> For the complete documentation index, see [llms.txt](https://docs.wproofreader.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wproofreader.com/v6.18.1/deployment/installation/kubernetes/install-wproofreader-server.md).

# Install WProofreader Server

Install WProofreader Server with Helm and create its service database with db-manager.

On this page, you install WProofreader Server with the [wproofreader-helm](https://github.com/WebSpellChecker/wproofreader-helm) chart. During the install, db-manager creates the `cloud_service` database and two MySQL users:

* `appserver` for WProofreader Server.
* `app_service` for Admin-panel.

Before you start, load the settings in your terminal:

```bash
cd ~/wproofreader-k8s
source wsc-stack.env
```

{% stepper %}
{% step %}

#### Create the database Secret

The Secret contains the MySQL administrator password for db-manager and the passwords of the two new users.

```bash
kubectl -n wsc create secret generic wproofreader-db \
  --from-literal=root-password="${MYSQL_ADMIN_PASSWORD}" \
  --from-literal=appserver-password="${APPSERVER_DB_PASSWORD}" \
  --from-literal=admin-panel-password="${SERVICE_DB_PASSWORD}"

kubectl -n wsc describe secret wproofreader-db
```

The output lists `root-password`, `appserver-password`, and `admin-panel-password`. It does not show their values.

{% hint style="info" %}
For production, create this Secret and the license Secret with your secret-management system. See [Prerequisites](/v6.18.1/deployment/installation/kubernetes/prerequisites.md#create-the-settings-file).
{% endhint %}
{% endstep %}

{% step %}

#### Create the license Secret

```bash
kubectl -n wsc create secret generic wproofreader-license \
  --from-literal=license="${WPR_LICENSE_TICKET_ID}"
```

{% endstep %}

{% step %}

#### Create the values file

This command creates `wproofreader-values.yaml` with the MySQL host and the names of the two Secrets.

```bash
cat > wproofreader-values.yaml <<EOF
licenseExistingSecret: wproofreader-license
database:
  enabled: true
  host: ${MYSQL_HOST}
  existingSecret: wproofreader-db
databaseProvisioning:
  enabled: true
  rootUser: ${MYSQL_ADMIN_USER}
EOF
```

{% endstep %}

{% step %}

#### Use your own WProofreader Server image

By default, the chart uses the public `webspellchecker/wproofreader` image from Docker Hub. This image is for evaluation only. It has four English languages (`en_US`, `en_GB`, `en_CA`, and `en_AU`), and you cannot add languages or AI models to it. See [Run the image from Docker Hub](/v6.18.1/deployment/installation/docker/run-the-image-from-docker-hub.md).

For production, build your own WProofreader Server image and push it to your container registry. To build the image, see [Build using Dockerfile](/v6.18.1/deployment/installation/docker/build-using-dockerfile.md) or [Build using prebuilt configuration](/v6.18.1/deployment/installation/docker/build-using-prebuilt-configuration.md).

If your registry requires authentication, create a Secret with the registry credentials. Replace `<registry_host>`, `<user>`, and `<password>`:

```bash
kubectl -n wsc create secret docker-registry wproofreader-registry \
  --docker-server='<registry_host>' \
  --docker-username='<user>' \
  --docker-password='<password>'
```

The command shows `secret/wproofreader-registry created`.

Add the image settings to the values file. Replace `<registry_host>/<repository>` with the image name without the tag, and `<tag>` with the image tag:

```bash
cat >> wproofreader-values.yaml <<'EOF'
image:
  repository: <registry_host>/<repository>
  tag: "<tag>"
imagePullSecrets:
  - name: wproofreader-registry
EOF
```

If your registry does not require authentication, remove the two `imagePullSecrets` lines.

db-manager must have the same version as WProofreader Server. The chart takes the db-manager image tag from the chart `appVersion`, not from `image.tag`. If your WProofreader Server version is not the `appVersion` in `wproofreader-helm/wproofreader/Chart.yaml`, add the db-manager tag under `databaseProvisioning` in `wproofreader-values.yaml`. Replace `<wproofreader_version>` with the version of your WProofreader Server image, for example `6.18.1.0`:

```yaml
databaseProvisioning:
  enabled: true
  rootUser: root
  image:
    tag: "<wproofreader_version>"
```

The db-manager image comes from Docker Hub. If the cluster cannot get images from Docker Hub, copy `webspellchecker/db-manager:<wproofreader_version>` to your registry and add `repository: <registry_host>/<db_manager_repository>` under `databaseProvisioning.image`. The db-manager Job uses the same `imagePullSecrets`.

For later upgrades, update both image tags as described in [Upgrade the stack](/v6.18.1/deployment/installation/kubernetes/upgrade-and-uninstall.md#upgrade-the-stack).

{% hint style="info" %}
For an evaluation, you can skip this step and use the image from Docker Hub.
{% endhint %}
{% endstep %}

{% step %}

#### Configure MySQL TLS

Skip this step if the MySQL server accepts connections without TLS. The MySQL server that you can install with this guide does not require TLS.

If an existing MySQL server requires TLS, add the `tls` settings under `databaseProvisioning` in `wproofreader-values.yaml`.

Use this configuration to encrypt the connection without certificate verification:

```yaml
databaseProvisioning:
  enabled: true
  rootUser: root
  tls:
    mode: required
```

Replace `root` if `MYSQL_ADMIN_USER` has a different value.

To verify the MySQL server certificate and host name, first create a Secret with the certificate authority (CA) certificate. Replace `mysql-ca.pem` with the path to the CA certificate:

```bash
kubectl -n wsc create secret generic wproofreader-mysql-ca \
  --from-file=ca.crt=mysql-ca.pem
```

The command shows `secret/wproofreader-mysql-ca created`.

Then use this configuration:

```yaml
databaseProvisioning:
  enabled: true
  rootUser: root
  tls:
    mode: verify-identity
    caSecret: wproofreader-mysql-ca
    caSecretKey: ca.crt
```

Use `mode: verify-ca` instead of `mode: verify-identity` if the certificate does not contain the MySQL host name. This mode verifies the certificate authority, but it does not verify the host name.
{% endstep %}

{% step %}

#### Install WProofreader Server

```bash
helm upgrade --install wproofreader-app ./wproofreader-helm/wproofreader \
  --namespace wsc \
  --values wproofreader-values.yaml \
  --timeout 15m
```

The command first runs db-manager. Then it shows `STATUS: deployed`.

Wait until WProofreader Server is ready:

```bash
kubectl -n wsc rollout status deployment/wproofreader-app --timeout=15m
```

The rollout command shows `successfully rolled out`.

Check the database provisioning Job:

```bash
kubectl -n wsc get job wproofreader-app-db-provision
```

The `COMPLETIONS` column shows `1/1`.

{% hint style="info" %}
The first start can take some minutes. The cluster must download the WProofreader Server image, and WProofreader Server must activate the license.
{% endhint %}
{% endstep %}

{% step %}

#### Check the version and license

```bash
kubectl -n wsc run wproofreader-version-check \
  --rm --attach --restart=Never --image=curlimages/curl:8.22.0 \
  -- curl --fail --show-error --silent \
  'http://wproofreader-app.wsc.svc.cluster.local/wscservice/api?cmd=ver'

kubectl -n wsc run wproofreader-license-check \
  --rm --attach --restart=Never --image=curlimages/curl:8.22.0 \
  -- curl --fail --show-error --silent \
  'http://wproofreader-app.wsc.svc.cluster.local/wscservice/api?cmd=license_status'
```

The first response contains `"ProgramVersion"` and the version installed in your WProofreader Server image. The second response contains `"valid":true`.

`kubectl` can show Pod messages before each response. You can ignore these messages.

{% hint style="warning" %}
Do not continue until the license is valid. Admin-panel blocks most operations when the license is not valid. For the reasons, see [License status](/v6.18.1/api-reference/auxiliary-api-commands/license-status.md) and [License verification](/v6.18.1/deployment/licensing/license-verification.md).
{% endhint %}
{% endstep %}
{% endstepper %}

### If db-manager fails

The install stops when db-manager cannot create the database. Read the db-manager log:

```bash
kubectl -n wsc logs job/wproofreader-app-db-provision
```

Common causes are an incorrect MySQL host, an incorrect administrator password, or an administrator account without permission to create databases and users.

To correct the problem:

1. Correct the value in `wsc-stack.env`.
2. Load the settings. Then delete the Secrets from this page:

```bash
source wsc-stack.env
kubectl -n wsc delete secret wproofreader-db wproofreader-license
```

3. Do the steps on this page again, from the first step.

### Next step

[Install Admin-panel](/v6.18.1/deployment/installation/kubernetes/install-admin-panel.md)