fix(docker): correct Crush installation tar extraction

Fixed the Crush AI assistant installation in Dockerfile by replacing the single-line tar extraction with --strip-components (which was failing) with a multi-step approach: download to temp, extract, move binary, and cleanup. This ensures the binary is properly extracted from the versioned directory structure in the tarball. Generated with [Claude Code](https://claude.ai/code) via [Happy](https://happy.engineering) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Happy <yesreply@happy.engineering>
feat(helm): rip out sequentialthinking MCP server sidecar
2026-02-24 02:42:44 +00:00 · 2026-02-23 21:05:40 -05:00 · 2026-02-23 20:55:38 -05:00 · 2026-02-23 20:54:15 -05:00 · 2026-02-23 20:54:15 -05:00 · 2026-02-24 01:45:24 +00:00
29 changed files with 2709 additions and 1232 deletions
@@ -0,0 +1,9 @@
+{
+  "enabledMcpjsonServers": [
+    "kubernetes",
+    "flux",
+    "playwright",
+    "github",
+    "pgtuner"
+  ]
+}
@@ -0,0 +1,94 @@
+# CI/CD Pipeline Guide
+
+## 🚀 Simplified Pipeline - Only 3 Workflows!
+
+### 1️⃣ For Releases → **Unified Release**
+Use this for all version releases:
+1. Go to [Actions → Unified Release](https://github.com/cpfarhood/devcontainer/actions/workflows/release-unified.yaml)
+2. Click "Run workflow"
+3. Either:
+   - Enter specific version (e.g., `0.2.1`), OR
+   - Choose release type (patch/minor/major) for auto-increment
+4. Click "Run workflow"
+
+**This single workflow does EVERYTHING:**
+- ✅ Updates chart version
+- ✅ Creates git tag
+- ✅ Builds Docker image with all proper tags
+- ✅ Publishes Helm chart to GHCR
+- ✅ Creates GitHub Release with changelog
+- ✅ No more `[skip ci]` blocking builds!
+
+### 2️⃣ For Quick Fixes → **Quick Fix Build**
+Use this for emergency fixes without version changes:
+1. Go to [Actions → Quick Fix Build](https://github.com/cpfarhood/devcontainer/actions/workflows/quick-fix.yaml)
+2. Click "Run workflow"
+3. Enter tag (default: `latest`)
+4. Click "Run workflow"
+
+**Just builds and pushes Docker image** - no version bumps, no releases.
+
+### 3️⃣ Automatic CI → **Build and Push**
+Runs automatically on:
+- Pull requests (builds but doesn't push)
+- Tags starting with `v*` (builds and pushes)
+- Manual trigger available
+
+## Workflow Files
+
+| Workflow | File | Purpose | When to Use |
+|----------|------|---------|-------------|
+| **Unified Release** | `release-unified.yaml` | Full release process | New versions |
+| **Quick Fix Build** | `quick-fix.yaml` | Docker build only | Hotfixes |
+| **Build and Push** | `build-and-push.yaml` | CI/CD automation | PRs & tags |
+
+## Examples
+
+### Release a new version
+```bash
+# Via GitHub UI (Recommended):
+# Go to Actions → Unified Release → Run workflow
+
+# Via GitHub CLI:
+gh workflow run release-unified.yaml -f version=0.2.1
+# OR auto-increment:
+gh workflow run release-unified.yaml -f release_type=patch
+```
+
+### Push a quick fix
+```bash
+# Via GitHub UI:
+# Go to Actions → Quick Fix Build → Run workflow
+
+# Via GitHub CLI:
+gh workflow run quick-fix.yaml -f tag=hotfix-1
+```
+
+### Check workflow status
+```bash
+# List all recent runs
+gh run list --limit 5
+
+# Watch a specific workflow
+gh run watch
+```
+
+## Version Strategy
+
+- **Major** (1.0.0): Breaking changes
+- **Minor** (0.2.0): New features
+- **Patch** (0.2.1): Bug fixes
+
+## What We Fixed
+
+### Before (Nightmare 😱)
+- Auto-version-bump with `[skip ci]` prevented Docker builds
+- 6+ disconnected workflows
+- Manual tag deletion and re-pushing
+- Version conflicts everywhere
+
+### After (Simple! 🎉)
+- **3 total workflows** (down from 6+)
+- **1 button** for complete releases
+- **No more `[skip ci]`** blocking builds
+- **Clear separation** of concerns
@@ -4,8 +4,6 @@ on:
  push:
    branches:
      - main
-    tags:
-      - 'v*'
  pull_request:
    branches:
      - main
@@ -18,6 +16,9 @@ env:
 jobs:
  build-and-push:
    runs-on: ubuntu-latest
+    # Skip builds triggered by release-unified.yaml commits (github-actions[bot])
+    # to prevent racing with the release workflow's own Docker build
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' || github.actor != 'github-actions[bot]'
    permissions:
      contents: read
      packages: write
@@ -46,9 +47,6 @@ jobs:
          tags: |
            type=ref,event=branch
            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
            type=sha,prefix=sha-
            type=raw,value=latest,enable={{is_default_branch}}

@@ -1,57 +0,0 @@
-name: Publish Helm Chart
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'chart/**'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  packages: write
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Helm
-        uses: azure/setup-helm@v4
-
-      - name: Bump patch version
-        id: bump
-        run: |
-          CURRENT=$(grep '^version:' chart/Chart.yaml | awk '{print $2}')
-          MAJOR=$(echo $CURRENT | cut -d. -f1)
-          MINOR=$(echo $CURRENT | cut -d. -f2)
-          PATCH=$(echo $CURRENT | cut -d. -f3)
-          NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
-          sed -i "s/^version: .*/version: ${NEW_VERSION}/" chart/Chart.yaml
-          echo "version=${NEW_VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Commit version bump
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add chart/Chart.yaml
-          git commit -m "chore: bump chart version to ${{ steps.bump.outputs.version }} [skip ci]"
-          git push
-
-      - name: Log in to GHCR
-        run: |
-          helm registry login ghcr.io \
-            --username ${{ github.actor }} \
-            --password ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Package chart
-        run: helm package chart/
-
-      - name: Push chart to GHCR
-        run: |
-          helm push devcontainer-${{ steps.bump.outputs.version }}.tgz oci://ghcr.io/cpfarhood/charts
@@ -0,0 +1,54 @@
+name: Quick Fix Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag for the image (defaults to latest)'
+        required: false
+        default: 'latest'
+        type: string
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and Push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.tag }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64
+
+      - name: Summary
+        run: |
+          echo "## ✅ Quick Fix Build Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Images Published:" >> $GITHUB_STEP_SUMMARY
+          echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.tag }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,159 @@
+name: Unified Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to release (e.g., 0.1.25)'
+        required: true
+        type: string
+      release_type:
+        description: 'Release type'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Determine Version
+        id: version
+        run: |
+          if [ "${{ github.event.inputs.version }}" != "" ]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            # Auto-determine next version based on release type
+            CURRENT=$(grep '^version:' chart/Chart.yaml | awk '{print $2}')
+            MAJOR=$(echo $CURRENT | cut -d. -f1)
+            MINOR=$(echo $CURRENT | cut -d. -f2)
+            PATCH=$(echo $CURRENT | cut -d. -f3)
+
+            case "${{ github.event.inputs.release_type }}" in
+              major)
+                VERSION="$((MAJOR + 1)).0.0"
+                ;;
+              minor)
+                VERSION="${MAJOR}.$((MINOR + 1)).0"
+                ;;
+              patch)
+                VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
+                ;;
+            esac
+          fi
+
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "tag=v${VERSION}" >> $GITHUB_OUTPUT
+          echo "🚀 Releasing version ${VERSION}"
+
+      - name: Update Chart Version
+        run: |
+          sed -i "s/^version: .*/version: ${{ steps.version.outputs.version }}/" chart/Chart.yaml
+          git add chart/Chart.yaml
+          git diff --quiet --staged || git commit -m "chore: release version ${{ steps.version.outputs.version }}"
+
+      - name: Create and Push Tag
+        run: |
+          git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
+          git push origin main
+          git push origin "${{ steps.version.outputs.tag }}"
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and Push Docker Image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64
+
+      - name: Package Helm Chart
+        run: |
+          helm registry login ghcr.io \
+            --username ${{ github.actor }} \
+            --password ${{ secrets.GITHUB_TOKEN }}
+          helm package chart/
+          helm push devcontainer-${{ steps.version.outputs.version }}.tgz oci://ghcr.io/cpfarhood/charts
+
+      - name: Generate Release Notes
+        id: notes
+        run: |
+          # Get commits since last tag
+          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+          if [ -z "$PREV_TAG" ]; then
+            COMMITS=$(git log --pretty=format:"- %s (%h)" HEAD)
+          else
+            COMMITS=$(git log --pretty=format:"- %s (%h)" ${PREV_TAG}..HEAD)
+          fi
+
+          cat << EOF > release-notes.md
+          ## 🚀 Release ${{ steps.version.outputs.version }}
+
+          ### Changes
+          ${COMMITS}
+
+          ### Docker Image
+          \`\`\`bash
+          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
+          \`\`\`
+
+          ### Helm Chart
+          \`\`\`bash
+          helm install devcontainer oci://ghcr.io/cpfarhood/charts/devcontainer --version ${{ steps.version.outputs.version }}
+          \`\`\`
+          EOF
+
+          echo "notes<<EOF" >> $GITHUB_OUTPUT
+          cat release-notes.md >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Create GitHub Release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ steps.version.outputs.tag }}
+          release_name: Release ${{ steps.version.outputs.tag }}
+          body: ${{ steps.notes.outputs.notes }}
+          draft: false
+          prerelease: false
@@ -1,51 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-permissions:
-  contents: write
-  packages: write
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Generate Release Notes
-        id: notes
-        run: |
-          # Get the tag message or generate from commits
-          TAG_MESSAGE=$(git tag -l --format='%(contents)' ${{ github.ref_name }})
-          if [ -z "$TAG_MESSAGE" ]; then
-            # Generate from commit messages since last tag
-            PREV_TAG=$(git describe --tags --abbrev=0 ${{ github.ref_name }}^ 2>/dev/null || echo "")
-            if [ -z "$PREV_TAG" ]; then
-              COMMITS=$(git log --pretty=format:"- %s (%h)" ${{ github.ref_name }})
-            else
-              COMMITS=$(git log --pretty=format:"- %s (%h)" ${PREV_TAG}..${{ github.ref_name }})
-            fi
-            NOTES="## Changes\n\n${COMMITS}\n\n## Docker Image\n\n\`\`\`bash\ndocker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }}\n\`\`\`"
-          else
-            NOTES="${TAG_MESSAGE}\n\n## Docker Image\n\n\`\`\`bash\ndocker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }}\n\`\`\`"
-          fi
-          echo "notes<<EOF" >> $GITHUB_OUTPUT
-          echo -e "$NOTES" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Create Release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref_name }}
-          release_name: Release ${{ github.ref_name }}
-          body: ${{ steps.notes.outputs.notes }}
-          draft: false
-          prerelease: false
@@ -1,259 +0,0 @@
-# Release Process
-
-This document describes how to create releases for this project.
-
-## Semantic Versioning
-
-We follow [Semantic Versioning 2.0.0](https://semver.org/):
-
- **MAJOR** version (v2.0.0): Incompatible API/breaking changes
- **MINOR** version (v1.1.0): New features, backwards compatible
- **PATCH** version (v1.0.1): Bug fixes, backwards compatible
-
-## Creating a Release
-
-### Method 1: Using GitHub CLI (Recommended)
-
-```bash
-# Ensure you're on main branch and up to date
-git checkout main
-git pull
-
-# Create and push a tag
-VERSION="v1.0.0"  # Change this
-git tag -a "$VERSION" -m "Release $VERSION
-
-## What's New
- Feature 1
- Feature 2
- Bug fix 1
-
-## Docker Image
-\`\`\`bash
-docker pull ghcr.io/cpfarhood/devcontainer:$VERSION
-\`\`\`
-"
-
-git push origin "$VERSION"
-
-# The GitHub Actions workflow will automatically:
-# 1. Build the Docker image
-# 2. Push to ghcr.io with multiple tags
-# 3. Create a GitHub release with notes
-```
-
-### Method 2: Using Git Tags Only
-
-```bash
-git checkout main
-git pull
-
-# Create annotated tag
-git tag -a v1.0.0 -m "Release v1.0.0"
-
-# Push tag
-git push origin v1.0.0
-```
-
-### Method 3: Using GitHub Web UI
-
-1. Go to https://github.com/cpfarhood/devcontainer/releases
-2. Click "Draft a new release"
-3. Click "Choose a tag"
-4. Type the new version (e.g., `v1.0.0`)
-5. Click "Create new tag on publish"
-6. Fill in the release title and description
-7. Click "Publish release"
-
-## What Happens Automatically
-
-When you push a version tag (`v*`), GitHub Actions will:
-
-1. **Build Docker image** with multiple tags:
-   - `ghcr.io/cpfarhood/devcontainer:v1.2.3` (exact version)
-   - `ghcr.io/cpfarhood/devcontainer:1.2` (minor version)
-   - `ghcr.io/cpfarhood/devcontainer:1` (major version)
-   - `ghcr.io/cpfarhood/devcontainer:latest` (if on default branch)
-
-2. **Create GitHub Release** with:
-   - Auto-generated release notes from commits
-   - Docker pull command in the description
-
-## Version Bump Guidelines
-
-### Patch Release (v1.0.X)
- Bug fixes
- Documentation updates
- Minor dependency updates
- No new features
- No breaking changes
-
-**Example:** v1.0.1
-```bash
-git tag -a v1.0.1 -m "Release v1.0.1 - Bug fixes"
-git push origin v1.0.1
-```
-
-### Minor Release (v1.X.0)
- New features
- New optional configuration variables
- Enhancements to existing features
- Backwards compatible
- No breaking changes
-
-**Example:** v1.1.0
-```bash
-git tag -a v1.1.0 -m "Release v1.1.0 - New Happy Coder features"
-git push origin v1.1.0
-```
-
-### Major Release (vX.0.0)
- Breaking changes
- Required configuration changes
- Removal of deprecated features
- Incompatible API changes
-
-**Example:** v2.0.0
-```bash
-git tag -a v2.0.0 -m "Release v2.0.0 - Breaking: New storage architecture"
-git push origin v2.0.0
-```
-
-## Pre-releases
-
-For alpha, beta, or release candidates:
-
-```bash
-# Alpha
-git tag -a v1.1.0-alpha.1 -m "Release v1.1.0-alpha.1"
-git push origin v1.1.0-alpha.1
-
-# Beta
-git tag -a v1.1.0-beta.1 -m "Release v1.1.0-beta.1"
-git push origin v1.1.0-beta.1
-
-# Release Candidate
-git tag -a v1.1.0-rc.1 -m "Release v1.1.0-rc.1"
-git push origin v1.1.0-rc.1
-```
-
-## Release Checklist
-
-Before creating a release:
-
- [ ] All tests pass
- [ ] Documentation is up to date
- [ ] CHANGELOG.md is updated (if you maintain one)
- [ ] Version number follows semver
- [ ] On main/master branch
- [ ] All changes are committed
- [ ] Tag message includes release notes
-
-## Docker Image Tags
-
-Each release creates multiple Docker tags for flexibility:
-
-| Git Tag | Docker Tags Created |
-|---------|---------------------|
-| v1.2.3 | `:v1.2.3`, `:1.2`, `:1`, `:latest` |
-| v2.0.0 | `:v2.0.0`, `:2.0`, `:2`, `:latest` |
-| v1.2.4-beta.1 | `:v1.2.4-beta.1`, `:1.2-beta` |
-
-**Usage examples:**
-```bash
-# Specific version (recommended for production)
-docker pull ghcr.io/cpfarhood/devcontainer:v1.2.3
-
-# Minor version (gets patches automatically)
-docker pull ghcr.io/cpfarhood/devcontainer:1.2
-
-# Major version (gets minor updates and patches)
-docker pull ghcr.io/cpfarhood/devcontainer:1
-
-# Latest (always gets newest stable release)
-docker pull ghcr.io/cpfarhood/devcontainer:latest
-```
-
-## Viewing Releases
-
- **GitHub Releases:** https://github.com/cpfarhood/devcontainer/releases
- **Docker Images:** https://github.com/cpfarhood/devcontainer/pkgs/container/devcontainer
- **Git Tags:** `git tag -l`
-
-## Deleting a Release
-
-If you need to delete a bad release:
-
-```bash
-# Delete local tag
-git tag -d v1.0.0
-
-# Delete remote tag
-git push origin :refs/tags/v1.0.0
-
-# Delete GitHub release (use web UI or gh CLI)
-gh release delete v1.0.0
-```
-
-**Note:** Docker images pushed to ghcr.io cannot be easily deleted. It's better to create a new patch version.
-
-## First Release
-
-For the initial v1.0.0 release:
-
-```bash
-git checkout main
-git pull
-
-git tag -a v1.0.0 -m "Release v1.0.0 - Initial Release
-
-## Features
- Antigravity IDE with web-based VNC access
- Happy Coder AI assistant integration
- Automatic GitHub repository cloning
- Persistent home directory with ReadWriteMany PVC
- Secure non-root execution (claude user, UID 1000)
- Support for private repositories with GitHub token
- HTTPRoute (Gateway API) support
- Multi-platform Docker images
- Comprehensive deployment documentation
-
-## Docker Image
-\`\`\`bash
-docker pull ghcr.io/cpfarhood/devcontainer:v1.0.0
-\`\`\`
-
-## Deployment
-See DEPLOYMENT.md for complete deployment instructions.
-"
-
-git push origin v1.0.0
-```
-
-## Example Release Workflow
-
-```bash
-# 1. Finish your feature/fix on a branch
-git checkout feature/new-feature
-git commit -m "feat: Add new feature"
-git push
-
-# 2. Create PR and merge to main
-gh pr create
-# ... get approval and merge ...
-
-# 3. Pull latest main
-git checkout main
-git pull
-
-# 4. Create release tag
-git tag -a v1.1.0 -m "Release v1.1.0 - New feature"
-git push origin v1.1.0
-
-# 5. Wait for GitHub Actions
-# - Check: https://github.com/cpfarhood/devcontainer/actions
-
-# 6. Verify release
-# - GitHub: https://github.com/cpfarhood/devcontainer/releases
-# - Docker: docker pull ghcr.io/cpfarhood/devcontainer:v1.1.0
-```
@@ -1,5 +1,12 @@
 {
  "mcpServers": {
+    "github": {
+      "type": "http",
+      "url": "https://api.githubcopilot.com/mcp/",
+      "headers": {
+        "Authorization": "Bearer ${GITHUB_TOKEN}"
+      }
+    },
    "kubernetes": {
      "type": "sse",
      "url": "http://localhost:8080/sse"
@@ -10,8 +17,20 @@
    },
    "playwright": {
      "type": "sse",
-      "url": "http://playwright-mcp.playwright.svc.cluster.local:3000/sse"
-    } 
+      "url": "http://localhost:8086/sse"
+    },
+    "pgtuner": {
+      "type": "sse",
+      "url": "http://localhost:8085/sse"
+    },
+    "fetch": {
+      "type": "sse",
+      "url": "http://localhost:8082/sse"
+    },
+    "sequentialthinking": {
+      "type": "sse",
+      "url": "http://localhost:8083/sse"
+    }
  }
 }

@@ -4,11 +4,12 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co

 ## Project Overview

-Antigravity is a Docker-based cloud development environment that provides:
+The Dev Container is a Docker-based cloud development environment that provides:
 - Web-based GUI IDE (VSCode/Antigravity) via VNC on port 5800
- Happy Coder AI assistant integration
+- Claude Code, Happy Coder, OpenCode, and Crush AI coding agents (terminal-based)
 - Automatic GitHub repository cloning on startup
 - Kubernetes-native deployment with persistent home storage
+- MCP (Model Context Protocol) sidecars for AI assistant integrations

 The stack is primarily **Bash scripts + YAML** — there is no Node.js package, compiled language, or test framework.

@@ -19,7 +20,7 @@ The stack is primarily **Bash scripts + YAML** — there is no Node.js package,
 ```bash
 make build                              # Build Docker image
 make build REGISTRY=ghcr.io/myuser IMAGE_TAG=v1.0  # Custom registry/tag
-docker build -t ghcr.io/cpfarhood/antigravity:latest .  # Direct build
+docker build -t ghcr.io/cpfarhood/devcontainer:latest .  # Direct build
 ```

 ### Running Locally
@@ -33,12 +34,14 @@ make clean   # Remove volumes
 ### Kubernetes Deployment

 ```bash
-make k8s-deploy          # Deploy via kustomize
-kubectl apply -k k8s/    # Direct kustomize apply
-make k8s-delete          # Tear down
-make k8s-port-forward    # Forward port 5800 to localhost
-make k8s-logs            # Stream container logs
-make k8s-shell           # Open interactive shell in pod
+GITHUB_REPO="https://github.com/user/repo" make helm-deploy  # Deploy with Helm
+make helm-delete          # Tear down Helm release
+make helm-port-forward    # Forward port 5800 to localhost
+make helm-logs            # Stream container logs
+make helm-shell           # Open interactive shell in pod
+
+# Or use Helm directly
+helm install mydev ./chart --set name=mydev --set githubRepo=https://github.com/user/repo
 ```

 ### Other Useful Targets
@@ -55,26 +58,114 @@ make push   # Push image to registry (build first)
 ```
 Container start
  → scripts/startapp.sh
-    → scripts/init-repo.sh (clone GITHUB_REPO, start Happy Coder)
-    → launch VSCode as user `claude` in /workspace
+    → scripts/init-repo.sh
+      → Configure git user & credentials
+      → Clone GITHUB_REPO (if set)
+    → Launch VSCode as user `user` in /workspace
 ```

 ### Key Files

 | File | Purpose |
 |------|---------|
-| `Dockerfile` | Image definition — installs Chrome, Node.js, VSCode, Happy Coder; creates non-root user `claude` (UID 1000) |
-| `scripts/init-repo.sh` | Clones GitHub repo, authenticates with token, starts Happy Coder background service |
+| `Dockerfile` | Image definition — installs Chrome, Node.js, VSCode, Claude Code, Happy Coder, OpenCode, Crush; creates non-root user (UID 1000) |
+| `scripts/init-repo.sh` | Configures git credentials, clones GitHub repo |
 | `scripts/startapp.sh` | Calls init-repo.sh then opens VSCode in the workspace |
-| `k8s/statefulset.yaml` | StatefulSet + headless Service; mounts `/home` (PVC) and `/workspace` (emptyDir) |
-| `k8s/configmap.yaml` | `GITHUB_REPO`, `HAPPY_SERVER_URL`, `HAPPY_WEBAPP_URL` |
-| `k8s/httproute.yaml` | Gateway API HTTPRoute for external browser access |
-| `k8s/secrets-example.yaml` | Template for SealedSecrets (GitHub token, VNC password) |
+| `chart/` | Helm chart for Kubernetes deployment |
+| `chart/templates/deployment.yaml` | Deployment spec — main container + MCP sidecar containers |
+| `chart/templates/rbac.yaml` | ServiceAccount, Role/ClusterRole based on `clusterAccess` value |
+| `chart/templates/pvc.yaml` | PersistentVolumeClaim for user home |
+| `chart/templates/service.yaml` | ClusterIP Service (VNC + optional SSH) |
+| `chart/values.yaml` | Default Helm values |
+| `.mcp.json` | MCP server connection config (GitHub Copilot, Kubernetes, Flux, Fetch, Sequential Thinking, Playwright, pgtuner) |
 | `Makefile` | Build/deploy automation |

+### MCP Sidecars
+
+MCP (Model Context Protocol) servers run as sidecar containers in the pod, enabling AI assistants to interact with various services:
+
+| Sidecar | Image | Version | Port | Endpoint | Default |
+|---------|-------|---------|------|----------|---------|
+| `kubernetes-mcp` | `quay.io/containers/kubernetes_mcp_server` | v0.0.57 | 8080 | `http://localhost:8080/sse` | Enabled |
+| `flux-mcp` | `ghcr.io/controlplaneio-fluxcd/flux-operator-mcp` | v0.41.1 | 8081 | `http://localhost:8081/sse` | Enabled |
+| `fetch-mcp` | `mcp/fetch` | latest | 8082 | `http://localhost:8082/sse` | Enabled |
+| `sequentialthinking-mcp` | `mcp/sequentialthinking` | latest | 8083 | `http://localhost:8083/sse` | Enabled |
+| `homeassistant-mcp` | `ghcr.io/homeassistant-ai/ha-mcp` | stable | 8087 | `http://localhost:8087/sse` | Disabled |
+| `pgtuner-mcp` | `dog830228/pgtuner_mcp` | latest | 8085 | `http://localhost:8085/sse` | Disabled |
+| `playwright-mcp` | `mcr.microsoft.com/playwright/mcp` | latest | 8086 | `http://localhost:8086/sse` | Enabled |
+
+**Note:**
+- GitHub MCP is accessed via the Copilot API (`https://api.githubcopilot.com/mcp/`), not as a sidecar
+- Kubernetes and Flux sidecars require `clusterAccess` != `none` to be deployed (they need RBAC permissions)
+- Kubernetes and Flux sidecars inherit the pod's ServiceAccount RBAC permissions
+- Fetch sidecar provides web content fetching capabilities and HTML to markdown conversion
+- Sequential thinking sidecar enables structured thinking and problem-solving processes
+- Home Assistant sidecar requires `HOMEASSISTANT_URL` and `HOMEASSISTANT_TOKEN` in the env secret
+- PostgreSQL tuner sidecar requires `DATABASE_URI` in the env secret (PostgreSQL connection string)
+- Playwright sidecar provides browser automation and web testing capabilities
+
+#### Enabling/Disabling MCP Servers
+
+To control MCP sidecars, set the `enabled` flag in your values override:
+
+```yaml
+# Disable all MCP sidecars
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: false
+    flux:
+      enabled: false
+    fetch:
+      enabled: false
+    sequentialthinking:
+      enabled: false
+    homeassistant:
+      enabled: false
+    pgtuner:
+      enabled: false
+    playwright:
+      enabled: false
+
+# Or selectively enable/disable
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: true  # Keep Kubernetes MCP enabled
+    flux:
+      enabled: false # Disable Flux MCP
+    fetch:
+      enabled: true  # Enable Fetch MCP for web content fetching
+    sequentialthinking:
+      enabled: true  # Enable Sequential Thinking MCP for problem-solving
+    homeassistant:
+      enabled: true  # Enable Home Assistant MCP (requires secrets)
+    pgtuner:
+      enabled: true  # Enable PostgreSQL tuner MCP (requires DATABASE_URI)
+    playwright:
+      enabled: true  # Enable Playwright MCP for browser automation
+```
+
+When deploying via Helm:
+```bash
+# Quick start (recommended)
+cp chart/values-quickstart.yaml my-values.yaml
+# Edit name and githubRepo in my-values.yaml
+helm install my-devcontainer ./chart -f my-values.yaml
+
+# Using --set flags
+helm install my-devcontainer ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/user/repo \
+  --set mcp.sidecars.kubernetes.enabled=false
+
+# Full customization
+helm install my-devcontainer ./chart -f custom-values.yaml
+```
+
 ### Storage Model

- `/home` — ReadWriteMany PVC (persists across pod restarts, holds user config/dotfiles)
+- `/config` — ReadWriteMany PVC (persists across pod restarts, holds user config/dotfiles)
 - `/workspace` — emptyDir by default (ephemeral; can be changed to PVC)

 ### Environment Variables
@@ -83,7 +174,10 @@ Container start
 - `GITHUB_REPO` — URL of repository to clone into `/workspace`

 **Optional:**
- `GITHUB_TOKEN` — PAT for private repo access
+- `GITHUB_TOKEN` — PAT for private repo access (automatically configures git credentials)
+- `GIT_USER_NAME` — Git user name for commits (default: "DevContainer User")
+- `GIT_USER_EMAIL` — Git user email for commits (default: "devcontainer@example.com")
+- `GITLAB_HOST` — GitLab hostname if using GitLab with same token
 - `VNC_PASSWORD` — VNC web interface password
 - `DISPLAY_WIDTH` / `DISPLAY_HEIGHT` — VNC resolution
 - `USER_ID` / `GROUP_ID` — Override UID/GID (default 1000)
@@ -92,16 +186,16 @@ Container start

 ### CI/CD

- **`build-and-push.yaml`** — Builds and pushes to GHCR on every push to `main`, version tags (`v*`), and PRs. Tags: `latest` (main), semver, branch name, commit SHA.
- **`release.yaml`** — Creates a GitHub Release with docker pull instructions when a version tag is pushed.
+- **`build-and-push.yaml`** — Builds and pushes to GHCR on every push to `main`, version tags (`v*`), and PRs. For version tags, also creates GitHub Release with Helm chart after Docker build completes. Tags: `latest` (main), semver, branch name, commit SHA.
 - **`dependabot.yml`** — Weekly updates for GitHub Actions and Docker base image.

 Image registry: `ghcr.io/cpfarhood/devcontainer`

 ## Kubernetes Notes

- Uses Kustomize (`kubectl apply -k k8s/`)
- Storage class is `ceph-filesystem` by default — change in `statefulset.yaml` for other clusters
+- Deployed via Helm chart (`chart/`), published as OCI artifact to GHCR, reconciled by Flux
+- Storage class is `ceph-filesystem` by default — change via `storage.className` in values
 - Resource limits: 1–4 CPU, 2–8Gi memory
 - Health checks (liveness/readiness probes) on port 5800
- Secrets managed via SealedSecrets (see `k8s/secrets-example.yaml`)
+- Secrets: optional env Secret (`devcontainer-{name}-secrets-env`) for `GITHUB_TOKEN`, `VNC_PASSWORD`, etc.
+- RBAC: controlled by `clusterAccess` value (`none`, `readonlyns`, `readwritens`, `readonly`, `readwrite`)
@@ -1,436 +1,449 @@
 # Deployment Guide

-This guide provides step-by-step instructions for deploying the Antigravity Dev Container to Kubernetes.
+This guide provides step-by-step instructions for deploying the Antigravity Dev Container using Helm.

 ## Prerequisites

- Kubernetes cluster with Gateway API support
+- Kubernetes cluster (1.19+)
 - `kubectl` configured to access your cluster
+- `helm` CLI installed (3.0+)
 - ReadWriteMany storage class available (e.g., `ceph-filesystem`, `nfs-client`, `efs-sc`)
- Sealed Secrets controller installed (for secret encryption)
 - GitHub Container Registry access (images are public)

-## Required Configuration Variables
+## Quick Start

-Before deploying, you need to provide the following configuration:
-
-### 1. Storage Configuration
-
-**Variable:** `storageClassName`
-**Location:** `k8s/statefulset.yaml` (line ~117)
-**Description:** The ReadWriteMany storage class name in your cluster
-**Example values:**
- `ceph-filesystem` (Rook-Ceph)
- `nfs-client` (NFS)
- `efs-sc` (AWS EFS)
- `azurefile` (Azure Files)
- `filestore` (GCP Filestore)
-
-**How to find your storage class:**
-```bash
-kubectl get storageclass
-```
-
-Look for a storage class that supports `ReadWriteMany` access mode.
-
-### 2. GitHub Repository (Required)
-
-**Variable:** `github-repo`
-**Location:** `k8s/configmap.yaml` (line ~9)
-**Description:** The GitHub repository URL to clone on container startup
-**Format:** `https://github.com/username/repository`
-**Example:** `https://github.com/cpfarhood/my-project`
-
-### 3. GitHub Token (Optional, for private repos)
-
-**Variable:** `github-token`
-**Location:** `k8s/secrets-example.yaml` (sealed secret)
-**Description:** GitHub Personal Access Token for cloning private repositories
-**Format:** `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
-**Required:** Only if cloning a private repository
-
-**How to create a GitHub token:**
-1. Go to https://github.com/settings/tokens
-2. Click "Generate new token (classic)"
-3. Select scopes: `repo` (for private repos)
-4. Generate and copy the token
-
-### 4. VNC Password (Optional)
-
-**Variable:** `vnc-password`
-**Location:** `k8s/secrets-example.yaml` (sealed secret)
-**Description:** Password for accessing the VNC web interface
-**Format:** Any string (recommend 12+ characters)
-**Required:** Optional, but recommended for security
-
-### 5. Gateway Configuration (Required for external access)
-
-**Variables:**
- `parentRefs.name` - Your Gateway resource name
- `parentRefs.namespace` - Namespace where Gateway is deployed
- `hostnames` - Domain name for accessing the container
-
-**Location:** `k8s/httproute.yaml`
-**Example:**
-```yaml
-parentRefs:
- name: cilium-gateway  # Your Gateway name
-  namespace: kube-system  # Your Gateway namespace
-hostnames:
- "devcontainer.example.com"  # Your domain
-```
-
-### 6. Namespace (Optional)
-
-**Variable:** `namespace`
-**Location:** `k8s/kustomization.yaml` (line ~5)
-**Description:** Kubernetes namespace to deploy into
-**Default:** `default`
-**Example:** `devcontainer`, `development`, `team-workspaces`
-
-### 7. Container Image (Optional)
-
-**Variable:** `image`
-**Location:** `k8s/statefulset.yaml` (line ~32)
-**Description:** Docker image to use
-**Default:** `ghcr.io/cpfarhood/devcontainer:latest`
-**Format:** `registry/repository:tag`
-
-### 8. Resource Limits (Optional)
-
-**Variables:**
- `resources.requests.memory` (default: `2Gi`)
- `resources.requests.cpu` (default: `1000m`)
- `resources.limits.memory` (default: `8Gi`)
- `resources.limits.cpu` (default: `4000m`)
-
-**Location:** `k8s/statefulset.yaml` (lines ~98-103)
-
-### 9. Happy Coder Configuration (Optional)
-
-**Variables:**
- `happy-server-url` - Custom Happy server URL
- `happy-webapp-url` - Custom Happy webapp URL
-
-**Location:** `k8s/configmap.yaml` (lines ~12-13, commented out)
-**Default:** Uses Happy's default servers
-**When to set:** Only if using a self-hosted Happy instance
-
-## Deployment Steps
-
-### Step 1: Clone the Repository
+### 1. Clone the Repository

 ```bash
 git clone https://github.com/cpfarhood/devcontainer.git
 cd devcontainer
 ```

-### Step 2: Configure Storage Class
+### 2. Create Secret (Optional)

-Edit `k8s/statefulset.yaml` and find the `volumeClaimTemplates` section (around line 117):
+For private repos or VNC password:

 ```bash
-# Find your storage class
-kubectl get storageclass
-
-# Edit the file
-vi k8s/statefulset.yaml
+kubectl create secret generic devcontainer-mydev-secrets-env \
+  --from-literal=GITHUB_TOKEN='ghp_...' \
+  --from-literal=VNC_PASSWORD='changeme' \
+  --from-literal=ANTHROPIC_API_KEY='sk-ant-...'
 ```

-Change `storageClassName` to match your cluster:
-```yaml
-volumeClaimTemplates:
- metadata:
-    name: userhome
-  spec:
-    accessModes: [ "ReadWriteMany" ]
-    storageClassName: "ceph-filesystem"  # ← Change this
-    resources:
-      requests:
-        storage: 10Gi
-```
-
-### Step 3: Configure GitHub Repository
-
-Edit `k8s/configmap.yaml`:
+### 3. Deploy with Helm

 ```bash
-vi k8s/configmap.yaml
+# Basic deployment
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo
+
+# With custom storage class
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set storage.className=nfs-client
+
+# With cluster access for kubectl
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set clusterAccess=readwritens
 ```

-Set your repository URL:
-```yaml
-data:
-  github-repo: "https://github.com/yourusername/yourrepo"
-```
-
-### Step 4: Configure Gateway (HTTPRoute)
-
-Edit `k8s/httproute.yaml`:
+### 4. Access the Container

 ```bash
-# Find your Gateway
-kubectl get gateway -A
-
-# Edit the file
-vi k8s/httproute.yaml
-```
-
-Update with your Gateway details:
-```yaml
-spec:
-  parentRefs:
-  - name: your-gateway-name        # ← Change this
-    namespace: your-gateway-namespace  # ← Change this
-  hostnames:
-  - "devcontainer.yourdomain.com"  # ← Change this
-```
-
-### Step 5: Create Secrets
-
-Create the secrets for GitHub token and VNC password:
-
-```bash
-# Create the secret
-kubectl create secret generic antigravity-secrets \
-  --from-literal=github-token='ghp_your_token_here' \
-  --from-literal=vnc-password='your_vnc_password' \
-  --dry-run=client -o yaml | \
-  kubeseal --format=yaml > k8s/sealedsecrets.yaml
-
-# Verify the sealed secret was created
-cat k8s/sealedsecrets.yaml
-```
-
-**If you don't have Sealed Secrets controller:**
-
-Option 1: Install Sealed Secrets
-```bash
-kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml
-```
-
-Option 2: Use plain secrets (not recommended for production)
-```bash
-kubectl create secret generic antigravity-secrets \
-  --from-literal=github-token='ghp_your_token_here' \
-  --from-literal=vnc-password='your_vnc_password'
-```
-
-### Step 6: Review Configuration (Optional)
-
-Review and adjust optional settings:
-
-**Namespace:**
-```bash
-vi k8s/kustomization.yaml
-# Change line 5: namespace: default
-```
-
-**Resource limits:**
-```bash
-vi k8s/statefulset.yaml
-# Adjust lines 98-103 for your needs
-```
-
-### Step 7: Deploy to Kubernetes
-
-```bash
-# Deploy everything
-kubectl apply -k k8s/
-
-# Or if you changed the namespace
-kubectl apply -k k8s/ -n your-namespace
-```
-
-### Step 8: Verify Deployment
-
-```bash
-# Check StatefulSet
-kubectl get statefulset antigravity
-
-# Check Pod
-kubectl get pods -l app=antigravity
-
-# Check PVC
-kubectl get pvc -l app=antigravity
-
-# Check HTTPRoute
-kubectl get httproute antigravity
-
-# View logs
-kubectl logs antigravity-0
-```
-
-### Step 9: Access the Container
-
-**Option A: Via HTTPRoute (external access)**
-```bash
-# Open in browser
-open https://devcontainer.yourdomain.com
-```
-
-**Option B: Via Port Forward (local access)**
-```bash
-# Port forward to localhost
-kubectl port-forward statefulset/antigravity 5800:5800
-
-# Open in browser
+# Port forward
+kubectl port-forward deployment/devcontainer-mydev 5800:5800
 open http://localhost:5800
 ```

-## Configuration Summary
+## Deployment Options

-Here's a quick checklist of all variables you need to set:
+### Using Values File

-### Required Variables
+Create a custom `values.yaml`:

-| Variable | File | Line | Example Value |
-|----------|------|------|---------------|
-| `storageClassName` | `k8s/statefulset.yaml` | ~117 | `ceph-filesystem` |
-| `github-repo` | `k8s/configmap.yaml` | ~9 | `https://github.com/user/repo` |
-| `parentRefs.name` | `k8s/httproute.yaml` | ~8 | `cilium-gateway` |
-| `parentRefs.namespace` | `k8s/httproute.yaml` | ~9 | `kube-system` |
-| `hostnames` | `k8s/httproute.yaml` | ~10 | `devcontainer.example.com` |
+```yaml
+name: mydev
+githubRepo: https://github.com/youruser/yourrepo
+ide: vscode
+ssh: false

-### Optional Variables
+# Storage
+storage:
+  size: 32Gi
+  className: ceph-filesystem

-| Variable | File | Line | Default | When to Change |
-|----------|------|------|---------|----------------|
-| `namespace` | `k8s/kustomization.yaml` | ~5 | `default` | If deploying to different namespace |
-| `github-token` | Sealed secret | N/A | None | For private repos |
-| `vnc-password` | Sealed secret | N/A | None | For VNC security |
-| `image` | `k8s/statefulset.yaml` | ~32 | `ghcr.io/cpfarhood/devcontainer:latest` | For specific version or custom build |
-| `resources.*` | `k8s/statefulset.yaml` | ~98-103 | 2Gi/8Gi RAM, 1/4 CPU | Based on workload needs |
-| `happy-server-url` | `k8s/configmap.yaml` | ~12 | Default Happy server | For self-hosted Happy |
-| `happy-webapp-url` | `k8s/configmap.yaml` | ~13 | Default Happy webapp | For self-hosted Happy |
+# Resources
+resources:
+  requests:
+    memory: "4Gi"
+    cpu: "2000m"
+  limits:
+    memory: "16Gi"
+    cpu: "8000m"
+
+# Kubernetes access
+clusterAccess: readwritens
+
+# MCP sidecars
+mcpSidecars:
+  kubernetes:
+    enabled: true
+  flux:
+    enabled: false
+```
+
+Deploy:
+
+```bash
+helm install mydev ./chart -f values.yaml
+```
+
+### SSH Access Setup
+
+Enable SSH and add your public key:
+
+```bash
+# Create secret with SSH key
+kubectl create secret generic devcontainer-mydev-secrets-env \
+  --from-literal=SSH_AUTHORIZED_KEYS='ssh-ed25519 AAAA...'
+
+# Deploy with SSH enabled
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set ssh=true
+
+# Connect via SSH
+kubectl port-forward deployment/devcontainer-mydev 2222:22
+ssh -p 2222 user@localhost
+```
+
+### MCP Sidecar Configuration
+
+Control MCP servers for AI-assisted operations.
+
+**Important:** Kubernetes and Flux MCP sidecars are only deployed when:
+1. They are enabled in values (`mcpSidecars.<name>.enabled: true`)
+2. AND `clusterAccess` is not `none` (they need RBAC permissions to function)
+
+```bash
+# Disable all MCP sidecars
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set mcpSidecars.kubernetes.enabled=false \
+  --set mcpSidecars.flux.enabled=false \
+  --set mcpSidecars.homeassistant.enabled=false
+
+# Enable only Kubernetes MCP
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set mcpSidecars.kubernetes.enabled=true \
+  --set mcpSidecars.flux.enabled=false
+
+# Enable Home Assistant MCP (requires credentials)
+kubectl create secret generic devcontainer-mydev-secrets-env \
+  --from-literal=homeassistant-url='http://homeassistant.local:8123' \
+  --from-literal=homeassistant-token='your_long_lived_token'
+
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set mcpSidecars.homeassistant.enabled=true
+```
+
+### Cluster Access Levels
+
+Configure Kubernetes RBAC permissions:
+
+| Value | Scope | Permissions | Use Case |
+|-------|-------|-------------|----------|
+| `none` | No access | None | Default, isolated development |
+| `readonlyns` | Namespace | Read-only | View resources in namespace |
+| `readwritens` | Namespace | Full access | Deploy apps in namespace |
+| `readonly` | Cluster-wide | Read-only | View all cluster resources |
+| `readwrite` | Cluster-wide | Full access | Cluster administration |
+
+```bash
+# Example: Full access within namespace
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set clusterAccess=readwritens
+```
+
+## Ingress Configuration
+
+### Using Gateway API HTTPRoute
+
+Create an HTTPRoute for external access:
+
+```yaml
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: devcontainer-mydev
+spec:
+  parentRefs:
+  - name: your-gateway
+    namespace: your-gateway-namespace
+  hostnames:
+  - devcontainer.example.com
+  rules:
+  - backendRefs:
+    - name: devcontainer-mydev
+      port: 5800
+```
+
+### Using Traditional Ingress
+
+Create an Ingress resource:
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: devcontainer-mydev
+spec:
+  rules:
+  - host: devcontainer.example.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: devcontainer-mydev
+            port:
+              number: 5800
+```
+
+## Advanced Configurations
+
+### Custom Happy Coder Endpoints
+
+For self-hosted Happy instances:
+
+```bash
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set happyServerUrl=https://your-happy-server.com \
+  --set happyWebappUrl=https://your-happy-webapp.com
+```
+
+### Custom Display Resolution
+
+```bash
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set display.width=2560 \
+  --set display.height=1440
+```
+
+### Different IDE Options
+
+```bash
+# Use Google Antigravity
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set ide=antigravity
+
+# SSH-only mode (no GUI)
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set ide=none \
+  --set ssh=true
+```
+
+## Helm Operations
+
+### List Deployments
+
+```bash
+helm list
+```
+
+### Upgrade Deployment
+
+```bash
+# Change values
+helm upgrade mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/newrepo
+
+# Upgrade with new chart version
+git pull
+helm upgrade mydev ./chart
+```
+
+### Uninstall
+
+```bash
+helm uninstall mydev
+
+# Note: PVC persists by default
+kubectl delete pvc userhome-mydev
+```
+
+### Rollback
+
+```bash
+# View history
+helm history mydev
+
+# Rollback to previous version
+helm rollback mydev
+
+# Rollback to specific revision
+helm rollback mydev 3
+```

 ## Troubleshooting

-### Pod not starting
+### Pod Not Starting

-**Check events:**
 ```bash
-kubectl describe pod antigravity-0
+# Check pod status
+kubectl get pods -l app.kubernetes.io/instance=mydev
+
+# Describe pod for events
+kubectl describe pod -l app.kubernetes.io/instance=mydev
+
+# Check logs
+kubectl logs deployment/devcontainer-mydev
 ```

-**Common issues:**
- Storage class doesn't support ReadWriteMany
- PVC not binding (check storage class exists)
- Image pull errors (check image name)
+### Repository Not Cloning

-### Repository not cloning
-
-**Check logs:**
 ```bash
-kubectl logs antigravity-0 | grep -A 10 "Repository Initialization"
+# Check init logs
+kubectl logs deployment/devcontainer-mydev | grep "Repository Initialization"
+
+# Verify secret exists
+kubectl get secret devcontainer-mydev-secrets-env
+
+# Check environment
+kubectl exec deployment/devcontainer-mydev -- env | grep GITHUB
 ```

-**Common issues:**
- Invalid GitHub URL
- Private repo without token
- Token doesn't have correct permissions
+### VNC Not Accessible

-### HTTPRoute not working
-
-**Check HTTPRoute:**
 ```bash
-kubectl describe httproute antigravity
+# Check service
+kubectl get svc devcontainer-mydev
+kubectl describe svc devcontainer-mydev
+
+# Test with port-forward
+kubectl port-forward deployment/devcontainer-mydev 5800:5800
 ```

-**Common issues:**
- Gateway name/namespace incorrect
- Domain not pointing to Gateway
- TLS certificate not issued
+### MCP Sidecar Issues

-### VNC not accessible
-
-**Check service:**
 ```bash
-kubectl get svc antigravity
-kubectl describe svc antigravity
+# Check all containers
+kubectl get pod -l app.kubernetes.io/instance=mydev -o jsonpath='{.items[0].spec.containers[*].name}'
+
+# Check MCP container logs
+kubectl logs deployment/devcontainer-mydev -c kubernetes-mcp
+kubectl logs deployment/devcontainer-mydev -c flux-mcp
+kubectl logs deployment/devcontainer-mydev -c homeassistant-mcp
+
+# Verify RBAC permissions (for Kubernetes/Flux MCP)
+kubectl auth can-i --list --as system:serviceaccount:default:devcontainer-mydev
+
+# Check Home Assistant MCP credentials
+kubectl get secret devcontainer-mydev-secrets-env -o jsonpath='{.data.homeassistant-url}' | base64 -d
+# Verify the URL is accessible from the pod
+kubectl exec deployment/devcontainer-mydev -- curl -s http://homeassistant.local:8123/api/
 ```

-**Port forward test:**
+### Storage Issues
+
 ```bash
-kubectl port-forward antigravity-0 5800:5800
-# Try accessing http://localhost:5800
+# Check PVC
+kubectl get pvc userhome-mydev
+kubectl describe pvc userhome-mydev
+
+# Check available storage classes
+kubectl get storageclass
+
+# Verify ReadWriteMany support
+kubectl get storageclass <class-name> -o yaml | grep -i accessmodes
 ```

-## Quick Deploy Example
+## Best Practices

-Complete deployment with all values filled in:
+### Production Deployment
+
+1. **Use specific image tags** instead of `latest`:
+   ```bash
+   helm install mydev ./chart --set image.tag=v1.0.0
+   ```
+
+2. **Set resource limits** appropriately:
+   ```yaml
+   resources:
+     requests:
+       memory: "4Gi"
+       cpu: "2000m"
+     limits:
+       memory: "8Gi"
+       cpu: "4000m"
+   ```
+
+3. **Enable VNC password**:
+   ```bash
+   kubectl create secret generic devcontainer-mydev-secrets-env \
+     --from-literal=VNC_PASSWORD='strong-password-here'
+   ```
+
+4. **Use dedicated namespace**:
+   ```bash
+   kubectl create namespace dev-environments
+   helm install mydev ./chart -n dev-environments
+   ```
+
+5. **Configure appropriate cluster access**:
+   - Use `readonlyns` or `readwritens` for namespace-scoped work
+   - Avoid `readwrite` cluster-wide access unless necessary
+
+### Multi-User Deployment
+
+For teams, create separate deployments per user:

 ```bash
-# 1. Set your values
-STORAGE_CLASS="ceph-filesystem"
-GITHUB_REPO="https://github.com/myuser/myproject"
-GITHUB_TOKEN="ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-VNC_PASSWORD="my-secure-password-123"
-GATEWAY_NAME="cilium-gateway"
-GATEWAY_NAMESPACE="kube-system"
-DOMAIN="devcontainer.example.com"
+# User 1
+helm install alice-dev ./chart \
+  --set name=alice-dev \
+  --set githubRepo=https://github.com/alice/project

-# 2. Update storage class
-sed -i "s/storageClassName: .*/storageClassName: \"$STORAGE_CLASS\"/" k8s/statefulset.yaml
-
-# 3. Update GitHub repo
-sed -i "s|github-repo: .*|github-repo: \"$GITHUB_REPO\"|" k8s/configmap.yaml
-
-# 4. Update Gateway
-sed -i "s/- name: gateway/- name: $GATEWAY_NAME/" k8s/httproute.yaml
-sed -i "s/namespace: gateway-system/namespace: $GATEWAY_NAMESPACE/" k8s/httproute.yaml
-sed -i "s/antigravity.example.com/$DOMAIN/" k8s/httproute.yaml
-
-# 5. Create sealed secret
-kubectl create secret generic antigravity-secrets \
-  --from-literal=github-token="$GITHUB_TOKEN" \
-  --from-literal=vnc-password="$VNC_PASSWORD" \
-  --dry-run=client -o yaml | \
-  kubeseal --format=yaml > k8s/sealedsecrets.yaml
-
-# 6. Deploy
-kubectl apply -k k8s/
-
-# 7. Watch deployment
-kubectl get pods -l app=antigravity -w
+# User 2
+helm install bob-dev ./chart \
+  --set name=bob-dev \
+  --set githubRepo=https://github.com/bob/project
 ```

-## Updates and Maintenance
+### Backup and Recovery

-### Updating the Image
-
-The image is automatically built and pushed to ghcr.io on every commit to main.
-
-**To use latest:**
-```bash
-kubectl set image statefulset/antigravity \
-  antigravity=ghcr.io/cpfarhood/devcontainer:latest
-```
-
-**To use specific version:**
-```bash
-kubectl set image statefulset/antigravity \
-  antigravity=ghcr.io/cpfarhood/devcontainer:v1.0.0
-```
-
-### Changing Repository
-
-Edit the ConfigMap and restart:
-```bash
-kubectl edit configmap antigravity-config
-# Change github-repo value
-kubectl rollout restart statefulset/antigravity
-```
-
-### Scaling
+The home directory persists on PVC. To backup:

 ```bash
-# Scale to multiple instances (each gets own home PVC)
-kubectl scale statefulset antigravity --replicas=3
+# Create backup pod
+kubectl run backup --image=busybox --restart=Never --rm -i --tty \
+  -- tar czf - -C /home . | gzip > home-backup.tar.gz
 ```

 ## Support

 For issues or questions:
 - GitHub Issues: https://github.com/cpfarhood/devcontainer/issues
- Documentation: https://github.com/cpfarhood/devcontainer
+- Documentation: https://github.com/cpfarhood/devcontainer
@@ -1,7 +1,7 @@
 FROM jlesage/baseimage-gui:ubuntu-22.04-v4

 # Set environment variables
-ENV APP_NAME="Antigravity Dev Container" \
+ENV APP_NAME="Dev Container" \
    KEEP_APP_RUNNING=1 \
    DISPLAY_WIDTH=1920 \
    DISPLAY_HEIGHT=1080 \
@@ -64,6 +64,20 @@ RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \
 # Install Happy Coder and Claude Code globally
 RUN npm install -g happy-coder @anthropic-ai/claude-code

+# Install OpenCode AI coding agent
+RUN OPENCODE_VERSION=$(curl -sL https://api.github.com/repos/opencode-ai/opencode/releases/latest | jq -r '.tag_name') && \
+    curl -fsSL "https://github.com/opencode-ai/opencode/releases/download/${OPENCODE_VERSION}/opencode-linux-x86_64.tar.gz" | \
+    tar -xz -C /usr/local/bin opencode && \
+    chmod +x /usr/local/bin/opencode
+
+# Install Crush AI coding agent (OpenCode successor by Charm)
+RUN CRUSH_VERSION=$(curl -sL https://api.github.com/repos/charmbracelet/crush/releases/latest | jq -r '.tag_name' | sed 's/^v//') && \
+    curl -fsSL "https://github.com/charmbracelet/crush/releases/download/v${CRUSH_VERSION}/crush_${CRUSH_VERSION}_Linux_x86_64.tar.gz" -o /tmp/crush.tar.gz && \
+    tar -xzf /tmp/crush.tar.gz -C /tmp && \
+    mv /tmp/crush_${CRUSH_VERSION}_Linux_x86_64/crush /usr/local/bin/crush && \
+    chmod +x /usr/local/bin/crush && \
+    rm -rf /tmp/crush*
+
 # Install VSCode
 RUN wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor -o /usr/share/keyrings/packages.microsoft.gpg && \
    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/repos/code stable main" > /etc/apt/sources.list.d/vscode.list && \
@@ -77,10 +91,26 @@ RUN mkdir -p /etc/apt/keyrings && \
      gpg --dearmor --yes -o /etc/apt/keyrings/antigravity-repo-key.gpg && \
    echo "deb [signed-by=/etc/apt/keyrings/antigravity-repo-key.gpg] https://us-central1-apt.pkg.dev/projects/antigravity-auto-updater-dev/ antigravity-debian main" \
      > /etc/apt/sources.list.d/antigravity.list && \
+    # Clear package cache to force fresh repository data
+    rm -rf /var/lib/apt/lists/* && \
    apt-get update && \
-    apt-get install -y antigravity && \
+    # Show available versions for debugging
+    apt-cache policy antigravity && \
+    # Install latest version
+    apt-get install -y --no-install-recommends antigravity && \
+    # Display installed version
+    dpkg -l | grep antigravity && \
    rm -rf /var/lib/apt/lists/*

+# Pre-configure Antigravity to skip onboarding/setup on first run
+RUN mkdir -p /etc/skel/.config/antigravity/User/globalStorage && \
+    echo '{"antigravityUnifiedStateSync.seenNuxOneTimeMigration": true, "antigravityUnifiedStateSync.browserOnboarding.completed": true, "antigravityUnifiedStateSync.hasOnboardingCompleted": true, "browserOnboarding.hasSeenWelcome": true, "antigravityUnifiedStateSync.browserPreferences.hasAddedLocalhostToAllowlist": true, "antigravityUnifiedStateSync.oauthToken.hasLegacyMigrated": true, "antigravityUnifiedStateSync.auth.tokenSyncEnabled": true, "antigravityUnifiedStateSync.auth.cloudSyncEnabled": true, "theme": "vs-dark"}' \
+      > /etc/skel/.config/antigravity/User/globalStorage/storage.json && \
+    echo '{"workbench.startupEditor": "none", "workbench.welcomePage.walkthroughs.openOnInstall": false, "workbench.tips.enabled": false, "extensions.ignoreRecommendations": true, "telemetry.telemetryLevel": "off", "update.mode": "none", "extensions.autoUpdate": false, "extensions.autoCheckUpdates": false, "workbench.enableExperiments": true, "workbench.settings.enableNaturalLanguageSearch": true, "antigravity.onboarding.completed": true, "antigravity.browserOnboarding.completed": true, "antigravity.setup.completed": true, "antigravity.ai.enabled": true, "antigravity.ai.autoComplete.enabled": true, "antigravity.ai.chat.enabled": true, "antigravity.ai.codeActions.enabled": true, "antigravity.ai.explainCode.enabled": true, "antigravity.ai.generateCode.enabled": true, "antigravity.ai.optimizeCode.enabled": true, "antigravity.ai.autoSuggest.enabled": true, "antigravity.telemetry.crashReporter": "on", "antigravity.ai.acceptTerms": true, "antigravity.auth.syncState": true, "antigravity.auth.enableTokenSync": true, "antigravity.ai.enableCloudSync": true, "antigravity.settings.sync": true}' \
+      > /etc/skel/.config/antigravity/User/settings.json && \
+    # Validate Antigravity installation
+    /usr/share/antigravity/antigravity --version || echo "WARNING: Antigravity version check failed"
+
 # Install OpenSSH server (for SSH IDE mode)
 RUN apt-get update && \
    apt-get install -y openssh-server && \
@@ -119,4 +149,4 @@ ENV HOME=/config/userdata \
 EXPOSE 5800

 # Set app name for baseimage-gui
-RUN set-cont-env APP_NAME "Antigravity"
+RUN set-cont-env APP_NAME "Dev Container"
@@ -44,26 +44,40 @@ clean: stop
 	@echo "Cleaning up..."
 	rm -rf ./home ./workspace

-# Kubernetes deployment
-k8s-deploy:
-	@echo "Deploying to Kubernetes..."
-	kubectl apply -k k8s/
+# Helm deployment
+RELEASE_NAME ?= mydev
+NAMESPACE ?= default

-k8s-delete:
-	@echo "Deleting from Kubernetes..."
-	kubectl delete -k k8s/
+helm-deploy:
+	@echo "Deploying with Helm (release: $(RELEASE_NAME))..."
+	@if [ -z "$(GITHUB_REPO)" ]; then \
+		echo "ERROR: GITHUB_REPO environment variable is required"; \
+		echo "Usage: GITHUB_REPO=https://github.com/user/repo make helm-deploy"; \
+		exit 1; \
+	fi
+	helm upgrade --install $(RELEASE_NAME) ./chart \
+		--namespace $(NAMESPACE) \
+		--set name=$(RELEASE_NAME) \
+		--set githubRepo="$(GITHUB_REPO)" \
+		--set image.repository=$(REGISTRY)/$(IMAGE_NAME) \
+		--set image.tag=$(IMAGE_TAG)

-k8s-logs:
-	@echo "Showing logs..."
-	kubectl logs -f antigravity-0
+helm-delete:
+	@echo "Deleting Helm release $(RELEASE_NAME)..."
+	helm uninstall $(RELEASE_NAME) --namespace $(NAMESPACE)
+	@echo "Note: PVC persists. To delete: kubectl delete pvc userhome-$(RELEASE_NAME) -n $(NAMESPACE)"

-k8s-shell:
-	@echo "Opening shell..."
-	kubectl exec -it antigravity-0 -- bash
+helm-logs:
+	@echo "Showing logs for $(RELEASE_NAME)..."
+	kubectl logs -f deployment/devcontainer-$(RELEASE_NAME) -n $(NAMESPACE)

-k8s-port-forward:
-	@echo "Port forwarding to localhost:5800..."
-	kubectl port-forward antigravity-0 5800:5800
+helm-shell:
+	@echo "Opening shell in $(RELEASE_NAME)..."
+	kubectl exec -it deployment/devcontainer-$(RELEASE_NAME) -n $(NAMESPACE) -- bash
+
+helm-port-forward:
+	@echo "Port forwarding $(RELEASE_NAME) to localhost:5800..."
+	kubectl port-forward deployment/devcontainer-$(RELEASE_NAME) 5800:5800 -n $(NAMESPACE)

 # Show help
 help:
@@ -78,24 +92,29 @@ help:
 	@echo "  stop               - Stop running container"
 	@echo "  clean              - Clean up containers and volumes"
 	@echo ""
-	@echo "Kubernetes Targets:"
-	@echo "  k8s-deploy         - Deploy to Kubernetes"
-	@echo "  k8s-delete         - Delete from Kubernetes"
-	@echo "  k8s-logs           - Show container logs"
-	@echo "  k8s-shell          - Open shell in container"
-	@echo "  k8s-port-forward   - Port forward to localhost"
+	@echo "Helm/Kubernetes Targets:"
+	@echo "  helm-deploy        - Deploy with Helm chart (requires GITHUB_REPO)"
+	@echo "  helm-delete        - Delete Helm release"
+	@echo "  helm-logs          - Show container logs"
+	@echo "  helm-shell         - Open shell in container"
+	@echo "  helm-port-forward  - Port forward to localhost"
 	@echo ""
 	@echo "Variables:"
 	@echo "  REGISTRY           - Docker registry (default: ghcr.io/cpfarhood)"
 	@echo "  IMAGE_NAME         - Image name (default: antigravity)"
 	@echo "  IMAGE_TAG          - Image tag (default: latest)"
+	@echo "  RELEASE_NAME       - Helm release name (default: mydev)"
+	@echo "  NAMESPACE          - Kubernetes namespace (default: default)"
+	@echo "  GITHUB_REPO        - GitHub repository URL (required for helm-deploy)"
 	@echo ""
 	@echo "Environment Variables for 'make run':"
 	@echo "  GITHUB_REPO        - GitHub repository URL"
 	@echo "  GITHUB_TOKEN       - GitHub token (optional)"
 	@echo "  VNC_PASSWORD       - VNC password (optional)"
 	@echo ""
-	@echo "Example:"
+	@echo "Examples:"
 	@echo "  make build"
 	@echo "  make push REGISTRY=ghcr.io/myuser IMAGE_TAG=v1.0"
 	@echo "  GITHUB_REPO=https://github.com/user/repo make run"
+	@echo "  GITHUB_REPO=https://github.com/user/repo make helm-deploy"
+	@echo "  RELEASE_NAME=alice-dev GITHUB_REPO=https://github.com/alice/project make helm-deploy"
@@ -1,17 +1,43 @@
-# Antigravity Dev Container
+# Dev Container

 ![Build and Push](https://github.com/cpfarhood/devcontainer/actions/workflows/build-and-push.yaml/badge.svg)

 A containerized cloud development environment with web-based GUI access, featuring:
 - **VSCode or Google Antigravity** via browser-based VNC (port 5800)
 - **SSH access** option (OpenSSH on port 22, additive with any IDE)
- **Happy Coder** AI assistant backed by Claude
+- **Claude Code**, **Happy Coder**, **OpenCode**, and **Crush** AI coding agents (terminal-based)
 - **Automatic GitHub repo cloning** on startup
 - **Persistent home directory** via ReadWriteMany PVC
 - **Kubernetes-native** Helm chart deployment

 ## Quick Start

+### Option A: Quickstart (Recommended)
+
+For 80% of users, use the simplified quickstart values:
+
+```bash
+# Copy and customize the quickstart template
+cp chart/values-quickstart.yaml my-values.yaml
+
+# Edit my-values.yaml to set your name and repository:
+# name: mydev
+# githubRepo: https://github.com/youruser/yourrepo
+
+# Deploy with minimal configuration
+helm install mydev ./chart -f my-values.yaml
+```
+
+### Option B: One-Command Deploy
+
+```bash
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo
+```
+
+### Option C: Full Configuration
+
 ### 1. Create a secret

 The secret is picked up automatically via `envFrom`. Keys recognised:
@@ -22,6 +48,10 @@ The secret is picked up automatically via `envFrom`. Keys recognised:
 | `VNC_PASSWORD` | Password for the VNC web UI |
 | `ANTHROPIC_API_KEY` | API key — alternative to browser-based Claude login |
 | `SSH_AUTHORIZED_KEYS` | Public key(s) for SSH access (required when `ssh: true`) |
+| `HOMEASSISTANT_URL` | Home Assistant URL (required when `mcp.sidecars.homeassistant.enabled: true`) |
+| `HOMEASSISTANT_TOKEN` | Home Assistant long-lived access token (required when `mcp.sidecars.homeassistant.enabled: true`) |
+| `DATABASE_URI` | PostgreSQL connection string (required when `mcp.sidecars.pgtuner.enabled: true`) |
+| `PGTUNER_EXCLUDE_USERIDS` | Comma-separated PostgreSQL user OIDs to exclude from monitoring (optional) |

 ```bash
 kubectl create secret generic devcontainer-mydev-secrets-env \
@@ -71,20 +101,32 @@ A Chrome browser window will open inside VNC for the Claude Max OAuth login. Cre

 ## Helm Chart Reference

+The Helm chart uses a logical organization with these main sections:
+- **Basic Configuration**: name, image, githubRepo
+- **Access & Interface**: IDE, SSH, display, user settings
+- **Infrastructure**: storage, resources, cluster access
+- **Integrations**: Happy Coder, MCP sidecars
+- **Smart Defaults**: auto-detection and profiles
+
+📖 **Documentation**:
+- [USAGE.md](chart/USAGE.md) - Comprehensive examples and scenarios
+- [values-quickstart.yaml](chart/values-quickstart.yaml) - Minimal configuration
+- [values.schema.json](chart/values.schema.json) - IDE validation support
+
 ### Core values

 | Value | Default | Description |
 |-------|---------|-------------|
 | `name` | `""` | Instance name — used in all resource names (`devcontainer-{name}`) |
 | `githubRepo` | `""` | Repository to clone into `/workspace` on startup |
-| `ide` | `vscode` | IDE to launch — `vscode`, `antigravity`, or `none` (see below) |
-| `ssh` | `false` | Also start an OpenSSH server on port 22 (additive, any `ide`) |
+| `ide.type` | `vscode` | IDE to launch — `vscode`, `antigravity`, or `none` (see below) |
+| `ssh.enabled` | `false` | Also start an OpenSSH server on port 22 (additive, any IDE) |
 | `image.repository` | `ghcr.io/cpfarhood/devcontainer` | Container image |
 | `image.tag` | `latest` | Image tag |

 ### IDE choice

-`ide` controls what GUI is launched in the VNC session:
+`ide.type` controls what GUI is launched in the VNC session:

 | Value | Port | Description |
 |-------|------|-------------|
@@ -94,14 +136,14 @@ A Chrome browser window will open inside VNC for the Claude Max OAuth login. Cre

 ### SSH access

-`ssh: true` starts OpenSSH on port 22 **in addition to** the IDE. It works with any `ide` value:
+`ssh.enabled: true` starts OpenSSH on port 22 **in addition to** the IDE. It works with any `ide.type` value:

 ```bash
 # SSH-only (no VNC)
-helm install mydev ./chart --set name=mydev --set ide=none --set ssh=true
+helm install mydev ./chart --set name=mydev --set ide.type=none --set ssh.enabled=true

 # VSCode in VNC + SSH access at the same time
-helm install mydev ./chart --set name=mydev --set ssh=true
+helm install mydev ./chart --set name=mydev --set ssh.enabled=true
 ```

 Add your public key to the env secret:
@@ -123,10 +165,10 @@ ssh -p 2222 user@localhost

 | Value | Default | Description |
 |-------|---------|-------------|
-| `happyServerUrl` | `https://happy.farh.net` | Happy Coder server endpoint |
-| `happyWebappUrl` | `https://happy-coder.farh.net` | Happy Coder webapp URL |
-| `happyHomeDir` | `/home/user/.happy` | Happy runtime state directory (persists on the home PVC) |
-| `happyExperimental` | `true` | Enable experimental Happy features |
+| `happy.serverUrl` | `https://happy.farh.net` | Happy Coder server endpoint |
+| `happy.webappUrl` | `https://happy-coder.farh.net` | Happy Coder webapp URL |
+| `happy.homeDir` | `/config/userdata/.happy` | Happy runtime state directory (persists on the home PVC) |
+| `happy.experimental` | `true` | Enable experimental Happy features |

 ### Kubernetes cluster access

@@ -150,15 +192,128 @@ helm install mydev ./chart \

 With any non-`none` value, a `ServiceAccount` named `devcontainer-{name}` is created and set as the pod's `serviceAccountName`, so `kubectl` and any in-cluster API calls use it automatically.

+### MCP Sidecars
+
+The devcontainer includes MCP (Model Context Protocol) servers as sidecar containers that enable AI assistants to interact with various services:
+
+| Sidecar | Default | Purpose |
+|---------|---------|---------|
+| `mcp.sidecars.kubernetes.enabled` | `true` | Kubernetes API access via MCP |
+| `mcp.sidecars.flux.enabled` | `true` | Flux GitOps operations via MCP |
+| `mcp.sidecars.homeassistant.enabled` | `false` | Home Assistant smart home control via MCP |
+| `mcp.sidecars.pgtuner.enabled` | `false` | PostgreSQL performance tuning and analysis via MCP |
+| `mcp.sidecars.playwright.enabled` | `true` | Browser automation and web testing via MCP |
+
+**Notes:**
+- GitHub MCP is accessed via the Copilot API (`https://api.githubcopilot.com/mcp/`), not as a sidecar
+- Kubernetes and Flux sidecars require `clusterAccess` != `none` to be deployed (automatically disabled when no cluster access)
+- Kubernetes and Flux sidecars inherit the pod's ServiceAccount RBAC permissions (controlled by `clusterAccess`)
+- Home Assistant sidecar requires `HOMEASSISTANT_URL` and `HOMEASSISTANT_TOKEN` in the env secret
+- PostgreSQL tuner sidecar requires `DATABASE_URI` in the env secret (PostgreSQL connection string)
+- Playwright sidecar provides browser automation and web testing capabilities
+
+**Disable MCP sidecars:**
+```bash
+# Disable multiple sidecars
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set mcp.sidecars.kubernetes.enabled=false \
+  --set mcp.sidecars.flux.enabled=false \
+  --set mcp.sidecars.playwright.enabled=false
+
+# Or selectively disable
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set mcp.sidecars.flux.enabled=false  # Disable only Flux MCP
+```
+
+**Enable Home Assistant MCP:**
+```bash
+# Create secret with Home Assistant credentials
+kubectl create secret generic devcontainer-mydev-secrets-env \
+  --from-literal=GITHUB_TOKEN='ghp_...' \
+  --from-literal=HOMEASSISTANT_URL='http://homeassistant.local:8123' \
+  --from-literal=HOMEASSISTANT_TOKEN='your_long_lived_access_token'
+
+# Deploy with Home Assistant MCP enabled
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set mcp.sidecars.homeassistant.enabled=true
+```
+
+**Enable PostgreSQL Tuner MCP:**
+```bash
+# Create secret with PostgreSQL connection string
+kubectl create secret generic devcontainer-mydev-secrets-env \
+  --from-literal=GITHUB_TOKEN='ghp_...' \
+  --from-literal=DATABASE_URI='postgresql://user:password@postgres.example.com:5432/dbname'
+
+# Deploy with PostgreSQL tuner MCP enabled
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo \
+  --set mcp.sidecars.pgtuner.enabled=true
+```
+
+**Custom MCP configuration:**
+```yaml
+# values.yaml override
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: true
+      image:
+        repository: quay.io/containers/kubernetes_mcp_server
+        tag: v0.0.57
+      port: 8080
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "50m"
+        limits:
+          memory: "256Mi"
+          cpu: "500m"
+    flux:
+      enabled: false  # Disabled in this example
+    homeassistant:
+      enabled: true
+      image:
+        repository: ghcr.io/homeassistant-ai/ha-mcp
+        tag: stable
+      port: 8087
+    pgtuner:
+      enabled: true
+      image:
+        repository: dog830228/pgtuner_mcp
+        tag: latest
+      port: 8085
+    playwright:
+      enabled: true
+      image:
+        repository: mcr.microsoft.com/playwright/mcp
+        tag: latest
+      port: 8086
+      resources:
+        requests:
+          memory: "128Mi"
+          cpu: "100m"
+        limits:
+          memory: "512Mi"
+          cpu: "1000m"
+```
+
 ### Display and resources

 | Value | Default | Description |
 |-------|---------|-------------|
 | `display.width` | `1920` | VNC width (px) |
 | `display.height` | `1080` | VNC height (px) |
-| `secureConnection` | `0` | Set to `1` if TLS is not terminated upstream |
-| `userId` | `1000` | UID for the app user |
-| `groupId` | `1000` | GID for the app user |
+| `display.secureConnection` | `0` | Set to `1` if TLS is not terminated upstream |
+| `user.id` | `1000` | UID for the app user |
+| `user.groupId` | `1000` | GID for the app user |
 | `storage.size` | `32Gi` | Home PVC size |
 | `storage.className` | `ceph-filesystem` | StorageClass (must be ReadWriteMany) |
 | `shm.sizeLimit` | `2Gi` | `/dev/shm` size (memory-backed; used by Electron apps) |
@@ -181,8 +336,6 @@ Container start
  → /startapp.sh  (runs as app user, UID 1000)
      → init-repo.sh
          → clone / pull GITHUB_REPO into /workspace/{repo}
-          → rm daemon.state.json.lock    — clear stale Happy lock
-          → happy daemon start           — starts Happy Coder background daemon
      → IDE=vscode:      code --new-window --wait /workspace/{repo}
        IDE=antigravity:  antigravity --no-sandbox --user-data-dir ~/.config/antigravity ... /workspace/{repo}
        IDE=none:         sleep infinity
@@ -193,26 +346,31 @@ Container start

 | Mount | Source | Persistence |
 |-------|--------|-------------|
-| `/home` | ReadWriteMany PVC (`userhome-{name}`) | Survives pod restarts — stores Claude credentials, dotfiles, git config |
+| `/config` | ReadWriteMany PVC (`userhome-{name}`) | Survives pod restarts — stores Claude credentials, dotfiles, git config |
 | `/workspace` | `emptyDir` | Ephemeral — repo is re-cloned on each pod start |

-Happy Coder's runtime state (`HAPPY_HOME_DIR`) is kept in `/home/user/.happy` on the persistent home PVC, so auth credentials and settings survive pod restarts. A stale lock file (`daemon.state.json.lock`) is removed automatically on each startup.
+Happy Coder's runtime state (`HAPPY_HOME_DIR`) is kept in `/config/userdata/.happy` on the persistent home PVC, so auth credentials and settings survive pod restarts when manually started.

 ---

 ## Troubleshooting

-### Happy Coder daemon not starting
+### Happy Coder (manual startup)
+
+Happy daemon is not started automatically. Launch it manually when needed:

 ```bash
+# Start Happy Coder daemon manually
+happy daemon start
+
 # Check daemon status
 happy daemon status

-# Start manually (also clears any stale lock)
-happy daemon start
-
 # View daemon logs
 ls ~/.happy/logs/
+
+# Stop daemon if needed
+happy daemon stop
 ```

 ### Claude not authenticated
@@ -1,305 +1,444 @@
-# Configuration Variables Reference
+# Helm Chart Values Reference

-Quick reference for all configurable variables in this project.
+Complete reference for all configurable values in the Antigravity Dev Container Helm chart.

-## Required Variables
+## Core Configuration

-These MUST be configured before deployment:
-
-### Storage Class Name
- **Variable:** `storageClassName`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~117
+### name
 - **Type:** String
- **Description:** ReadWriteMany storage class available in your cluster
- **Example:** `ceph-filesystem`, `nfs-client`, `efs-sc`
- **How to find:** `kubectl get storageclass`
-
-### GitHub Repository URL
- **Variable:** `github-repo`
- **File:** `k8s/configmap.yaml`
- **Line:** ~9
- **Type:** String (URL)
- **Description:** Repository to clone on container startup
- **Format:** `https://github.com/username/repository`
- **Example:** `https://github.com/cpfarhood/my-project`
-
-### Gateway Name
- **Variable:** `parentRefs[0].name`
- **File:** `k8s/httproute.yaml`
- **Line:** ~8
- **Type:** String
- **Description:** Name of your Gateway resource
- **How to find:** `kubectl get gateway -A`
-
-### Gateway Namespace
- **Variable:** `parentRefs[0].namespace`
- **File:** `k8s/httproute.yaml`
- **Line:** ~9
- **Type:** String
- **Description:** Namespace where Gateway is deployed
- **How to find:** `kubectl get gateway -A`
-
-### Domain Hostname
- **Variable:** `hostnames[0]`
- **File:** `k8s/httproute.yaml`
- **Line:** ~11
- **Type:** String (FQDN)
- **Description:** Domain name for accessing the container
- **Example:** `devcontainer.example.com`
-
-## Optional Variables
-
-### GitHub Token
- **Variable:** `github-token`
- **File:** Sealed Secret
- **Type:** String (GitHub PAT)
- **Description:** Personal Access Token for private repos
- **Required:** Only for private repositories
- **Format:** `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
- **Scopes:** `repo`
-
-### VNC Password
- **Variable:** `vnc-password`
- **File:** Sealed Secret
- **Type:** String
- **Description:** Password for VNC web interface
- **Required:** Recommended for security
- **Format:** Any string (12+ characters recommended)
-
-### Namespace
- **Variable:** `namespace`
- **File:** `k8s/kustomization.yaml`
- **Line:** ~5
- **Type:** String
- **Description:** Kubernetes namespace for deployment
- **Default:** `default`
-
-### Container Image
- **Variable:** `image`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~32
- **Type:** String (image reference)
- **Description:** Docker image to deploy
- **Default:** `ghcr.io/cpfarhood/devcontainer:latest`
- **Format:** `registry/repository:tag`
-
-### Memory Request
- **Variable:** `resources.requests.memory`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~99
- **Type:** String (quantity)
- **Description:** Minimum memory to reserve
- **Default:** `2Gi`
- **Format:** `<number>Gi` or `<number>Mi`
-
-### Memory Limit
- **Variable:** `resources.limits.memory`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~102
- **Type:** String (quantity)
- **Description:** Maximum memory allowed
- **Default:** `8Gi`
- **Format:** `<number>Gi` or `<number>Mi`
-
-### CPU Request
- **Variable:** `resources.requests.cpu`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~100
- **Type:** String (quantity)
- **Description:** Minimum CPU to reserve
- **Default:** `1000m` (1 core)
- **Format:** `<number>m` (millicores) or `<number>` (cores)
-
-### CPU Limit
- **Variable:** `resources.limits.cpu`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~103
- **Type:** String (quantity)
- **Description:** Maximum CPU allowed
- **Default:** `4000m` (4 cores)
- **Format:** `<number>m` (millicores) or `<number>` (cores)
-
-### Storage Size
- **Variable:** `storage` (under volumeClaimTemplates)
- **File:** `k8s/statefulset.yaml`
- **Line:** ~120
- **Type:** String (quantity)
- **Description:** Size of home directory PVC
- **Default:** `10Gi`
- **Format:** `<number>Gi` or `<number>Ti`
-
-### Happy Server URL
- **Variable:** `happy-server-url`
- **File:** `k8s/configmap.yaml`
- **Line:** ~12 (commented)
- **Type:** String (URL)
- **Description:** Custom Happy Coder server
- **Default:** `https://api.cluster-fluster.com`
- **When to set:** Self-hosted Happy instance only
-
-### Happy Webapp URL
- **Variable:** `happy-webapp-url`
- **File:** `k8s/configmap.yaml`
- **Line:** ~13 (commented)
- **Type:** String (URL)
- **Description:** Custom Happy Coder webapp
- **Default:** `https://app.happy.engineering`
- **When to set:** Self-hosted Happy instance only
-
-### Display Width
- **Variable:** `DISPLAY_WIDTH`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~56
- **Type:** String (number)
- **Description:** VNC display width in pixels
- **Default:** `1920`
-
-### Display Height
- **Variable:** `DISPLAY_HEIGHT`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~58
- **Type:** String (number)
- **Description:** VNC display height in pixels
- **Default:** `1080`
-
-### User ID
- **Variable:** `USER_ID`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~51
- **Type:** String (number)
- **Description:** UID for claude user
- **Default:** `1000`
-
-### Group ID
- **Variable:** `GROUP_ID`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~53
- **Type:** String (number)
- **Description:** GID for claude user
- **Default:** `1000`
-
-### StatefulSet Replicas
- **Variable:** `replicas`
- **File:** `k8s/statefulset.yaml`
- **Line:** ~21
- **Type:** Integer
- **Description:** Number of container instances
- **Default:** `1`
- **Note:** Each replica gets own home PVC
-
-## Environment Variables (Runtime)
-
-These are set at runtime, not in configuration files:
-
-### GITHUB_REPO
- **Type:** String (URL)
- **Description:** Repository URL (from ConfigMap)
+- **Default:** `""`
 - **Required:** Yes
- **Source:** ConfigMap `antigravity.github-repo`
+- **Description:** Instance name used to generate resource names (`devcontainer-{name}`, `userhome-{name}`)
+- **Example:** `mydev`, `alice-dev`, `team-workspace`

-### GITHUB_TOKEN
+### githubRepo
 - **Type:** String
- **Description:** GitHub PAT (from Secret)
- **Required:** No (only for private repos)
- **Source:** Secret `antigravity.github-token`
+- **Default:** `""`
+- **Required:** Yes
+- **Description:** GitHub repository URL to clone into `/workspace`
+- **Example:** `https://github.com/username/repository`

-### VNC_PASSWORD
+### ide
 - **Type:** String
- **Description:** VNC password (from Secret)
- **Required:** No
- **Source:** Secret `antigravity.vnc-password`
+- **Default:** `vscode`
+- **Options:** `vscode`, `antigravity`, `none`
+- **Description:** IDE to launch inside the container
+  - `vscode` — VSCode via VNC browser UI on port 5800
+  - `antigravity` — Google Antigravity (VSCode fork) via VNC on port 5800
+  - `none` — No IDE; useful when `ssh: true` is the sole access method

-### HAPPY_SERVER_URL
- **Type:** String (URL)
- **Description:** Happy server URL (from ConfigMap)
- **Required:** No
- **Source:** ConfigMap `antigravity.happy-server-url`
+### ssh
+- **Type:** Boolean
+- **Default:** `false`
+- **Description:** Start an OpenSSH server on port 22 in addition to the IDE
+- **Note:** Requires `SSH_AUTHORIZED_KEYS` in env secret for key-based login

-### HAPPY_WEBAPP_URL
- **Type:** String (URL)
- **Description:** Happy webapp URL (from ConfigMap)
- **Required:** No
- **Source:** ConfigMap `antigravity.happy-webapp-url`
+## Image Configuration

-### HAPPY_HOME_DIR
- **Type:** String (path)
- **Description:** Happy data directory
- **Required:** No
- **Default:** `/home/claude/.happy`
- **Source:** Hardcoded in StatefulSet
+### image.repository
+- **Type:** String
+- **Default:** `ghcr.io/cpfarhood/devcontainer`
+- **Description:** Container image repository

-### HAPPY_EXPERIMENTAL
- **Type:** String (boolean)
- **Description:** Enable Happy experimental features
- **Required:** No
+### image.tag
+- **Type:** String
+- **Default:** `latest`
+- **Description:** Container image tag
+- **Best Practice:** Use specific version tags for production
+
+### image.pullPolicy
+- **Type:** String
+- **Default:** `Always`
+- **Options:** `Always`, `IfNotPresent`, `Never`
+- **Description:** Image pull policy
+
+## Happy Coder Configuration
+
+### happyServerUrl
+- **Type:** String
+- **Default:** `https://happy.farh.net`
+- **Description:** Happy Coder server endpoint
+- **When to Change:** Self-hosted Happy instance
+
+### happyWebappUrl
+- **Type:** String
+- **Default:** `https://happy-coder.farh.net`
+- **Description:** Happy Coder webapp URL
+- **When to Change:** Self-hosted Happy instance
+
+### happyHomeDir
+- **Type:** String
+- **Default:** `/config/userdata/.happy`
+- **Description:** Happy runtime state directory (persists on PVC)
+
+### happyExperimental
+- **Type:** String
+- **Default:** `"true"`
+- **Description:** Enable experimental Happy features
+
+## Display Configuration
+
+### display.width
+- **Type:** String
+- **Default:** `"1920"`
+- **Description:** VNC display width in pixels
+
+### display.height
+- **Type:** String
+- **Default:** `"1080"`
+- **Description:** VNC display height in pixels
+
+### secureConnection
+- **Type:** String
+- **Default:** `"0"`
+- **Options:** `"0"`, `"1"`
+- **Description:** Set to `"0"` when TLS is terminated at the gateway layer
+
+## User Configuration
+
+### userId
+- **Type:** String
+- **Default:** `"1000"`
+- **Description:** UID for the app user
+
+### groupId
+- **Type:** String
+- **Default:** `"1000"`
+- **Description:** GID for the app user
+
+## Storage Configuration
+
+### storage.size
+- **Type:** String
+- **Default:** `32Gi`
+- **Description:** Size of the persistent home directory
+- **Format:** Kubernetes quantity (e.g., `10Gi`, `100Gi`, `1Ti`)
+
+### storage.className
+- **Type:** String
+- **Default:** `ceph-filesystem`
+- **Description:** StorageClass name (must support ReadWriteMany)
+- **Examples:** `ceph-filesystem`, `nfs-client`, `efs-sc`, `azurefile`
+
+### shm.sizeLimit
+- **Type:** String
+- **Default:** `2Gi`
+- **Description:** `/dev/shm` size (memory-backed emptyDir for Electron apps)
+
+## Resource Limits
+
+### resources.requests.memory
+- **Type:** String
+- **Default:** `2Gi`
+- **Description:** Minimum memory to reserve
+- **Format:** Kubernetes quantity
+
+### resources.requests.cpu
+- **Type:** String
+- **Default:** `1000m`
+- **Description:** Minimum CPU to reserve
+- **Format:** Millicores (`1000m` = 1 CPU core)
+
+### resources.limits.memory
+- **Type:** String
+- **Default:** `8Gi`
+- **Description:** Maximum memory allowed
+- **Format:** Kubernetes quantity
+
+### resources.limits.cpu
+- **Type:** String
+- **Default:** `4000m`
+- **Description:** Maximum CPU allowed
+- **Format:** Millicores (`4000m` = 4 CPU cores)
+
+## Kubernetes Access
+
+### clusterAccess
+- **Type:** String
+- **Default:** `none`
+- **Options:**
+  - `none` — No cluster access
+  - `readonlyns` — Read-only access to release namespace
+  - `readwritens` — Full access to release namespace
+  - `readonly` — Read-only access cluster-wide
+  - `readwrite` — Full access cluster-wide
+- **Description:** RBAC permissions for the pod's ServiceAccount
+
+## Secrets
+
+### envSecretName
+- **Type:** String
+- **Default:** `""` (auto-generates as `devcontainer-{name}-secrets-env`)
+- **Description:** Name of existing Secret containing environment variables
+- **Keys Recognized:**
+  - `GITHUB_TOKEN` — PAT for private repo access
+  - `VNC_PASSWORD` — Password for VNC web UI
+  - `ANTHROPIC_API_KEY` — API key for Claude
+  - `SSH_AUTHORIZED_KEYS` — Public keys for SSH access
+  - `homeassistant-url` — Home Assistant base URL (e.g., http://homeassistant.local:8123)
+  - `homeassistant-token` — Home Assistant long-lived access token
+
+## MCP Sidecars
+
+### mcpSidecars.kubernetes.enabled
+- **Type:** Boolean
 - **Default:** `true`
- **Source:** Hardcoded in StatefulSet
+- **Description:** Enable Kubernetes MCP server sidecar

-## Variable Groups by Use Case
+### mcpSidecars.kubernetes.image.repository
+- **Type:** String
+- **Default:** `quay.io/containers/kubernetes_mcp_server`
+- **Description:** Kubernetes MCP server image

-### Minimal Deployment
-Only these variables are required for basic deployment:
-1. `storageClassName`
-2. `github-repo`
-3. `parentRefs.name`
-4. `parentRefs.namespace`
-5. `hostnames`
+### mcpSidecars.kubernetes.image.tag
+- **Type:** String
+- **Default:** `latest`
+- **Description:** Kubernetes MCP server image tag

-### Private Repository Deployment
-Add these for private repos:
-1. All minimal deployment variables
-2. `github-token` (sealed secret)
+### mcpSidecars.kubernetes.port
+- **Type:** Integer
+- **Default:** `8080`
+- **Description:** Port for Kubernetes MCP server

-### Production Deployment
-Recommended for production:
-1. All private repository variables
-2. `vnc-password` (sealed secret)
-3. `resources.requests.*` (adjusted for workload)
-4. `resources.limits.*` (adjusted for workload)
-5. `namespace` (dedicated namespace)
+### mcpSidecars.kubernetes.resources
+- **Type:** Object
+- **Default:**
+  ```yaml
+  requests:
+    memory: "64Mi"
+    cpu: "50m"
+  limits:
+    memory: "256Mi"
+    cpu: "500m"
+  ```
+- **Description:** Resource limits for Kubernetes MCP sidecar

-### Multi-User Deployment
-For multiple users:
-1. All production deployment variables
-2. `replicas` (set to number of users)
-3. Larger `storage` size for home PVCs
+### mcpSidecars.flux.enabled
+- **Type:** Boolean
+- **Default:** `true`
+- **Description:** Enable Flux MCP server sidecar

-## Quick Copy Templates
+### mcpSidecars.flux.image.repository
+- **Type:** String
+- **Default:** `ghcr.io/controlplaneio-fluxcd/flux-operator-mcp`
+- **Description:** Flux MCP server image
+
+### mcpSidecars.flux.image.tag
+- **Type:** String
+- **Default:** `v0.41.1`
+- **Description:** Flux MCP server image tag
+
+### mcpSidecars.flux.port
+- **Type:** Integer
+- **Default:** `8081`
+- **Description:** Port for Flux MCP server
+
+### mcpSidecars.flux.resources
+- **Type:** Object
+- **Default:**
+  ```yaml
+  requests:
+    memory: "64Mi"
+    cpu: "50m"
+  limits:
+    memory: "256Mi"
+    cpu: "500m"
+  ```
+- **Description:** Resource limits for Flux MCP sidecar
+
+### mcpSidecars.homeassistant.enabled
+- **Type:** Boolean
+- **Default:** `false`
+- **Description:** Enable Home Assistant MCP server sidecar
+- **Note:** Requires `homeassistant-url` and `homeassistant-token` in env secret
+
+### mcpSidecars.homeassistant.image.repository
+- **Type:** String
+- **Default:** `ghcr.io/homeassistant-ai/ha-mcp`
+- **Description:** Home Assistant MCP server image
+
+### mcpSidecars.homeassistant.image.tag
+- **Type:** String
+- **Default:** `stable`
+- **Description:** Home Assistant MCP server image tag
+- **Options:** `stable` (recommended), `latest` (dev builds), `v{version}` (specific version)
+
+### mcpSidecars.homeassistant.port
+- **Type:** Integer
+- **Default:** `8087`
+- **Description:** Port for Home Assistant MCP server (SSE mode)
+
+### mcpSidecars.homeassistant.resources
+- **Type:** Object
+- **Default:**
+  ```yaml
+  requests:
+    memory: "64Mi"
+    cpu: "50m"
+  limits:
+    memory: "256Mi"
+    cpu: "500m"
+  ```
+- **Description:** Resource limits for Home Assistant MCP sidecar
+
+## Usage Examples
+
+### Minimal Configuration

-### Minimal Required Variables
 ```yaml
-# k8s/statefulset.yaml
-storageClassName: "CHANGE_ME"  # Line ~117
-
-# k8s/configmap.yaml
-github-repo: "CHANGE_ME"  # Line ~9
-
-# k8s/httproute.yaml
-parentRefs:
- name: CHANGE_ME  # Line ~8
-  namespace: CHANGE_ME  # Line ~9
-hostnames:
- "CHANGE_ME"  # Line ~11
+name: mydev
+githubRepo: https://github.com/user/repo
 ```

-### With Secrets
-```bash
-kubectl create secret generic antigravity-secrets \
-  --from-literal=github-token='CHANGE_ME' \
-  --from-literal=vnc-password='CHANGE_ME' \
-  --dry-run=client -o yaml | \
-  kubeseal --format=yaml > k8s/sealedsecrets.yaml
-```
+### Production Configuration

-### With Resource Adjustments
 ```yaml
-# k8s/statefulset.yaml (lines ~98-103)
+name: prod-workspace
+githubRepo: https://github.com/company/application
+ide: vscode
+ssh: true
+
+image:
+  tag: v1.0.0
+
+storage:
+  size: 100Gi
+  className: ceph-filesystem
+
 resources:
  requests:
-    memory: "CHANGE_ME"  # e.g., 4Gi
-    cpu: "CHANGE_ME"     # e.g., 2000m
+    memory: "4Gi"
+    cpu: "2000m"
  limits:
-    memory: "CHANGE_ME"  # e.g., 16Gi
-    cpu: "CHANGE_ME"     # e.g., 8000m
+    memory: "16Gi"
+    cpu: "8000m"
+
+clusterAccess: readwritens
+
+mcpSidecars:
+  kubernetes:
+    enabled: true
+  flux:
+    enabled: false
 ```
+
+### Development Team Configuration
+
+```yaml
+name: team-dev
+githubRepo: https://github.com/team/project
+ide: antigravity
+
+display:
+  width: "2560"
+  height: "1440"
+
+storage:
+  size: 50Gi
+  className: nfs-client
+
+clusterAccess: readonly
+
+happyServerUrl: https://happy.internal.company.com
+happyWebappUrl: https://happy-app.internal.company.com
+```
+
+### Smart Home Development Configuration
+
+```yaml
+name: smarthome-dev
+githubRepo: https://github.com/user/home-automation
+ide: vscode
+
+clusterAccess: readwritens
+
+mcpSidecars:
+  kubernetes:
+    enabled: true
+  flux:
+    enabled: false
+  homeassistant:
+    enabled: true
+    image:
+      tag: stable
+
+# Requires secrets:
+# homeassistant-url: http://homeassistant.local:8123
+# homeassistant-token: <long-lived-access-token>
+```
+
+## Helm CLI Examples
+
+### Using --set Flags
+
+```bash
+# Basic deployment
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/user/repo
+
+# With multiple values
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/user/repo \
+  --set ide=antigravity \
+  --set storage.size=50Gi \
+  --set clusterAccess=readwritens \
+  --set mcpSidecars.flux.enabled=false
+```
+
+### Using Values File
+
+Create `custom-values.yaml`:
+```yaml
+name: mydev
+githubRepo: https://github.com/user/repo
+storage:
+  size: 50Gi
+clusterAccess: readwritens
+```
+
+Deploy:
+```bash
+helm install mydev ./chart -f custom-values.yaml
+```
+
+### Combining Methods
+
+```bash
+helm install mydev ./chart \
+  -f base-values.yaml \
+  -f prod-values.yaml \
+  --set githubRepo=https://github.com/user/repo \
+  --set image.tag=v2.0.0
+```
+
+## Value Precedence
+
+Values are applied in order of precedence (highest to lowest):
+1. `--set` flags on command line
+2. `-f` values files (later files override earlier)
+3. `chart/values.yaml` defaults
+
+## Environment Variables
+
+These environment variables are set in the container based on chart values:
+
+| Environment Variable | Source Value | Description |
+|---------------------|--------------|-------------|
+| `GITHUB_REPO` | `githubRepo` | Repository to clone |
+| `GITHUB_TOKEN` | Secret: `github-token` | PAT for private repos |
+| `VNC_PASSWORD` | Secret: `vnc-password` | VNC access password |
+| `ANTHROPIC_API_KEY` | Secret: `anthropic-api-key` | Claude API key |
+| `SSH_AUTHORIZED_KEYS` | Secret: `ssh-authorized-keys` | SSH public keys |
+| `HAPPY_SERVER_URL` | `happyServerUrl` | Happy server endpoint |
+| `HAPPY_WEBAPP_URL` | `happyWebappUrl` | Happy webapp URL |
+| `HAPPY_HOME_DIR` | `happyHomeDir` | Happy data directory |
+| `HAPPY_EXPERIMENTAL` | `happyExperimental` | Experimental features |
+| `DISPLAY_WIDTH` | `display.width` | VNC width |
+| `DISPLAY_HEIGHT` | `display.height` | VNC height |
+| `SECURE_CONNECTION` | `secureConnection` | TLS termination |
+| `USER_ID` | `userId` | App user UID |
+| `GROUP_ID` | `groupId` | App user GID |
+| `IDE` | `ide` | IDE to launch |
+| `SSH` | `ssh` | SSH server enabled |
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: devcontainer
-description: Antigravity Dev Container with Happy Coder AI assistant
+description: Dev Container with AI coding agents and MCP sidecars
 type: application
-version: 0.1.14
+version: 0.4.13
 appVersion: "latest"
@@ -0,0 +1,381 @@
+# Dev Container Helm Chart Usage Guide
+
+This guide provides common usage patterns and examples for the Dev Container Helm chart.
+
+## Quick Start
+
+### 1. Minimal Installation (Recommended)
+
+Use the quickstart values for the simplest setup:
+
+```bash
+# Copy and customize quickstart values
+cp values-quickstart.yaml my-values.yaml
+
+# Edit my-values.yaml to set your name and repo:
+# name: myproject
+# githubRepo: https://github.com/youruser/yourproject
+
+# Install
+helm install myproject ./chart -f my-values.yaml
+```
+
+### 2. One-Command Installation
+
+```bash
+helm install mydev ./chart \
+  --set name=mydev \
+  --set githubRepo=https://github.com/youruser/yourrepo
+```
+
+## Common Use Cases
+
+### Development Environment
+
+**Scenario**: Standard development with GitHub integration
+
+```yaml
+name: dev-environment
+githubRepo: https://github.com/company/project
+
+ide:
+  type: vscode
+
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: true
+    playwright:
+      enabled: true
+    flux:
+      enabled: false    # Disable if not using Flux
+```
+
+### Team Workspace
+
+**Scenario**: Shared development environment with more resources
+
+```yaml
+name: team-workspace
+githubRepo: https://github.com/company/project
+
+resources:
+  requests:
+    memory: "4Gi"
+    cpu: "2000m"
+  limits:
+    memory: "16Gi"
+    cpu: "8000m"
+
+storage:
+  size: 64Gi
+
+ssh:
+  enabled: true         # Enable SSH access for team
+
+clusterAccess: readwrite # Full cluster access
+```
+
+### Kubernetes Admin Environment
+
+**Scenario**: Platform engineering with full cluster access
+
+```yaml
+name: k8s-admin
+githubRepo: https://github.com/company/k8s-configs
+
+clusterAccess: readwrite
+
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: true
+    flux:
+      enabled: true
+    pgtuner:
+      enabled: true     # Database administration
+    playwright:
+      enabled: false    # Save resources
+```
+
+### AI/ML Development
+
+**Scenario**: AI development with browser automation
+
+```yaml
+name: ai-playground
+githubRepo: https://github.com/company/ai-project
+
+resources:
+  requests:
+    memory: "8Gi"       # More memory for ML workloads
+    cpu: "4000m"
+  limits:
+    memory: "32Gi"
+    cpu: "16000m"
+
+storage:
+  size: 128Gi           # Large datasets
+
+mcp:
+  sidecars:
+    playwright:
+      enabled: true     # Web scraping, testing
+    kubernetes:
+      enabled: false    # Save resources
+    flux:
+      enabled: false
+```
+
+### Lightweight Environment
+
+**Scenario**: Resource-constrained setup
+
+```yaml
+name: lightweight
+githubRepo: https://github.com/youruser/small-project
+
+resources:
+  requests:
+    memory: "1Gi"
+    cpu: "500m"
+  limits:
+    memory: "2Gi"
+    cpu: "1000m"
+
+storage:
+  size: 8Gi
+
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: false
+    flux:
+      enabled: false
+    playwright:
+      enabled: false
+    # Only keep essential sidecars enabled
+```
+
+## Secret Configuration
+
+### Basic Secrets
+
+```bash
+# GitHub access only
+kubectl create secret generic devcontainer-mydev-secrets-env \
+  --from-literal=GITHUB_TOKEN='ghp_...' \
+  --from-literal=VNC_PASSWORD='changeme'
+```
+
+### Extended Secrets
+
+```bash
+# Full feature set
+kubectl create secret generic devcontainer-mydev-secrets-env \
+  --from-literal=GITHUB_TOKEN='ghp_...' \
+  --from-literal=VNC_PASSWORD='changeme' \
+  --from-literal=SSH_AUTHORIZED_KEYS='ssh-ed25519 AAAA...' \
+  --from-literal=HOMEASSISTANT_URL='http://homeassistant.local:8123' \
+  --from-literal=HOMEASSISTANT_TOKEN='eyJ...' \
+  --from-literal=DATABASE_URI='postgresql://user:pass@postgres:5432/db'
+```
+
+## Storage Configuration
+
+### Different Storage Classes
+
+```yaml
+# For different Kubernetes distributions
+storage:
+  className: ""           # Auto-detect (recommended)
+  # className: longhorn   # Longhorn
+  # className: nfs-client # NFS
+  # className: fast-ssd   # Custom fast storage
+```
+
+### Storage Sizes by Use Case
+
+```yaml
+# Small projects
+storage:
+  size: 8Gi
+
+# Standard development
+storage:
+  size: 32Gi
+
+# Large projects / datasets
+storage:
+  size: 128Gi
+
+# Team environments
+storage:
+  size: 256Gi
+```
+
+## Access Patterns
+
+### VNC Only (Default)
+
+```yaml
+ide:
+  type: vscode
+
+# Access via: kubectl port-forward deployment/devcontainer-mydev 5800:5800
+```
+
+### SSH Only
+
+```yaml
+ide:
+  type: none
+
+ssh:
+  enabled: true
+
+# Access via: kubectl port-forward deployment/devcontainer-mydev 2222:22
+# ssh -p 2222 user@localhost
+```
+
+### Both VNC and SSH
+
+```yaml
+ide:
+  type: vscode
+
+ssh:
+  enabled: true
+
+# VNC: kubectl port-forward deployment/devcontainer-mydev 5800:5800
+# SSH: kubectl port-forward deployment/devcontainer-mydev 2222:22
+```
+
+## Resource Profiles
+
+### Small (1-2 developers)
+```yaml
+resources:
+  requests:
+    memory: "1Gi"
+    cpu: "500m"
+  limits:
+    memory: "4Gi"
+    cpu: "2000m"
+```
+
+### Medium (standard development)
+```yaml
+resources:
+  requests:
+    memory: "2Gi"
+    cpu: "1000m"
+  limits:
+    memory: "8Gi"
+    cpu: "4000m"
+```
+
+### Large (intensive workloads)
+```yaml
+resources:
+  requests:
+    memory: "4Gi"
+    cpu: "2000m"
+  limits:
+    memory: "16Gi"
+    cpu: "8000m"
+```
+
+### XLarge (AI/ML, data processing)
+```yaml
+resources:
+  requests:
+    memory: "8Gi"
+    cpu: "4000m"
+  limits:
+    memory: "32Gi"
+    cpu: "16000m"
+```
+
+## MCP Sidecar Combinations
+
+### Minimal (basic development)
+```yaml
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: false
+    flux:
+      enabled: false
+    playwright:
+      enabled: true     # Keep for web testing
+```
+
+### Standard (full-stack development)
+```yaml
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: true
+    flux:
+      enabled: false
+    playwright:
+      enabled: true
+```
+
+### DevOps/Platform (infrastructure work)
+```yaml
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: true
+    flux:
+      enabled: true
+    pgtuner:
+      enabled: true
+    playwright:
+      enabled: false
+```
+
+### All Features
+```yaml
+mcp:
+  sidecars:
+    kubernetes:
+      enabled: true
+    flux:
+      enabled: true
+    homeassistant:
+      enabled: true
+    pgtuner:
+      enabled: true
+    playwright:
+      enabled: true
+```
+
+## Troubleshooting
+
+### Values Validation
+
+Your IDE should automatically validate values.yaml against the schema. If not:
+
+```bash
+# Manual validation (if you have a JSON schema validator)
+helm template ./chart -f values.yaml > /dev/null
+```
+
+### Common Issues
+
+**Resource Limits**: Start with smaller resource requests and increase as needed.
+
+**Storage Class**: Use `className: ""` for auto-detection.
+
+**GitHub Access**: Ensure GITHUB_TOKEN has `repo` scope.
+
+**MCP Sidecars**: Disable unused sidecars to save resources.
+
+### Getting Help
+
+1. Check the main [README.md](../README.md) for detailed documentation
+2. Review [values.yaml](values.yaml) for all available options
+3. Use [values-quickstart.yaml](values-quickstart.yaml) as a starting point
@@ -1,28 +1,96 @@
 {{/*
 Resource name prefix: devcontainer-{name}
 */}}
-{{- define "antigravity.fullname" -}}
+{{- define "devcontainer.fullname" -}}
 {{- printf "devcontainer-%s" .Values.name }}
 {{- end }}

 {{/*
 PVC name: userhome-{name}
 */}}
-{{- define "antigravity.pvcName" -}}
+{{- define "devcontainer.pvcName" -}}
 {{- printf "userhome-%s" .Values.name }}
 {{- end }}

 {{/*
 Secret name for env vars, default to devcontainer-{name}-secrets-env
 */}}
-{{- define "antigravity.envSecretName" -}}
+{{- define "devcontainer.envSecretName" -}}
 {{- .Values.envSecretName | default (printf "devcontainer-%s-secrets-env" .Values.name) }}
 {{- end }}

 {{/*
 Common labels
 */}}
-{{- define "antigravity.labels" -}}
+{{- define "devcontainer.labels" -}}
 app: devcontainer
 instance: {{ .Values.name }}
 {{- end }}
+
+{{/*
+Smart resource sizing based on enabled features
+*/}}
+{{- define "devcontainer.smartResources" -}}
+{{- $baseMemory := "2Gi" }}
+{{- $baseCpu := "1000m" }}
+{{- $limitMemory := "8Gi" }}
+{{- $limitCpu := "4000m" }}
+
+{{/* Adjust for enabled MCP sidecars */}}
+{{- if .Values.mcp.sidecars.playwright.enabled }}
+  {{- $baseMemory = "3Gi" }}
+  {{- $limitMemory = "12Gi" }}
+{{- end }}
+
+{{/* Adjust for IDE type */}}
+{{- if eq .Values.ide.type "antigravity" }}
+  {{- $baseMemory = "4Gi" }}
+  {{- $limitMemory = "16Gi" }}
+{{- end }}
+
+requests:
+  memory: {{ .Values.resources.requests.memory | default $baseMemory | quote }}
+  cpu: {{ .Values.resources.requests.cpu | default $baseCpu | quote }}
+limits:
+  memory: {{ .Values.resources.limits.memory | default $limitMemory | quote }}
+  cpu: {{ .Values.resources.limits.cpu | default $limitCpu | quote }}
+{{- end }}
+
+{{/*
+Auto-detect environment type and set smart defaults
+*/}}
+{{- define "devcontainer.smartDefaults" -}}
+{{- $isDev := or (contains "dev" .Values.name) (contains "test" .Values.name) (contains "local" .Values.name) }}
+{{- $isProd := or (contains "prod" .Values.name) (contains "production" .Values.name) }}
+{{- $isTeam := or (contains "team" .Values.name) (contains "shared" .Values.name) }}
+
+{{/* Development environment - enable more sidecars, smaller resources */}}
+{{- if $isDev }}
+development: true
+{{/* Production environment - conservative defaults, fewer sidecars */}}
+{{- else if $isProd }}
+production: true
+{{/* Team environment - enable SSH, more resources */}}
+{{- else if $isTeam }}
+team: true
+{{- end }}
+{{- end }}
+
+{{/*
+Smart MCP sidecar selection based on cluster access
+*/}}
+{{- define "devcontainer.mcpDefaults" -}}
+{{- if eq .Values.clusterAccess "none" }}
+  {{/* No cluster access - disable k8s/flux sidecars */}}
+  kubernetes:
+    enabled: false
+  flux:
+    enabled: false
+{{- else }}
+  {{/* Has cluster access - enable k8s sidecars */}}
+  kubernetes:
+    enabled: true
+  flux:
+    enabled: {{ ne .Values.clusterAccess "readonly" }}
+{{- end }}
+{{- end }}
@@ -1,68 +1,87 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "antigravity.fullname" . }}
+  name: {{ include "devcontainer.fullname" . }}
  labels:
-    {{- include "antigravity.labels" . | nindent 4 }}
+    {{- include "devcontainer.labels" . | nindent 4 }}
 spec:
  replicas: 1
  selector:
    matchLabels:
-      {{- include "antigravity.labels" . | nindent 6 }}
+      {{- include "devcontainer.labels" . | nindent 6 }}
  template:
    metadata:
      labels:
-        {{- include "antigravity.labels" . | nindent 8 }}
+        {{- include "devcontainer.labels" . | nindent 8 }}
    spec:
      {{- if ne (.Values.clusterAccess | default "none") "none" }}
-      serviceAccountName: {{ include "antigravity.fullname" . }}
+      serviceAccountName: {{ include "devcontainer.fullname" . }}
      {{- end }}
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: "OnRootMismatch"
+      {{- if and .Values.ide.type (eq .Values.ide.type "antigravity") }}
+      initContainers:
+        - name: setup-userdata
+          image: busybox:latest
+          command: ['sh', '-c']
+          args:
+            - |
+              echo "Setting up userdata directory..."
+              mkdir -p /config/userdata
+              chown 1000:1000 /config/userdata
+              chmod 755 /config/userdata
+              echo "Userdata directory setup complete"
+          volumeMounts:
+            - name: userhome
+              mountPath: /config
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+      {{- end }}
      containers:
        - name: devcontainer
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
-            {{- if ne (.Values.ide | default "vscode") "none" }}
+            {{- if ne (.Values.ide.type | default "vscode") "none" }}
            - containerPort: 5800
              name: vnc-web
              protocol: TCP
            {{- end }}
-            {{- if .Values.ssh }}
+            {{- if .Values.ssh.enabled }}
            - containerPort: 22
              name: ssh
              protocol: TCP
            {{- end }}
          env:
            - name: IDE
-              value: {{ .Values.ide | default "vscode" | quote }}
+              value: {{ .Values.ide.type | default "vscode" | quote }}
            - name: SSH
-              value: {{ .Values.ssh | toString | quote }}
+              value: {{ .Values.ssh.enabled | toString | quote }}
            - name: USER_ID
-              value: {{ .Values.userId | quote }}
+              value: {{ .Values.user.id | quote }}
            - name: GROUP_ID
-              value: {{ .Values.groupId | quote }}
+              value: {{ .Values.user.groupId | quote }}
            - name: DISPLAY_WIDTH
              value: {{ .Values.display.width | quote }}
            - name: DISPLAY_HEIGHT
              value: {{ .Values.display.height | quote }}
            - name: SECURE_CONNECTION
-              value: {{ .Values.secureConnection | quote }}
+              value: {{ .Values.display.secureConnection | quote }}
            - name: HAPPY_HOME_DIR
-              value: {{ .Values.happyHomeDir | quote }}
+              value: {{ .Values.happy.homeDir | quote }}
            - name: HAPPY_EXPERIMENTAL
-              value: {{ .Values.happyExperimental | quote }}
+              value: {{ .Values.happy.experimental | quote }}
            - name: HAPPY_SERVER_URL
-              value: {{ .Values.happyServerUrl | quote }}
+              value: {{ .Values.happy.serverUrl | quote }}
            - name: HAPPY_WEBAPP_URL
-              value: {{ .Values.happyWebappUrl | quote }}
+              value: {{ .Values.happy.webappUrl | quote }}
            - name: GITHUB_REPO
              value: {{ .Values.githubRepo | quote }}
          envFrom:
            - secretRef:
-                name: {{ include "antigravity.envSecretName" . }}
+                name: {{ include "devcontainer.envSecretName" . }}
                optional: true
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
@@ -73,7 +92,7 @@ spec:
              mountPath: /workspace
            - name: shm
              mountPath: /dev/shm
-          {{- if ne (.Values.ide | default "vscode") "none" }}
+          {{- if ne (.Values.ide.type | default "vscode") "none" }}
          livenessProbe:
            httpGet:
              path: /
@@ -86,7 +105,7 @@ spec:
              port: 5800
            initialDelaySeconds: 10
            periodSeconds: 5
-          {{- else if .Values.ssh }}
+          {{- else if .Values.ssh.enabled }}
          livenessProbe:
            tcpSocket:
              port: 22
@@ -98,54 +117,156 @@ spec:
            initialDelaySeconds: 5
            periodSeconds: 5
          {{- end }}
-        {{- if .Values.mcpSidecars.kubernetes.enabled }}
+        {{- if and .Values.mcp.sidecars.kubernetes.enabled (ne .Values.clusterAccess "none") }}
        - name: kubernetes-mcp
-          image: "{{ .Values.mcpSidecars.kubernetes.image.repository }}:{{ .Values.mcpSidecars.kubernetes.image.tag }}"
+          image: "{{ .Values.mcp.sidecars.kubernetes.image.repository }}:{{ .Values.mcp.sidecars.kubernetes.image.tag }}"
          args:
            - --port
-            - {{ .Values.mcpSidecars.kubernetes.port | quote }}
+            - {{ .Values.mcp.sidecars.kubernetes.port | quote }}
          ports:
-            - containerPort: {{ .Values.mcpSidecars.kubernetes.port }}
+            - containerPort: {{ .Values.mcp.sidecars.kubernetes.port }}
              name: k8s-mcp
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
-              port: {{ .Values.mcpSidecars.kubernetes.port }}
+              port: {{ .Values.mcp.sidecars.kubernetes.port }}
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
-              port: {{ .Values.mcpSidecars.kubernetes.port }}
+              port: {{ .Values.mcp.sidecars.kubernetes.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
-            {{- toYaml .Values.mcpSidecars.kubernetes.resources | nindent 12 }}
+            {{- toYaml .Values.mcp.sidecars.kubernetes.resources | nindent 12 }}
        {{- end }}
-        {{- if .Values.mcpSidecars.flux.enabled }}
+        {{- if and .Values.mcp.sidecars.flux.enabled (ne .Values.clusterAccess "none") }}
        - name: flux-mcp
-          image: "{{ .Values.mcpSidecars.flux.image.repository }}:{{ .Values.mcpSidecars.flux.image.tag }}"
+          image: "{{ .Values.mcp.sidecars.flux.image.repository }}:{{ .Values.mcp.sidecars.flux.image.tag }}"
          args:
            - serve
            - --transport=sse
-            - --port={{ .Values.mcpSidecars.flux.port }}
+            - --port={{ .Values.mcp.sidecars.flux.port }}
          ports:
-            - containerPort: {{ .Values.mcpSidecars.flux.port }}
+            - containerPort: {{ .Values.mcp.sidecars.flux.port }}
              name: flux-mcp
              protocol: TCP
          livenessProbe:
            tcpSocket:
-              port: {{ .Values.mcpSidecars.flux.port }}
+              port: {{ .Values.mcp.sidecars.flux.port }}
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
-              port: {{ .Values.mcpSidecars.flux.port }}
+              port: {{ .Values.mcp.sidecars.flux.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
-            {{- toYaml .Values.mcpSidecars.flux.resources | nindent 12 }}
+            {{- toYaml .Values.mcp.sidecars.flux.resources | nindent 12 }}
+        {{- end }}
+        {{- if .Values.mcp.sidecars.homeassistant.enabled }}
+        - name: homeassistant-mcp
+          image: "{{ .Values.mcp.sidecars.homeassistant.image.repository }}:{{ .Values.mcp.sidecars.homeassistant.image.tag }}"
+          imagePullPolicy: Always
+          command: ["fastmcp", "run", "--transport", "sse", "--host", "0.0.0.0", "--port", "{{ .Values.mcp.sidecars.homeassistant.port }}"]
+          ports:
+            - name: homeassistant
+              containerPort: {{ .Values.mcp.sidecars.homeassistant.port }}
+          env:
+            - name: HOMEASSISTANT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "devcontainer.envSecretName" . }}
+                  key: HOMEASSISTANT_URL
+                  optional: true
+            - name: HOMEASSISTANT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "devcontainer.envSecretName" . }}
+                  key: HOMEASSISTANT_TOKEN
+                  optional: true
+          livenessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.homeassistant.port }}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.homeassistant.port }}
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.mcp.sidecars.homeassistant.resources | nindent 12 }}
+        {{- end }}
+        {{- if .Values.mcp.sidecars.pgtuner.enabled }}
+        - name: pgtuner-mcp
+          image: "{{ .Values.mcp.sidecars.pgtuner.image.repository }}:{{ .Values.mcp.sidecars.pgtuner.image.tag }}"
+          imagePullPolicy: Always
+          command: ["python", "-m", "pgtuner_mcp", "--mode", "sse", "--host", "0.0.0.0", "--port", "{{ .Values.mcp.sidecars.pgtuner.port }}"]
+          ports:
+            - name: pgtuner
+              containerPort: {{ .Values.mcp.sidecars.pgtuner.port }}
+          env:
+            - name: DATABASE_URI
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "devcontainer.envSecretName" . }}
+                  key: DATABASE_URI
+                  optional: true
+            - name: PGTUNER_EXCLUDE_USERIDS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "devcontainer.envSecretName" . }}
+                  key: PGTUNER_EXCLUDE_USERIDS
+                  optional: true
+          livenessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.pgtuner.port }}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.pgtuner.port }}
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.mcp.sidecars.pgtuner.resources | nindent 12 }}
+        {{- end }}
+        {{- if .Values.mcp.sidecars.playwright.enabled }}
+        - name: playwright-mcp
+          image: "{{ .Values.mcp.sidecars.playwright.image.repository }}:{{ .Values.mcp.sidecars.playwright.image.tag }}"
+          imagePullPolicy: Always
+          command: ["node"]
+          args:
+            - cli.js
+            - --headless
+            - --browser
+            - chromium
+            - --no-sandbox
+            - --host
+            - 0.0.0.0
+            - --port
+            - {{ .Values.mcp.sidecars.playwright.port | quote }}
+          ports:
+            - name: playwright
+              containerPort: {{ .Values.mcp.sidecars.playwright.port }}
+          livenessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.playwright.port }}
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.playwright.port }}
+            initialDelaySeconds: 10
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.mcp.sidecars.playwright.resources | nindent 12 }}
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
        {{- end }}
      volumes:
        - name: workspace
@@ -156,4 +277,4 @@ spec:
            sizeLimit: {{ .Values.shm.sizeLimit }}
        - name: userhome
          persistentVolumeClaim:
-            claimName: {{ include "antigravity.pvcName" . }}
+            claimName: {{ include "devcontainer.pvcName" . }}
@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "antigravity.pvcName" . }}
+  name: {{ include "devcontainer.pvcName" . }}
  labels:
-    {{- include "antigravity.labels" . | nindent 4 }}
+    {{- include "devcontainer.labels" . | nindent 4 }}
 spec:
  accessModes:
    - ReadWriteMany
@@ -1,7 +1,7 @@
 {{- $access := .Values.clusterAccess | default "none" }}
-{{- $name   := include "antigravity.fullname" . }}
+{{- $name   := include "devcontainer.fullname" . }}
 {{- $ns     := .Release.Namespace }}
-{{- $labels := include "antigravity.labels" . }}
+{{- $labels := include "devcontainer.labels" . }}

 {{- if ne $access "none" }}
 ---
@@ -1,22 +1,22 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "antigravity.fullname" . }}
+  name: {{ include "devcontainer.fullname" . }}
  labels:
-    {{- include "antigravity.labels" . | nindent 4 }}
+    {{- include "devcontainer.labels" . | nindent 4 }}
 spec:
  ports:
-    {{- if ne (.Values.ide | default "vscode") "none" }}
+    {{- if ne (.Values.ide.type | default "vscode") "none" }}
    - port: 5800
      name: vnc-web
      protocol: TCP
      targetPort: vnc-web
    {{- end }}
-    {{- if .Values.ssh }}
+    {{- if .Values.ssh.enabled }}
    - port: 22
      name: ssh
      protocol: TCP
      targetPort: ssh
    {{- end }}
  selector:
-    {{- include "antigravity.labels" . | nindent 4 }}
+    {{- include "devcontainer.labels" . | nindent 4 }}
@@ -0,0 +1,58 @@
+# =============================================================================
+# QUICKSTART VALUES - Just set these 3 essentials!
+# =============================================================================
+
+# Instance name (required)
+name: mydev
+
+# GitHub repository to clone (required)
+githubRepo: https://github.com/youruser/yourrepo
+
+# IDE choice (optional - defaults to vscode)
+# Options: vscode | antigravity | none
+ide:
+  type: vscode
+
+# =============================================================================
+# COMMON CUSTOMIZATIONS (optional)
+# =============================================================================
+
+# Enable SSH access
+# ssh:
+#   enabled: true
+
+# Adjust resources for smaller/larger workloads
+# resources:
+#   requests:
+#     memory: "1Gi"    # Smaller
+#     cpu: "500m"
+#   limits:
+#     memory: "4Gi"    # Smaller
+#     cpu: "2000m"
+
+# Different storage size
+# storage:
+#   size: 16Gi         # Smaller
+
+# Disable some MCP sidecars to save resources
+# mcp:
+#   sidecars:
+#     kubernetes:
+#       enabled: false
+#     flux:
+#       enabled: false
+
+# =============================================================================
+# USAGE INSTRUCTIONS
+# =============================================================================
+
+# 1. Copy this file: cp values-quickstart.yaml my-values.yaml
+# 2. Edit the 'name' and 'githubRepo' fields above
+# 3. Deploy: helm install mydev ./chart -f my-values.yaml
+# 4. Access: kubectl port-forward deployment/devcontainer-mydev 5800:5800
+# 5. Open: http://localhost:5800
+
+# For secrets (GitHub token, passwords):
+# kubectl create secret generic devcontainer-mydev-secrets-env \
+#   --from-literal=GITHUB_TOKEN='ghp_...' \
+#   --from-literal=VNC_PASSWORD='changeme'
@@ -0,0 +1,262 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://github.com/cpfarhood/devcontainer/chart/values.schema.json",
+  "title": "Dev Container Helm Chart Values Schema",
+  "description": "Schema for validating values.yaml in the Dev Container Helm chart",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Instance name used to generate resource names",
+      "pattern": "^[a-z0-9][a-z0-9-]*[a-z0-9]$",
+      "minLength": 1,
+      "maxLength": 63
+    },
+    "image": {
+      "type": "object",
+      "properties": {
+        "repository": {
+          "type": "string",
+          "description": "Container image repository"
+        },
+        "tag": {
+          "type": "string",
+          "description": "Container image tag"
+        },
+        "pullPolicy": {
+          "type": "string",
+          "enum": ["Always", "IfNotPresent", "Never"],
+          "description": "Image pull policy"
+        }
+      },
+      "required": ["repository", "tag"]
+    },
+    "githubRepo": {
+      "type": "string",
+      "description": "GitHub repository URL to clone",
+      "pattern": "^https://github\\.com/.+/.+$"
+    },
+    "ide": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": ["vscode", "antigravity", "none"],
+          "description": "IDE to launch in the container"
+        }
+      },
+      "required": ["type"]
+    },
+    "ssh": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable SSH server on port 22"
+        }
+      },
+      "required": ["enabled"]
+    },
+    "display": {
+      "type": "object",
+      "properties": {
+        "width": {
+          "type": "string",
+          "pattern": "^[0-9]+$",
+          "description": "VNC display width in pixels"
+        },
+        "height": {
+          "type": "string",
+          "pattern": "^[0-9]+$",
+          "description": "VNC display height in pixels"
+        },
+        "secureConnection": {
+          "type": "string",
+          "enum": ["0", "1"],
+          "description": "Enable secure VNC connection"
+        }
+      },
+      "required": ["width", "height", "secureConnection"]
+    },
+    "user": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[0-9]+$",
+          "description": "User ID (UID)"
+        },
+        "groupId": {
+          "type": "string",
+          "pattern": "^[0-9]+$",
+          "description": "Group ID (GID)"
+        }
+      },
+      "required": ["id", "groupId"]
+    },
+    "storage": {
+      "type": "object",
+      "properties": {
+        "size": {
+          "type": "string",
+          "pattern": "^[0-9]+[KMGT]i$",
+          "description": "Storage size (e.g., 32Gi)"
+        },
+        "className": {
+          "type": "string",
+          "description": "Storage class name (must support ReadWriteMany)"
+        }
+      },
+      "required": ["size", "className"]
+    },
+    "resources": {
+      "type": "object",
+      "properties": {
+        "requests": {
+          "$ref": "#/$defs/resourceSpec"
+        },
+        "limits": {
+          "$ref": "#/$defs/resourceSpec"
+        }
+      },
+      "required": ["requests", "limits"]
+    },
+    "shm": {
+      "type": "object",
+      "properties": {
+        "sizeLimit": {
+          "type": "string",
+          "pattern": "^[0-9]+[KMGT]i$",
+          "description": "Shared memory size limit"
+        }
+      },
+      "required": ["sizeLimit"]
+    },
+    "clusterAccess": {
+      "type": "string",
+      "enum": ["none", "readonlyns", "readwritens", "readonly", "readwrite"],
+      "description": "Kubernetes cluster access level"
+    },
+    "happy": {
+      "type": "object",
+      "properties": {
+        "serverUrl": {
+          "type": "string",
+          "format": "uri",
+          "description": "Happy Coder server URL"
+        },
+        "webappUrl": {
+          "type": "string",
+          "format": "uri",
+          "description": "Happy Coder webapp URL"
+        },
+        "homeDir": {
+          "type": "string",
+          "description": "Happy Coder home directory"
+        },
+        "experimental": {
+          "type": "string",
+          "enum": ["true", "false"],
+          "description": "Enable experimental Happy features"
+        }
+      },
+      "required": ["serverUrl", "webappUrl", "homeDir", "experimental"]
+    },
+    "mcp": {
+      "type": "object",
+      "properties": {
+        "sidecars": {
+          "type": "object",
+          "properties": {
+            "kubernetes": {
+              "$ref": "#/$defs/mcpSidecar"
+            },
+            "flux": {
+              "$ref": "#/$defs/mcpSidecar"
+            },
+            "homeassistant": {
+              "$ref": "#/$defs/mcpSidecar"
+            },
+            "pgtuner": {
+              "$ref": "#/$defs/mcpSidecar"
+            },
+            "playwright": {
+              "$ref": "#/$defs/mcpSidecar"
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "required": ["sidecars"]
+    },
+    "envSecretName": {
+      "type": "string",
+      "description": "Custom environment secret name"
+    },
+    "resourceProfile": {
+      "type": "string",
+      "enum": ["auto", "small", "medium", "large", "xlarge"],
+      "description": "Resource profile preset"
+    }
+  },
+  "required": ["name"],
+  "$defs": {
+    "resourceSpec": {
+      "type": "object",
+      "properties": {
+        "memory": {
+          "type": "string",
+          "pattern": "^[0-9]+[KMGT]i$",
+          "description": "Memory resource specification"
+        },
+        "cpu": {
+          "type": "string",
+          "pattern": "^[0-9]+m?$",
+          "description": "CPU resource specification"
+        }
+      },
+      "required": ["memory", "cpu"]
+    },
+    "mcpSidecar": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable this MCP sidecar"
+        },
+        "image": {
+          "type": "object",
+          "properties": {
+            "repository": {
+              "type": "string"
+            },
+            "tag": {
+              "type": "string"
+            }
+          },
+          "required": ["repository", "tag"]
+        },
+        "port": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 65535,
+          "description": "Port for the MCP sidecar"
+        },
+        "resources": {
+          "type": "object",
+          "properties": {
+            "requests": {
+              "$ref": "#/$defs/resourceSpec"
+            },
+            "limits": {
+              "$ref": "#/$defs/resourceSpec"
+            }
+          },
+          "required": ["requests", "limits"]
+        }
+      },
+      "required": ["enabled", "image", "port", "resources"]
+    }
+  }
+}
@@ -1,6 +1,11 @@
+# =============================================================================
+# BASIC CONFIGURATION
+# =============================================================================
+
 # Instance name — used to generate resource names (devcontainer-{name}, userhome-{name})
 name: ""

+# Container image configuration
 image:
  repository: ghcr.io/cpfarhood/devcontainer
  tag: latest
@@ -9,43 +14,40 @@ image:
 # GitHub repository to clone into /workspace
 githubRepo: ""

-# IDE to launch inside the container.
-# Options:
-#   vscode      — VSCode via VNC browser UI on port 5800 (default)
-#   antigravity — Google Antigravity (VSCode fork) via VNC on port 5800
-#   none        — no IDE; useful when ssh: true is the sole access method
-ide: vscode
+# =============================================================================
+# ACCESS & INTERFACE
+# =============================================================================

-# Start an OpenSSH server on port 22 in addition to the IDE.
-# Set SSH_AUTHORIZED_KEYS in the env secret to allow key-based login.
-ssh: false
+# IDE configuration
+ide:
+  # Options: vscode | antigravity | none
+  type: vscode

-# Happy Coder endpoints
-happyServerUrl: "https://happy.farh.net"
-happyWebappUrl: "https://happy-coder.farh.net"
-happyHomeDir: "/config/userdata/.happy"
-happyExperimental: "true"
+# SSH access configuration
+ssh:
+  enabled: false

-# VNC display
+# VNC display settings
 display:
  width: "1920"
  height: "1080"
+  secureConnection: "0"  # Set to "1" when TLS is not terminated upstream

-# Set to "0" when TLS is terminated at the gateway layer
-secureConnection: "0"
+# User configuration
+user:
+  id: "1000"
+  groupId: "1000"

-userId: "1000"
-groupId: "1000"
+# =============================================================================
+# INFRASTRUCTURE & RESOURCES
+# =============================================================================

+# Storage configuration
 storage:
  size: 32Gi
  className: ceph-filesystem

-# Shared memory size — mounted at /dev/shm as a memory-backed emptyDir.
-# Electron apps (Antigravity, Chrome) use /dev/shm for GPU/IPC buffers.
-shm:
-  sizeLimit: 2Gi
-
+# Resource allocation
 resources:
  requests:
    memory: "2Gi"
@@ -54,44 +56,123 @@ resources:
    memory: "8Gi"
    cpu: "4000m"

-# Kubernetes cluster access granted to the devcontainer pod via RBAC.
-# Options:
-#   none        — no cluster access (default)
-#   readonlyns  — get/list/watch all resources in the release namespace
-#   readwritens — full access to all resources in the release namespace
-#   readonly    — get/list/watch all resources cluster-wide
-#   readwrite   — full access to all resources cluster-wide
+# Shared memory for Electron apps (Chrome, Antigravity)
+shm:
+  sizeLimit: 2Gi
+
+# Kubernetes cluster access via RBAC
+# Options: none | readonlyns | readwritens | readonly | readwrite
 clusterAccess: none

-# Name of existing Secret containing env vars (GITHUB_TOKEN, VNC_PASSWORD, etc.)
-# Defaults to: devcontainer-{name}-secrets-env
-envSecretName: ""
+# =============================================================================
+# INTEGRATIONS
+# =============================================================================

-# MCP server sidecars — run alongside the devcontainer to inherit pod RBAC.
-mcpSidecars:
-  kubernetes:
-    enabled: true
-    image:
-      repository: quay.io/containers/kubernetes_mcp_server
-      tag: latest
-    port: 8080
-    resources:
-      requests:
-        memory: "64Mi"
-        cpu: "50m"
-      limits:
-        memory: "256Mi"
-        cpu: "500m"
-  flux:
-    enabled: true
-    image:
-      repository: ghcr.io/controlplaneio-fluxcd/flux-operator-mcp
-      tag: latest
-    port: 8081
-    resources:
-      requests:
-        memory: "64Mi"
-        cpu: "50m"
-      limits:
-        memory: "256Mi"
-        cpu: "500m"
+# Happy Coder AI assistant configuration
+happy:
+  serverUrl: "https://happy.farh.net"
+  webappUrl: "https://happy-coder.farh.net"
+  homeDir: "/config/userdata/.happy"
+  experimental: "true"
+
+# MCP (Model Context Protocol) server sidecars
+mcp:
+  sidecars:
+    # Kubernetes API access
+    kubernetes:
+      enabled: true
+      image:
+        repository: quay.io/containers/kubernetes_mcp_server
+        tag: v0.0.57
+      port: 8080
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "50m"
+        limits:
+          memory: "256Mi"
+          cpu: "500m"
+
+    # Flux GitOps operations
+    flux:
+      enabled: true
+      image:
+        repository: ghcr.io/controlplaneio-fluxcd/flux-operator-mcp
+        tag: v0.41.1
+      port: 8081
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "50m"
+        limits:
+          memory: "256Mi"
+          cpu: "500m"
+
+
+
+    # Home Assistant smart home control
+    homeassistant:
+      enabled: false  # Requires HOMEASSISTANT_URL and HOMEASSISTANT_TOKEN
+      image:
+        repository: ghcr.io/homeassistant-ai/ha-mcp
+        tag: stable
+      port: 8087
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "50m"
+        limits:
+          memory: "256Mi"
+          cpu: "500m"
+
+    # PostgreSQL performance tuning
+    pgtuner:
+      enabled: false  # Requires DATABASE_URI in secrets
+      image:
+        repository: dog830228/pgtuner_mcp
+        tag: latest
+      port: 8085
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "50m"
+        limits:
+          memory: "256Mi"
+          cpu: "500m"
+
+    # Browser automation and web testing
+    playwright:
+      enabled: true
+      image:
+        repository: mcr.microsoft.com/playwright/mcp
+        tag: latest
+      port: 8086
+      resources:
+        requests:
+          memory: "128Mi"
+          cpu: "100m"
+        limits:
+          memory: "512Mi"
+          cpu: "1000m"
+
+# =============================================================================
+# SMART DEFAULTS & AUTO-DETECTION
+# =============================================================================
+
+# Environment auto-detection based on name patterns
+# Automatically adjusts defaults for dev/test/prod/team environments
+autoDetect:
+  environment: true       # Auto-detect dev/prod/team from name
+  storageClass: true      # Auto-detect ReadWriteMany storage class
+  resources: true         # Auto-size resources based on enabled features
+
+# Resource profiles (auto-selected based on environment and features)
+# Override specific values above to customize
+resourceProfile: auto    # auto | small | medium | large | xlarge
+
+# =============================================================================
+# ADVANCED CONFIGURATION
+# =============================================================================
+
+# Custom env secret name (defaults to: devcontainer-{name}-secrets-env)
+envSecretName: ""
@@ -2,19 +2,29 @@

 ## Key Architecture Facts
 - Image: `ghcr.io/cpfarhood/devcontainer:latest` (repo name is `devcontainer`, not `antigravity`)
- `imagePullPolicy: Always` in statefulset (set during initial deployment debugging)
+- Deployed via Helm chart (`chart/`), not kustomize anymore
 - Service must NOT be headless (`clusterIP: None`) — Cilium gateway can't route to headless services
 - `SECURE_CONNECTION=0` — TLS is terminated at the gateway, not the app
 - Container user is `user` (UID 1000) — baseimage-gui runs startapp.sh as `app` user, sudo is not available
- HTTPRoute is managed by Authentik outpost, not in kustomization

-## Cluster Patterns
- External gateway: `external` in `gateway-system`, handles `*.farh.net` on port 443 HTTPS only
- Hostnames must be exactly `*.farh.net` (not `*.subdomain.farh.net`) to match gateway listener
- Authentik outpost Terraform lives in `../kubernetes/terraform/authentik-*-proxy/`
- Outpost config uses `external` gateway for public apps, `internal` for internal apps
+## Deployment Method
+- **Primary**: Helm chart in `chart/` directory
+- **Makefile targets**: `helm-deploy`, `helm-delete`, `helm-logs`, `helm-shell`, `helm-port-forward`
+- **Old kustomize** (`k8s/` directory) has been removed — all deployments use Helm now
+- Chart published as OCI artifact to GHCR, reconciled by Flux
+
+## MCP Sidecars
+- **Kubernetes MCP** (v0.0.57, port 8080): Only deployed when enabled AND `clusterAccess` != `none`
+- **Flux MCP** (v0.41.1, port 8081): Only deployed when enabled AND `clusterAccess` != `none`
+- **Home Assistant MCP** (6.7.1, port 8087): Disabled by default, requires secrets:
+  - `homeassistant-url`: Base URL like `http://homeassistant.local:8123`
+  - `homeassistant-token`: Long-lived access token
+- **Playwright MCP**: External service, not a sidecar
+- Configure via `mcpSidecars.<name>.enabled` in values
+- **Version Strategy**: All MCP images use pinned versions for stability (no `latest` tags)

 ## Common Gotchas
 - `baseimage-gui` creates user dynamically — don't hardcode usernames in scripts, use numeric UID/GID
 - `chown /home` fails (PVC root not owned by container) — only chown subdirectories
 - `sudo` not available in startapp.sh — script already runs as correct user
+- MCP sidecars need appropriate secrets and RBAC permissions to function
@@ -1,9 +1,65 @@
 #!/bin/bash
-# Initialize repository and start Happy Coder
+# Initialize repository
 set -e

 echo "=== Repository Initialization ==="

+# Set up basic git configuration
+echo "Configuring git user settings..."
+# Use environment variables if provided, otherwise use defaults
+GIT_USER_NAME="${GIT_USER_NAME:-DevContainer User}"
+GIT_USER_EMAIL="${GIT_USER_EMAIL:-devcontainer@example.com}"
+
+git config --global user.name "$GIT_USER_NAME"
+git config --global user.email "$GIT_USER_EMAIL"
+
+# Set up git credentials early if GITHUB_TOKEN is provided
+# This ensures all git operations have proper authentication
+if [ -n "$GITHUB_TOKEN" ]; then
+    echo "Setting up git credentials..."
+    # Configure git to use credential store globally
+    git config --global credential.helper store
+
+    # Create or update the credentials file
+    CREDENTIALS_FILE="/config/userdata/.git-credentials"
+
+    # Support multiple git hosting providers
+    # GitHub supports both oauth2 and token as username
+    echo "https://oauth2:${GITHUB_TOKEN}@github.com" > "$CREDENTIALS_FILE"
+    echo "https://${GITHUB_TOKEN}:x-oauth-basic@github.com" >> "$CREDENTIALS_FILE"
+    echo "https://token:${GITHUB_TOKEN}@github.com" >> "$CREDENTIALS_FILE"
+
+    # GitLab format (if same token works)
+    if [ -n "$GITLAB_HOST" ]; then
+        echo "https://oauth2:${GITHUB_TOKEN}@${GITLAB_HOST}" >> "$CREDENTIALS_FILE"
+    fi
+
+    chmod 600 "$CREDENTIALS_FILE"
+
+    # Also create a symlink in the home directory if it doesn't exist
+    # This handles cases where git might look in different locations
+    if [ ! -f "$HOME/.git-credentials" ] && [ "$HOME" != "/config/userdata" ]; then
+        ln -sf "$CREDENTIALS_FILE" "$HOME/.git-credentials"
+    fi
+
+    echo "Git credentials configured"
+else
+    # Even without a token, ensure git has a proper credential helper configured
+    # This prevents errors when credentials are added later
+    echo "No GITHUB_TOKEN provided, configuring basic git settings..."
+    git config --global credential.helper store
+
+    # Create an empty credentials file with proper permissions
+    CREDENTIALS_FILE="/config/userdata/.git-credentials"
+    touch "$CREDENTIALS_FILE"
+    chmod 600 "$CREDENTIALS_FILE"
+
+    # Create symlink if needed
+    if [ ! -f "$HOME/.git-credentials" ] && [ "$HOME" != "/config/userdata" ]; then
+        ln -sf "$CREDENTIALS_FILE" "$HOME/.git-credentials"
+    fi
+fi
+
 # Check if GITHUB_REPO is set
 if [ -z "$GITHUB_REPO" ]; then
    echo "GITHUB_REPO not set, skipping repository clone"
@@ -21,14 +77,6 @@ else
    if [ -d "$WORKSPACE_DIR/.git" ]; then
        echo "Repository already exists, pulling latest changes..."
        cd "$WORKSPACE_DIR"
-
-        # Configure git to use token if provided
-        if [ -n "$GITHUB_TOKEN" ]; then
-            git config credential.helper store
-            echo "https://oauth2:${GITHUB_TOKEN}@github.com" > /config/userdata/.git-credentials
-            chmod 600 /config/userdata/.git-credentials
-        fi
-
        git pull || echo "Pull failed, continuing anyway..."
    else
        echo "Cloning repository..."
@@ -39,11 +87,6 @@ else
            # Replace https://github.com/ with https://oauth2:token@github.com/
            CLONE_URL=$(echo "$GITHUB_REPO" | sed "s|https://github.com/|https://oauth2:${GITHUB_TOKEN}@github.com/|")
            git clone "$CLONE_URL" "$WORKSPACE_DIR"
-
-            # Configure credentials for future use
-            git config --global credential.helper store
-            echo "https://oauth2:${GITHUB_TOKEN}@github.com" > /config/userdata/.git-credentials
-            chmod 600 /config/userdata/.git-credentials
        else
            git clone "$GITHUB_REPO" "$WORKSPACE_DIR"
        fi
@@ -59,18 +102,6 @@ chown -R "$RUN_UID:$RUN_GID" "$WORKSPACE_DIR"
 mkdir -p "$HOME"
 chown "$RUN_UID:$RUN_GID" "$HOME"

-# Start Happy Coder daemon. startapp.sh already runs as the app user (UID 1000),
-# so no sudo needed — Happy/Claude Code will find credentials in the correct home dir.
-echo "Starting Happy Coder..."
-
-# Remove stale lock file. HAPPY_HOME_DIR lives on the home PVC so it survives
-# pod restarts — without this cleanup the daemon refuses to start after a crash.
-rm -f "${HAPPY_HOME_DIR:-$HOME/.happy}/daemon.state.json.lock"
-
-cd "$WORKSPACE_DIR"
-happy daemon start || echo "Happy Coder daemon failed to start, continuing anyway..."
-
-echo "Happy Coder daemon started"

 # Export workspace directory for startapp.sh
 echo "$WORKSPACE_DIR" > /tmp/workspace-dir
@@ -2,9 +2,9 @@
 # Start application script for baseimage-gui
 set -e

-echo "=== Starting Antigravity Dev Container ==="
+echo "=== Starting Dev Container ==="

-# Initialize repository and Happy Coder
+# Initialize repository
 /usr/local/bin/init-repo

 # Get workspace directory
@@ -0,0 +1,46 @@
+#!/bin/bash
+# Test script to verify git credentials configuration
+
+set -e
+
+echo "=== Git Credentials Test ==="
+
+# Check git configuration
+echo "1. Git user configuration:"
+git config --global user.name || echo "  ❌ user.name not set"
+git config --global user.email || echo "  ❌ user.email not set"
+
+echo ""
+echo "2. Git credential helper:"
+git config --global credential.helper || echo "  ❌ credential.helper not set"
+
+echo ""
+echo "3. Credentials file locations:"
+CREDENTIALS_FILE="/config/userdata/.git-credentials"
+if [ -f "$CREDENTIALS_FILE" ]; then
+    echo "  ✓ $CREDENTIALS_FILE exists"
+    echo "  Permissions: $(stat -c %a $CREDENTIALS_FILE)"
+    echo "  Lines in file: $(wc -l < $CREDENTIALS_FILE)"
+else
+    echo "  ❌ $CREDENTIALS_FILE does not exist"
+fi
+
+if [ -f "$HOME/.git-credentials" ]; then
+    if [ -L "$HOME/.git-credentials" ]; then
+        echo "  ✓ $HOME/.git-credentials is a symlink to $(readlink -f $HOME/.git-credentials)"
+    else
+        echo "  ✓ $HOME/.git-credentials exists (not a symlink)"
+    fi
+else
+    echo "  ❌ $HOME/.git-credentials does not exist"
+fi
+
+echo ""
+echo "4. Environment check:"
+echo "  HOME=$HOME"
+echo "  GITHUB_TOKEN=${GITHUB_TOKEN:+[SET]}"
+echo "  GIT_USER_NAME=${GIT_USER_NAME:-[NOT SET]}"
+echo "  GIT_USER_EMAIL=${GIT_USER_EMAIL:-[NOT SET]}"
+
+echo ""
+echo "=== Test Complete ==="