🚀 SlyCharts - The sly Helm Charts

⚠️ IMPORTANT ANNOUNCEMENT - GitHub Pages Helm Repository Deprecation

The traditional GitHub Pages Helm repository (https://slydlake.github.io/helm-charts) is being phased out.

✅ Migration Required: Please switch to our OCI registry for all future installations and updates:

oci://ghcr.io/slybase/charts/<chart-name>

📅 Timeline:

• ✅ Now: OCI registry fully operational (recommended)
• ⚠️ ** 30th November 2025:** GitHub Pages repo will be removed

📖 Migration Guide below

A collection of production-ready Helm charts for self-hosted applications, featuring signed charts for enhanced security.

🔐 Security Features

All charts in this repository are signed with Cosign using keyless signing for maximum security and trust:

• ✅ Cryptographically Signed - Every chart release is signed
• ✅ Keyless Verification - No private key management required
• ✅ FluxCD Compatible - Native signature verification support
• ✅ Multiple Distribution - Available via traditional Helm repos and OCI registry

📖 Complete Signing & Verification Guide →

📦 Available Charts

Chart	Description	Version	Status
wg-easy	WireGuard VPN with web interface		✅ Signed
wireguard	WireGuard VPN server		✅ Signed
wordpress	WordPress with MariaDB and Memcached		✅ Signed

🚀 Quick Start

OCI Registry (✅ Recommended)

# Install directly from OCI registry
helm install wg-easy oci://ghcr.io/slybase/charts/wg-easy

# With custom values
helm install wg-easy oci://ghcr.io/slybase/charts/wg-easy \
  --values my-values.yaml

Traditional Helm Repository (⚠️ Deprecated)

⚠️ This method is deprecated. Please use OCI registry instead.

# Add repository (not recommended)
helm repo add slydlake https://slydlake.github.io/helm-charts
helm repo update

# Install a chart
helm install wg-easy slydlake/wg-easy

FluxCD with Signature Verification

apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: slybase-oci-charts
  namespace: flux-system
spec:
  type: oci
  interval: 10m
  url: oci://ghcr.io/slybase/charts
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: wg-easy
  namespace: default
spec:
  interval: 10m
  chart:
    spec:
      chart: wg-easy
      sourceRef:
        kind: HelmRepository
        name: slybase-oci-charts
        namespace: flux-system
      verify:
        provider: cosign # Enable signature verification

🔍 Chart Verification

Verify chart authenticity before installation:

# For OCI charts
cosign verify ghcr.io/slybase/charts/wg-easy:latest \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate-identity "https://github.com/slydlake/helm-charts/.github/workflows/oci-release.yaml@refs/heads/main"

# For traditional charts (download signature bundle first)
cosign verify-blob chart.tgz \
  --bundle chart.tgz.cosign.bundle \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate-identity "https://github.com/slydlake/helm-charts/.github/workflows/release.yaml@refs/heads/main"

🏗️ Development

Prerequisites

• Helm 3.8+
• Cosign (for verification)
• FluxCD (for GitOps deployment)

Local Testing

# Clone repository
git clone https://github.com/slydlake/helm-charts.git
cd helm-charts

# Test chart rendering
helm template charts/wg-easy

# Install locally
helm install test-release charts/wg-easy --dry-run

🔄 Migration from GitHub Pages Repo to OCI

Why Migrate?

✅ Benefits of OCI Registry:

• 🚀 Faster chart downloads
• 🔐 Better security integration
• 📦 Industry standard (Docker-like registry)
• 🎯 Simplified authentication
• 🔄 Native Cosign signature verification

Migration Steps

1. Remove old Helm repository (if configured)

helm repo remove slydlake

2. Update your installations to OCI

For existing deployments:

# Upgrade using OCI registry (preserves all settings)
helm upgrade <release-name> oci://ghcr.io/slybase/charts/<chart-name> \
  --namespace <namespace> \
  --reuse-values

For new deployments:

# Install from OCI registry
helm install <release-name> oci://ghcr.io/slybase/charts/<chart-name> \
  --namespace <namespace> \
  --values values.yaml

3. For FluxCD Users

Update your HelmRelease resources:

apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: slydlake-oci
spec:
  type: oci
  url: oci://ghcr.io/slybase/charts
  interval: 5m
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: wireguard
spec:
  chart:
    spec:
      chart: wireguard
      sourceRef:
        kind: HelmRepository
        name: slydlake-oci
      verify:
        provider: cosign  # ✅ Native signature verification!

4. Verify Migration

helm list -A | grep <your-release>
# Should show OCI source

What Stays the Same?

• ✅ All values.yaml configurations
• ✅ No pod restarts needed
• ✅ Same features and functionality
• ✅ Cosign signatures (even better integrated!)

Need Help?

• 📖 Full OCI Guide
• 🐛 Open an Issue
• 💬 Discussions

---

🔄 Release Process

Charts are automatically released on every push to main branch:

1. OCI Release (✅ Primary): Signed OCI artifacts to ghcr.io/slybase/charts
2. Traditional Release (⚠️ Deprecated): GitHub Pages (being phased out)
3. Signing: All charts signed with Cosign keyless signing
4. Verification: Automatic signature verification in CI/CD

Note: The GitHub Pages Helm repository (method #2) is deprecated and will be disabled soon. All new releases prioritize OCI distribution.

🌟 ArtifactHub

Find these charts on ArtifactHub with verified signatures for enhanced trust and discovery.

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🤝 Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Test your changes
5. Submit a pull request

🔗 Links

• Documentation: Chart Signing Guide
• Issues: GitHub Issues
• OCI Registry: ghcr.io/slybase/charts
• Traditional Repo: slydlake.github.io/helm-charts