.. index:: HELM Charts

HELM Charts
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

First, you need to get access to the HELM charts.
They are hosted in a private :term:`Git` repository.
You'll get access by sharing a public key with us.

1. Create a new public/private key (that way, there won't be a conflict with already registered keys at GitHub): ``ssh-keygen -t ed25519 -f my-key``
2. Send your new ``my-key.pub`` public key to the contact person at Sagemath, Inc.
   This key will be added as a deployment key.
3. Then, in a new empty directory (e.g. ``cocalc-onprem``):

.. code:: bash

    git init .
    git config --local core.sshCommand "ssh -i ~/path/to/my-key -o IdentitiesOnly=yes -o IdentityAgent=none"
    git remote add github git@github.com:sagemathinc/cocalc-onprem-helm.git
    git pull github main
    git branch --set-upstream-to=github/main

(replace ``~/path/to/my-key`` by the path to the private key generated in step 1.)

.. note::

   The two extra ``-o`` flags above are important. Without them, on a system
   that already has a running ``ssh-agent`` or another GitHub key in
   ``~/.ssh/config``, OpenSSH will offer **all** known keys to GitHub and
   GitHub authenticates against the *first* key it recognizes. If that's
   one of your personal-account keys, GitHub then refuses the deployment
   key — even though it's sitting right there in your ``core.sshCommand``.
   The symptom is a confusing ``Permission denied (publickey)`` error
   despite a working key.

   * ``-o IdentitiesOnly=yes`` — use **only** the key passed via ``-i``.
   * ``-o IdentityAgent=none`` — ignore any running ``ssh-agent``.

   If you'd rather configure this once in ``~/.ssh/config`` instead of
   per-repository, add a host alias:

   .. code:: text

       Host cocalc-onprem-deploy
         HostName github.com
         User git
         IdentityFile ~/path/to/my-key
         IdentitiesOnly yes

   and then use that alias in your remote URL:

   .. code:: bash

       git remote add github git@cocalc-onprem-deploy:sagemathinc/cocalc-onprem-helm.git

   With either approach you can drop the ``core.sshCommand`` line.

Once this is done, pull periodically to get updates and :ref:`update the deployed HELM chart <updating>`.
In particular, the tags for the deployed docker images will change – see :doc:`../ops/versions` for more details.