Kubernetes

Configure a Kubernetes deployment - where settings, secrets and files go, and one page per feature.

A Kubernetes deployment reads the same environment variables as the Toolkit. Where a Toolkit page says “add this to config/variables.env”, put the value into the ConfigMap overleaf-env, or into the Secret overleaf-secrets when it is a password, key or token. Then restart:

kubectl -n overleaf apply -f 30-config.yaml        # after editing the ConfigMap
kubectl -n overleaf patch secret overleaf-secrets --type merge \
  -p '{"stringData":{"GITHUB_TOKEN_CIPHER_PASSWORD":"'"$(openssl rand -hex 32)"'"}}'
kubectl -n overleaf rollout restart deployment/overleaf

Values in config/overleaf.rc are Toolkit settings, not environment variables; the Q&A at the end of this page says what replaces them.

Features

Each feature of the Toolkit configuration has a page here with its services, settings, network paths, background jobs, what changes with several replicas, and how it was tested:

Feature	Services in the pod	Beyond the ConfigMap and Secret
Authentication: OIDC, SAML, LDAP, Public Access, reCAPTCHA, Password restrictions	web	client secrets, the IdP certificate, the LDAP CA
Sandboxed Compiles	clsi	Docker Engine and the TeX Live images on every node
Pandoc Import and Export	clsi, web	the Pandoc image in Docker on every node
Git integration	git-bridge (own pod), web, history-v1	the git-bridge StatefulSet and two Services
GitHub, GitLab, Gitea Synchronisation	web	Git integration
Dropbox Synchronisation	web, third-party-datastore, document-updater	Git integration, the webhook reachable from the internet, database indexes
Zotero, Mendeley Integration	web	the cipher password in the Secret
MCP Server	web	Git integration
AI Integration	web, linked-url-proxy	–
Overleaf Import API	web, linked-url-proxy	–
Templates	web, filestore	S3 for several replicas
External URL	linked-url-proxy	public node addresses in OVERLEAF_LINKED_URL_BLOCKED_NETWORKS
Logging	every service	a volume at /var/log/overleaf to keep logs
TLS proxy	your ingress or load balancer	TLS ends in front of the pods
Branding	web	–
Localization	web	one host name per language
Email delivery	web	–
Redis	every service with live state	–
S3	history-v1, filestore	an S3 service, required for several replicas
Adding LaTeX user help	web	the pods must reach the wiki
Horizontal scaling	all	S3, a load balancer with sticky sessions

Certificates and other files

Some features take a file path instead of a value: the SAML certificates (OVERLEAF_SAML_IDP_CERT, …), the LDAP CA (OVERLEAF_LDAP_TLS_OPTS_CA_PATH), or a private CA for a self-hosted GitHub Enterprise, GitLab or Gitea (NODE_EXTRA_CA_CERTS). Put the files into a Secret and mount it where the Toolkit pages expect them, /var/lib/overleaf/certs:

kubectl -n overleaf create secret generic overleaf-certs --from-file=idp_cert.pem --from-file=ca.pem

40-overleaf.yaml (additions)

          volumeMounts:
            # ...
            - name: certs
              mountPath: /var/lib/overleaf/certs
              readOnly: true
      volumes:
        # ...
        - name: certs
          secret:
            secretName: overleaf-certs

Then refer to them by path in the ConfigMap, for example NODE_EXTRA_CA_CERTS: /var/lib/overleaf/certs/ca.pem, and restart.

Cipher passwords. Set every *_CIPHER_PASSWORD of the features you use in the Secret. Some features otherwise generate a key file in the data volume on first use: with one replica that works until the volume is lost, with several replicas each replica would encrypt with a different key.

Q&A

Which Toolkit settings from config/overleaf.rc do I need?

Answer: None of them are read by Ayakaleaf Pro. Their Kubernetes counterparts:

config/overleaf.rc	Kubernetes
OVERLEAF_LISTEN_IP, OVERLEAF_PORT	the Service (NodePort) or your ingress
SIBLING_CONTAINERS_ENABLED	SANDBOXED_COMPILES* in the ConfigMap, Docker socket in the pod
GIT_BRIDGE_ENABLED	Git integration
MONGO_ENABLED, REDIS_ENABLED, MONGO_URL, REDIS_HOST	the StatefulSets or your managed services, OVERLEAF_MONGO_URL and OVERLEAF_REDIS_HOST
REDIS_AOF_PERSISTENCE	--appendonly yes in 20-redis.yaml
NGINX_ENABLED, TLS_*	your ingress or load balancer