Quickstart

This puts a complete Lembos on a local Kubernetes cluster: one pod per service, PostgreSQL, Redis and Temporal beside them, a mail catcher for invitations, and TLS from a certificate authority the install generates. It is the fastest way to see the Portal with your own eyes.

What you needCopy Anchor Link

• Helm 3 and kubectl
• Git, to fetch the chart
• A k3s cluster with about 4 CPUs and 8 GiB of memory to spare:

  • macOS — colima with Kubernetes:

    Copy Text

    colima start --kubernetes --cpu 4 --memory 8
    kubectl config use-context colima

  • Linux — k3s itself.

1. InstallCopy Anchor Link

git clone https://github.com/lembosproj/deploy && cd deploy

helm repo add dandydeveloper https://dandydeveloper.github.io/charts
helm repo add temporal https://go.temporal.io/helm-charts
helm dependency build charts/lembos

helm upgrade --install lembos charts/lembos -n lembos --create-namespace \
  -f charts/lembos/values-k3s.yaml

2. Let the cluster find itselfCopy Anchor Link

Once per cluster, restart CoreDNS so *.lembos.localhost resolves to the ingress inside the cluster as well as outside it:

kubectl -n kube-system rollout restart deployment/coredns

3. Wait for it to come upCopy Anchor Link

kubectl -n lembos get pods -w

The first install takes a few minutes, most of it pulling images. Some services restart once or twice while they wait for the database and Temporal to accept connections — that is expected.

4. Trust the certificateCopy Anchor Link

Every address is served with a certificate from a CA the install generated. Trust it once:

kubectl -n lembos get secret lembos-ingress-ca -o jsonpath='{.data.ca\.crt}' | base64 -d > lembos-ca.crt

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain lembos-ca.crt

Firefox keeps its own store: import the file under Settings → Certificates.

5. Sign inCopy Anchor Link

Open https://portal.lembos.localhost and sign in as [email protected]. The password was generated for you:

kubectl -n lembos get secret lembos-secrets -o jsonpath='{.data.identity-admin-password}' | base64 -d; echo

Invitations, confirmations and password resets land in the mail catcher; nothing leaves the cluster.

Clean upCopy Anchor Link

helm uninstall lembos -n lembos     # keeps the generated secrets and the data
kubectl delete namespace lembos     # removes everything, the CA included

NextCopy Anchor Link

• Concepts — what you are looking at.
• Install — the same thing in a cluster other people use.