From ddb70f793d872e5df6ee82a48fe9457ba07fec9a Mon Sep 17 00:00:00 2001
From: MergeCheck <mergecheck@example.invalid>
Date: Fri, 3 Jul 2026 11:17:54 -0300
Subject: [PATCH 1/2] fix(docmost): centralize template validation

---
 charts/docmost/templates/_helpers.tpl  | 15 +++++++++++++++
 charts/docmost/templates/validate.yaml | 13 +------------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/charts/docmost/templates/_helpers.tpl b/charts/docmost/templates/_helpers.tpl
index 1902c0500..bce706887 100644
--- a/charts/docmost/templates/_helpers.tpl
+++ b/charts/docmost/templates/_helpers.tpl
@@ -254,3 +254,18 @@ true
 {{- define "docmost.backupDbPasswordSecretKey" -}}
 {{- include "docmost.databaseSecretKey" . -}}
 {{- end -}}
+
+{{- define "docmost.validate" -}}
+{{- if and (ne (int .Values.replicaCount) 1) (ne .Values.storage.mode "s3") -}}
+{{- fail "docmost: replicaCount greater than 1 requires storage.mode=s3 because local storage is single-writer" -}}
+{{- end -}}
+{{- if and (eq .Values.storage.mode "local") (not .Values.storage.local.enabled) (not .Values.storage.local.existingClaim) -}}
+{{- fail "docmost: storage.mode=local requires storage.local.enabled=true or storage.local.existingClaim" -}}
+{{- end -}}
+{{- if and (eq .Values.storage.mode "s3") (not .Values.storage.s3.bucket) -}}
+{{- fail "docmost: storage.mode=s3 requires storage.s3.bucket" -}}
+{{- end -}}
+{{- if and (eq .Values.storage.mode "s3") (not .Values.storage.s3.existingSecret) (or (not .Values.storage.s3.accessKey) (not .Values.storage.s3.secretKey)) -}}
+{{- fail "docmost: storage.mode=s3 requires storage.s3.existingSecret or both storage.s3.accessKey and storage.s3.secretKey" -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/docmost/templates/validate.yaml b/charts/docmost/templates/validate.yaml
index 1dd2b10c4..8c3fc7f04 100644
--- a/charts/docmost/templates/validate.yaml
+++ b/charts/docmost/templates/validate.yaml
@@ -1,13 +1,2 @@
 {{/* SPDX-License-Identifier: Apache-2.0 */}}
-{{- if and (ne (int .Values.replicaCount) 1) (ne .Values.storage.mode "s3") -}}
-{{- fail "docmost: replicaCount greater than 1 requires storage.mode=s3 because local storage is single-writer" -}}
-{{- end -}}
-{{- if and (eq .Values.storage.mode "local") (not .Values.storage.local.enabled) (not .Values.storage.local.existingClaim) -}}
-{{- fail "docmost: storage.mode=local requires storage.local.enabled=true or storage.local.existingClaim" -}}
-{{- end -}}
-{{- if and (eq .Values.storage.mode "s3") (not .Values.storage.s3.bucket) -}}
-{{- fail "docmost: storage.mode=s3 requires storage.s3.bucket" -}}
-{{- end -}}
-{{- if and (eq .Values.storage.mode "s3") (not .Values.storage.s3.existingSecret) (or (not .Values.storage.s3.accessKey) (not .Values.storage.s3.secretKey)) -}}
-{{- fail "docmost: storage.mode=s3 requires storage.s3.existingSecret or both storage.s3.accessKey and storage.s3.secretKey" -}}
-{{- end -}}
+{{- include "docmost.validate" . -}}

From fe069f952db16c4d83876ae18c5ed243adf1845c Mon Sep 17 00:00:00 2001
From: MergeCheck <mergecheck@example.invalid>
Date: Sun, 5 Jul 2026 18:17:14 -0300
Subject: [PATCH 2/2] fix(docmost): reject unsupported storage modes

---
 charts/docmost/templates/_helpers.tpl | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/charts/docmost/templates/_helpers.tpl b/charts/docmost/templates/_helpers.tpl
index bce706887..384c12bd3 100644
--- a/charts/docmost/templates/_helpers.tpl
+++ b/charts/docmost/templates/_helpers.tpl
@@ -256,6 +256,9 @@ true
 {{- end -}}
 
 {{- define "docmost.validate" -}}
+{{- if and (ne .Values.storage.mode "local") (ne .Values.storage.mode "s3") -}}
+{{- fail (printf "docmost: storage.mode must be 'local' or 's3', got %q" .Values.storage.mode) -}}
+{{- end -}}
 {{- if and (ne (int .Values.replicaCount) 1) (ne .Values.storage.mode "s3") -}}
 {{- fail "docmost: replicaCount greater than 1 requires storage.mode=s3 because local storage is single-writer" -}}
 {{- end -}}