From d9a484758beff666a4d873b8e6c44c080afee1a9 Mon Sep 17 00:00:00 2001
From: Marco Lecheler <marco.lecheler@mercedes-benz.com>
Date: Sun, 11 Oct 2026 19:37:22 +0200
Subject: [PATCH] feat(paperless-gpt): add optional ingress

---
 charts/paperless-gpt/Chart.yaml             |  4 +--
 charts/paperless-gpt/README.md              | 22 ++++++++++++--
 charts/paperless-gpt/templates/ingress.yaml | 33 +++++++++++++++++++++
 charts/paperless-gpt/values.yaml            | 23 ++++++++++++++
 4 files changed, 78 insertions(+), 4 deletions(-)
 create mode 100644 charts/paperless-gpt/templates/ingress.yaml

diff --git a/charts/paperless-gpt/Chart.yaml b/charts/paperless-gpt/Chart.yaml
index 761e3ae..d2f9f1a 100644
--- a/charts/paperless-gpt/Chart.yaml
+++ b/charts/paperless-gpt/Chart.yaml
@@ -15,7 +15,7 @@ sources:
   - https://github.com/taskmedia/helm
 icon: https://media.task.media/images/logo.png
 type: application
-version: 0.1.0
+version: 0.2.0
 # upstream image tag without the leading v
 appVersion: "0.29.0"
 
@@ -31,4 +31,4 @@ annotations:
       image: icereed/paperless-gpt:v0.29.0
   artifacthub.io/changes: |
     - kind: added
-      description: Initial chart for paperless-gpt
+      description: Optional ingress (ingress.*) for cert-manager and authenticating proxy integration
diff --git a/charts/paperless-gpt/README.md b/charts/paperless-gpt/README.md
index 408e93e..89b8004 100644
--- a/charts/paperless-gpt/README.md
+++ b/charts/paperless-gpt/README.md
@@ -4,8 +4,8 @@ Helm chart for [paperless-gpt](https://github.com/icereed/paperless-gpt), an LLM
 metadata assistant for [paperless-ngx](https://docs.paperless-ngx.com/). It uses the official
 upstream image `icereed/paperless-gpt`.
 
-> **paperless-gpt has no built-in authentication.** The chart creates a `ClusterIP` service only;
-> put an authenticating proxy (e.g. forward-auth) in front of any ingress.
+> **paperless-gpt has no built-in authentication.** The ingress is disabled by default; always put
+> an authenticating proxy (e.g. forward-auth) in front of it.
 
 ## Usage
 
@@ -56,6 +56,24 @@ config:
 Any upstream [environment variable](https://github.com/icereed/paperless-gpt#configuration) can be
 set via `config` (plain), `secretConfig` (stored in a chart-managed secret) or `existingSecret`.
 
+## Ingress
+
+Optional standard `Ingress`; with the cert-manager annotation the TLS certificate is created
+automatically (example for Traefik, cert-manager and an authentik forward-auth middleware):
+
+```yaml
+ingress:
+  enabled: true
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: authentik-proxy@kubernetescrd
+  host: gpt.example.com
+  tls:
+    secretName: paperless-gpt-tls
+```
+
 ## Notes
 
 - Runs a single replica with the `Recreate` strategy: state is a local SQLite database.
diff --git a/charts/paperless-gpt/templates/ingress.yaml b/charts/paperless-gpt/templates/ingress.yaml
new file mode 100644
index 0000000..1c41f91
--- /dev/null
+++ b/charts/paperless-gpt/templates/ingress.yaml
@@ -0,0 +1,33 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: "{{ include "paperlessgpt.fullname" . }}"
+  labels:
+    {{- include "paperlessgpt.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- with .Values.ingress.tls.secretName }}
+  tls:
+    - secretName: {{ . }}
+      hosts:
+        - {{ required "ingress.host is required" $.Values.ingress.host | quote }}
+  {{- end }}
+  rules:
+    - host: {{ required "ingress.host is required" .Values.ingress.host | quote }}
+      http:
+        paths:
+          - path: {{ .Values.ingress.path }}
+            pathType: {{ .Values.ingress.pathType }}
+            backend:
+              service:
+                name: "{{ include "paperlessgpt.fullname" . }}"
+                port:
+                  name: http
+{{- end }}
diff --git a/charts/paperless-gpt/values.yaml b/charts/paperless-gpt/values.yaml
index ad8c6e4..4af53ec 100644
--- a/charts/paperless-gpt/values.yaml
+++ b/charts/paperless-gpt/values.yaml
@@ -70,6 +70,29 @@ service:
   port: 8080
   annotations: {}
 
+# ingress exposes the service. paperless-gpt has no built-in authentication:
+# always add an authenticating proxy (e.g. forward-auth middleware) in front.
+# Example (Traefik + cert-manager + authentik):
+#   enabled: true
+#   annotations:
+#     cert-manager.io/cluster-issuer: letsencrypt-prod
+#     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+#     traefik.ingress.kubernetes.io/router.tls: "true"
+#     traefik.ingress.kubernetes.io/router.middlewares: authentik-proxy@kubernetescrd
+#   host: gpt.example.com
+#   tls:
+#     secretName: paperless-gpt-tls
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  host: ""
+  path: /
+  pathType: Prefix
+  tls:
+    # secretName enables TLS for ingress.host (certificate e.g. created by cert-manager)
+    secretName: ""
+
 # runs as non-root; the entrypoint then skips PUID/PGID handling
 podSecurityContext:
   runAsNonRoot: true