# Prepare embedded databases > [HTML Version](embedded-databases-settings.html) For the BRIX On-Premises system to operate, database management systems such as PostgreSQL, MongoDB, Valkey, the service bus RabbitMQ, and an S3 compatible object storage are required. This article describes the installation of these databases and S3 storage in a Kubernetes cluster using the `brix365-dbs` chart. It's possible to install only the required components from the `brix365-dbs`, with unused ones being disabled. ```` начало примечание ```` **Note** **** Use the `brix365-dbs` chart components: PostgreSQL, MongoDB, and S3 storage, for evaluation, testing, and some DEV/TEST scenarios. In a production environment, we recommend installing external [PostgreSQL](postgresql.md), [MongoDB](mongodb.md), and [S3 storage](seaweedfs.md). This will ensure the required service level and prevent the runtime environment from affecting data integrity. You will be able to promptly update external components to fix vulnerabilities and perform backups faster and more reliably. ```` конец примечание ```` The installation consists of four steps: 1. [Downloading the Helm chart and configuration file](#helm-chart). 2. [Filling out the configuration file](#file-config). 3. [Installing the brix365-dbs chart using helm in the Kubernetes cluster](#kubernetes-cluster). 4. [Connecting to the databases and S3](#databases-s3). ## Step 1: Downloading the Helm chart and configuration file To install via the internet, obtain the configuration file `values-brix365-dbs.yaml` by executing the following command: ```` helm repo add brix365 https://charts.brix365.com helm repo update helm show values brix365/brix365-dbs > values-brix365-dbs.yaml ```` Obtaining the configuration file for installation in a closed loop without internet access First, download the file on a computer with internet access. 1. Download the BRIX images and upload them to your local image registry. Read more in [Download BRIX images](downloadin-images-elma365.md). 2. Download the latest version archive of the chart `brix365-dbs` from the **brix365** repository by executing the following command: ```` helm repo add brix365 https://charts.brix365.com helm repo update helm pull brix365/brix365-dbs 3. ```` Copy the obtained chart archive \[OBJECT\] to the server where the installation will be carried out. 4. Unpack the chart \[OBJECT\] on the server where the installation will take place and copy the default configuration file \[OBJECT\] to \[OBJECT\]: ```` tar -xf brix365-dbs-X.Y.Z.tgz cp brix365-dbs/values.yaml values-brix365-dbs.yaml ```````` ## Step 2: Filling out the configuration file Fill out the configuration file \[OBJECT\] for the installation of databases and S3 storage. This article will cover the installation of databases and S3 storage in a Kubernetes cluster using the chart \[OBJECT\]. For this, standard connection strings and passwords specified in the chart will be used. In the chart \[OBJECT\], there is the **global** section where the installation of components and chart sections is enabled or disabled. This is necessary for configuring parameters of each component: **postgresql**, **mongodb**, **rabbitmq**, **valkey**, **seaweedfs**, **minio**, **elasticsearch**. We will discuss the necessary parameters for installing databases and S3 storage for the sections of these components. ```` начало внимание ```` We recommend using SeaweedFS as your S3 storage solution, as MinIO has been transitioned to limited support mode since December, 2025. For more information, please see the [official MinIO information](https://github.com/minio/minio/commit/27742d469462e1561c776f88ca7a1f26816d69e2). ```` конец внимание 1. ```` In the **global** section, enable the installation of necessary databases and S3 storage. To do this, select `true` in the `enabled` parameter for those components you want to install. ```` \# Selecting databases to install global:   postgresql:   # Installing postgres   enabled: true   mongodb:   # Installing mongoDB   enabled: true   valkey:   # Installing valkey   enabled: true   rabbitmq:   # Installing rabbitmq   enabled: true   minio:   # Installing minio for S3 storage   enabled: false   elasticsearch:   # Installing Elasticsearch (is enabled for BRIX Bot)   enabled: false seaweedfs: # Installing seaweedfs enabled: true ```` 2. Fill out configuration of the components for which you enabled installation. - [PostgreSQL](#pg). - [MongoDB](#mongo). - [RabbitMQ](#rabbit). - [Valkey](#valkey). - [SeaweedFS](#sw). - [MinIO](#minio). ### PostgreSQL configuration parameters If necessary, change the parameters: - `database` is the name of the database that will be created in PostgreSQL at the time of installation; - \[OBJECT\] is the name of the user for accessing the database specified in database. The user will be created in PostgreSQL at the time of installation; - \[OBJECT\] is the password for the user specified in **username**; - \[OBJECT\] is the size of the data storage, selected individually. ```` \# Selecting databases to install global: ... \# postgres database settings postgresql:   auth:   # database name   database: brix365   # user   username: postgres   # Postgres database password   postgresPassword: pgpassword   replicationUsername: repl\_user   replicationPassword: repl\_password   enablePostgresUser: true   password: pgpassword   primary:   persistence:   # data storage size (PVC)   size: 100Gi   enabled: true ... ```` Filling out clustering parameters for PostgreSQL To configure fault tolerance, uncomment and fill in the parameters `cluster Mode`. For the parameter \[OBJECT\], specify the required number of replicas. ```` \# Selecting databases to install global: ... \# Postgres database settings postgresql: ...   # cluster Mode — uncomment the following lines   architecture: replication   readReplicas:   replicaCount: 2   replication:   synchronousCommit: 'on'   numSynchronousReplicas: 1   applicationName: replication ... ```````` Filling out connection parameters to the private registry for installation in a closed loop without internet access To connect to a private registry, you need to: 1. Specify the address and path to the private registry in the parameter \[OBJECT\] for the initialization container. 2. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\] for the initialization container. The secret must be created manually and encrypted in Base64. 3. Specify the address and path to the private registry in the parameter \[OBJECT\]. 4. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\]. The secret must be created manually and encrypted in Base64. ```` \# Selecting databases to install global: ... \# Postgres database settings postgresql: ...   # Enabling the initialization container, which changes the owner and group of the volume mount point to \`RunAsUser:fsGroup   volumePermissions:   enabled: true   # address and secret for the private registry of initialization container images   image:   registry: registry.example.com/bitnami-shell   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ...   # Address and secret for the private registry   image:   registry: registry.example.com/postgresql   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ... ```` Where repository** **format is: - Address is** **\[OBJECT\]. - Path is \[OBJECT\] (for initialization container \[OBJECT\]). ### MongoDB configuration parameters If necessary, change the following parameters: - \[OBJECT\] is the name of the database to be created in MongoDB during installation; - \[OBJECT\] is the name of the user for accessing the specified database in \[OBJECT\]. The user will be created in MongoDB during installation; - \[OBJECT\] is the password for the user mentioned in \[OBJECT\]; - \[OBJECT\] is the data storage size, which is selected individually. ```` \# Selecting databases to install global: ... \# MongoDB settings mongodb:   auth:   # user   username: brix365   # database name   database: brix365   # database password   password: mongopassword   # root password   rootPassword: mongorootpassword   replicaSetKey: replicapassword   persistence:   # data storage size (PVC)   size: 20Gi ... ```` Filling out clustering parameters for MongoDB To configure fault tolerance, uncomment and fill in the parameters \[OBJECT\]. For the parameter \[OBJECT\], specify the required number of nodes in the cluster. ```` \# Selecting databases to install global: ... \# MongoDB settings mongodb: ...   # cluster Mode — uncomment the following lines   architecture: replicaset   replicaCount: 3 ... ```` ```` Filling out parameters for connecting to a private registry for offline installation To connect to a private registry, you need to: 1. Specify the address and path to the private registry in the parameter \[OBJECT\] for the initialization container. 2. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\] for the initialization container. The secret must be created manually and encrypted in Base64. 3. Specify the address and path to the private registry in the parameter \[OBJECT\]. 4. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\]. The secret must be created manually and encrypted in Base64. ```` \# Selecting databases to install global: ... \# MongoDB settings mongodb: ...   # Enabling the initialization container, which changes the owner and group of the volume mount point to \`RunAsUser:fsGroup   volumePermissions:   enabled: true   # address and secret for the private registry of initialization container images   image:   registry: registry.example.com/bitnami-shell   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ...   # address and secret for the private registry of initialization container images   image:   registry: registry.example.com/mongodb   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ... ```` Where repository** **format is: - Address is \[OBJECT\]. - Path is \[OBJECT\] (for initialization container \[OBJECT\]). ### RabbitMQ configuration parameters If necessary, change the following parameters: - \[OBJECT\] is the name of the database to be created in RabbitMQ during installation; - \[OBJECT\] is the name of the user for accessing the virtual host specified in \[OBJECT\]. The user will be created in RabbitMQ during installation; - \[OBJECT\] is the password for the user mentioned in \[OBJECT\]; - \[OBJECT\] is the data storage size, which is selected individually. ```` \# Selecting databases to install global: ... \# rabbitMQ settings rabbitmq:   auth:   # user   username: brix365   # vhost   vhost: brix365   # password   password: rmqpassword   erlangCookie: zk8Jdo2Kzz4ql   persistence:   # data storage size (PVC)   size: 5Gi ... ```` Filling out clustering parameters for RabbitMQ To configure fault tolerance, uncomment and fill in the parameters \[OBJECT\]. For the parameter \[OBJECT\], specify the required number of nodes in the cluster. ```` \# Selecting databases to install global: ... \# rabbitMQ settings rabbitmq: ...   # cluster Mode — uncomment the following lines   replicaCount: 3 ... ```` ```` Filling out parameters for connecting to a private registry for offline installation To connect to a private registry, you need to: 1. Specify the address and path to the private registry in the parameter \[OBJECT\] for the initialization container. 2. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\] for the initialization container. The secret must be created manually and encrypted in Base64. 3. Specify the address and path to the private registry in the parameter \[OBJECT\]. 4. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\]. The secret must be created manually and encrypted in Base64. ```` \# Selecting databases to install global: ... \# rabbitMQ settings rabbitmq: ...   # Enabling the initialization container, which changes the owner and group of the volume mount point to \`RunAsUser:fsGroup   volumePermissions:   enabled: true   # address and secret for the private registry of initialization container images   image:   registry: registry.example.com/bitnami-shell   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ...   # address and secret for the private registry   image:   registry: registry.example.com/rabbitmq   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ... ```` Where repository** **format is: - Address is \[OBJECT\]. - Path is \[OBJECT\] (for initialization container \[OBJECT\]). ### Valkey confguration parameters If necessary, change the data storage size in the parameter \[OBJECT\], which is selected individually. ```` \# Selecting databases to install global: ... \# Valkey settings valkey:   master:   persistence:   # data storage size (PVC)   size: 10Gi   # If undefined, the default StorageClass is used   # storageClass: "-" ...   commonConfiguration: |-   maxclients 20000   replica:   persistence:   # data storage size (PVC)   size: 10Gi ... ```` Filling out clustering parameters for Valkey To configure fault tolerance, uncomment and fill in the parameters \[OBJECT\]. For the parameter \[OBJECT\], specify the required number of nodes in the cluster. ```` \# Selecting databases to install. global: ... \# Valkey settomgs valkey: ...   replica:   persistence:   ...   replicaCount: 3   # cluster Mode — uncomment the following lines   architecture: replication   sentinel:   enabled: true   quorum: 2 ... ```` ```` Filling out parameters for connecting to a private registry for offline installation To connect to a private registry, you need to: 1. Specify the address and path to the private registry in the parameter \[OBJECT\] for the initialization container. 2. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\] for the initialization container. The secret must be created manually and encrypted in Base64. 3. Specify the address and path to the private registry in the parameter \[OBJECT\]. 4. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\]. The secret must be created manually and encrypted in Base64. ```` \# Selecting databases to install global: ... \# Valkey settings valkey: ...   # Enabling the initialization container, which changes the owner and group of the volume mount point to \`RunAsUser:fsGroup   volumePermissions:   enabled: true   # address and secret for the private registry of initialization container images   image:   registry: registry.example.com/bitnami-shell   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ...   # address and secret for the private registry   image:   registry: registry.example.com/valkey   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ... ```` Where repository** **format is: - address is \[OBJECT\]; - path is \[OBJECT\] (for initialization container \[OBJECT\]). ### SeaweedFS configuration parameters 1. By default, a secret named `my-s3-secret` is created when SeaweedFS is installed. You can use your own secret instead and specify its name in the SeaweedFS configuration using the [seaweedfs.s3.existingConfigSecret parameter](#secret-parameter). Example secret: ```` apiVersion: v1 kind: Secret type: Opaque metadata: name: my-custom-s3-secret namespace: labels: app.kubernetes.io/name: seaweedfs app.kubernetes.io/component: s3 stringData: seaweedfs\_s3\_config: '\{"identities":\[\{"name":"anvAdmin","credentials":\[\{"accessKey":"","secretKey":""\}\],"actions":\["Admin","Read","Write"\]\}\]\}' ```` Where: - `` is the username for accessing S3 storage. - `` is the password for this user. 2. If necessary, modify the SeaweedFS configuration parameters: - `filer.s3.createBuckets.name` is the name of the bucket that will be created in SeaweedFS during installation. **Important**: Create a bucket in S3 with a name following the **s3brix365\*** format. Examples of S3 buckets: **s3brix365**, **s3brix365-dev**, **s3brix365-prod**. - `seaweedfs.s3.existingConfigSecret`. If you [created your own secret](#create-secret) with access credentials to your S3 storage, specify the name of this secret. You can leave the default value, `my-s3-secret`. A secret with this name will then be created automatically during SeaweedFS installation. - `s3.iIngress.host` is the domain name (FQDN) by which the S3 storage will be accessible. This article uses `brix365\_server.your\_domain` as an example. - `size` is the size of the data storage. Please specify a value based on the size of your data. ```` \# Selecting DBs to install global: ... \# SeaweedFS settings seaweedfs: \# Master configuration parameters master: replicas: 1 \# XYZ replication type for files: \# X number of replicas in other DCs \# Y number of replicas in other racks \# Z number of replicas on other volumes defaultReplication: "000" data: \# Master datastore size (PVC) size: "10Gi" \# If not defined, the default StorageClass is used \# storageClass: "" volume: replicas: 1 dataDirs: \# Volume datastore size (PVC) \-size: "30Gi" name: data1 type: "persistentVolumeClaim" hostPathPrefix: /ssd maxVolumes: 0 \# if not defined, the default StorageClass is used \# storageClass: "" filer: replicas: 1 \# Type XYZ replications for metadata: \# X number of replicas in other DCs \# Y number of replicas in other racks \# Z number of replicas on other volumes defaultReplicaPlacement: "000" maxMB: 256 data: \# filer data storage size (PVC) size: "30Gi" \# if not defined, the default StorageClass is used \# storageClass: "" s3: createBuckets: \# brix365 bucket \- name: s3brix365 anonymousRead: false s3: replicas: 1 existingConfigSecret: my-s3-secret ingress: \## specify ingressClassName className: "" \# include host in ingress (required for TLS) \# host: " brix365\_server.your\_domain " \# TLS settings \# tls: \# - hosts: \# - brix365\_server.your\_domain \# secretName: "brix365-onpremise-tls" ... ```` Filling out TLS/SSL parameters for SeaweedFS To enable TLS/SSL support in SeaweedFS, follow these steps: 1. Prepare a secret with a certificate for HTTPS. For more information, see [Create a secret with a certificate for HTTPS operation](preparation-secret-with-certificate-https.md). 2. In the `seaweedfs.s3.ingress.tls.hosts.secretName` parameter, specify the name of the secret created in the previous step. This article uses the name `brix365-onpremise-tls` as an example. 3. In the `seaweedfs.s3.ingress.host parameter`, specify the domain name (FQDN) by which the SeaweedFS S3 storage will be accessible. This article uses the name `brix365\_server.your\_domain` as an example. 4. In the `seaweedfs.s3.ingress.tls.hosts` parameter for configuring TLS, also specify the domain name (FQDN) where the SeaweedFS S3 storage will be accessible. This article uses `brix365\_server.your\_domain` as an example. ```` \# Selecting installed databases global: ... \# SeaweedFS settings seaweedfs: ... s3: ingress: \# specify ingressClassName className: "" \# include host in ingress (required for TLS) host: "brix365\_server.your\_domain" \# SeaweedFS TLS settings tls: \- hosts: \- brix365\_server.your\_domain secretName: "brix365-onpremise-tls" ... ```` If you used a self-signed certificate with OpenSSL or a certificate issued by a local CA when creating a secret with a certificate for HTTPS, configure trust support for the custom CA certificate. For embedded databases, you can use the [Kyverno](install-kyverno.md) add-on module. Filling out parameters for connecting to a private registry for offline installation To connect to a private registry: 1. In the `seaweedfs.global.image.repository` parameter, specify the address and path to the private registry. 2. In the `seaweedfs.global.imagePullSecrets` parameter, specify the name of the secret with access rights to the private registry for the initial container. The secret must be manually created and Base64-encoded. ```` \# Selecting databases to install global: ... \# S3 storage settings seaweedfs: \# Address and secret for the private registry of the initialization container images global: registry: registry.example.com repository: "docker/databases" imageName: "seaweedfs" imagePullPolicy: IfNotPresent \# The secret with access rights to the private registry must be manually created and Base64-encoded imagePullSecrets: \- name: yandexsecret-dbs ... ```` Where the repository format is the address: `registry.example.com`. ### MinIO configuration parameters If necessary, modify the following parameters: - \[OBJECT\] is the name of the user for access to the S3 storage. The user will be created in MinIO during installation. - \[OBJECT\] is the password for the user specified in \[OBJECT\]. - \[OBJECT\] is the name of the bucket that will be created in MinIO during installation. ```` Начало внимание ```` The bucket name in S3 must follow the format **s3brix365\***. Examples: - \[OBJECT\]. - \[OBJECT\]. - \[OBJECT\]. ```` Конец внимание - ```` \[OBJECT\] is the name of the bucket for Ingress, which must match \[OBJECT\]. - \[OBJECT\] is the domain name (FQDN) by which the S3 storage will be accessible. In the context of this article it is \[OBJECT\]. - \[OBJECT\] is the data storage size, which is selected individually. ```` \# Selecting databases to install global: ... \# minio (S3 storage)settings minio:   auth:   rootUser: "PZSF73JG72Ksd955JKU1HIA"   rootPassword: "aFDkj28Jbs2JKbnvJH678MNwiz88zKjsuNBHHs"   # BRIX bucket   defaultBuckets: s3brix365   # Additional buckets are enabled for BRIX + BRIX Bot   # defaultBuckets: s3brix365,s3brix365bot,brix365bot-static-files,brix365bot-temporary-files   apiIngress:   extraHosts:   - path: /s3brix365   name: brix365\_server.your\_domain ...   persistence:   # data storage size (PVC)   size: 100Gi ... ```` Filling out TLS/SSL enabling parameters for MinIO To enable TLS/SSL support in MinIO, follow these steps: 1. Prepare a secret with a certificate for HTTPS operation. Read more in [Create a secret with a certificate for HTTPS operation](preparation-secret-with-certificate-https.md). 2. Fill in the TLS/SSL parameters for MinIO: ```` \# Selecting databases to install global: ... \# minio (S3 storage) settings minio: ... apiIngress: extraHosts: - path: /s3brix365 # enabling host in ingress (necessary to specify for TLS) # for the app, enable hostEnabled in the file values-brix365.yaml name: brix365\_server.your\_domain # TLS settings for minio extraTls: - hosts: - brix365\_server.your\_domain secretName: "brix365-onpremise-tls" ... ```` where: - \[OBJECT\] is the name of the secret created in the previous step. In the context of this article it is \[OBJECT\]. - \[OBJECT\] and \[OBJECT\] ishe domain name (FQDN) by which the MinIO S3 storage is accessible. In the context of this article it is \[OBJECT\]. If you used a self-signed certificate created with OpenSSL or a certificate issued by a local certification authority when creating the secret for HTTPS operation, you need to configure trust support for the user's CA certificate. For built-in databases, you can do this using the Kyverno add-ons module. Filling out parameters for connecting to a private registry for offline installation To connect to a private registry, you need to: 1. Specify the address and path to the private registry in the parameter \[OBJECT\] for the initialization container. 2. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\] for the initialization container. The secret must be created manually and encrypted in Base64. 3. Specify the address and path to the private registry in the parameter \[OBJECT\]. 4. Indicate the name of the secret with access rights to the private registry in the parameter \[OBJECT\]. The secret must be created manually and encrypted in Base64. ```` \# Selecting databases to install global: ... \# minio (S3 storage) settings minio: ...   # Enabling the initialization container, which changes the owner and group of the volume mount point to \`RunAsUser:fsGroup   volumePermissions:   enabled: true   # address and secret for the private registry of initialization container images   image:   registry: registry.example.com/bitnami-shell   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ...   # address and secret for the private registry   image:   registry: registry.example.com/minio   # The secret with access rights to the private registry must be created manually, encrypted in Base64   pullSecrets:   - myRegistryKeySecretName ... ```` Where repository** **format is: - Address is \[OBJECT\]. - Path is \[OBJECT\] (for initialization container \[OBJECT\]). ## Step 3: Installing the brix365-dbs chart using helm in the Kubernetes cluster Install the \[OBJECT\] chart in the **brix365-dbs** namespace. For online installation: ```` helm upgrade --install brix365-dbs brix365/brix365-dbs -f values-brix365-dbs.yaml -n brix365-dbs --create-namespace ```` For offline installation without internet access, go to the directory with the downloaded chart and execute the command: ```` helm upgrade --install brix365-dbs ./brix365-dbs -f values-brix365-dbs.yaml -n brix365-dbs --create-namespace ## ```` Step 4: Connecting to the databases and S3 The domain name for the Kubernetes cluster is assumed to be **cluster.local**. Connection string for PostgreSQL: ```` postgresql://brix365:SecretPassword@postgres.brix365-dbs.svc.cluster.local:5432/brix365?sslmode=disable ```` Connection string for MongoDB: ```` mongodb://brix365:SecretPassword@mongo.brix365-dbs.svc.cluster.local:27017/brix365?ssl=false\&replicaSet=rs0\&readPreference=nearest ```` Connection string for RabbitMQ: ```` amqp://brix365user:SecretPassword@rabbitmq.brix365-dbs.svc.cluster.local:5672/brix365vhost ```` Connection string for Valkey: ```` redis://valkey.brix365-dbs.svc.cluster.local:6379/0 ```` Connection string for Valkey for a cluster mode: ```` redis://valkey.brix365-dbs.svc.cluster.local:26379/0?masterName=myprimary ```` Connection string for S3: - **address**: \[OBJECT\]. - **bucket**: \[OBJECT\]. - **region**: \[OBJECT\]. - **access key ID**: \[OBJECT\]. - **secret access key**: \[OBJECT\]. - **upload method**: \[OBJECT\]. - **enable SSL**: \[OBJECT\]. ## Deleting brix365-dbs chart using helm in the Kubernetes cluster ```` Начало внимание ```` Before deleting the chart \[OBJECT\], perform a backup of the databases and S3 storage. Deleting the chart \[OBJECT\] will lead to a complete loss of data by the BRIX application. ```` Конец внимание ```` Delete chart \[OBJECT\] in namespace **brix365-dbs**: ```` helm uninstall brix365-dbs -n brix365-dbs ````