwrite/ci/default-values.yaml my-values.yaml"
 make kind-down
 ```
 
-Functions and Sites need S3 and the executor. `hack/compute-plane.sh` starts
-an S3 server next to the kind cluster and writes the values for it:
+Functions and Sites are on by default, on the built-in object storage. To
+build and execute a function as the nightly workflow does:
 
 ```console
-hack/compute-plane.sh /tmp/compute-values.yaml
-make install VALUES="charts/appwrite/ci/full-values.yaml /tmp/compute-values.yaml"
+make install VALUES=charts/appwrite/ci/full-values.yaml
 hack/functions-smoke.sh appwrite appwrite node-22
 ```
 
@@ -157,7 +156,7 @@ also opens a pull request for `appVersion`). To follow it:
    new version's `app/config/variables.php`, and review the diff. New
    variables may need values or computed settings in `templates/_env.tpl`.
 3. Compare the new version's `docker-compose.yml` with the chart: image tags
-   of the console, geo, assistant, browser and other components, the
+   of the console, geo, browser and other components, the
    orchestrator and executor versions, new workers or queues
    (`app/config/workers.php`, mirrored by the queue catalog in
    `templates/workers/_workers.tpl` and by `workers.queues`), and new tasks.
@@ -193,9 +192,8 @@ hack/appwrite-e2e.sh ~/source/appwrite appwrite appwrite --filter testCreateUser
 
 It reconfigures the release for testing (development mode, open console
 sign-up, mail and request catchers), so only point it at a throwaway install.
-Functions and Sites suites need the compute plane
-(`hack/compute-plane.sh` writes the values) and the runtimes they use in
-`compute.functionsRuntimes`. Suites that need a fresh instance (the first
+Functions and Sites suites need the runtimes they use in
+`compute.functionsRuntimes` (as `charts/appwrite/ci/full-values.yaml` sets). Suites that need a fresh instance (the first
 organization in Teams), GitHub or Gitea, or ClamAV don't pass against a shared
 install.
 

Makefile

@@ -54,7 +54,9 @@ docs: ## Regenerate the chart README with helm-docs
 .PHONY: env-defaults
 env-defaults: ## Regenerate files/env-defaults.yaml from Appwrite's variables.php at APP_VERSION
 	curl -fsSL "https://raw.githubusercontent.com/appwrite/appwrite/$(APP_VERSION)/app/config/variables.php" -o .variables.php
-	php hack/gen-env-defaults.php .variables.php $(APP_VERSION) > $(CHART)/files/env-defaults.yaml
+	@# Into a temporary file first: PHP prints fatal errors to stdout.
+	php hack/gen-env-defaults.php .variables.php $(APP_VERSION) > .env-defaults.yaml || { rm -f .variables.php .env-defaults.yaml; exit 1; }
+	mv .env-defaults.yaml $(CHART)/files/env-defaults.yaml
 	rm -f .variables.php
 
 .PHONY: images

README.md

@@ -10,7 +10,7 @@ to production, swap each of those for a managed service, one at a time.
 
 | | |
 | --- | --- |
-| Appwrite | 2.3.0 |
+| Appwrite | 2.5.0 |
 | Kubernetes | 1.29 or later |
 | Helm | 4, or 3.18 or later |
 | Chart | `oci://ghcr.io/appwrite/charts/appwrite` |
@@ -60,7 +60,7 @@ cluster. Without it, a database backup can't be read:
 kubectl -n appwrite get secret appwrite -o jsonpath='{.data._APP_OPENSSL_KEY_V1}' | base64 -d
 ```
 
-To install a branch, or before the first release is on `ghcr.io`, use
+To install a branch, use
 `./charts/appwrite` from a clone in place of the `oci://` reference
 ([installing from source](docs/getting-started.md#installing-from-source)).
 
@@ -88,7 +88,7 @@ Every guide is listed in [`docs/`](docs/README.md), and every example in
 | PostgreSQL | built-in StatefulSet | RDS, Cloud SQL, Azure, CloudNativePG; or MariaDB, MySQL, MongoDB | [External databases](docs/external-databases.md#postgresql) |
 | Redis | built-in StatefulSet | ElastiCache, Memorystore, Azure Cache, Valkey | [External databases](docs/external-databases.md#redis) |
 | ClickHouse | built-in StatefulSet | ClickHouse Cloud, Altinity operator | [External databases](docs/external-databases.md#clickhouse) |
-| File storage | PersistentVolumeClaim | S3, R2, GCS, Spaces, MinIO, ... | [Storage](docs/storage.md#s3) |
+| File storage, deployments and builds | built-in object storage (SeaweedFS) | S3, R2, GCS, Spaces, MinIO, ...; or a PersistentVolumeClaim | [Storage](docs/storage.md#s3) |
 | Email | off | any SMTP server: SES, SendGrid, Postmark, ... | [Integrations](docs/integrations.md#email-smtp) |
 | Git deployments, console sign-in, SMS, Sentry | off | GitHub, GitLab, Gitea, Bitbucket, Google, Twilio, ... | [Integrations](docs/integrations.md) |
 

charts/appwrite/Chart.yaml

@@ -3,10 +3,10 @@ name: appwrite
 description: Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.
 type: application
 version: 1.0.0
-appVersion: "2.3.0"
+appVersion: "2.5.0"
 kubeVersion: ">=1.29.0-0"
 home: https://github.com/appwrite/helm-chart
-icon: https://raw.githubusercontent.com/appwrite/appwrite/2.3.0/public/images/logos/appwrite-icon.svg
+icon: https://raw.githubusercontent.com/appwrite/appwrite/2.5.0/public/images/logos/appwrite-icon.svg
 sources:
   - https://github.com/appwrite/helm-chart
   - https://github.com/appwrite/appwrite
@@ -61,13 +61,11 @@ annotations:
       description: '`values.schema.json`, `helm test` pods, documentation from getting started to backups, GitOps and troubleshooting, and example values files for local, production, external services, AWS, GCP, Azure, and Functions and Sites installs.'
   artifacthub.io/images: |
     - name: appwrite
-      image: docker.io/appwrite/appwrite:2.3.0
-    - name: assistant
-      image: docker.io/appwrite/assistant:0.8.4
+      image: docker.io/appwrite/appwrite:2.5.0
     - name: autogravity
       image: ghcr.io/appwrite/autogravity:0.0.11
     - name: browser
-      image: docker.io/appwrite/browser:0.3.4
+      image: docker.io/appwrite/browser:0.3.6
     - name: builds
       image: ghcr.io/open-runtimes/orchestrator/job-sidecar:2.2.3
     - name: builtin
@@ -76,20 +74,22 @@ annotations:
       image: docker.io/library/redis:7.4.11-alpine
     - name: builtin
       image: docker.io/clickhouse/clickhouse-server:26.4.5-alpine
+    - name: builtin
+      image: docker.io/chrislusf/seaweedfs:4.48
     - name: builtin-exporter
       image: quay.io/prometheuscommunity/postgres-exporter:v0.20.1
     - name: builtin-exporter
       image: docker.io/oliver006/redis_exporter:v1.93.0-alpine
     - name: console
-      image: docker.io/appwrite/new:1.1.159-self-hosted
+      image: docker.io/appwrite/new:1.2.74-self-hosted
     - name: dind
       image: docker.io/library/docker:29.9.0-dind
     - name: embedding
       image: docker.io/appwrite/embedding:0.3.1
     - name: executor
-      image: docker.io/openruntimes/executor:0.29.0
+      image: docker.io/openruntimes/executor:1.1.2
     - name: geo
-      image: docker.io/appwrite/geo:0.3.1
+      image: docker.io/appwrite/geo:0.3.2
     - name: orchestrator
       image: ghcr.io/open-runtimes/orchestrator/jobs-service:2.2.3
   artifacthub.io/displayName: Appwrite