Enhance Helm chart with ServiceAccount support and configurable ports

- Updated Chart.yaml to version 0.2.0 and added annotations for changes.
- Modified release-chart.yaml to trigger releases via Gitea and handle pre-releases.
- Introduced ServiceAccount configuration in values.yaml and related templates.
- Adjusted internal container ports to prevent conflicts between nginx and aptly.
- Updated README.md and NOTES.txt to reflect new configurations and usage instructions.

.gitea/workflows/release-chart.yaml

@@ -1,13 +1,24 @@
 name: Release chart
-# Triggered by `git tag chart/vX.Y.Z && git push --tags`, independently of
-# image releases — see docs/versioning.md. Never bumps the image: Chart.yaml's
-# committed appVersion (last set by release-image.yaml) is what gets packaged,
-# so a chart-only release always pins the last released image, never `latest`.
+# Triggered by publishing a Gitea Release whose tag matches `chart/vX.Y.Z`
+# (create the tag + release together via the Gitea UI's "New Release" page,
+# or `git tag chart/vX.Y.Z && git push --tags` followed by turning that tag
+# into a Release) — independently of image releases (release-image.yaml), see
+# docs/versioning.md.
+#
+# Ticking "This is a pre-release" on that Gitea Release bakes
+# `artifacthub.io/prerelease: "true"` into the packaged Chart.yaml (never
+# committed back — see the "Set ArtifactHub prerelease annotation" step
+# below), so ArtifactHub lists that specific chart version as a pre-release.
+#
+# This job also matches the `release: published` event fired by
+# release-image.yaml's own auto-created Gitea Release for `image/v*` tags —
+# the `if:` guard below skips anything whose tag isn't `chart/v*`.
 #
 # Chart version is pure SemVer, deliberately WITHOUT the `+up<aptly>` build
 # metadata bookstack-chart uses: Helm rewrites `+` to `_` on OCI push (and
 # back on pull), which breaks listing in some third-party tooling (e.g.
-# Rancher). The aptly version lives in appVersion instead.
+# Rancher). The aptly version lives in appVersion instead. A SemVer
+# pre-release suffix (`chart/v0.2.0-rc.1`) works fine and is unaffected.
 #
 # The chart is pushed under f.weber/charts/aptly, NOT f.weber/aptly: Gitea's
 # package registry stores both container images and Helm OCI charts as
@@ -15,9 +26,8 @@ name: Release chart
 # the container image of the same name makes the package listing/type
 # ambiguous. A distinct `charts/` path keeps the two package kinds apart.
 on:
-  push:
-    tags:
-      - 'chart/v*'
+  release:
+    types: [published]
 
 concurrency:
   group: release-chart
@@ -25,15 +35,16 @@ concurrency:
 
 jobs:
   release:
+    if: startsWith(gitea.event.release.tag_name, 'chart/v')
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
-      - name: Parse chart version from tag
+      - name: Parse chart version from the release's tag
         id: version
-        run: echo "version=${GITEA_REF_NAME#chart/v}" >> "$GITEA_OUTPUT"
+        run: echo "version=${TAG_NAME#chart/v}" >> "$GITEA_OUTPUT"
         env:
-          GITEA_REF_NAME: ${{ gitea.ref_name }}
+          TAG_NAME: ${{ gitea.event.release.tag_name }}
 
       - uses: azure/setup-helm@v4.3.0
         with:
@@ -54,6 +65,11 @@ jobs:
             exit 1
           fi
 
+      - name: Set ArtifactHub prerelease annotation (packaged copy only, never committed)
+        if: gitea.event.release.prerelease
+        run: |
+          yq -i '.annotations["artifacthub.io/prerelease"] = "true"' charts/aptly/Chart.yaml
+
       - name: Import GPG signing key
         uses: crazy-max/ghaction-import-gpg@v6
         with:
@@ -88,11 +104,12 @@ jobs:
             --username "${{ secrets.REGISTRY_USER }}" --password-stdin
           helm push "aptly-${{ steps.version.outputs.version }}.tgz" oci://git.morlana.online/f.weber/charts
 
-      - name: Create Gitea release with chart artifacts
+      - name: Attach chart artifacts to the Gitea release
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ gitea.ref_name }}
+          tag_name: ${{ gitea.event.release.tag_name }}
           name: "aptly chart ${{ steps.version.outputs.version }}"
+          prerelease: ${{ gitea.event.release.prerelease }}
           body: |
             `helm pull oci://git.morlana.online/f.weber/charts/aptly --version ${{ steps.version.outputs.version }}`
           files: |