✨(project) Django boilerplate

This commit introduces a boilerplate inspired by https://github.com/numerique-gouv/impress. The code has been cleaned to remove unnecessary Impress logic and dependencies. Changes made: - Removed Minio, WebRTC, and create bucket from the stack. - Removed the Next.js frontend (it will be replaced by Vite). - Cleaned up impress-specific backend logics. The whole stack remains functional: - All tests pass. - Linter checks pass. - Agent Connexion sources are already set-up. Why clear out the code? To adhere to the KISS principle, we aim to maintain a minimalist codebase. Cloning Impress allowed us to quickly inherit its code quality tools and deployment configurations for staging, pre-production, and production environments. What’s broken? - The tsclient is not functional anymore. - Some make commands need to be fixed. - Helm sources are outdated. - Naming across the project sources are inconsistent (impress, visio, etc.) - CI is not configured properly. This list might be incomplete. Let's grind it.
2024-01-09 15:30:36 +01:00
parent 2d81979b0a
commit 5b1a2b20de
146 changed files with 12668 additions and 1 deletions
--- a/src/helm/env.d/dev/secrets.enc.yaml
+++ b/src/helm/env.d/dev/secrets.enc.yaml
@@ -0,0 +1,60 @@
+djangoSecretKey: ENC[AES256_GCM,data:2b4nHO2i/HtaNJYi1d8xJyhCpK1qV7fHD45T6VarWpNg1HkcJgC7zTgHMEvfedRd2tE=,iv:qcHlXG/mNr3CFtZhjbw3AVRbMxkGZaAZPtHtS8ksO58=,tag:mTC6mc5JKqpEQ/9ubggKmA==,type:str]
+oidc:
+    clientId: ENC[AES256_GCM,data:gcwhXfL4iNwWWleR/l3p2aRSp9nsdLhQtUMlglLqJSdDy6iu,iv:WxK7BBQrVa115dsHEiMC7NyvlQXuhLiZzHYSuhZYy4w=,tag:RYwutm8QB+mIl7b+AYvqxg==,type:str]
+    clientSecret: ENC[AES256_GCM,data:9rU6HWRiX+6afLf4fGyIRyiv/pyihbCbO9DA2L4HOz/RAMaO9iZWW1QqIK8JCBuGh/XP1I3sd0mlbiXxCv1X3w==,iv:0NgcQtCVjIWhfzQbBx2Hh7NxumF3xW8nNuReUkvdk58=,tag:rkMAJ8Ilk8Pusw3PAyW/6A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age15fyxdwmg5mvldtqqus87xspuws2u0cpvwheehrtvkexj4tnsqqysw6re2x
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiem9OZTZYQnV5UVpzaHN0
+            MlpGL2xaMTVldkVPY2Jub3IxU2FhcVBNYWxvCk1qbHJFa2ZVdmp4Yy9COGFPNzlL
+            amh5S21qbm1jTlgxZjBZMk5BTllNZlUKLS0tIGM5aTJrbnRSdXZPWVF3RVR2dlRD
+            NThRV1hpb0k5RElvRlYySTZyMXp3dGsK92FrBnrHAIRcGooyJviJSUA+eHiwvVkm
+            b1T9jk9bmoipV/8WkXbGyk0TZKYuB4pvPE88eNLrYeotTiRu9tJUNw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16hnlml8yv4ynwy0seer57g8qww075crd0g7nsundz3pj4wk7m3vqftszg7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQUhLb2Z4N3ptTjBHZ3N3
+            cVBNMDJFS09wck9LcytJR1h4WCtlblZpYkJnCmdBN1laOGdiN1lKbUFBOTdLTUM1
+            NHFLZm51M0dLakIxcG1ncnFrb3dCeXMKLS0tIDdWUmlkYy9PSWhoYkRPNXc4aDNa
+            TWxUMUlqUHhNL3NZL0R2WE9ySU5wcTAKMzwEzXiGSGr4BJNZ78mo68V1Jq4ydOWl
+            dlSkEe+zv2jYYmLxirBDbLN+dwUwyAA8/eYYidvuMvHw1sfT14GyRw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1plkp8td6zzfcavjusmsfrlk54t9vn8jjxm8zaz7cmnr7kzl2nfnsd54hwg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiZFRjVmtiVXpONk4xZktB
+            TXo5OE1Jam1qREdPTjJSanUvd3R3dWI5SDA0CjZqZDNxZklNZXhvOExSaGlzOW85
+            OFYxMzhYMTFDUStpYTdLdEFEdUU3ZW8KLS0tIDVkYmVQMTcvbFhFa0xPb2h6TlFW
+            TmJUY2hncjg4TkhxOWRxazh5cXQyWHcKgDbgGfl1WQiT6tIG/pmikYUYIF0l4kj7
+            ZxlgL+Vn9y3fl5B2LGn/fXfi9B/exgLMCR/GRm3vF4OpPqLYbL0rzw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12g6f5fse25tgrwweleh4jls3qs52hey2edh759smulwmk5lnzadslu2cp3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWanllM2FDOStFNWVhR1A3
+            MVJMRDFCTHY3ZlF3MHg3MGxOWGRtSko0MVd3CmFheUllSkN4VTF5WmZubU1BeWtp
+            em1tL3dwWGszYmVYSUlwVVZDR3BIK0UKLS0tIDQrWEtuZGVSM3JwM0xYc2N2alpG
+            eEtzN3Y3UVZkQVlBd0dUWmdVdStSUmcKNQZ0uj0Sj3e7Q9PKsZi4CcS5LEWlD9tL
+            nOaoMiN1AA307uvePKgFAuChQ5VsAGMcegLJ5M8w516/+yO42yexUw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1qy04neuzwpasmvljqrcvhwnf0kz5cpyteze38c8avp0czewskasszv9pyw
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxa0F4VW5oRGFYSVpPOTVW
+            QjEvL2czQkRwK0tWOStxYkJRaUlHUjlSWWswClE4TW9tLy9oQXZQSVc3R3cwTGU1
+            ZGh4UTUzR0FKY0NmMFFaaTFKakVNNlkKLS0tIFRvZ0V5emV6cjBqNlZxOEpwVy8y
+            N0ZkVmNzTzhhRTA5TDMxc2tGN3BFemMKlyPtb7gfYREoPaU3ZlpynCuqxo4KW0b9
+            G+3aGz7SKZ7pcuAaWuuMdyA6XzwS/HOe2L2cW3P5x/0k0JQd2Ie8jA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-04-11T14:59:54Z"
+    mac: ENC[AES256_GCM,data:Pv37FsNCpk5Ckx3a+j+daPB6f34X5kIko/AZIQkgfRXs3SRJtAdp5VuwYTtwcp/s3Hxi6ZZPLZ+YRh6OqN5g3GaOBR4z2Ohv0ioB/5FLMICOt7VM/zroyXWIjWwpRPsRwjesba7nr9CqbQNDYt8ko4O9kR4w6y2JHbzLeOkohHc=,iv:+/B4m+c03e9iQMrijg7hJhDwQJZP55Bhnsr0n00Y2Cw=,tag:vXVZVbU+R1FpNVUSgnFA9A==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/src/helm/env.d/dev/values.impress.yaml.gotmpl
+++ b/src/helm/env.d/dev/values.impress.yaml.gotmpl
@@ -0,0 +1,105 @@
+image:
+  repository: localhost:5001/impress-backend
+  pullPolicy: Always
+  tag: "latest"
+
+backend:
+  replicas: 1
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: https://impress.127.0.0.1.nip.io,http://impress.127.0.0.1.nip.io
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: "*"
+    DJANGO_SECRET_KEY: {{ .Values.djangoSecretKey }}
+    DJANGO_SETTINGS_MODULE: impress.settings
+    DJANGO_SUPERUSER_PASSWORD: admin
+    DJANGO_EMAIL_HOST: "mailcatcher"
+    DJANGO_EMAIL_PORT: 1025
+    DJANGO_EMAIL_USE_SSL: False
+    OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID: {{ .Values.oidc.clientId }}
+    OIDC_RP_CLIENT_SECRET: {{ .Values.oidc.clientSecret }}
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://impress.127.0.0.1.nip.io
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://impress.127.0.0.1.nip.io
+    LOGIN_REDIRECT_URL_FAILURE: https://impress.127.0.0.1.nip.io
+    LOGOUT_REDIRECT_URL: https://impress.127.0.0.1.nip.io
+    DB_HOST: postgres-postgresql
+    DB_NAME: impress
+    DB_USER: dinum
+    DB_PASSWORD: pass
+    DB_PORT: 5432
+    POSTGRES_DB: impress
+    POSTGRES_USER: dinum
+    POSTGRES_PASSWORD: pass
+    REDIS_URL: redis://default:pass@redis-master:6379/1
+    AWS_S3_ENDPOINT_URL: http://minio.impress.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: impress
+    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_STORAGE_BUCKET_NAME: impress-media-storage
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+
+  migrate:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py migrate --no-input &&
+        python manage.py create_demo --force
+    restartPolicy: Never
+
+  command:
+    - "gunicorn"
+    - "-c"
+    - "/usr/local/etc/gunicorn/impress.py"
+    - "impress.wsgi:application"
+    - "--reload"
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email admin@example.com --password admin
+    restartPolicy: Never
+
+frontend:
+  envVars:
+    PORT: 8080
+    NEXT_PUBLIC_API_ORIGIN: https://impress.127.0.0.1.nip.io
+    NEXT_PUBLIC_SIGNALING_URL: wss://impress.127.0.0.1.nip.io/ws
+
+  replicas: 1
+  command:
+    - yarn
+    - dev
+
+  image:
+    repository: localhost:5001/impress-frontend
+    pullPolicy: Always
+    tag: "latest"
+
+webrtc:
+  replicas: 1
+
+  image:
+    repository: localhost:5001/impress-y-webrtc-signaling
+    pullPolicy: Always
+    tag: "latest"
+
+ingress:
+  enabled: true
+  host: impress.127.0.0.1.nip.io
+
+ingressWS:
+  enabled: true
+  host: impress.127.0.0.1.nip.io
+
+ingressAdmin:
+  enabled: true
+  host: impress.127.0.0.1.nip.io
--- a/src/helm/env.d/preprod/secrets.enc.yaml
+++ b/src/helm/env.d/preprod/secrets.enc.yaml
@@ -0,0 +1 @@
+../../../../secrets/numerique-gouv/impress/env/preprod/secrets.enc.yaml
--- a/src/helm/env.d/preprod/values.impress.yaml.gotmpl
+++ b/src/helm/env.d/preprod/values.impress.yaml.gotmpl
@@ -0,0 +1,147 @@
+image:
+  repository: lasuite/impress-backend
+  pullPolicy: Always
+  tag: "v0.1.0"
+
+backend:
+  migrateJobAnnotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: http://impress-preprod.beta.numerique.gouv.fr,https://impress-preprod.beta.numerique.gouv.fr
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: "*"
+    DJANGO_SUPERUSER_EMAIL:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_EMAIL
+    DJANGO_SECRET_KEY:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SECRET_KEY
+    DJANGO_SETTINGS_MODULE: impress.settings
+    DJANGO_SUPERUSER_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_PASSWORD
+    DJANGO_EMAIL_HOST: "snap-mail.numerique.gouv.fr"
+    DJANGO_EMAIL_PORT: 465
+    DJANGO_EMAIL_USE_SSL: True
+    DJANGO_SILENCED_SYSTEM_CHECKS: security.W008,security.W004
+    OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_ID
+    OIDC_RP_CLIENT_SECRET:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_SECRET
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://impress-preprod.beta.numerique.gouv.fr
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://impress-preprod.beta.numerique.gouv.fr
+    LOGIN_REDIRECT_URL_FAILURE: https://impress-preprod.beta.numerique.gouv.fr
+    LOGOUT_REDIRECT_URL: https://impress-preprod.beta.numerique.gouv.fr
+    DB_HOST:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: host
+    DB_NAME:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    DB_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    DB_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    DB_PORT:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: port
+    POSTGRES_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    POSTGRES_DB:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    POSTGRES_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    REDIS_URL:
+      secretKeyRef:
+        name: redis.redis.libre.sh
+        key: url
+    AWS_S3_ENDPOINT_URL:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: url
+    AWS_S3_ACCESS_KEY_ID:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: accessKey
+    AWS_S3_SECRET_ACCESS_KEY:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: secretKey
+    AWS_STORAGE_BUCKET_NAME:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: bucket
+    AWS_S3_REGION_NAME: local
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD
+    restartPolicy: Never
+
+frontend:
+  image:
+    repository: lasuite/impress-frontend
+    pullPolicy: Always
+    tag: "v0.1.0"
+
+webrtc:
+  image:
+    repository: lasuite/impress-y-webrtc-signaling
+    pullPolicy: Always
+    tag: "v0.1.0"
+
+ingress:
+  enabled: true
+  host: impress-preprod.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+
+ingressWS:
+  enabled: true
+  host: impress-preprod.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+
+ingressAdmin:
+  enabled: true
+  host: impress-preprod.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/auth-signin: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/start
+    nginx.ingress.kubernetes.io/auth-url: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/auth
--- a/src/helm/env.d/production/secrets.enc.yaml
+++ b/src/helm/env.d/production/secrets.enc.yaml
@@ -0,0 +1 @@
+../../../../secrets/numerique-gouv/impress/env/production/secrets.enc.yaml
--- a/src/helm/env.d/production/values.impress.yaml.gotmpl
+++ b/src/helm/env.d/production/values.impress.yaml.gotmpl
@@ -0,0 +1,147 @@
+image:
+  repository: lasuite/impress-backend
+  pullPolicy: Always
+  tag: "v0.1.0"
+
+backend:
+  migrateJobAnnotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: https://docs.numerique.gouv.fr
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: "*"
+    DJANGO_SECRET_KEY:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SECRET_KEY
+    DJANGO_SETTINGS_MODULE: impress.settings
+    DJANGO_SUPERUSER_EMAIL:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_EMAIL
+    DJANGO_SUPERUSER_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_PASSWORD
+    DJANGO_EMAIL_HOST: "snap-mail.numerique.gouv.fr"
+    DJANGO_EMAIL_PORT: 465
+    DJANGO_EMAIL_USE_SSL: True
+    DJANGO_SILENCED_SYSTEM_CHECKS: security.W008,security.W004
+    OIDC_OP_JWKS_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://auth.agentconnect.gouv.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_ID
+    OIDC_RP_CLIENT_SECRET:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_SECRET
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://docs.numerique.gouv.fr
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://docs.numerique.gouv.fr
+    LOGIN_REDIRECT_URL_FAILURE: https://docs.numerique.gouv.fr
+    LOGOUT_REDIRECT_URL: https://docs.numerique.gouv.fr
+    DB_HOST:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: host
+    DB_NAME:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    DB_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    DB_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    DB_PORT:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: port
+    POSTGRES_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    POSTGRES_DB:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    POSTGRES_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    REDIS_URL:
+      secretKeyRef:
+        name: redis.redis.libre.sh
+        key: url
+    AWS_S3_ENDPOINT_URL:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: url
+    AWS_S3_ACCESS_KEY_ID:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: accessKey
+    AWS_S3_SECRET_ACCESS_KEY:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: secretKey
+    AWS_STORAGE_BUCKET_NAME:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: bucket
+    AWS_S3_REGION_NAME: local
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD
+    restartPolicy: Never
+
+frontend:
+  image:
+    repository: lasuite/impress-frontend
+    pullPolicy: Always
+    tag: "v0.1.0"
+
+webrtc:
+  image:
+    repository: lasuite/impress-y-webrtc-signaling
+    pullPolicy: Always
+    tag: "v0.1.0"
+
+ingress:
+  enabled: true
+  host: docs.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+
+ingressWS:
+  enabled: true
+  host: docs.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+
+ingressAdmin:
+  enabled: true
+  host: docs.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/auth-signin: https://oauth2-proxy.beta.numerique.gouv.fr/oauth2/start
+    nginx.ingress.kubernetes.io/auth-url: https://oauth2-proxy.beta.numerique.gouv.fr/oauth2/auth
--- a/src/helm/env.d/staging/secrets.enc.yaml
+++ b/src/helm/env.d/staging/secrets.enc.yaml
@@ -0,0 +1 @@
+../../../../secrets/numerique-gouv/impress/env/staging/secrets.enc.yaml
--- a/src/helm/env.d/staging/values.impress.yaml.gotmpl
+++ b/src/helm/env.d/staging/values.impress.yaml.gotmpl
@@ -0,0 +1,147 @@
+image:
+  repository: lasuite/impress-backend
+  pullPolicy: Always
+  tag: "main"
+
+backend:
+  migrateJobAnnotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+  envVars:
+    DJANGO_CSRF_TRUSTED_ORIGINS: http://impress-staging.beta.numerique.gouv.fr,https://impress-staging.beta.numerique.gouv.fr
+    DJANGO_CONFIGURATION: Production
+    DJANGO_ALLOWED_HOSTS: "*"
+    DJANGO_SECRET_KEY:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SECRET_KEY
+    DJANGO_SETTINGS_MODULE: impress.settings
+    DJANGO_SUPERUSER_EMAIL:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_EMAIL
+    DJANGO_SUPERUSER_PASSWORD:
+      secretKeyRef:
+        name: backend
+        key: DJANGO_SUPERUSER_PASSWORD
+    DJANGO_EMAIL_HOST: "snap-mail.numerique.gouv.fr"
+    DJANGO_EMAIL_PORT: 465
+    DJANGO_EMAIL_USE_SSL: True
+    DJANGO_SILENCED_SYSTEM_CHECKS: security.W008,security.W004
+    OIDC_OP_JWKS_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/jwks
+    OIDC_OP_AUTHORIZATION_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/authorize
+    OIDC_OP_TOKEN_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/token
+    OIDC_OP_USER_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/userinfo
+    OIDC_OP_LOGOUT_ENDPOINT: https://fca.integ01.dev-agentconnect.fr/api/v2/session/end
+    OIDC_RP_CLIENT_ID:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_ID
+    OIDC_RP_CLIENT_SECRET:
+      secretKeyRef:
+        name: backend
+        key: OIDC_RP_CLIENT_SECRET
+    OIDC_RP_SIGN_ALGO: RS256
+    OIDC_RP_SCOPES: "openid email"
+    OIDC_REDIRECT_ALLOWED_HOSTS: https://impress-staging.beta.numerique.gouv.fr
+    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
+    LOGIN_REDIRECT_URL: https://impress-staging.beta.numerique.gouv.fr
+    LOGIN_REDIRECT_URL_FAILURE: https://impress-staging.beta.numerique.gouv.fr
+    LOGOUT_REDIRECT_URL: https://impress-staging.beta.numerique.gouv.fr
+    DB_HOST:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: host
+    DB_NAME:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    DB_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    DB_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    DB_PORT:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: port
+    POSTGRES_USER:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: username
+    POSTGRES_DB:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: database
+    POSTGRES_PASSWORD:
+      secretKeyRef:
+        name: postgresql.postgres.libre.sh
+        key: password
+    REDIS_URL:
+      secretKeyRef:
+        name: redis.redis.libre.sh
+        key: url
+    AWS_S3_ENDPOINT_URL:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: url
+    AWS_S3_ACCESS_KEY_ID:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: accessKey
+    AWS_S3_SECRET_ACCESS_KEY:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: secretKey
+    AWS_STORAGE_BUCKET_NAME:
+      secretKeyRef:
+        name: impress-media-storage.bucket.libre.sh
+        key: bucket
+    AWS_S3_REGION_NAME: local
+    STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+
+  createsuperuser:
+    command:
+      - "/bin/sh"
+      - "-c"
+      - |
+        python manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD
+    restartPolicy: Never
+
+frontend:
+  image:
+    repository: lasuite/impress-frontend
+    pullPolicy: Always
+    tag: "main"
+
+webrtc:
+  image:
+    repository: lasuite/impress-y-webrtc-signaling
+    pullPolicy: Always
+    tag: "main"
+
+ingress:
+  enabled: true
+  host: impress-staging.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+
+ingressWS:
+  enabled: true
+  host: impress-staging.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+
+ingressAdmin:
+  enabled: true
+  host: impress-staging.beta.numerique.gouv.fr
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/auth-signin: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/start
+    nginx.ingress.kubernetes.io/auth-url: https://oauth2-proxy-preprod.beta.numerique.gouv.fr/oauth2/auth
--- a/src/helm/extra/Chart.yaml
+++ b/src/helm/extra/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: extra
+description: A Helm chart to add some manifests to impress
+type: application
+version: 0.1.0
--- a/src/helm/extra/templates/keydb.yaml
+++ b/src/helm/extra/templates/keydb.yaml
@@ -0,0 +1,7 @@
+apiVersion: core.libre.sh/v1alpha1
+kind: Redis
+metadata:
+  name: redis
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  disableAuth: false
--- a/src/helm/extra/templates/postgresql.yaml
+++ b/src/helm/extra/templates/postgresql.yaml
@@ -0,0 +1,7 @@
+apiVersion: core.libre.sh/v1alpha1
+kind: Postgres
+metadata:
+  name: postgresql
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  database: impress
--- a/src/helm/extra/templates/s3.yaml
+++ b/src/helm/extra/templates/s3.yaml
@@ -0,0 +1,8 @@
+apiVersion: core.libre.sh/v1alpha1
+kind: Bucket
+metadata:
+  name: impress-media-storage
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  provider: data
+  versioned: true
--- a/src/helm/extra/templates/secrets.yaml
+++ b/src/helm/extra/templates/secrets.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: backend
+stringData:
+  DJANGO_SUPERUSER_EMAIL: {{ .Values.djangoSuperUserEmail }}
+  DJANGO_SUPERUSER_PASSWORD: {{ .Values.djangoSuperUserPass }}
+  DJANGO_SECRET_KEY: {{ .Values.djangoSecretKey }}
+  OIDC_RP_CLIENT_ID: {{ .Values.oidc.clientId }}
+  OIDC_RP_CLIENT_SECRET: {{ .Values.oidc.clientSecret }}
--- a/src/helm/helmfile.yaml
+++ b/src/helm/helmfile.yaml
@@ -0,0 +1,82 @@
+repositories:
+- name: bitnami
+  url: registry-1.docker.io/bitnamicharts
+  oci: true
+
+releases:
+  - name: postgres
+    installed: {{ eq .Environment.Name "dev" | toYaml }}
+    namespace: {{ .Namespace }}
+    chart: bitnami/postgresql
+    version: 13.1.5
+    values:
+      - auth:
+          username: dinum
+          password: pass
+          database: impress
+      - tls:
+          enabled: true
+          autoGenerated: true
+
+  - name: minio
+    installed: {{ eq .Environment.Name "dev" | toYaml }}
+    namespace: {{ .Namespace }}
+    chart: bitnami/minio
+    version: 12.10.10
+    values: 
+      - auth:
+          rootUser: impress
+          rootPassword: password
+      - provisioning:
+          enabled: true
+          buckets:
+            - name: impress-media-storage
+              versioning: true
+
+  - name: redis
+    installed: {{ eq .Environment.Name "dev" | toYaml }}
+    namespace: {{ .Namespace }}
+    chart: bitnami/redis
+    version: 18.19.2
+    values:
+      - auth:
+          password: pass
+        architecture: standalone
+
+  - name: extra
+    installed: {{ ne .Environment.Name "dev" | toYaml }}
+    namespace: {{ .Namespace }}
+    chart: ./extra
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+
+  - name: impress
+    version: {{ .Values.version }}
+    namespace: {{ .Namespace }}
+    chart: ./impress
+    values:
+      - env.d/{{ .Environment.Name }}/values.impress.yaml.gotmpl
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+
+environments:
+  dev:
+    values:
+      - version: 0.0.1
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+  staging:
+    values:
+      - version: 0.0.1
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+  preprod:
+    values:
+      - version: 0.0.1
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+  production:
+    values:
+      - version: 0.0.1
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
--- a/src/helm/impress/Chart.yaml
+++ b/src/helm/impress/Chart.yaml
@@ -0,0 +1,4 @@
+apiVersion: v2
+type: application
+name: impress
+version: 0.0.1
--- a/src/helm/impress/README.md
+++ b/src/helm/impress/README.md
@@ -0,0 +1,128 @@
+# Impress helm chart
+
+## Parameters
+
+### General configuration
+
+| Name                                       | Description                                          | Value                    |
+| ------------------------------------------ | ---------------------------------------------------- | ------------------------ |
+| `image.repository`                         | Repository to use to pull impress's container image     | `lasuite/impress-backend` |
+| `image.tag`                                | impress's container tag                                 | `latest`                 |
+| `image.pullPolicy`                         | Container image pull policy                          | `IfNotPresent`           |
+| `image.credentials.username`               | Username for container registry authentication       |                          |
+| `image.credentials.password`               | Password for container registry authentication       |                          |
+| `image.credentials.registry`               | Registry url for which the credentials are specified |                          |
+| `image.credentials.name`                   | Name of the generated secret for imagePullSecrets    |                          |
+| `nameOverride`                             | Override the chart name                              | `""`                     |
+| `fullnameOverride`                         | Override the full application name                   | `""`                     |
+| `ingress.enabled`                          | whether to enable the Ingress or not                 | `false`                  |
+| `ingress.className`                        | IngressClass to use for the Ingress                  | `nil`                    |
+| `ingress.host`                             | Host for the Ingress                                 | `impress.example.com`       |
+| `ingress.path`                             | Path to use for the Ingress                          | `/`                      |
+| `ingress.hosts`                            | Additional host to configure for the Ingress         | `[]`                     |
+| `ingress.tls.enabled`                      | Weather to enable TLS for the Ingress                | `true`                   |
+| `ingress.tls.additional[].secretName`      | Secret name for additional TLS config                |                          |
+| `ingress.tls.additional[].hosts[]`         | Hosts for additional TLS config                      |                          |
+| `ingress.customBackends`                   | Add custom backends to ingress                       | `[]`                     |
+| `ingressAdmin.enabled`                     | whether to enable the Ingress or not                 | `false`                  |
+| `ingressAdmin.className`                   | IngressClass to use for the Ingress                  | `nil`                    |
+| `ingressAdmin.host`                        | Host for the Ingress                                 | `impress.example.com`       |
+| `ingressAdmin.path`                        | Path to use for the Ingress                          | `/admin`                 |
+| `ingressAdmin.hosts`                       | Additional host to configure for the Ingress         | `[]`                     |
+| `ingressAdmin.tls.enabled`                 | Weather to enable TLS for the Ingress                | `true`                   |
+| `ingressAdmin.tls.additional[].secretName` | Secret name for additional TLS config                |                          |
+| `ingressAdmin.tls.additional[].hosts[]`    | Hosts for additional TLS config                      |                          |
+
+### backend
+
+| Name                                                  | Description                                                                        | Value                                           |
+| ----------------------------------------------------- | ---------------------------------------------------------------------------------- | ----------------------------------------------- |
+| `backend.command`                                     | Override the backend container command                                             | `[]`                                            |
+| `backend.args`                                        | Override the backend container args                                                | `[]`                                            |
+| `backend.replicas`                                    | Amount of backend replicas                                                         | `3`                                             |
+| `backend.shareProcessNamespace`                       | Enable share process namespace between containers                                  | `false`                                         |
+| `backend.sidecars`                                    | Add sidecars containers to backend deployment                                      | `[]`                                            |
+| `backend.securityContext`                             | Configure backend Pod security context                                             | `nil`                                           |
+| `backend.envVars`                                     | Configure backend container environment variables                                  | `undefined`                                     |
+| `backend.envVars.BY_VALUE`                            | Example environment variable by setting value directly                             |                                                 |
+| `backend.envVars.FROM_CONFIGMAP.configMapKeyRef.name` | Name of a ConfigMap when configuring env vars from a ConfigMap                     |                                                 |
+| `backend.envVars.FROM_CONFIGMAP.configMapKeyRef.key`  | Key within a ConfigMap when configuring env vars from a ConfigMap                  |                                                 |
+| `backend.envVars.FROM_SECRET.secretKeyRef.name`       | Name of a Secret when configuring env vars from a Secret                           |                                                 |
+| `backend.envVars.FROM_SECRET.secretKeyRef.key`        | Key within a Secret when configuring env vars from a Secret                        |                                                 |
+| `backend.podAnnotations`                              | Annotations to add to the backend Pod                                              | `{}`                                            |
+| `backend.service.type`                                | backend Service type                                                               | `ClusterIP`                                     |
+| `backend.service.port`                                | backend Service listening port                                                     | `80`                                            |
+| `backend.service.targetPort`                          | backend container listening port                                                   | `8000`                                          |
+| `backend.service.annotations`                         | Annotations to add to the backend Service                                          | `{}`                                            |
+| `backend.migrate.command`                             | backend migrate command                                                            | `["python","manage.py","migrate","--no-input"]` |
+| `backend.migrate.restartPolicy`                       | backend migrate job restart policy                                                 | `Never`                                         |
+| `backend.probes.liveness.path`                        | Configure path for backend HTTP liveness probe                                     | `/__heartbeat__`                                |
+| `backend.probes.liveness.targetPort`                  | Configure port for backend HTTP liveness probe                                     | `undefined`                                     |
+| `backend.probes.liveness.initialDelaySeconds`         | Configure initial delay for backend liveness probe                                 | `10`                                            |
+| `backend.probes.liveness.initialDelaySeconds`         | Configure timeout for backend liveness probe                                       | `10`                                            |
+| `backend.probes.startup.path`                         | Configure path for backend HTTP startup probe                                      | `undefined`                                     |
+| `backend.probes.startup.targetPort`                   | Configure port for backend HTTP startup probe                                      | `undefined`                                     |
+| `backend.probes.startup.initialDelaySeconds`          | Configure initial delay for backend startup probe                                  | `undefined`                                     |
+| `backend.probes.startup.initialDelaySeconds`          | Configure timeout for backend startup probe                                        | `undefined`                                     |
+| `backend.probes.readiness.path`                       | Configure path for backend HTTP readiness probe                                    | `/__lbheartbeat__`                              |
+| `backend.probes.readiness.targetPort`                 | Configure port for backend HTTP readiness probe                                    | `undefined`                                     |
+| `backend.probes.readiness.initialDelaySeconds`        | Configure initial delay for backend readiness probe                                | `10`                                            |
+| `backend.probes.readiness.initialDelaySeconds`        | Configure timeout for backend readiness probe                                      | `10`                                            |
+| `backend.resources`                                   | Resource requirements for the backend container                                    | `{}`                                            |
+| `backend.nodeSelector`                                | Node selector for the backend Pod                                                  | `{}`                                            |
+| `backend.tolerations`                                 | Tolerations for the backend Pod                                                    | `[]`                                            |
+| `backend.affinity`                                    | Affinity for the backend Pod                                                       | `{}`                                            |
+| `backend.persistence`                                 | Additional volumes to create and mount on the backend. Used for debugging purposes | `{}`                                            |
+| `backend.persistence.volume-name.size`                | Size of the additional volume                                                      |                                                 |
+| `backend.persistence.volume-name.type`                | Type of the additional volume, persistentVolumeClaim or emptyDir                   |                                                 |
+| `backend.persistence.volume-name.mountPath`           | Path where the volume should be mounted to                                         |                                                 |
+| `backend.extraVolumeMounts`                           | Additional volumes to mount on the backend.                                        | `[]`                                            |
+| `backend.extraVolumes`                                | Additional volumes to mount on the backend.                                        | `[]`                                            |
+
+### frontend
+
+| Name                                                   | Description                                                                         | Value                     |
+| ------------------------------------------------------ | ----------------------------------------------------------------------------------- | ------------------------- |
+| `frontend.image.repository`                            | Repository to use to pull impress's frontend container image                           | `lasuite/impress-frontend` |
+| `frontend.image.tag`                                   | impress's frontend container tag                                                       | `latest`                  |
+| `frontend.image.pullPolicy`                            | frontend container image pull policy                                                | `IfNotPresent`            |
+| `frontend.command`                                     | Override the frontend container command                                             | `[]`                      |
+| `frontend.args`                                        | Override the frontend container args                                                | `[]`                      |
+| `frontend.replicas`                                    | Amount of frontend replicas                                                         | `3`                       |
+| `frontend.shareProcessNamespace`                       | Enable share process namefrontend between containers                                | `false`                   |
+| `frontend.sidecars`                                    | Add sidecars containers to frontend deployment                                      | `[]`                      |
+| `frontend.securityContext`                             | Configure frontend Pod security context                                             | `nil`                     |
+| `frontend.envVars`                                     | Configure frontend container environment variables                                  | `undefined`               |
+| `frontend.envVars.BY_VALUE`                            | Example environment variable by setting value directly                              |                           |
+| `frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.name` | Name of a ConfigMap when configuring env vars from a ConfigMap                      |                           |
+| `frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.key`  | Key within a ConfigMap when configuring env vars from a ConfigMap                   |                           |
+| `frontend.envVars.FROM_SECRET.secretKeyRef.name`       | Name of a Secret when configuring env vars from a Secret                            |                           |
+| `frontend.envVars.FROM_SECRET.secretKeyRef.key`        | Key within a Secret when configuring env vars from a Secret                         |                           |
+| `frontend.podAnnotations`                              | Annotations to add to the frontend Pod                                              | `{}`                      |
+| `frontend.service.type`                                | frontend Service type                                                               | `ClusterIP`               |
+| `frontend.service.port`                                | frontend Service listening port                                                     | `80`                      |
+| `frontend.service.targetPort`                          | frontend container listening port                                                   | `8080`                    |
+| `frontend.service.annotations`                         | Annotations to add to the frontend Service                                          | `{}`                      |
+| `frontend.probes`                                      | Configure probe for frontend                                                        | `{}`                      |
+| `frontend.probes.liveness.path`                        | Configure path for frontend HTTP liveness probe                                     |                           |
+| `frontend.probes.liveness.targetPort`                  | Configure port for frontend HTTP liveness probe                                     |                           |
+| `frontend.probes.liveness.initialDelaySeconds`         | Configure initial delay for frontend liveness probe                                 |                           |
+| `frontend.probes.liveness.initialDelaySeconds`         | Configure timeout for frontend liveness probe                                       |                           |
+| `frontend.probes.startup.path`                         | Configure path for frontend HTTP startup probe                                      |                           |
+| `frontend.probes.startup.targetPort`                   | Configure port for frontend HTTP startup probe                                      |                           |
+| `frontend.probes.startup.initialDelaySeconds`          | Configure initial delay for frontend startup probe                                  |                           |
+| `frontend.probes.startup.initialDelaySeconds`          | Configure timeout for frontend startup probe                                        |                           |
+| `frontend.probes.readiness.path`                       | Configure path for frontend HTTP readiness probe                                    |                           |
+| `frontend.probes.readiness.targetPort`                 | Configure port for frontend HTTP readiness probe                                    |                           |
+| `frontend.probes.readiness.initialDelaySeconds`        | Configure initial delay for frontend readiness probe                                |                           |
+| `frontend.probes.readiness.initialDelaySeconds`        | Configure timeout for frontend readiness probe                                      |                           |
+| `frontend.resources`                                   | Resource requirements for the frontend container                                    | `{}`                      |
+| `frontend.nodeSelector`                                | Node selector for the frontend Pod                                                  | `{}`                      |
+| `frontend.tolerations`                                 | Tolerations for the frontend Pod                                                    | `[]`                      |
+| `frontend.affinity`                                    | Affinity for the frontend Pod                                                       | `{}`                      |
+| `frontend.persistence`                                 | Additional volumes to create and mount on the frontend. Used for debugging purposes | `{}`                      |
+| `frontend.persistence.volume-name.size`                | Size of the additional volume                                                       |                           |
+| `frontend.persistence.volume-name.type`                | Type of the additional volume, persistentVolumeClaim or emptyDir                    |                           |
+| `frontend.persistence.volume-name.mountPath`           | Path where the volume should be mounted to                                          |                           |
+| `frontend.extraVolumeMounts`                           | Additional volumes to mount on the frontend.                                        | `[]`                      |
+| `frontend.extraVolumes`                                | Additional volumes to mount on the frontend.                                        | `[]`                      |
--- a/src/helm/impress/generate-readme.sh
+++ b/src/helm/impress/generate-readme.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+docker image ls | grep readme-generator-for-helm
+if [ "$?" -ne "0" ]; then
+	git clone https://github.com/bitnami/readme-generator-for-helm.git /tmp/readme-generator-for-helm
+	cd /tmp/readme-generator-for-helm
+	docker build -t readme-generator-for-helm:latest .
+	cd $(dirname -- "${BASH_SOURCE[0]}")
+fi
+docker run --rm -it -v ./values.yaml:/app/values.yaml -v ./README.md:/app/README.md readme-generator-for-helm:latest readme-generator -v values.yaml -r README.md
--- a/src/helm/impress/templates/_helpers.tpl
+++ b/src/helm/impress/templates/_helpers.tpl
@@ -0,0 +1,184 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "impress.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "impress.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "impress.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+impress.labels
+*/}}
+{{- define "impress.labels" -}}
+helm.sh/chart: {{ include "impress.chart" . }}
+{{ include "impress.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "impress.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "impress.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+transform dictionnary of environment variables
+Usage : {{ include "impress.env.transformDict" .Values.envVars }}
+
+Example:
+envVars:
+  # Using simple strings as env vars
+  ENV_VAR_NAME: "envVar value"
+  # Using a value from a configMap
+  ENV_VAR_FROM_CM:
+    configMapKeyRef:
+      name: cm-name
+      key: "key_in_cm"
+  # Using a value from a secret
+  ENV_VAR_FROM_SECRET:
+    secretKeyRef:
+      name: secret-name
+      key: "key_in_secret"
+*/}}
+{{- define "impress.env.transformDict" -}}
+{{- range $key, $value := . }}
+- name: {{ $key | quote }}
+{{- if $value | kindIs "map" }}
+  valueFrom: {{ $value | toYaml | nindent 4 }}
+{{- else }}
+  value: {{ $value | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+
+{{/*
+impress env vars
+*/}}
+{{- define "impress.common.env" -}}
+{{- $topLevelScope := index . 0 -}}
+{{- $workerScope := index . 1 -}}
+{{- include "impress.env.transformDict" $workerScope.envVars -}}
+{{- end }}
+
+{{/*
+Common labels
+
+Requires array with top level scope and component name
+*/}}
+{{- define "impress.common.labels" -}}
+{{- $topLevelScope := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- include "impress.labels" $topLevelScope }}
+app.kubernetes.io/component: {{ $component }}
+{{- end }}
+
+{{/*
+Common selector labels
+
+Requires array with top level scope and component name
+*/}}
+{{- define "impress.common.selectorLabels" -}}
+{{- $topLevelScope := index . 0 -}}
+{{- $component := index . 1 -}}
+{{- include "impress.selectorLabels" $topLevelScope }}
+app.kubernetes.io/component: {{ $component }}
+{{- end }}
+
+{{- define "impress.probes.abstract" -}}
+{{- if .exec -}}
+exec:
+{{- toYaml .exec | nindent 2 }}
+{{- else if .tcpSocket -}}
+tcpSocket:
+{{- toYaml .tcpSocket | nindent 2 }}
+{{- else -}}
+httpGet:
+  path: {{ .path }}
+  port: {{ .targetPort }}
+{{- end }}
+initialDelaySeconds: {{ .initialDelaySeconds | eq nil | ternary 0 .initialDelaySeconds }}
+timeoutSeconds: {{ .timeoutSeconds | eq nil | ternary 1 .timeoutSeconds }}
+{{- end }}
+
+{{/*
+Full name for the backend
+
+Requires top level scope
+*/}}
+{{- define "impress.backend.fullname" -}}
+{{ include "impress.fullname" . }}-backend
+{{- end }}
+
+{{/*
+Full name for the frontend
+
+Requires top level scope
+*/}}
+{{- define "impress.frontend.fullname" -}}
+{{ include "impress.fullname" . }}-frontend
+{{- end }}
+
+{{/*
+Full name for the webrtc
+
+Requires top level scope
+*/}}
+{{- define "impress.webrtc.fullname" -}}
+{{ include "impress.fullname" . }}-webrtc
+{{- end }}
+
+{{/*
+Usage : {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" .Values.path.to.the.image1) }}
+*/}}
+{{- define "impress.secret.dockerconfigjson.name" }}
+{{- if (default (dict) .imageCredentials).name }}{{ .imageCredentials.name }}{{ else }}{{ .fullname | trunc 63 | trimSuffix "-" }}-dockerconfig{{ end -}}
+{{- end }}
+
+{{/*
+Usage : {{ include "impress.secret.dockerconfigjson" (dict "fullname" (include "impress.fullname" .) "imageCredentials" .Values.path.to.the.image1) }}
+*/}}
+{{- define "impress.secret.dockerconfigjson" }}
+{{- if .imageCredentials -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "impress.secret.dockerconfigjson.name" (dict "fullname" .fullname "imageCredentials" .imageCredentials) }}
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": before-hook-creation
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: {{ template "impress.secret.dockerconfigjson.data" .imageCredentials }}
+{{- end -}}
+{{- end }}
--- a/src/helm/impress/templates/backend_deployment.yaml
+++ b/src/helm/impress/templates/backend_deployment.yaml
@@ -0,0 +1,136 @@
+{{- $envVars := include "impress.common.env" (list . .Values.backend) -}}
+{{- $fullName := include "impress.backend.fullname" . -}}
+{{- $component := "backend" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.common.labels" (list . $component) | nindent 4 }}
+spec:
+  replicas: {{ .Values.backend.replicas }}
+  selector:
+    matchLabels:
+      {{- include "impress.common.selectorLabels" (list . $component) | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        {{- with .Values.backend.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "impress.common.selectorLabels" (list . $component) | nindent 8 }}
+    spec:
+      {{- if $.Values.image.credentials }}
+      imagePullSecrets:
+        - name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
+      {{- end}}
+      shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      containers:
+        {{- with .Values.backend.sidecars }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          image: "{{ (.Values.backend.image | default dict).repository | default .Values.image.repository }}:{{ (.Values.backend.image | default dict).tag | default .Values.image.tag }}"
+          imagePullPolicy: {{ (.Values.backend.image | default dict).pullPolicy | default .Values.image.pullPolicy }}
+          {{- with .Values.backend.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.backend.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            {{- if $envVars}}
+            {{- $envVars | indent 12 }}
+            {{- end }}
+          {{- with .Values.backend.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.backend.service.targetPort }}
+              protocol: TCP
+          {{- if .Values.backend.probes.liveness }}
+          livenessProbe:
+            {{- include "impress.probes.abstract" (merge .Values.backend.probes.liveness (dict "targetPort" .Values.backend.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.backend.probes.readiness }}
+          readinessProbe:
+            {{- include "impress.probes.abstract" (merge .Values.backend.probes.readiness (dict "targetPort" .Values.backend.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.backend.probes.startup }}
+          startupProbe:
+            {{- include "impress.probes.abstract" (merge .Values.backend.probes.startup (dict "targetPort" .Values.backend.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- with .Values.backend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- range $index, $value := .Values.mountFiles }}
+            - name: "files-{{ $index }}"
+              mountPath: {{ $value.path }}
+              subPath: content
+            {{- end }}
+            {{- range $name, $volume := .Values.backend.persistence }}
+            - name: "{{ $name }}"
+              mountPath: "{{ $volume.mountPath }}"
+            {{- end }}
+            {{- range .Values.backend.extraVolumeMounts }}
+            - name: {{ .name }}
+              mountPath: {{ .mountPath }}
+              subPath: {{ .subPath | default "" }}
+              readOnly: {{ .readOnly }}
+            {{- end }}
+      {{- with .Values.backend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        {{- range $index, $value := .Values.mountFiles }}
+        - name: "files-{{ $index }}"
+          configMap:
+            name: "{{ include "impress.fullname" $ }}-files-{{ $index }}"
+        {{- end }}
+        {{- range $name, $volume := .Values.backend.persistence }}
+        - name: "{{ $name }}"
+          {{- if eq $volume.type "emptyDir" }}
+          emptyDir: {}
+          {{- else }}
+          persistentVolumeClaim:
+            claimName: "{{ $fullName }}-{{ $name }}"
+          {{- end }}
+        {{- end }}
+        {{- range .Values.backend.extraVolumes }}
+        - name: {{ .name }}
+          {{- if .existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .existingClaim }}
+          {{- else if .hostPath }}
+          hostPath:
+            {{ toYaml .hostPath | nindent 12 }}
+          {{- else if .csi }}
+          csi:
+            {{- toYaml .csi | nindent 12 }}
+          {{- else if .configMap }}
+          configMap:
+            {{- toYaml .configMap | nindent 12 }}
+          {{- else if .emptyDir }}
+          emptyDir:
+            {{- toYaml .emptyDir | nindent 12 }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- end }}
--- a/src/helm/impress/templates/backend_job.yaml
+++ b/src/helm/impress/templates/backend_job.yaml
@@ -0,0 +1,121 @@
+{{- $envVars := include "impress.common.env" (list . .Values.backend) -}}
+{{- $fullName := include "impress.backend.fullname" . -}}
+{{- $component := "backend" -}}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ $fullName }}-migrate
+  namespace: {{ .Release.Namespace | quote }}
+  {{- with .Values.backend.migrateJobAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "impress.common.labels" (list . $component) | nindent 4 }}
+spec:
+  template:
+    metadata:
+      annotations:
+        {{- with .Values.backend.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "impress.common.selectorLabels" (list . $component) | nindent 8 }}
+    spec:
+      {{- if $.Values.image.credentials }}
+      imagePullSecrets:
+        - name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
+      {{- end}}
+      shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      containers:
+        {{- with .Values.backend.sidecars }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          image: "{{ (.Values.backend.image | default dict).repository | default .Values.image.repository }}:{{ (.Values.backend.image | default dict).tag | default .Values.image.tag }}"
+          imagePullPolicy: {{ (.Values.backend.image | default dict).pullPolicy | default .Values.image.pullPolicy }}
+          {{- with .Values.backend.migrate.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.backend.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            {{- if $envVars}}
+            {{- $envVars | indent 12 }}
+            {{- end }}
+          {{- with .Values.backend.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.backend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- range $index, $value := .Values.mountFiles }}
+            - name: "files-{{ $index }}"
+              mountPath: {{ $value.path }}
+              subPath: content
+            {{- end }}
+            {{- range $name, $volume := .Values.backend.persistence }}
+            - name: "{{ $name }}"
+              mountPath: "{{ $volume.mountPath }}"
+            {{- end }}
+            {{- range .Values.backend.extraVolumeMounts }}
+            - name: {{ .name }}
+              mountPath: {{ .mountPath }}
+              subPath: {{ .subPath | default "" }}
+              readOnly: {{ .readOnly }}
+            {{- end }}
+      {{- with .Values.backend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      restartPolicy: {{ .Values.backend.migrate.restartPolicy }}
+      volumes:
+        {{- range $index, $value := .Values.mountFiles }}
+        - name: "files-{{ $index }}"
+          configMap:
+            name: "{{ include "impress.fullname" $ }}-files-{{ $index }}"
+        {{- end }}
+        {{- range $name, $volume := .Values.backend.persistence }}
+        - name: "{{ $name }}"
+          {{- if eq $volume.type "emptyDir" }}
+          emptyDir: {}
+          {{- else }}
+          persistentVolumeClaim:
+            claimName: "{{ $fullName }}-{{ $name }}"
+          {{- end }}
+        {{- end }}
+        {{- range .Values.backend.extraVolumes }}
+        - name: {{ .name }}
+          {{- if .existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .existingClaim }}
+          {{- else if .hostPath }}
+          hostPath:
+            {{ toYaml .hostPath | nindent 12 }}
+          {{- else if .csi }}
+          csi:
+            {{- toYaml .csi | nindent 12 }}
+          {{- else if .configMap }}
+          configMap:
+            {{- toYaml .configMap | nindent 12 }}
+          {{- else if .emptyDir }}
+          emptyDir:
+            {{- toYaml .emptyDir | nindent 12 }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- end }}
--- a/src/helm/impress/templates/backend_job_createsuperuser.yaml
+++ b/src/helm/impress/templates/backend_job_createsuperuser.yaml
@@ -0,0 +1,121 @@
+{{- $envVars := include "impress.common.env" (list . .Values.backend) -}}
+{{- $fullName := include "impress.backend.fullname" . -}}
+{{- $component := "backend" -}}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ $fullName }}-createsuperuser
+  namespace: {{ .Release.Namespace | quote }}
+  {{- with .Values.backend.migrateJobAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "impress.common.labels" (list . $component) | nindent 4 }}
+spec:
+  template:
+    metadata:
+      annotations:
+        {{- with .Values.backend.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "impress.common.selectorLabels" (list . $component) | nindent 8 }}
+    spec:
+      {{- if $.Values.image.credentials }}
+      imagePullSecrets:
+        - name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
+      {{- end}}
+      shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
+      containers:
+        {{- with .Values.backend.sidecars }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          image: "{{ (.Values.backend.image | default dict).repository | default .Values.image.repository }}:{{ (.Values.backend.image | default dict).tag | default .Values.image.tag }}"
+          imagePullPolicy: {{ (.Values.backend.image | default dict).pullPolicy | default .Values.image.pullPolicy }}
+          {{- with .Values.backend.createsuperuser.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.backend.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            {{- if $envVars}}
+            {{- $envVars | indent 12 }}
+            {{- end }}
+          {{- with .Values.backend.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.backend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- range $index, $value := .Values.mountFiles }}
+            - name: "files-{{ $index }}"
+              mountPath: {{ $value.path }}
+              subPath: content
+            {{- end }}
+            {{- range $name, $volume := .Values.backend.persistence }}
+            - name: "{{ $name }}"
+              mountPath: "{{ $volume.mountPath }}"
+            {{- end }}
+            {{- range .Values.backend.extraVolumeMounts }}
+            - name: {{ .name }}
+              mountPath: {{ .mountPath }}
+              subPath: {{ .subPath | default "" }}
+              readOnly: {{ .readOnly }}
+            {{- end }}
+      {{- with .Values.backend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.backend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      restartPolicy: {{ .Values.backend.createsuperuser.restartPolicy }}
+      volumes:
+        {{- range $index, $value := .Values.mountFiles }}
+        - name: "files-{{ $index }}"
+          configMap:
+            name: "{{ include "impress.fullname" $ }}-files-{{ $index }}"
+        {{- end }}
+        {{- range $name, $volume := .Values.backend.persistence }}
+        - name: "{{ $name }}"
+          {{- if eq $volume.type "emptyDir" }}
+          emptyDir: {}
+          {{- else }}
+          persistentVolumeClaim:
+            claimName: "{{ $fullName }}-{{ $name }}"
+          {{- end }}
+        {{- end }}
+        {{- range .Values.backend.extraVolumes }}
+        - name: {{ .name }}
+          {{- if .existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .existingClaim }}
+          {{- else if .hostPath }}
+          hostPath:
+            {{ toYaml .hostPath | nindent 12 }}
+          {{- else if .csi }}
+          csi:
+            {{- toYaml .csi | nindent 12 }}
+          {{- else if .configMap }}
+          configMap:
+            {{- toYaml .configMap | nindent 12 }}
+          {{- else if .emptyDir }}
+          emptyDir:
+            {{- toYaml .emptyDir | nindent 12 }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- end }}
--- a/src/helm/impress/templates/backend_svc.yaml
+++ b/src/helm/impress/templates/backend_svc.yaml
@@ -0,0 +1,21 @@
+{{- $envVars := include "impress.common.env" (list . .Values.backend) -}}
+{{- $fullName := include "impress.backend.fullname" . -}}
+{{- $component := "backend" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.common.labels" (list . $component) | nindent 4 }}
+  annotations:
+    {{- toYaml $.Values.backend.service.annotations | nindent 4 }}
+spec:
+  type: {{ .Values.backend.service.type }}
+  ports:
+    - port: {{ .Values.backend.service.port }}
+      targetPort: {{ .Values.backend.service.targetPort }}
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "impress.common.selectorLabels" (list . $component) | nindent 4 }}
--- a/src/helm/impress/templates/frontend_deployment.yaml
+++ b/src/helm/impress/templates/frontend_deployment.yaml
@@ -0,0 +1,136 @@
+{{- $envVars := include "impress.common.env" (list . .Values.frontend) -}}
+{{- $fullName := include "impress.frontend.fullname" . -}}
+{{- $component := "frontend" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.common.labels" (list . $component) | nindent 4 }}
+spec:
+  replicas: {{ .Values.frontend.replicas }}
+  selector:
+    matchLabels:
+      {{- include "impress.common.selectorLabels" (list . $component) | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        {{- with .Values.frontend.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "impress.common.selectorLabels" (list . $component) | nindent 8 }}
+    spec:
+      {{- if $.Values.image.credentials }}
+      imagePullSecrets:
+        - name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
+      {{- end}}
+      shareProcessNamespace: {{ .Values.frontend.shareProcessNamespace }}
+      containers:
+        {{- with .Values.frontend.sidecars }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          image: "{{ (.Values.frontend.image | default dict).repository | default .Values.image.repository }}:{{ (.Values.frontend.image | default dict).tag | default .Values.image.tag }}"
+          imagePullPolicy: {{ (.Values.frontend.image | default dict).pullPolicy | default .Values.image.pullPolicy }}
+          {{- with .Values.frontend.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.frontend.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            {{- if $envVars}}
+            {{- $envVars | indent 12 }}
+            {{- end }}
+          {{- with .Values.frontend.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.frontend.service.targetPort }}
+              protocol: TCP
+          {{- if .Values.frontend.probes.liveness }}
+          livenessProbe:
+            {{- include "impress.probes.abstract" (merge .Values.frontend.probes.liveness (dict "targetPort" .Values.frontend.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.frontend.probes.readiness }}
+          readinessProbe:
+            {{- include "impress.probes.abstract" (merge .Values.frontend.probes.readiness (dict "targetPort" .Values.frontend.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.frontend.probes.startup }}
+          startupProbe:
+            {{- include "impress.probes.abstract" (merge .Values.frontend.probes.startup (dict "targetPort" .Values.frontend.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- with .Values.frontend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- range $index, $value := .Values.mountFiles }}
+            - name: "files-{{ $index }}"
+              mountPath: {{ $value.path }}
+              subPath: content
+            {{- end }}
+            {{- range $name, $volume := .Values.frontend.persistence }}
+            - name: "{{ $name }}"
+              mountPath: "{{ $volume.mountPath }}"
+            {{- end }}
+            {{- range .Values.frontend.extraVolumeMounts }}
+            - name: {{ .name }}
+              mountPath: {{ .mountPath }}
+              subPath: {{ .subPath | default "" }}
+              readOnly: {{ .readOnly }}
+            {{- end }}
+      {{- with .Values.frontend.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.frontend.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.frontend.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        {{- range $index, $value := .Values.mountFiles }}
+        - name: "files-{{ $index }}"
+          configMap:
+            name: "{{ include "impress.fullname" $ }}-files-{{ $index }}"
+        {{- end }}
+        {{- range $name, $volume := .Values.frontend.persistence }}
+        - name: "{{ $name }}"
+          {{- if eq $volume.type "emptyDir" }}
+          emptyDir: {}
+          {{- else }}
+          persistentVolumeClaim:
+            claimName: "{{ $fullName }}-{{ $name }}"
+          {{- end }}
+        {{- end }}
+        {{- range .Values.frontend.extraVolumes }}
+        - name: {{ .name }}
+          {{- if .existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .existingClaim }}
+          {{- else if .hostPath }}
+          hostPath:
+            {{ toYaml .hostPath | nindent 12 }}
+          {{- else if .csi }}
+          csi:
+            {{- toYaml .csi | nindent 12 }}
+          {{- else if .configMap }}
+          configMap:
+            {{- toYaml .configMap | nindent 12 }}
+          {{- else if .emptyDir }}
+          emptyDir:
+            {{- toYaml .emptyDir | nindent 12 }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- end }}
--- a/src/helm/impress/templates/frontend_svc.yaml
+++ b/src/helm/impress/templates/frontend_svc.yaml
@@ -0,0 +1,21 @@
+{{- $envVars := include "impress.common.env" (list . .Values.frontend) -}}
+{{- $fullName := include "impress.frontend.fullname" . -}}
+{{- $component := "frontend" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.common.labels" (list . $component) | nindent 4 }}
+  annotations:
+    {{- toYaml $.Values.frontend.service.annotations | nindent 4 }}
+spec:
+  type: {{ .Values.frontend.service.type }}
+  ports:
+    - port: {{ .Values.frontend.service.port }}
+      targetPort: {{ .Values.frontend.service.targetPort }}
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "impress.common.selectorLabels" (list . $component) | nindent 4 }}
--- a/src/helm/impress/templates/ingress.yaml
+++ b/src/helm/impress/templates/ingress.yaml
@@ -0,0 +1,118 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "impress.fullname" . -}}
+{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    {{- if .Values.ingress.host }}
+    - secretName: {{ $fullName }}-tls
+      hosts:
+        - {{ .Values.ingress.host | quote }}
+    {{- end }}
+    {{- range .Values.ingress.tls.additional }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- if .Values.ingress.host }}
+    - host: {{ .Values.ingress.host | quote }}
+      http:
+        paths:
+          - path: {{ .Values.ingress.path | quote }}
+            {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "impress.frontend.fullname" . }}
+                port:
+                  number: {{ .Values.frontend.service.port }}
+              {{- else }}
+              serviceName: {{ include "impress.frontend.fullname" . }}
+              servicePort: {{ .Values.frontend.service.port }}
+            {{- end }}
+          - path: /api
+            {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "impress.backend.fullname" . }}
+                port:
+                  number: {{ .Values.backend.service.port }}
+              {{- else }}
+              serviceName: {{ include "impress.backend.fullname" . }}
+              servicePort: {{ .Values.backend.service.port }}
+            {{- end }}
+          {{- with .Values.ingress.customBackends }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+    {{- end }}
+    {{- range .Values.ingress.hosts }}
+    - host: {{ . | quote }}
+      http:
+        paths:
+          - path: {{ $.Values.ingress.path | quote }}
+            {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "impress.frontend.fullname" $ }}
+                port:
+                  number: {{ $.Values.frontend.service.port }}
+              {{- else }}
+              serviceName: {{ include "impress.frontend.fullname" $ }}
+              servicePort: {{ $.Values.frontend.service.port }}
+            {{- end }}
+          - path: /api
+            {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "impress.backend.fullname" $ }}
+                port:
+                  number: {{ $.Values.backend.service.port }}
+              {{- else }}
+              serviceName: {{ include "impress.backend.fullname" $ }}
+              servicePort: {{ $.Values.backend.service.port }}
+            {{- end }}
+          {{- with $.Values.ingress.customBackends }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+    {{- end }}
+{{- end }}
+
--- a/src/helm/impress/templates/ingress_admin.yaml
+++ b/src/helm/impress/templates/ingress_admin.yaml
@@ -0,0 +1,98 @@
+{{- if .Values.ingressAdmin.enabled -}}
+{{- $fullName := include "impress.fullname" . -}}
+{{- if and .Values.ingressAdmin.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingressAdmin.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingressAdmin.annotations "kubernetes.io/ingress.class" .Values.ingressAdmin.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}-admin
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.labels" . | nindent 4 }}
+  {{- with .Values.ingressAdmin.annotations }}
+  annotations:
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingressAdmin.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingressAdmin.className }}
+  {{- end }}
+  {{- if .Values.ingressAdmin.tls.enabled }}
+  tls:
+    {{- if .Values.ingressAdmin.host }}
+    - secretName: {{ $fullName }}-tls
+      hosts:
+        - {{ .Values.ingressAdmin.host | quote }}
+    {{- end }}
+    {{- range .Values.ingressAdmin.tls.additional }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- if .Values.ingressAdmin.host }}
+    - host: {{ .Values.ingressAdmin.host | quote }}
+      http:
+        paths:
+          - path: {{ .Values.ingressAdmin.path | quote }}
+            {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "impress.backend.fullname" . }}
+                port:
+                  number: {{ .Values.backend.service.port }}
+              {{- else }}
+              serviceName: {{ include "impress.backend.fullname" . }}
+              servicePort: {{ .Values.backend.service.port }}
+            {{- end }}
+          - path: /static
+            {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "impress.backend.fullname" . }}
+                port:
+                  number: {{ .Values.backend.service.port }}
+              {{- else }}
+              serviceName: {{ include "impress.backend.fullname" . }}
+              servicePort: {{ .Values.backend.service.port }}
+            {{- end }}
+    {{- end }}
+    {{- range .Values.ingressAdmin.hosts }}
+    - host: {{ . | quote }}
+      http:
+        paths:
+          - path: {{ $.Values.ingressAdmin.path | quote }}
+            {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "impress.backend.fullname" $ }}
+                port:
+                  number: {{ $.Values.backend.service.port }}
+              {{- else }}
+              serviceName: {{ include "impress.backend.fullname" $ }}
+              servicePort: {{ $.Values.backend.service.port }}
+            {{- end }}
+    {{- end }}
+{{- end }}
+
--- a/src/helm/impress/templates/ingress_ws.yaml
+++ b/src/helm/impress/templates/ingress_ws.yaml
@@ -0,0 +1,72 @@
+{{- if .Values.ingressWS.enabled -}}
+{{- $fullName := include "impress.fullname" . -}}
+{{- if and .Values.ingressWS.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingressWS.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingressWS.annotations "kubernetes.io/ingress.class" .Values.ingressWS.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}-ws
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.labels" . | nindent 4 }}
+  {{- with .Values.ingressWS.annotations }}
+  annotations:
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingressWS.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingressWS.className }}
+  {{- end }}
+  {{- if .Values.ingressWS.tls.enabled }}
+  tls:
+    {{- if .Values.ingressWS.host }}
+    - secretName: {{ $fullName }}-tls
+      hosts:
+        - {{ .Values.ingressWS.host | quote }}
+    {{- end }}
+    {{- range .Values.ingressWS.tls.additional }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- if .Values.ingressWS.host }}
+    - host: {{ .Values.ingressWS.host | quote }}
+      http:
+        paths:
+          - path: {{ .Values.ingressWS.path | quote }}
+            {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: ImplementationSpecific
+            {{- end }}
+            backend:
+              service:
+                name: {{ include "impress.webrtc.fullname" . }}
+                port:
+                  number: {{ .Values.webrtc.service.port }}
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ include "impress.webrtc.fullname" . }}
+                port:
+                  number: {{ .Values.webrtc.service.port }}
+              {{- else }}
+              serviceName: {{ include "impress.webrtc.fullname" . }}
+              servicePort: {{ .Values.webrtc.service.port }}
+            {{- end }}
+          {{- with .Values.ingressWS.customBackends }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+    {{- end }}
+{{- end }}
+
--- a/src/helm/impress/templates/webrtc_deployment.yaml
+++ b/src/helm/impress/templates/webrtc_deployment.yaml
@@ -0,0 +1,136 @@
+{{- $envVars := include "impress.common.env" (list . .Values.webrtc) -}}
+{{- $fullName := include "impress.webrtc.fullname" . -}}
+{{- $component := "webrtc" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.common.labels" (list . $component) | nindent 4 }}
+spec:
+  replicas: {{ .Values.webrtc.replicas }}
+  selector:
+    matchLabels:
+      {{- include "impress.common.selectorLabels" (list . $component) | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        {{- with .Values.webrtc.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "impress.common.selectorLabels" (list . $component) | nindent 8 }}
+    spec:
+      {{- if $.Values.image.credentials }}
+      imagePullSecrets:
+        - name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
+      {{- end}}
+      shareProcessNamespace: {{ .Values.webrtc.shareProcessNamespace }}
+      containers:
+        {{- with .Values.webrtc.sidecars }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        - name: {{ .Chart.Name }}
+          image: "{{ (.Values.webrtc.image | default dict).repository | default .Values.image.repository }}:{{ (.Values.webrtc.image | default dict).tag | default .Values.image.tag }}"
+          imagePullPolicy: {{ (.Values.webrtc.image | default dict).pullPolicy | default .Values.image.pullPolicy }}
+          {{- with .Values.webrtc.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.webrtc.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            {{- if $envVars}}
+            {{- $envVars | indent 12 }}
+            {{- end }}
+          {{- with .Values.webrtc.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.webrtc.service.targetPort }}
+              protocol: TCP
+          {{- if .Values.webrtc.probes.liveness }}
+          livenessProbe:
+            {{- include "impress.probes.abstract" (merge .Values.webrtc.probes.liveness (dict "targetPort" .Values.webrtc.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.webrtc.probes.readiness }}
+          readinessProbe:
+            {{- include "impress.probes.abstract" (merge .Values.webrtc.probes.readiness (dict "targetPort" .Values.webrtc.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.webrtc.probes.startup }}
+          startupProbe:
+            {{- include "impress.probes.abstract" (merge .Values.webrtc.probes.startup (dict "targetPort" .Values.webrtc.service.targetPort )) | nindent 12 }}
+          {{- end }}
+          {{- with .Values.webrtc.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- range $index, $value := .Values.mountFiles }}
+            - name: "files-{{ $index }}"
+              mountPath: {{ $value.path }}
+              subPath: content
+            {{- end }}
+            {{- range $name, $volume := .Values.webrtc.persistence }}
+            - name: "{{ $name }}"
+              mountPath: "{{ $volume.mountPath }}"
+            {{- end }}
+            {{- range .Values.webrtc.extraVolumeMounts }}
+            - name: {{ .name }}
+              mountPath: {{ .mountPath }}
+              subPath: {{ .subPath | default "" }}
+              readOnly: {{ .readOnly }}
+            {{- end }}
+      {{- with .Values.webrtc.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.webrtc.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.webrtc.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        {{- range $index, $value := .Values.mountFiles }}
+        - name: "files-{{ $index }}"
+          configMap:
+            name: "{{ include "impress.fullname" $ }}-files-{{ $index }}"
+        {{- end }}
+        {{- range $name, $volume := .Values.webrtc.persistence }}
+        - name: "{{ $name }}"
+          {{- if eq $volume.type "emptyDir" }}
+          emptyDir: {}
+          {{- else }}
+          persistentVolumeClaim:
+            claimName: "{{ $fullName }}-{{ $name }}"
+          {{- end }}
+        {{- end }}
+        {{- range .Values.webrtc.extraVolumes }}
+        - name: {{ .name }}
+          {{- if .existingClaim }}
+          persistentVolumeClaim:
+            claimName: {{ .existingClaim }}
+          {{- else if .hostPath }}
+          hostPath:
+            {{ toYaml .hostPath | nindent 12 }}
+          {{- else if .csi }}
+          csi:
+            {{- toYaml .csi | nindent 12 }}
+          {{- else if .configMap }}
+          configMap:
+            {{- toYaml .configMap | nindent 12 }}
+          {{- else if .emptyDir }}
+          emptyDir:
+            {{- toYaml .emptyDir | nindent 12 }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- end }}
--- a/src/helm/impress/templates/webrtc_svc.yaml
+++ b/src/helm/impress/templates/webrtc_svc.yaml
@@ -0,0 +1,21 @@
+{{- $envVars := include "impress.common.env" (list . .Values.webrtc) -}}
+{{- $fullName := include "impress.webrtc.fullname" . -}}
+{{- $component := "webrtc" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "impress.common.labels" (list . $component) | nindent 4 }}
+  annotations:
+    {{- toYaml $.Values.webrtc.service.annotations | nindent 4 }}
+spec:
+  type: {{ .Values.webrtc.service.type }}
+  ports:
+    - port: {{ .Values.webrtc.service.port }}
+      targetPort: {{ .Values.webrtc.service.targetPort }}
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "impress.common.selectorLabels" (list . $component) | nindent 4 }}
--- a/src/helm/impress/values.yaml
+++ b/src/helm/impress/values.yaml
@@ -0,0 +1,385 @@
+# Default values for impress.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+## @section General configuration
+
+## @param image.repository Repository to use to pull impress's container image
+## @param image.tag impress's container tag
+## @param image.pullPolicy Container image pull policy
+## @extra image.credentials.username Username for container registry authentication
+## @extra image.credentials.password Password for container registry authentication
+## @extra image.credentials.registry Registry url for which the credentials are specified
+## @extra image.credentials.name Name of the generated secret for imagePullSecrets
+image:
+  repository: lasuite/impress-backend
+  pullPolicy: IfNotPresent
+  tag: "latest"
+
+## @param nameOverride Override the chart name
+## @param fullnameOverride Override the full application name
+nameOverride: ""
+fullnameOverride: ""
+
+## @skip commonEnvVars
+commonEnvVars: &commonEnvVars
+  <<: []
+
+## @param ingress.enabled whether to enable the Ingress or not
+## @param ingress.className IngressClass to use for the Ingress
+## @param ingress.host Host for the Ingress
+## @param ingress.path Path to use for the Ingress
+ingress:
+  enabled: false
+  className: null
+  host: impress.example.com
+  path: /
+  ## @param ingress.hosts Additional host to configure for the Ingress
+  hosts: []
+  #  - chart-example.local
+  ## @param ingress.tls.enabled Weather to enable TLS for the Ingress
+  ## @skip ingress.tls.additional
+  ## @extra ingress.tls.additional[].secretName Secret name for additional TLS config
+  ## @extra ingress.tls.additional[].hosts[] Hosts for additional TLS config
+  tls:
+    enabled: true
+    additional: []
+
+  ## @param ingress.customBackends Add custom backends to ingress
+  customBackends: []
+
+## @param ingressWS.enabled whether to enable the Ingress or not
+## @param ingressWS.className IngressClass to use for the Ingress
+## @param ingressWS.host Host for the Ingress
+## @param ingressWS.path Path to use for the Ingress
+ingressWS:
+  enabled: false
+  className: null
+  host: impress.example.com
+  path: /ws
+  ## @param ingress.hosts Additional host to configure for the Ingress
+  hosts: []
+  #  - chart-example.local
+  ## @param ingressWS.tls.enabled Weather to enable TLS for the Ingress
+  ## @skip ingressWS.tls.additional
+  ## @extra ingressWS.tls.additional[].secretName Secret name for additional TLS config
+  ## @extra ingressWS.tls.additional[].hosts[] Hosts for additional TLS config
+  tls:
+    enabled: true
+    additional: []
+
+  ## @param ingressWS.customBackends Add custom backends to ingress
+  customBackends: []
+
+  annotations: 
+    nginx.ingress.kubernetes.io/enable-websocket: "true" 
+    nginx.ingress.kubernetes.io/upstream-hash-by: "$request_uri"
+
+## @param ingressAdmin.enabled whether to enable the Ingress or not
+## @param ingressAdmin.className IngressClass to use for the Ingress
+## @param ingressAdmin.host Host for the Ingress
+## @param ingressAdmin.path Path to use for the Ingress
+ingressAdmin:
+  enabled: false
+  className: null
+  host: impress.example.com
+  path: /admin
+  ## @param ingressAdmin.hosts Additional host to configure for the Ingress
+  hosts: [ ]
+  #  - chart-example.local
+  ## @param ingressAdmin.tls.enabled Weather to enable TLS for the Ingress
+  ## @skip ingressAdmin.tls.additional
+  ## @extra ingressAdmin.tls.additional[].secretName Secret name for additional TLS config
+  ## @extra ingressAdmin.tls.additional[].hosts[] Hosts for additional TLS config
+  tls:
+    enabled: true
+    additional: []
+
+
+## @section backend
+
+backend:
+
+  ## @param backend.command Override the backend container command
+  command: []
+
+  ## @param backend.args Override the backend container args
+  args: []
+
+  ## @param backend.replicas Amount of backend replicas
+  replicas: 3
+
+  ## @param backend.shareProcessNamespace Enable share process namespace between containers
+  shareProcessNamespace: false
+
+  ## @param backend.sidecars Add sidecars containers to backend deployment
+  sidecars: []
+
+  ## @param backend.migrateJobAnnotations Annotations for the migrate job
+  migrateJobAnnotations: {}
+
+  ## @param backend.securityContext Configure backend Pod security context
+  securityContext: null
+
+  ## @param backend.envVars Configure backend container environment variables
+  ## @extra backend.envVars.BY_VALUE Example environment variable by setting value directly
+  ## @extra backend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra backend.envVars.FROM_CONFIGMAP.configMapKeyRef.key Key within a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra backend.envVars.FROM_SECRET.secretKeyRef.name Name of a Secret when configuring env vars from a Secret
+  ## @extra backend.envVars.FROM_SECRET.secretKeyRef.key Key within a Secret when configuring env vars from a Secret
+  ## @skip backend.envVars
+  envVars:
+    <<: *commonEnvVars
+
+  ## @param backend.podAnnotations Annotations to add to the backend Pod
+  podAnnotations: {}
+
+  ## @param backend.service.type backend Service type
+  ## @param backend.service.port backend Service listening port
+  ## @param backend.service.targetPort backend container listening port
+  ## @param backend.service.annotations Annotations to add to the backend Service
+  service:
+    type: ClusterIP
+    port: 80
+    targetPort: 8000
+    annotations: {}
+
+ ## @param backend.migrate.command backend migrate command
+ ## @param backend.migrate.restartPolicy backend migrate job restart policy
+  migrate:
+    command:
+      - "python"
+      - "manage.py"
+      - "migrate"
+      - "--no-input"
+    restartPolicy: Never
+
+  ## @param backend.probes.liveness.path [nullable] Configure path for backend HTTP liveness probe
+  ## @param backend.probes.liveness.targetPort [nullable] Configure port for backend HTTP liveness probe
+  ## @param backend.probes.liveness.initialDelaySeconds [nullable] Configure initial delay for backend liveness probe
+  ## @param backend.probes.liveness.initialDelaySeconds [nullable] Configure timeout for backend liveness probe
+  ## @param backend.probes.startup.path [nullable] Configure path for backend HTTP startup probe
+  ## @param backend.probes.startup.targetPort [nullable] Configure port for backend HTTP startup probe
+  ## @param backend.probes.startup.initialDelaySeconds [nullable] Configure initial delay for backend startup probe
+  ## @param backend.probes.startup.initialDelaySeconds [nullable] Configure timeout for backend startup probe
+  ## @param backend.probes.readiness.path [nullable] Configure path for backend HTTP readiness probe
+  ## @param backend.probes.readiness.targetPort [nullable] Configure port for backend HTTP readiness probe
+  ## @param backend.probes.readiness.initialDelaySeconds [nullable] Configure initial delay for backend readiness probe
+  ## @param backend.probes.readiness.initialDelaySeconds [nullable] Configure timeout for backend readiness probe
+  probes:
+    liveness:
+      path: /__heartbeat__
+      initialDelaySeconds: 10
+    readiness:
+      path: /__lbheartbeat__
+      initialDelaySeconds: 10
+
+  ## @param backend.resources Resource requirements for the backend container
+  resources: {}
+
+  ## @param backend.nodeSelector Node selector for the backend Pod
+  nodeSelector: {}
+
+  ## @param backend.tolerations Tolerations for the backend Pod
+  tolerations: []
+
+  ## @param backend.affinity Affinity for the backend Pod
+  affinity: {}
+
+  ## @param backend.persistence Additional volumes to create and mount on the backend. Used for debugging purposes
+  ## @extra backend.persistence.volume-name.size Size of the additional volume
+  ## @extra backend.persistence.volume-name.type Type of the additional volume, persistentVolumeClaim or emptyDir
+  ## @extra backend.persistence.volume-name.mountPath Path where the volume should be mounted to
+  persistence: {}
+
+  ## @param backend.extraVolumeMounts Additional volumes to mount on the backend.
+  extraVolumeMounts: []
+
+  ## @param backend.extraVolumes Additional volumes to mount on the backend.
+  extraVolumes: []
+
+
+## @section frontend
+
+frontend:
+  ## @param frontend.image.repository Repository to use to pull impress's frontend container image
+  ## @param frontend.image.tag impress's frontend container tag
+  ## @param frontend.image.pullPolicy frontend container image pull policy
+  image:
+    repository: lasuite/impress-frontend
+    pullPolicy: IfNotPresent
+    tag: "latest"
+
+  ## @param frontend.command Override the frontend container command
+  command: []
+
+  ## @param frontend.args Override the frontend container args
+  args: []
+
+  ## @param frontend.replicas Amount of frontend replicas
+  replicas: 3
+
+  ## @param frontend.shareProcessNamespace Enable share process namefrontend between containers
+  shareProcessNamespace: false
+
+  ## @param frontend.sidecars Add sidecars containers to frontend deployment
+  sidecars: []
+
+  ## @param frontend.securityContext Configure frontend Pod security context
+  securityContext: null
+
+  ## @param frontend.envVars Configure frontend container environment variables
+  ## @extra frontend.envVars.BY_VALUE Example environment variable by setting value directly
+  ## @extra frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.key Key within a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra frontend.envVars.FROM_SECRET.secretKeyRef.name Name of a Secret when configuring env vars from a Secret
+  ## @extra frontend.envVars.FROM_SECRET.secretKeyRef.key Key within a Secret when configuring env vars from a Secret
+  ## @skip frontend.envVars
+  envVars:
+    <<: *commonEnvVars
+
+  ## @param frontend.podAnnotations Annotations to add to the frontend Pod
+  podAnnotations: {}
+
+  ## @param frontend.service.type frontend Service type
+  ## @param frontend.service.port frontend Service listening port
+  ## @param frontend.service.targetPort frontend container listening port
+  ## @param frontend.service.annotations Annotations to add to the frontend Service
+  service:
+    type: ClusterIP
+    port: 80
+    targetPort: 8080
+    annotations: {}
+
+  ## @param frontend.probes Configure probe for frontend
+  ## @extra frontend.probes.liveness.path Configure path for frontend HTTP liveness probe
+  ## @extra frontend.probes.liveness.targetPort Configure port for frontend HTTP liveness probe
+  ## @extra frontend.probes.liveness.initialDelaySeconds Configure initial delay for frontend liveness probe
+  ## @extra frontend.probes.liveness.initialDelaySeconds Configure timeout for frontend liveness probe
+  ## @extra frontend.probes.startup.path Configure path for frontend HTTP startup probe
+  ## @extra frontend.probes.startup.targetPort Configure port for frontend HTTP startup probe
+  ## @extra frontend.probes.startup.initialDelaySeconds Configure initial delay for frontend startup probe
+  ## @extra frontend.probes.startup.initialDelaySeconds Configure timeout for frontend startup probe
+  ## @extra frontend.probes.readiness.path Configure path for frontend HTTP readiness probe
+  ## @extra frontend.probes.readiness.targetPort Configure port for frontend HTTP readiness probe
+  ## @extra frontend.probes.readiness.initialDelaySeconds Configure initial delay for frontend readiness probe
+  ## @extra frontend.probes.readiness.initialDelaySeconds Configure timeout for frontend readiness probe
+  probes: {}
+
+  ## @param frontend.resources Resource requirements for the frontend container
+  resources: {}
+
+  ## @param frontend.nodeSelector Node selector for the frontend Pod
+  nodeSelector: {}
+
+  ## @param frontend.tolerations Tolerations for the frontend Pod
+  tolerations: []
+
+  ## @param frontend.affinity Affinity for the frontend Pod
+  affinity: {}
+
+  ## @param frontend.persistence Additional volumes to create and mount on the frontend. Used for debugging purposes
+  ## @extra frontend.persistence.volume-name.size Size of the additional volume
+  ## @extra frontend.persistence.volume-name.type Type of the additional volume, persistentVolumeClaim or emptyDir
+  ## @extra frontend.persistence.volume-name.mountPath Path where the volume should be mounted to
+  persistence: {}
+
+  ## @param frontend.extraVolumeMounts Additional volumes to mount on the frontend.
+  extraVolumeMounts: []
+
+  ## @param frontend.extraVolumes Additional volumes to mount on the frontend.
+  extraVolumes: []
+
+## @section webrtc
+
+webrtc:
+  ## @param webrtc.image.repository Repository to use to pull impress's webrtc container image
+  ## @param webrtc.image.tag impress's webrtc container tag
+  ## @param webrtc.image.pullPolicy webrtc container image pull policy
+  image:
+    repository: lasuite/impress-y-webrtc-signaling
+    pullPolicy: IfNotPresent
+    tag: "latest"
+
+  ## @param webrtc.command Override the webrtc container command
+  command: []
+
+  ## @param webrtc.args Override the webrtc container args
+  args: []
+
+  ## @param webrtc.replicas Amount of webrtc replicas
+  replicas: 3
+
+  ## @param webrtc.shareProcessNamespace Enable share process namewebrtc between containers
+  shareProcessNamespace: false
+
+  ## @param webrtc.sidecars Add sidecars containers to webrtc deployment
+  sidecars: []
+
+  ## @param webrtc.securityContext Configure webrtc Pod security context
+  securityContext: null
+
+  ## @param webrtc.envVars Configure webrtc container environment variables
+  ## @extra webrtc.envVars.BY_VALUE Example environment variable by setting value directly
+  ## @extra webrtc.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra webrtc.envVars.FROM_CONFIGMAP.configMapKeyRef.key Key within a ConfigMap when configuring env vars from a ConfigMap
+  ## @extra webrtc.envVars.FROM_SECRET.secretKeyRef.name Name of a Secret when configuring env vars from a Secret
+  ## @extra webrtc.envVars.FROM_SECRET.secretKeyRef.key Key within a Secret when configuring env vars from a Secret
+  ## @skip webrtc.envVars
+  envVars:
+    <<: *commonEnvVars
+
+  ## @param webrtc.podAnnotations Annotations to add to the webrtc Pod
+  podAnnotations: {}
+
+  ## @param webrtc.service.type webrtc Service type
+  ## @param webrtc.service.port webrtc Service listening port
+  ## @param webrtc.service.targetPort webrtc container listening port
+  ## @param webrtc.service.annotations Annotations to add to the webrtc Service
+  service:
+    type: ClusterIP
+    port: 443
+    targetPort: 4444
+    annotations: {}
+
+  ## @param webrtc.probes Configure probe for webrtc
+  ## @extra webrtc.probes.liveness.path Configure path for webrtc HTTP liveness probe
+  ## @extra webrtc.probes.liveness.targetPort Configure port for webrtc HTTP liveness probe
+  ## @extra webrtc.probes.liveness.initialDelaySeconds Configure initial delay for webrtc liveness probe
+  ## @extra webrtc.probes.liveness.initialDelaySeconds Configure timeout for webrtc liveness probe
+  ## @extra webrtc.probes.startup.path Configure path for webrtc HTTP startup probe
+  ## @extra webrtc.probes.startup.targetPort Configure port for webrtc HTTP startup probe
+  ## @extra webrtc.probes.startup.initialDelaySeconds Configure initial delay for webrtc startup probe
+  ## @extra webrtc.probes.startup.initialDelaySeconds Configure timeout for webrtc startup probe
+  ## @extra webrtc.probes.readiness.path Configure path for webrtc HTTP readiness probe
+  ## @extra webrtc.probes.readiness.targetPort Configure port for webrtc HTTP readiness probe
+  ## @extra webrtc.probes.readiness.initialDelaySeconds Configure initial delay for webrtc readiness probe
+  ## @extra webrtc.probes.readiness.initialDelaySeconds Configure timeout for webrtc readiness probe
+  probes:
+    liveness:
+      path: /ping
+      initialDelaySeconds: 10
+
+  ## @param webrtc.resources Resource requirements for the webrtc container
+  resources: {}
+
+  ## @param webrtc.nodeSelector Node selector for the webrtc Pod
+  nodeSelector: {}
+
+  ## @param webrtc.tolerations Tolerations for the webrtc Pod
+  tolerations: []
+
+  ## @param webrtc.affinity Affinity for the webrtc Pod
+  affinity: {}
+
+  ## @param webrtc.persistence Additional volumes to create and mount on the webrtc. Used for debugging purposes
+  ## @extra webrtc.persistence.volume-name.size Size of the additional volume
+  ## @extra webrtc.persistence.volume-name.type Type of the additional volume, persistentVolumeClaim or emptyDir
+  ## @extra webrtc.persistence.volume-name.mountPath Path where the volume should be mounted to
+  persistence: {}
+
+  ## @param webrtc.extraVolumeMounts Additional volumes to mount on the webrtc.
+  extraVolumeMounts: []
+
+  ## @param webrtc.extraVolumes Additional volumes to mount on the webrtc.
+  extraVolumes: []
				`@@ -0,0 +1 @@`
				`../../../../secrets/numerique-gouv/impress/env/preprod/secrets.enc.yaml`