​

Create the Kubernetes Cluster

​

(Optional): Configure Valkey

• We will deploy a managed Valkey provided by DigitalOcean. Go to the new Database creation page. Firstly, select the same region and VPC as you used when deploying your Kubernetes cluster, and select Valkey. Provide a name, and click Create Database Cluster. Again we used the default sizes, but your usage will vary and we recommend testing under your typical loads and adjusting by the database size as necessary.

• From the overview, click on Secure this database cluster by restricting access.. This will take you to the Trusted Sources panel in the Settings tab. Here we will improve the security of your database by only allowing connections from your Kubernetes cluster. Type the name of your Kubernetes cluster and add it as a Trusted Source.

• In the Overview tab for your Valkey database. Select connection string from the dropdown, and copy the displayed Connection String. You will require this when configuring your deployment in step 4.

​

(Optional): Configure Postgres

• We will now deploy a managed Postgres provided by DigitalOcean. Go to the new Database creation page. Firstly, select the same region and VPC as you used when deploying your Kubernetes cluster, and then select Postgres. Provide a name, and click Create Database Cluster. Again we used the default sizes, but your usage will vary and we recommend testing under your typical loads and adjusting by the database size as necessary.

• From the overview page for your Postgres database, click on Secure this database cluster by restricting access. This will take you to the Trusted Sources panel in the Settings tab. Here we will improve the security of your database by only allowing connections from your Kubernetes cluster. Type the name of your Kubernetes cluster and add it as a Trusted Source.

• In the Overview tab for your Valkey database. Select connection string from the dropdown, and copy the displayed Connection String. You will require this for when configuring your deployment in step 4.

​

(Optional): Configure Blob Storage (DigitalOcean Spaces)

• Navigate to the Create a Space page. Please select a region of your choice, we recommend the same region as you have deployed the cluster. We did not enable the CDN and we restricted the file listing for security purposes. Please provide a name for your Space, this has to be unique in the region so please use a different name than our example. Make a note of this name, this is the bucket value which we will require when configuring your deployment in subsequent steps. Click on Create Space.

• Once created, click on the Settings tab and add a CORS Configurations.
• Add a CORS Configuration which allows PUT requests from your domain.

• Now click on the Settings tab and copy the Endpoint value.

• Now navigate to the API page in DigitalOcean. Next to the Spaces access keys heading, click Generate New Key. You will only be able to see the Secret value once, so copy the name, the key and the secret and store this securely.

​

Create a Namespace

kubectl create namespace speckle --context "${YOUR_CLUSTER_CONTEXT_NAME}"

​

Create Secrets

kubectl create secret generic server-vars \
 --context "${YOUR_CLUSTER_CONTEXT_NAME}" \
 --namespace speckle \
 --from-literal=redis_url="${YOUR_REDIS_CONNECTION_STRING}" \
 --from-literal=postgres_url="${YOUR_POSTGRES_CONNECTION_STRING}" \
 --from-literal=s3_secret_key="${YOUR_SPACES_SECRET}" \
 --from-literal=session_secret="${YOUR_SECRET}" \
 --from-literal=email_password="${YOUR_EMAIL_SERVER_PASSWORD}" # optional, only required if you wish to enable email invitations

kubectl describe secret server-vars --namespace speckle --context "${YOUR_CLUSTER_CONTEXT_NAME}"

kubectl get secret server-vars --context "${YOUR_CLUSTER_CONTEXT_NAME}" \
  --namespace speckle \
  --output jsonpath='{.data.redis_url}' | base64 --decode

kubectl edit secrets server-vars --namespace speckle --context "${YOUR_CLUSTER_CONTEXT_NAME}"

​

Priority Classes

cat <<'EOF' | kubectl create --context "${YOUR_CLUSTER_CONTEXT_NAME}" --namespace speckle --filename -
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority
value: 100
globalDefault: false
description: "High priority (100) for business-critical services"
---
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: medium-priority
value: 50
globalDefault: true
description: "Medium priority (50) - dev/test services"
---
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: low-priority
value: -100
globalDefault: false
description: "Low priority (-100) - Non-critical microservices"
EOF

​

Certificate Manager

helm repo add jetstack https://charts.jetstack.io

​

Ingress

• We first let Helm know where NGINX ingress can be found:

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx

​

Configure your Deployment

• Fill in the requested fields and save the file:
  • namespace: required, we are using speckle in this guide so change this value
  • domain: required, this is the domain name at which your Speckle server will be available.
  • db.useCertificate: required, this should be set to true and will force Speckle to use the certificate for Postgres we shall provide in db.certificate.
  • db.certificate: required, this can be found by clicking Download CA certificate in your database’s overview page on DigitalOcean. You can find your Postgres database by selecting it from the Database page on DigitalOcean. When entering the data, please use Helm’s pipe operator for multiline strings and be careful with indentation. We recommend reading Helm’s guide on formatting multiline strings, and refer to the image below for an example of this format.
  • s3.endpoint: required, the endpoint can be found in the Settings Page of your DigitalOcean Space. You can find your Space by selecting it from the Spaces page on DigitalOcean. This value must be prepended with https://.
  • s3.bucket: required, this is the name of your DigitalOcean space.
  • s3.access_key: required, this is the Key of your Spaces API key. You can find this by viewing it from the Spaces API Key page on DigitalOcean
  • s3.auth.local.enabled: this is enabled by default. This requires users to register on your Speckle cluster with a username and password. If you wish to use a different authorization provider, such as Azure AD, Github, or Google, then set this value to false, and amend the relevant section below by enabling that and providing the relevant details where necessary.
  • server.email: optional, enabling emails will enable extra features like sending invites.
    • You will need to set server.email.enabled to true.
    • Please set server.email.host, server.email.username, and optionally depending on your email server server.email.port
    • This also requires the email_password secret to have been set in Step 3.
  • cert_manager_issuer: optional, the default is set for Let’s Encrypt staging api letsencrypt-staging. For production, or if you encounter an issue with certificates, change the value to letsencrypt-prod.

​

Deploy Speckle to Kubernetes

helm repo add speckle https://specklesystems.github.io/helm

​

Update your Domain

​

Create an account on your Server