Merge pull request #143 from kerberos-io/public-release-1786904956

A new public release - 1786904956
Merge pull request #147 from kerberos-io/detection-source-flags
2026-08-23 15:18:33 +00:00 · 2026-08-21 17:36:29 +02:00 · 2026-08-21 17:32:59 +02:00 · 2026-08-21 17:29:48 +02:00 · 2026-08-21 17:28:25 +02:00 · 2026-08-20 22:10:48 +02:00
25 changed files with 506 additions and 287 deletions
--- a/charts/hub/Chart.yaml
+++ b/charts/hub/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.121.0
+version: 0.130.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/charts/hub/README.md
+++ b/charts/hub/README.md
@@ -53,6 +53,11 @@ Below all configuration options and parameters are listed.
 | `mongodb.password` | MongoDB user password, by default `'yourmongodbpassword'` | `"yourpassword"` |
 | `mongodb.retryWrites` | Enable or disable MongoDB retryable writes. | `"true"` |
 | `mongodb.flavor` | Backend engine flavor: `"mongodb"` (native MongoDB / Atlas) or `"documentdb"` (AWS DocumentDB). The `documentdb` flavor disables features DocumentDB does not support (geospatial queries/indexes, complex `$lookup` pipelines). When set to `documentdb`, also set `mongodb.retryWrites: "false"`. | `"mongodb"` |
+| `mongodb.tls.enabled` | Enable TLS for MongoDB connections. When `mongodb.uri` is set, the chart appends missing `tls=true` and `tlsCAFile` query parameters. | `false` |
+| `mongodb.tls.existingSecret` | Existing Kubernetes Secret containing the MongoDB CA bundle. The Secret is mounted into every workload that consumes `mongodb-config`. | `""` |
+| `mongodb.tls.caFileName` | Key and filename of the CA bundle in `mongodb.tls.existingSecret` (for AWS DocumentDB, typically `global-bundle.pem`). | `""` |
+| `mongodb.tls.mountPath` | Read-only directory where the MongoDB CA Secret is mounted. | `"/etc/mongodb/tls"` |
+| `mongodb.tls.insecureSkipVerify` | Skip MongoDB certificate and hostname verification. This is insecure and intended only for local testing. | `false` |
 | `mqtt.host` | MQTT (Vernemq) hostname. | `"mqtt.yourdomain.com"` |
 | `mqtt.port` | MQTT (Vernemq) port for WSS (secure sockets), by default `'8443'`. | `"8443"` |
 | `mqtt.protocol` | MQTT (Vernemq) protocol, by default `'wss'`. | `"wss"` |
@@ -197,14 +202,28 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.caseFilterAssigneesDefault` | Default assignee filter behavior for cases in the frontend. | `"false"` |
 | `kerberoshub.frontend.features.case.enabled` | Enable or disable the case feature in the frontend. | `"true"` |
 | `kerberoshub.frontend.features.darkModeEnabled` | Enable or disable dark mode in the frontend. | `"true"` |
+| `kerberoshub.frontend.features.splashScreen.enabled` | Enable or disable the pre-bootstrap splash screen and reveal delay. | `"true"` |
 | `kerberoshub.frontend.features.landingPage` | Frontend landing page configuration. | `"/dashboard"` |
 | `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
 | `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
 | `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
+| `kerberoshub.frontend.features.organisations.enabled` | Enable or disable all organisation feature flags. When empty, the child settings apply independently. | `""` |
+| `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
+| `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
+| `kerberoshub.frontend.features.organisations.settingsEnabled` | Enable or disable the organisation identity link to organisation settings. | `"false"` |
+| `kerberoshub.frontend.features.projects.enabled` | Enable or disable all project feature flags. When empty, the child settings apply independently. | `""` |
+| `kerberoshub.frontend.features.projects.switcherEnabled` | Enable or disable the read-only project dropdown. | `"false"` |
+| `kerberoshub.frontend.features.projects.creationEnabled` | Reserved for the project creation UI. | `"false"` |
+| `kerberoshub.frontend.features.projects.settingsEnabled` | Reserved for the project settings UI. | `"false"` |
 | `kerberoshub.frontend.features.map.tileUrlLight` | Tile URL used by the map in light mode. | `"https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png"` |
 | `kerberoshub.frontend.features.map.tileUrlDark` | Tile URL used by the map in dark mode. | `"https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png"` |
 | `kerberoshub.frontend.features.map.attribution` | Attribution text displayed on the map tiles. | `"&copy; <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>"` |
 | `kerberoshub.frontend.features.liveview.defaultStreamMode` | Liveview behavior setting: `defaultStreamMode`. | `"SD"` |
+| `kerberoshub.frontend.features.liveview.liveStreamMode` | Transport backing LIVE mode: `webrtc`, `hls`, or `moq`. | `"webrtc"` |
+| `kerberoshub.frontend.features.liveview.hlsEnabled` | Offer HLS as a selectable LIVE transport. | `"true"` |
+| `kerberoshub.frontend.features.liveview.moqEnabled` | Offer MoQ as a selectable LIVE transport. | `"false"` |
+| `kerberoshub.frontend.features.liveview.moqRelayUrl` | WebTransport URL of the MoQ relay. | `"https://relay.uug.ai/anon"` |
+| `kerberoshub.frontend.features.liveview.moqBroadcastPrefix` | Prefix used to build MoQ broadcast names. | `"devices"` |
 | `kerberoshub.frontend.features.liveview.paginationMode` | Liveview behavior setting: `paginationMode` (`scroll`, `numbered` or `maxStreams`). | `"scroll"` |
 | `kerberoshub.frontend.features.liveview.pageSize` | Liveview behavior setting: `pageSize` (max streams shown per page in `numbered` mode). | `"6"` |
 | `kerberoshub.frontend.features.liveview.maxStreams` | Liveview behavior setting: `maxStreams`. | `"-1"` |
@@ -240,6 +259,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing` | Color customization for `floorplan` in the frontend. | `"hsla(204, 100%, 50%, 1)"` |
 | `kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete` | Color customization for `floorplan` in the frontend. | `"hsla(219, 100%, 94%, 1)"` |
 | `kerberoshub.frontend.features.faceRedaction.enabled` | Enable or disable `kerberoshub.frontend.features.faceRedaction`. | `"false"` |
+| `kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled` | Make classifier-generated tracks available in the redaction modal. | `"true"` |
 | `kerberoshub.support.enabled` | Enable or disable in-app support features. | `false` |
 | `kerberoshub.oauth2Proxy.enabled` | Enable or disable `kerberoshub.oauth2Proxy`. | `false` |
 | `kerberoshub.oauth2Proxy.github.clientId` | Client ID used by `kerberoshub.oauth2Proxy.github`. | `"github-client-id"` |
@@ -283,7 +303,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
 | `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
 | `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
-| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. | `1` |
+| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
 | `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
@@ -291,7 +311,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
 | `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
 | `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
-| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. | `1` |
+| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. Set to `0` to disable. | `0` |
 | `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
 | `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
 | `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
@@ -390,15 +410,6 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.export.logLevel` | Log verbosity level for `kerberospipeline.export`. | `"info"` |
 | `kerberospipeline.export.resources.requests.memory` | Memory request for `kerberospipeline.export`. | `"10Mi"` |
 | `kerberospipeline.export.resources.requests.cpu` | CPU request for `kerberospipeline.export`. | `"10m"` |
-| `kerberospipeline.redaction.repository` | Container image repository for `kerberospipeline.redaction`. | `"ghcr.io/uug-ai/hub-pipeline-redaction"` |
-| `kerberospipeline.redaction.pullPolicy` | Image pull policy for `kerberospipeline.redaction`. | `"IfNotPresent"` |
-| `kerberospipeline.redaction.tag` | Container image tag/version for `kerberospipeline.redaction`. | `"v1.0.0"` |
-| `kerberospipeline.redaction.replicas` | Number of replicas for `kerberospipeline.redaction`. | `2` |
-| `kerberospipeline.redaction.logLevel` | Log verbosity level for `kerberospipeline.redaction`. | `"info"` |
-| `kerberospipeline.redaction.resources.requests.memory` | Memory request for `kerberospipeline.redaction`. | `"512Mi"` |
-| `kerberospipeline.redaction.resources.requests.cpu` | CPU request for `kerberospipeline.redaction`. | `"500m"` |
-| `kerberospipeline.redaction.resources.limits.memory` | Memory limit for `kerberospipeline.redaction`. | `"2Gi"` |
-| `kerberospipeline.redaction.resources.limits.cpu` | CPU limit for `kerberospipeline.redaction`. | `"1000m"` |
 | `email.provider` | The email service provider for sending out messages over email , use `'mailgun'` or `'smtp'`. | `"mailgun"` |
 | `email.from` | The email address that is sending messages in name of, by default `'support@yourdomain.com'`. | `"support@yourdomain.com"` |
 | `email.displayName` | The display name that is sending messages in name of, by default `'yourdomain.com'` | `"yourdomain.com"` |
@@ -487,6 +498,7 @@ Following indexes should be executed on the MongoDB database (Kerberos) to impro
 #### Analysis collection

    db.getCollection("analysis").createIndex({start:1})
+    db.getCollection("analysis").createIndex({organisationId:1, projectId:1, key:1}, {name:"analysis_org_project_key"})
    db.getCollection("analysis").createIndex({userid:1, key:1})
    db.getCollection("analysis").createIndex({userid:1, start:1})

--- a/charts/hub/custom-layout/i18n/en.json
+++ b/charts/hub/custom-layout/i18n/en.json
@@ -366,7 +366,8 @@
        "deleteCase": "Delete case",
        "download": "Download",
        "delete": "Delete",
-        "openDetail": "Open detail"
+        "openDetail": "Open detail",
+        "runWorkflow": "Run workflow"
      },
      "exportSelection": {
        "title": "Export selection",
@@ -378,6 +379,16 @@
        "emptyAttachments": "This case has no attachments yet.",
        "attachmentsHeading": "Attachments"
      },
+      "runWorkflow": {
+        "title": "Run workflow",
+        "subtitle": "Launch a workflow over selected media on this case.",
+        "workflowLabel": "Workflow",
+        "loading": "Loading workflows…",
+        "noWorkflows": "No workflows are available to run on cases.",
+        "attachmentsSelected": "attachments selected",
+        "attachmentBadge": "Attachment",
+        "submit": "Run workflow"
+      },
      "filter": {
        "assignees": "Assignees",
        "labels": "Labels",
@@ -1614,7 +1625,8 @@
          "k10": "or use the upload button below",
          "k11": "Delete attachment",
          "k12": "Are you sure you want to delete this attachment? This action cannot be undone.",
-          "k13": "Yes, delete"
+          "k13": "Yes, delete",
+          "k14": "Redact faces"
        }
      },
      "media": {
@@ -1690,7 +1702,9 @@
                  "k14": "fps",
                  "k15": "Detection run",
                  "k16": "Select a detection run",
-                  "k17": "No detections"
+                  "k17": "No detections",
+                  "k18": "Automatic tracks unavailable",
+                  "k19": "Automatic face tracks are disabled. You can still draw redaction boxes manually on the player and submit."
                }
              },
              "motionmap": {
--- a/charts/hub/templates/_helpers.tpl
+++ b/charts/hub/templates/_helpers.tpl
@@ -0,0 +1,48 @@
+{{/* Build the path to the configured MongoDB CA bundle. */}}
+{{- define "hub.mongodb.tlsCAFile" -}}
+{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
+{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
+{{- define "hub.mongodb.uri" -}}
+{{- $uri := .Values.mongodb.uri | default "" -}}
+{{- if and .Values.mongodb.tls.enabled $uri -}}
+  {{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
+    {{- $separator := "?" -}}
+    {{- if contains "?" $uri -}}
+      {{- $separator = "&" -}}
+    {{- end -}}
+    {{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stls=true" $uri $separator -}}
+  {{- end -}}
+  {{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
+  {{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
+    {{- $separator := "&" -}}
+    {{- if not (contains "?" $uri) -}}
+      {{- $separator = "?" -}}
+    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
+  {{- end -}}
+{{- end -}}
+{{- $uri -}}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA Secret volume. */}}
+{{- define "hub.mongodb.tlsVolume" -}}
+- name: mongodb-tls
+  secret:
+    secretName: {{ .Values.mongodb.tls.existingSecret }}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA volume mount. */}}
+{{- define "hub.mongodb.tlsVolumeMount" -}}
+- name: mongodb-tls
+  mountPath: {{ .Values.mongodb.tls.mountPath }}
+  readOnly: true
+{{- end -}}
--- a/charts/hub/templates/configmap-mongodb.yaml
+++ b/charts/hub/templates/configmap-mongodb.yaml
@@ -4,7 +4,7 @@ metadata:
  name: mongodb-config
  namespace: {{ .Release.Namespace }}
 data:
-  MONGODB_URI: "{{ .Values.mongodb.uri }}"
+  MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
  MONGODB_HOST: "{{ .Values.mongodb.host }}"
  MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
  MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
@@ -12,4 +12,7 @@ data:
  MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
  MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
  MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
+  MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
+  MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
+  MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
  MONGODB_DATABASE_CLOUD: "Kerberos"
--- a/charts/hub/templates/kerberos-hub/hub-api.yaml
+++ b/charts/hub/templates/kerberos-hub/hub-api.yaml
@@ -131,7 +131,8 @@ spec:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
-      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
      {{- with .Values.kerberoshub.api.volumes }}
        {{- toYaml . | nindent 8 }}
@@ -141,6 +142,9 @@ spec:
          secret:
            secretName: {{ $serverTLS.secretName }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
      {{- end }}
      {{- with .Values.kerberoshub.api.topologySpreadConstraints }}
      topologySpreadConstraints:
@@ -157,7 +161,7 @@ spec:
          ports:
            - containerPort: 80
              name: http
-          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) }}
+          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
          volumeMounts:
          {{- with .Values.kerberoshub.api.volumeMounts}}
            {{- toYaml . | nindent 12 }}
@@ -167,6 +171,9 @@ spec:
              mountPath: {{ $serverTLS.mountPath }}
              readOnly: true
          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
          {{- end }}
          # Mongodb - loaded from ConfigMap
          envFrom:
@@ -187,6 +194,23 @@ spec:
              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
            - name: PUBLIC_URL
              value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: REFRESH_COOKIE_SECURE
+              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
+            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
+            {{- with .Values.kerberoshub.frontend.legacyUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- range .Values.kerberoshub.frontend.domains }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
+            {{- end }}
+            - name: CORS_ALLOWED_ORIGINS
+              value: {{ join "," $corsOrigins | quote }}
            {{ if .Values.isPrivate }}
            - name: KERBEROS_PRIVATE_CLOUD
              value: "true"
@@ -259,6 +283,19 @@ spec:
            - name: QUEUE_NAME
              value: "{{ .Values.queueName }}"

+            # Deployment-global workflow definitions (WORKFLOW_DEFINITIONS): the
+            # SAME set the workflows engine consumes, assembled from the enabled
+            # definitions under kerberoshub.workflows.definitions (see
+            # kerberos-pipeline/_workflows-helpers.tpl). hub-api reads these
+            # read-only to surface config workflows alongside the user workflows
+            # it stores in the database; the config workflows are never persisted.
+            - name: WORKFLOW_DEFINITIONS
+              value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+            # Deployment service routing catalog used by API-owned embedded
+            # workflows (for example the one-stage case redaction modal flow).
+            - name: WORKFLOW_STAGE_QUEUES
+              value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
+
            # Stripe for billing
            - name: STRIPE_KEY
              value: "{{ .Values.kerberoshub.api.stripe.privateKey }}"
--- a/charts/hub/templates/kerberos-hub/hub-cleanup.yaml
+++ b/charts/hub/templates/kerberos-hub/hub-cleanup.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberoshub.cleanup.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberoshub.cleanup.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
-          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
+          {{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
          volumeMounts:
+          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
            {{- toYaml . | nindent 12 }}
          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
          envFrom:
            - configMapRef:
                name: mongodb-config
--- a/charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml
+++ b/charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml
@@ -231,6 +231,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
        - name: FEATURE_DARK_MODE
          value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
+        - name: FEATURE_SPLASH_SCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
        - name: FEATURE_LANDING_PAGE
          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"

@@ -245,6 +247,12 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
        - name: FEATURE_HLS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
+        - name: FEATURE_MOQ_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
+        - name: MOQ_RELAY_URL
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
+        - name: MOQ_BROADCAST_PREFIX
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
        - name: FEATURE_LIVEVIEW_PAGE_SIZE
@@ -292,7 +300,9 @@ spec:

        # features > face redaction 
        - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}" 
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
        
        # features > media
        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
@@ -311,7 +321,7 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_CATEGORY_ENABLED
+        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
--- a/charts/hub/templates/kerberos-hub/hub-frontend.yaml
+++ b/charts/hub/templates/kerberos-hub/hub-frontend.yaml
@@ -312,8 +312,26 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
        - name: FEATURE_WORKFLOWS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_ORGANISATIONS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
+        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
+        - name: FEATURE_ORGANISATION_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
+        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_PROJECTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
+        - name: FEATURE_PROJECT_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
+        - name: FEATURE_PROJECT_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
+        - name: FEATURE_PROJECT_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
        - name: FEATURE_DARK_MODE
          value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
+        - name: FEATURE_SPLASH_SCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
        - name: FEATURE_LANDING_PAGE
          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"

@@ -330,6 +348,12 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
        - name: FEATURE_HLS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
+        - name: FEATURE_MOQ_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
+        - name: MOQ_RELAY_URL
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
+        - name: MOQ_BROADCAST_PREFIX
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
        - name: FEATURE_LIVEVIEW_PAGE_SIZE
@@ -394,7 +418,9 @@ spec:

        # features > face redaction 
        - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}" 
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
        
        # features > media
        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
@@ -413,7 +439,7 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_CATEGORY_ENABLED
+        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
--- a/charts/hub/templates/kerberos-hub/hub-monitor-device.yaml
+++ b/charts/hub/templates/kerberos-hub/hub-monitor-device.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberoshub.monitordevice.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberoshub.monitordevice.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
-          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
+          {{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
          volumeMounts:
+          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
            {{- toYaml . | nindent 12 }}
          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
          envFrom:
            - configMapRef:
                name: mongodb-config
--- a/charts/hub/templates/kerberos-hub/hub-reactivate-subscription.yaml
+++ b/charts/hub/templates/kerberos-hub/hub-reactivate-subscription.yaml
@@ -26,10 +26,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberoshub.reactivate.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberoshub.reactivate.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -38,10 +44,15 @@ spec:
        - name: hub-reactivate-subscription
          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
          imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
-          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
+          {{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
          volumeMounts:
+          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
            {{- toYaml . | nindent 12 }}
          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
          envFrom:
            - configMapRef:
                name: mongodb-config
--- a/charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl
+++ b/charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl
@@ -1,15 +1,17 @@
 {{/*
 Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
 JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
-This is the engine's single routing source: several distinct workflows can run
-over one recording — each opens its own run and dispatches only its own stages.
+This is the engine's boot-loaded configuration source and deployment stage
+catalog: several distinct config workflows can run over one recording — each
+opens its own run and dispatches only its own stages. Organisation-scoped
+database workflows are discovered separately at runtime.

 Each enabled definition contributes one workflow object:
  name      the map key (the workflow's human-readable name; also its identity —
            the engine derives a stable id from it when the definition carries
            no explicit id).
  enabled   always true here (a disabled definition is skipped entirely).
-  source    "config" — provenance marking a Helm-seeded, deployment-global,
+  source    "config" — provenance marking a Helm-defined, deployment-global,
            ops-managed workflow (read-only in the API, no owning organisation).
  triggers  how a run OPENS. Defaults to a single bare automatic trigger
            (opens for every recording); narrow with device/schedule triggers.
@@ -46,3 +48,20 @@ Each enabled definition contributes one workflow object:
 {{- end -}}
 {{- $defs | toJson -}}
 {{- end -}}
+
+{{/*
+Expose the deployment's operation→queue catalog to API producers that seed
+embedded WorkflowRuns. Unlike WORKFLOW_DEFINITIONS this includes services that
+are enabled for internal flows but are absent from user-visible workflow
+definitions. The workflows engine remains authoritative for dispatch; producers
+use this only to embed the same queue on a synthetic stage.
+*/}}
+{{- define "kerberoshub.workflows.stageQueues" -}}
+{{- $queues := dict -}}
+{{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
+{{- with $service.queue -}}
+{{- $_ := set $queues $operation . -}}
+{{- end -}}
+{{- end -}}
+{{- $queues | toJson -}}
+{{- end -}}
--- a/charts/hub/templates/kerberos-pipeline/hub-stage.yaml
+++ b/charts/hub/templates/kerberos-pipeline/hub-stage.yaml
@@ -12,6 +12,12 @@
  named "loitering" gets LOITERING_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run
  a worker outside the chart instead, leave services.<name>.enabled unset (or
  false) and point its workflow stage at the queue you publish.
+
+  All stages receive the Vault read credentials (KERBEROS_STORAGE_URI /
+  ACCESS_KEY / SECRET). A stage that also writes an artefact back to Vault (e.g.
+  redaction) declares its destination provider with the named field
+  services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
+  read-only stage omits it and gets no provider env.
 */ -}}
 {{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
 {{- $root := . -}}
@@ -101,6 +107,13 @@ spec:
          value: "{{ $root.Values.kerberosvault.accesskey }}"
        - name: KERBEROS_STORAGE_SECRET
          value: "{{ $root.Values.kerberosvault.secretkey }}"
+        {{- with $svc.storageProvider }}
+        # Destination Vault provider (KERBEROS_STORAGE_PROVIDER) — only stages
+        # that write an artefact back (e.g. redaction) set services.<name>.
+        # storageProvider; read-only stages omit it and get no provider env.
+        - name: KERBEROS_STORAGE_PROVIDER
+          value: {{ . | quote }}
+        {{- end }}

        # Per-stage tuning knobs. Any key/value under services.<name>.env is
        # rendered verbatim as container env, so a worker can be tuned from
@@ -127,6 +140,6 @@ spec:
      protocol: TCP
  selector:
    app: hub-{{ $name }}
-{{- end }}
+{{ end -}}
 {{- end }}
 {{- end }}
--- a/charts/hub/templates/kerberos-pipeline/hub-workflows.yaml
+++ b/charts/hub/templates/kerberos-pipeline/hub-workflows.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberoshub.services.workflows.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberoshub.services.workflows.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
+        {{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        envFrom:
        - configMapRef:
            name: mongodb-config
@@ -62,8 +73,10 @@ spec:
        # named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
        # trigger and executable stages, assembled from the enabled definitions
        # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
-        # Definitions are the engine's single routing source; empty means no
-        # workflows run.
+        # Definitions are the engine's boot-loaded config source and deployment
+        # stage catalog. Organisation-scoped database workflows are read per
+        # recording; an in-cluster engine still requires at least one config
+        # definition so an empty catalog cannot silently drop traffic.
        - name: WORKFLOWS_QUEUE
          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
        - name: WORKFLOW_DEFINITIONS
--- a/charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.analysis.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberospipeline.analysis.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
+        {{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        envFrom:
        - configMapRef:
            name: mongodb-config
--- a/charts/hub/templates/kerberos-pipeline/pipe-event.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-event.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.event.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberospipeline.event.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberospipeline.event.volumeMounts }}
+        {{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberospipeline.event.volumeMounts }}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        ports:
          - containerPort: 8080
        envFrom:
--- a/charts/hub/templates/kerberos-pipeline/pipe-export.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-export.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.export.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberospipeline.export.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberospipeline.export.volumeMounts }}
+        {{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberospipeline.export.volumeMounts }}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        envFrom:
        - configMapRef:
            name: mongodb-config
--- a/charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.monitor.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberospipeline.monitor.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
+        {{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        envFrom:
        - configMapRef:
            name: mongodb-config
--- a/charts/hub/templates/kerberos-pipeline/pipe-notify-test.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-notify-test.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.notifyTest.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberospipeline.notifyTest.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
+        {{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        envFrom:
        - configMapRef:
            name: mongodb-config
--- a/charts/hub/templates/kerberos-pipeline/pipe-notify.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-notify.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.notify.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberospipeline.notify.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberospipeline.notify.volumeMounts}}
+        {{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberospipeline.notify.volumeMounts}}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        envFrom:
        - configMapRef:
            name: mongodb-config
--- a/charts/hub/templates/kerberos-pipeline/pipe-redaction.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-redaction.yaml
@@ -1,116 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pipe-redaction
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberospipeline.redaction.replicas }}
-  selector:
-    matchLabels:
-      app: pipe-redaction
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: pipe-redaction
-    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.redaction.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.redaction.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: pipe-redaction
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.redaction.repository }}:{{ .Values.kerberospipeline.redaction.tag }}"
-        imagePullPolicy: {{ .Values.kerberospipeline.redaction.pullPolicy }}
-        {{- with .Values.kerberospipeline.redaction.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.redaction.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.redaction.logLevel }}"
-        - name: CLOUD_PROVIDER
-          value: "{{ .Values.cloudProvider }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Kafka settings
-        - name: KAFKA_BROKER
-          value: "{{ .Values.kafka.broker }}"
-        - name: KAFKA_USERNAME
-          value: "{{ .Values.kafka.username }}"
-        - name: KAFKA_PASSWORD
-          value: "{{ .Values.kafka.password }}"
-        - name: KAFKA_MECHANISM
-          value: "{{ .Values.kafka.mechanism }}"
-        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
-        # Kerberos Vault (used to download the source media and upload the redacted artifact).
-        - name: KERBEROS_STORAGE_URI
-          value: "{{ .Values.kerberosvault.uri }}"
-        - name: KERBEROS_STORAGE_PROVIDER
-          value: "{{ .Values.kerberosvault.provider }}"
-        - name: KERBEROS_STORAGE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.accesskey }}"
-        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-redaction
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-redaction
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-redaction
-{{- end }}
--- a/charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.sequence.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberospipeline.sequence.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
+        {{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        envFrom:
        - configMapRef:
            name: mongodb-config
--- a/charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml
+++ b/charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml
@@ -29,10 +29,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.throttler.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberospipeline.throttler.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
+        {{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
        volumeMounts:
+        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
          {{- toYaml . | nindent 12 }}
        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
        envFrom:
        - configMapRef:
            name: mongodb-config
--- a/charts/hub/templates/kerberos-vault/vault-forwarder.yaml
+++ b/charts/hub/templates/kerberos-vault/vault-forwarder.yaml
@@ -27,10 +27,16 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberoshub.forwarder.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
+      {{- with .Values.kerberoshub.forwarder.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
      {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
@@ -43,10 +49,15 @@ spec:
            requests:
              memory: 10Mi
              cpu: 10m
-          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
+          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
          volumeMounts:
+          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
            {{- toYaml . | nindent 12 }}
          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
          envFrom:
          - configMapRef:
              name: mongodb-config
--- a/charts/hub/values.yaml
+++ b/charts/hub/values.yaml
@@ -60,6 +60,15 @@ mongodb:
  # and indexes, complex $lookup pipelines, etc.). When using DocumentDB you
  # should also set retryWrites: "false".
  flavor: "mongodb"
+  # TLS for MongoDB-compatible backends. When uri is set, missing TLS query
+  # parameters are appended automatically. AWS DocumentDB requires TLS and a
+  # trusted RDS CA bundle, typically stored in an existing Kubernetes Secret.
+  tls:
+    enabled: false
+    existingSecret: ""
+    caFileName: ""
+    mountPath: "/etc/mongodb/tls"
+    insecureSkipVerify: false
 ###################################################
 # MQTT configuration (bi-directional communication)
 ###################################################
@@ -231,7 +240,7 @@ kerberoshub:
  api:
    repository: ghcr.io/uug-ai/hub-api
    pullPolicy: IfNotPresent
-    tag: "v1.9.29"
+    tag: "v1.9.51"
    replicas: 2
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Set to false to skip rendering the hub-api Service (e.g. when an
@@ -344,7 +353,7 @@ kerberoshub:
  frontend:
    repository: ghcr.io/uug-ai/hub-frontend
    pullPolicy: IfNotPresent
-    tag: "v1.9.32"
+    tag: "v1.13.9"
    replicas: 2
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Set to false to skip rendering the hub-frontend Service (e.g. when an
@@ -453,6 +462,8 @@ kerberoshub:
    features:
      # General
      darkModeEnabled: "true" # Enable or disable dark mode toggle 'true' or 'false'
+      splashScreen:
+        enabled: "true" # Enable or disable the pre-bootstrap splash screen 'true' or 'false'
      landingPage: "/dashboard" # Landing page after login '/dashboard', '/liveview', '/media', '/devices', '/sites', '/groups'
      # Internationalization (i18n): controls the runtime language behaviour
      # of the front-end. When `enabled` is "false" the language switcher is
@@ -466,6 +477,17 @@ kerberoshub:
      # Workflows allow you to define automated processes and actions in the front-end.
      workflows:
        enabled: "false" # Enable or disable workflows feature 'true' or 'false'
+      # Organisation controls remain visible as a read-only current organisation when switching is disabled.
+      organisations:
+        enabled: "" # Enable or disable all organisation feature flags; when empty, the child settings apply independently
+        switcherEnabled: "false" # Enable or disable organisation switching 'true' or 'false'
+        creationEnabled: "false" # Enable or disable organisation creation; requires switcherEnabled 'true' or 'false'
+        settingsEnabled: "false" # Enable or disable the organisation settings link 'true' or 'false'
+      projects:
+        enabled: "" # Enable or disable all project feature flags; when empty, the child settings apply independently
+        switcherEnabled: "false" # Enable or disable the read-only project dropdown 'true' or 'false'
+        creationEnabled: "false" # Reserved for project creation UI 'true' or 'false'
+        settingsEnabled: "false" # Reserved for project settings UI 'true' or 'false'
      # Map tile configuration  
      map:
        tileUrlLight: "https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png" # Map tile URL for light mode
@@ -474,8 +496,11 @@ kerberoshub:
      # Live view page
      liveview:
        defaultStreamMode: "SD" # Default stream mode 'SD' or 'HD' (will be migrated to 'preview' or 'live')
-        liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode 'webrtc' (default) or 'hls' (firewall-friendly, no TURN required)
+        liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode: 'webrtc' (default), 'hls' or 'moq'
        hlsEnabled: "true" # Offer HLS as a selectable LIVE transport 'true' or 'false'. When 'false' the HLS option is removed from the front-end and streams use webrtc
+        moqEnabled: "false" # Offer MoQ as a selectable LIVE transport 'true' or 'false'
+        moqRelayUrl: "https://relay.uug.ai/anon" # WebTransport URL of the MoQ relay
+        moqBroadcastPrefix: "devices" # Prefix used to build devices/<deviceKey>/live.hang broadcast names
        paginationMode: "scroll" # Pagination mode in live view 'scroll', 'numbered' or 'maxStreams'
        pageSize: "6" # Max streams shown per page when paginationMode is 'numbered' (4, 8, 12, 16 or 25)
        maxStreams: "-1" # Maximum number of live streams to show in live view, -1 for unlimited
@@ -539,6 +564,7 @@ kerberoshub:
      # Face redaction feature
      faceRedaction:
        enabled: "false" # Enable or disable face redaction 'true' or 'false'
+        classifierTracksEnabled: "true" # Make classifier-generated tracks available in the redaction modal
    # Optional integrations
    mixpanel: # We can keep track logging in Mixpanel as well
      apikey: "xxx"
@@ -574,7 +600,7 @@ kerberoshub:
  cleanup:
    repository: ghcr.io/uug-ai/hub-cleanup
    pullPolicy: IfNotPresent
-    tag: "v1.4.16"
+    tag: "v1.4.19"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -633,16 +659,18 @@ kerberoshub:
    # -----------------------------------------------------------------------
    # Global workflow definitions — the named workflows the engine runs.
    #
-    # `definitions` is the engine's single routing source: several distinct
-    # workflows can run over one recording, each opening its own run and
-    # dispatching only its own stages. It is a MAP keyed by workflow name (names
-    # are unique and merge cleanly across -f / --set overrides). Ships empty; the
-    # commented block is a worked example of an object-tracking + loitering
-    # pipeline. Add more keys to run more workflows.
+    # `definitions` is the engine's deployment-global configuration source and
+    # stage catalog: several distinct workflows can run over one recording, each
+    # opening its own run and dispatching only its own stages. Database-backed
+    # organisation workflows, when present, are read separately per recording.
+    # This is a MAP keyed by workflow name (names are unique and merge cleanly
+    # across -f / --set overrides). Ships empty; the commented block is a worked
+    # example of an object-tracking + loitering pipeline. Add more keys to run
+    # more config workflows.
    #
    # Each definition:
    #   enabled   include this workflow (soft-delete toggle).
-    #   source    always rendered as "config" (a Helm-seeded, ops-managed,
+    #   source    always rendered as "config" (a Helm-defined, ops-managed,
    #             deployment-global workflow — read-only in the API).
    #   triggers  how a run OPENS. Omit for a single bare automatic trigger
    #             (opens for every recording); the per-stage `needs` then decide
@@ -654,9 +682,9 @@ kerberoshub:
    #             {operation?, condition?} — operation is the readiness GATE (the
    #             upstream op whose data must be present before the condition is
    #             read; omit for a check on the run root itself), condition is
-    #             {path, op, value} where path is ABSOLUTE from the run root and
-    #             resolves through string-keyed maps only (it cannot index into
-    #             arrays). needsMode combines multiple needs: "any" (default;
+    #             {path, op, value} where path is ABSOLUTE from the run root;
+    #             a `*` segment fans out across array elements. needsMode combines
+    #             multiple needs: "any" (default;
    #             fire on the first match) or "all" (a join; fire once every need
    #             has resolved and matched). The queue is taken from the matching
    #             services.<operation> entry, so dispatch and consume cannot drift.
@@ -665,19 +693,19 @@ kerberoshub:
    # kerberoshub.services.<operation> (deploy the objecttracking / loitering
    # workers below).
    definitions: {}
-      #tracking-workflow:
-      #  enabled: true
-      #  triggers:
-      #    - type: automatic
-      #  stages:
-      #    - operation: objecttracking
-      #      dispatch: always
-      #    - operation: loitering
-      #      dispatch: conditional
-      #      # Fire loitering once objecttracking has resolved — a readiness join
-      #      # (no condition ⇒ gate on the upstream's presence, not a value).
-      #      needs:
-      #        - operation: objecttracking
+    #tracking-workflow:
+    #  enabled: true
+    #  triggers:
+    #    - type: automatic
+    #  stages:
+    #    - operation: objecttracking
+    #      dispatch: always
+    #    - operation: loitering
+    #      dispatch: conditional
+    #      # Fire loitering once objecttracking has resolved — a readiness join
+    #      # (no condition ⇒ gate on the upstream's presence, not a value).
+    #      needs:
+    #        - operation: objecttracking
  # Workflow deployments. Every workflows-subsystem Deployment's image/tag/
  # replicas/resources/queue lives here in a single, uniform shape:
  #   - `workflows` is the engine itself (the orchestrator). It is deployed
@@ -690,9 +718,10 @@ kerberoshub:
  #     when its own `enabled` is true AND the workflows engine is enabled.
  services:
    # hub-workflows — the workflows engine (orchestrator). Consumes the engine
-    # queue, evaluates the workflow definitions (WORKFLOW_DEFINITIONS) and
-    # dispatches to the stage workers below. Deployed when workflows.enabled is
-    # true; it has no separate `enabled` here.
+    # queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
+    # plus organisation-scoped database workflows, and dispatches to the stage
+    # workers below. Deployed when workflows.enabled is true; it has no separate
+    # `enabled` here.
    workflows:
      repository: ghcr.io/uug-ai/hub-workflows
      pullPolicy: IfNotPresent
@@ -714,61 +743,61 @@ kerberoshub:
        requests:
          memory: 10Mi
          cpu: 10m
-    # ---------------------------------------------------------------------
-    # EXAMPLE custom stage worker (commented out) — hub-loitering.
-    #
-    # Companion deployment for the workflows.definitions example above (the
-    # loitering stage of tracking-workflow). Uncomment to deploy the demo
-    # worker. It ships as its own repository/module.
-    # See https://github.com/uug-ai/hub-loitering.
-    #loitering:
-    #  # Deploy the hub-loitering worker.
-    #  enabled: true
-    #  repository: ghcr.io/uug-ai/hub-loitering
-    #  pullPolicy: IfNotPresent
-    #  tag: "v1.0.0"
-    #  replicas: 1 # Number of pods for the worker.
-    #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    #  #volumes:
-    #  #  - name: extra
-    #  #    emptyDir: {}
-    #  #volumeMounts:
-    #  #  - name: extra
-    #  #    mountPath: /data
-    #  logLevel: "info" # possible values: trace, debug, info, warn, error
-    #  # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
-    #  # same value is taken into the matching workflows.definitions stage, so the
-    #  # engine dispatches and the worker consumes the same queue with no drift.
-    #  # Convention: "kcloud-<operation>-queue.fifo".
-    #  queue: "kcloud-loitering-queue.fifo"
-    #  resources:
-    #    requests:
-    #      memory: 10Mi
-    #      cpu: 10m
-    # ---------------------------------------------------------------------
-    # EXAMPLE stage worker (commented out) for the workflows.definitions example
-    # above — hub-objecttracking. Uncomment the worker whose operation a
-    # definition references, so the engine dispatches and the worker consumes the
-    # same queue with no drift.
-    #objecttracking:
-    #  # Deploy the object-tracking worker (operation "objecttracking").
-    #  enabled: true
-    #  repository: ghcr.io/uug-ai/hub-objecttracking
-    #  pullPolicy: IfNotPresent
-    #  tag: "v1.0.0"
-    #  replicas: 1 # Number of pods for the worker.
-    #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    #  logLevel: "info" # possible values: trace, debug, info, warn, error
-    #  # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
-    #  queue: "kcloud-objecttracking-queue.fifo"
-    #  resources:
-    #    requests:
-    #      memory: 10Mi
-    #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE custom stage worker (commented out) — hub-loitering.
+          #
+          # Companion deployment for the workflows.definitions example above (the
+          # loitering stage of tracking-workflow). Uncomment to deploy the demo
+          # worker. It ships as its own repository/module.
+          # See https://github.com/uug-ai/hub-loitering.
+          #loitering:
+          #  # Deploy the hub-loitering worker.
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-loitering
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  #volumes:
+          #  #  - name: extra
+          #  #    emptyDir: {}
+          #  #volumeMounts:
+          #  #  - name: extra
+          #  #    mountPath: /data
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
+          #  # same value is taken into the matching workflows.definitions stage, so the
+          #  # engine dispatches and the worker consumes the same queue with no drift.
+          #  # Convention: "kcloud-<operation>-queue.fifo".
+          #  queue: "kcloud-loitering-queue.fifo"
+          #  resources:
+          #    requests:
+          #      memory: 10Mi
+          #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE stage worker (commented out) for the workflows.definitions example
+          # above — hub-objecttracking. Uncomment the worker whose operation a
+          # definition references, so the engine dispatches and the worker consumes the
+          # same queue with no drift.
+          #objecttracking:
+          #  # Deploy the object-tracking worker (operation "objecttracking").
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-objecttracking
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
+          #  queue: "kcloud-objecttracking-queue.fifo"
+          #  resources:
+          #    requests:
+          #      memory: 10Mi
+          #      cpu: 10m
  monitordevice:
    repository: ghcr.io/uug-ai/hub-monitor-device
    pullPolicy: IfNotPresent
-    tag: "v1.4.0"
+    tag: "v1.4.2"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -788,7 +817,7 @@ kerberoshub:
    repository: uugai/hub-reactivatesubscriptions
    pullPolicy: IfNotPresent
    tag: "v1.0.2"
-    replicas: 1 # Number of pods for the service.
+    replicas: 0 # Number of pods for the service. Set to 0 to disable.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
    #volumes:
@@ -824,7 +853,7 @@ kerberoshub:
    repository: uugai/hub-proxy
    pullPolicy: IfNotPresent
    tag: "v1.0.0"
-    replicas: 1 # Number of pods for the service.
+    replicas: 0 # Number of pods for the service. Set to 0 to disable.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
    #volumes:
@@ -846,7 +875,7 @@ kerberospipeline:
  event:
    repository: ghcr.io/uug-ai/hub-pipeline-event
    pullPolicy: IfNotPresent
-    tag: "v1.3.0"
+    tag: "v1.3.1"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -864,7 +893,7 @@ kerberospipeline:
  monitor:
    repository: ghcr.io/uug-ai/hub-pipeline-monitor
    pullPolicy: IfNotPresent
-    tag: "v1.3.10"
+    tag: "v1.3.13"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -881,7 +910,7 @@ kerberospipeline:
  sequence:
    repository: ghcr.io/uug-ai/hub-pipeline-sequence
    pullPolicy: IfNotPresent
-    tag: "v1.6.18"
+    tag: "v1.6.26"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -898,7 +927,7 @@ kerberospipeline:
  throttler:
    repository: uugai/hub-pipeline-throttler
    pullPolicy: IfNotPresent
-    tag: "v1.2.0"
+    tag: "v1.2.1"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -916,7 +945,7 @@ kerberospipeline:
  notify:
    repository: ghcr.io/uug-ai/hub-pipeline-notification
    pullPolicy: IfNotPresent
-    tag: "v1.3.9"
+    tag: "v1.3.18"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -935,7 +964,7 @@ kerberospipeline:
  notifyTest:
    repository: uugai/hub-pipeline-notification-test
    pullPolicy: IfNotPresent
-    tag: "v1.2.1"
+    tag: "v1.2.2"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    resources:
@@ -953,7 +982,7 @@ kerberospipeline:
  analysis:
    repository: ghcr.io/uug-ai/hub-pipeline-analysis
    pullPolicy: IfNotPresent
-    tag: "v1.7.17"
+    tag: "v1.8.5"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -971,7 +1000,7 @@ kerberospipeline:
  dominantColor:
    repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
    pullPolicy: IfNotPresent
-    tag: "v2.0.2"
+    tag: "v2.0.3"
    replicas: 3 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -992,7 +1021,7 @@ kerberospipeline:
  thumbnail:
    repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
    pullPolicy: IfNotPresent
-    tag: "v1.3.6"
+    tag: "v1.3.10"
    replicas: 2 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1018,7 +1047,7 @@ kerberospipeline:
  counting:
    repository: uugai/hub-pipeline-counting
    pullPolicy: IfNotPresent
-    tag: "v1.6.3"
+    tag: "v2.0.0"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1037,7 +1066,7 @@ kerberospipeline:
    enabled: false # Enable or disable the sprite generation 'true' or 'false
    repository: ghcr.io/uug-ai/hub-pipeline-sprite
    pullPolicy: IfNotPresent
-    tag: "v1.1.14"
+    tag: "v1.1.16"
    replicas: 5 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1061,7 +1090,7 @@ kerberospipeline:
  export:
    repository: ghcr.io/uug-ai/hub-pipeline-export
    pullPolicy: IfNotPresent
-    tag: "v1.2.8"
+    tag: "v1.2.10"
    replicas: 2 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -1077,27 +1106,6 @@ kerberospipeline:
      requests:
        memory: 10Mi
        cpu: 10m
-  redaction:
-    repository: ghcr.io/uug-ai/hub-pipeline-redaction
-    pullPolicy: IfNotPresent
-    tag: "v1.0.0"
-    replicas: 2 # Number of pods for the service.
-    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    # Optional extra volumes / volumeMounts for this deployment (empty = none).
-    #volumes:
-    #  - name: extra
-    #    emptyDir: {}
-    #volumeMounts:
-    #  - name: extra
-    #    mountPath: /data
-    logLevel: "info" # possible values: trace, debug, info, warn, error
-    resources:
-      requests:
-        memory: 512Mi
-        cpu: 500m
-      limits:
-        memory: 2Gi
-        cpu: 1000m
 ###########################################################################
 # Email configuration
 #
Author	SHA1	Message	Date
Cédric Verstraeten	f834d9b8f5	Merge pull request #143 from kerberos-io/public-release-1786904956 A new public release - 1786904956	2026-08-21 17:36:29 +02:00
Kilian	eefe96c679	Merge pull request #147 from kerberos-io/detection-source-flags detection source flags	2026-08-21 17:32:59 +02:00
Kilian	93888e2855	Merge pull request #144 from kerberos-io/feature/add-org-feature-flags add-org-feature-flags	2026-08-21 17:29:48 +02:00
Kilian Boute	759ac8dbf8	detection source flags	2026-08-21 17:28:25 +02:00
Cédric Verstraeten	4aaa70f121	Merge pull request #146 from kerberos-io/fix/cors-origin fix/cors-origin	2026-08-20 22:10:48 +02:00
Cédric Verstraeten	ad7ef4ac12	Add frontend URL to Hub API CORS Initialize CORS origins with the primary frontend URL while retaining support for the legacy frontend URL. Bump the Hub chart to 0.130.0.	2026-08-20 22:09:19 +02:00
Cédric Verstraeten	5ad56f9730	Merge pull request #145 from kerberos-io/feature/add-refresh-tokens-config feature/add-refresh-tokens-config	2026-08-20 21:44:32 +02:00
Cédric Verstraeten	91eb64a2f3	Update Chart.yaml	2026-08-20 21:35:04 +02:00
Cédric Verstraeten	55ae6cdd3e	Add dynamic CORS origins and secure refresh cookie Update the hub API Helm template to set `REFRESH_COOKIE_SECURE` automatically when the API schema is HTTPS, and generate `CORS_ALLOWED_ORIGINS` from configured frontend URLs (legacy URL, domain list, tenant wildcard domain, and demo URL). This keeps cookie behavior and CORS config aligned with deployment settings.	2026-08-20 21:33:32 +02:00
Kilian Boute	f492c14336	add flags	2026-08-20 18:01:19 +02:00
uug4ai	d4a13a4cff	A new public release - 1786904956	2026-08-16 18:29:18 +00:00
Kilian	98cc8d4f2d	Merge pull request #142 from kerberos-io/docs/workflow-source-alignment docs(workflows): clarify config and database sources	2026-08-13 12:48:11 +02:00
Kilian Boute	a5125eee69	docs(workflows): clarify definition sources	2026-08-13 10:23:21 +00:00
Cédric Verstraeten	b2ff3e2e20	Merge pull request #141 from kerberos-io/fix/allow-replicas-proxy-default-to-zero fix/allow-replicas-proxy-default-to-zero	2026-08-11 22:01:40 +02:00
Cédric Verstraeten	277ddde3b4	Disable proxy and reactivation services by default Default replicas for the hub proxy and reactivation subscriptions services are now set to 0, allowing them to be disabled unless explicitly enabled. This updates the chart metadata and docs to reflect the new default behavior.	2026-08-11 21:51:37 +02:00
Cédric Verstraeten	7878be79d6	Merge pull request #140 from kerberos-io/feature/add-mongodb-tls-support feature/add-mongodb-tls-support	2026-08-11 14:14:35 +02:00
Cédric Verstraeten	123bde292e	Merge pull request #136 from kerberos-io/public-release-1786356403 A new public release - 1786356403	2026-08-11 14:09:02 +02:00
Cédric Verstraeten	e76311872e	feat(hub): update chart version to 0.127.0 and add MongoDB TLS configuration options	2026-08-11 12:06:27 +00:00
Cédric Verstraeten	0f2176822a	feat(hub): add TLS support for MongoDB configuration	2026-08-11 12:05:43 +00:00
Kilian	8ca4c402f8	Merge pull request #139 from kerberos-io/feat/organisation-feature-flags chore(hub): bump chart version to 0.126.2	2026-08-10 12:36:29 +02:00
Kilian	8d9b943100	chore(hub): bump chart version to 0.126.2	2026-08-10 10:34:08 +00:00
Kilian	3e10489251	Merge pull request #137 from kerberos-io/feat/organisation-feature-flags Add organisation frontend feature flags	2026-08-10 12:26:01 +02:00
Kilian	a7fd8d394f	feat(hub): add organisation frontend flags Expose disabled-by-default Helm values for organisation switching and creation, and map them to the Hub frontend runtime environment.	2026-08-10 10:17:59 +00:00
uug4ai	c29647ec62	A new public release - 1786356403	2026-08-10 10:06:45 +00:00
Cédric Verstraeten	685b92e9cc	Merge pull request #135 from kerberos-io/feature/add-mock-support feature/add-mock-support	2026-08-05 22:42:36 +02:00
Cédric Verstraeten	01d1e6866a	Bump chart version to 0.126.1 and add MoQ support in live view configuration	2026-08-05 20:31:28 +00:00
Kilian	8cf73bcf1d	Merge pull request #134 from kerberos-io/KilianBoute-patch-2 Bump chart version to 0.126.0	2026-08-05 18:07:10 +02:00
Kilian	57f6ab6f3b	Bump chart version to 0.126.0	2026-08-05 18:06:58 +02:00
Kilian	2ed7829391	Merge pull request #133 from kerberos-io/feat/workflow-stage-queue-catalog workflow-stage-queue-catalog?	2026-08-05 17:50:44 +02:00
Kilian Boute	0c9726f21b	changer	2026-08-05 17:50:18 +02:00
Kilian	9ae2e1fc86	Merge pull request #131 from kerberos-io/feat/workflow-stage-queue-catalog Expose workflow stage queues to Hub API	2026-08-05 13:03:48 +02:00
Kilian Boute	f3a9886053	feat: expose workflow stage queues to API	2026-08-03 13:59:09 +00:00
Cédric Verstraeten	933fedc080	Merge pull request #130 from kerberos-io/feature/splash-screen-feature-flag feature/splash-screen-feature-flag	2026-07-31 15:35:02 +02:00
Cédric Verstraeten	2c7f6a89a3	Bump chart version to 0.124.0	2026-07-31 13:28:55 +00:00
Cédric Verstraeten	5af0ffab6c	Add splash screen feature flag to frontend configuration	2026-07-31 13:18:06 +00:00
Kilian	0a3cf69c80	Merge pull request #129 from kerberos-io/chore/remove-private-redaction-service chore(hub): remove private redaction service from public chart	2026-07-31 15:09:19 +02:00
Kilian Boute	b8499c97e2	chore(hub): remove private redaction service from public chart hub-pipeline-redaction is a private, client-specific worker. Remove its Deployment/Service template and the kerberospipeline.redaction values block (plus the generated README rows) from the public chart. Deployment is now documented in the private hub-pipeline-redaction repo.	2026-07-29 14:12:13 +00:00
Cédric Verstraeten	641dc7510c	Merge pull request #128 from kerberos-io/fix/hide-frontend-categories fix/hide-frontend-categories	2026-07-16 11:29:21 +02:00
Cédric Verstraeten	20f4fa24ba	Bump chart version to 0.123.1	2026-07-16 09:24:21 +00:00
Cédric Verstraeten	b793014f89	Rename media filter category feature environment variable to plural form	2026-07-16 09:23:46 +00:00
Kilian	348bab8f2b	Merge pull request #127 from kerberos-io/KilianBoute-patch-2 Bump chart version to 0.123.0	2026-07-10 19:22:23 +02:00
Kilian	8a71bd2a05	Bump chart version to 0.123.0	2026-07-10 19:22:05 +02:00
Kilian	611ddec1f1	Merge pull request #126 from kerberos-io/KilianBoute-patch-2 Bump chart version to 0.122.0	2026-07-10 19:20:23 +02:00
Kilian	34a285666e	Bump chart version to 0.122.0	2026-07-10 19:20:09 +02:00
Kilian	59cf74ba66	Merge pull request #125 from kerberos-io/feat/hub-i18n-run-workflow-redact feat(i18n): add Run workflow and Redact faces case UI strings	2026-07-10 19:10:52 +02:00
Kilian Boute	020f2d969d	feat(i18n): add Run workflow and Redact faces case UI strings Adds the en.json translations for the case Run-workflow dialog (title/subtitle/labels/empty/submit and the runWorkflow menu item) and the Redact faces attachment action (k14).	2026-07-10 17:10:14 +00:00
Kilian	eeb29e8cac	Merge pull request #124 from kerberos-io/feat/hub-api-workflow-definitions-env feat(hub-api): inject WORKFLOW_DEFINITIONS env so config workflows surface in the API	2026-07-10 19:09:13 +02:00
Kilian Boute	1ec2be4cc7	feat(hub-api): inject WORKFLOW_DEFINITIONS env so config workflows surface in the API hub-api reads WORKFLOW_DEFINITIONS (the same enabled definition set the workflows engine consumes, assembled via kerberoshub.workflows.workflowDefinitions) read-only to surface config workflows alongside DB/user workflows. Previously only the engine received this env, so hub-api returned an empty config-workflow list and manual/on-demand config workflows never appeared in GET /workflows.	2026-07-10 17:06:41 +00:00
Kilian	b9166ea1ed	Merge pull request #123 from kerberos-io/fix/hub-stage-service-separator fix(hub-stage): render valid YAML when multiple stage workers are enabled	2026-07-08 15:05:56 +02:00
Kilian Boute	be2290075c	fix(hub-stage): add newline before doc separator so multiple stage workers render valid YAML The generic stage-worker loop in templates/kerberos-pipeline/hub-stage.yaml closed each iteration with `{{- end }}`, whose left-trim stripped the newline after the Service's final line (`app: hub-<name>`). With a single enabled stage worker this was latent, but with two or more the next worker's `---` separator was glued onto the previous Service's last line (e.g. `app: hub-loitering---`), merging two resources into one malformed document. In production this surfaced as ArgoCD "one or more synchronization tasks are not valid" once objecttracking was enabled alongside anpr and loitering (3 stage workers -> 2 glued boundaries: anpr->loitering and loitering->objecttracking). Fix: emit a trailing newline before the next document separator by using `{{ end -}}` for the per-service if-close. Rendering the hub chart with the production values now yields 58 valid documents (previously 56, of which 2 were Service+Deployment glued together) and 0 malformed separators. Bump chart to 0.121.1 so the fix can be published to charts.kerberos.io.	2026-07-08 12:59:28 +00:00