diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
new file mode 100644
index 000000000..b5a8f0bbd
--- /dev/null
+++ b/.github/workflows/gh-pages.yml
@@ -0,0 +1,52 @@
+# Sample workflow for building and deploying a Jekyll site to GitHub Pages
+name: Deploy GitHub Pages dependencies preinstalled
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: ["main"]
+    paths:
+      - 'docs/**' # only execute if we have docs changes
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow one concurrent deployment
+concurrency:
+  group: "pages"
+  cancel-in-progress: true
+
+jobs:
+  # Build job
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Pages
+        uses: actions/configure-pages@v2
+      - name: Build with Jekyll
+        uses: actions/jekyll-build-pages@v1
+        with:
+          source: ./docs
+          destination: ./_site
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v1
+
+  # Deployment job
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v1
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
new file mode 100644
index 000000000..7cdc369ba
--- /dev/null
+++ b/.github/workflows/helm.yml
@@ -0,0 +1,39 @@
+name: Release Charts
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'helm/**' # only execute if we have helm chart changes
+
+jobs:
+  release:
+    # depending on default permission settings for your org (contents being read-only or read-write for workloads), you will have to add permissions
+    # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Install Helm
+        uses: azure/setup-helm@v3
+        with:
+          version: v3.10.0
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.4.1
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        with:
+          config: helm/cr.yaml
+          charts_dir: helm/
diff --git a/.github/workflows/k8s.yml b/.github/workflows/k8s.yml
new file mode 100644
index 000000000..fc5e8c906
--- /dev/null
+++ b/.github/workflows/k8s.yml
@@ -0,0 +1,90 @@
+name: k8s
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - 'helm/**' # only execute if we have helm chart changes
+  pull_request:
+    branches: ["main"]
+    paths:
+      - 'helm/**'
+
+jobs:
+  lint:
+    name: Lint Helm chart
+    runs-on: ubuntu-latest
+    outputs:
+      changed: ${{ steps.list-changed.outputs.changed }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: azure/setup-helm@v3
+        with:
+          version: v3.10.0
+      - uses: actions/setup-python@v4
+        with:
+          python-version: 3.11
+          check-latest: true
+      - uses: helm/chart-testing-action@v2.3.1
+      - name: Get changed status
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --config helm/ct.yaml --target-branch ${{ github.event.repository.default_branch }})
+          if [[ -n "$changed" ]]; then
+              echo "::set-output name=changed::true"
+          fi
+
+      - name: Run lint
+        run: ct lint --config helm/ct.yaml
+
+  # only bother to run if lint step reports a change to the helm chart
+  install:
+    needs:
+      - lint
+    if: ${{ needs.lint.outputs.changed == 'true' }}
+    name: Install Helm charts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.checkoutCommit }}
+      - name: Install Kubernetes tools
+        uses: yokawasa/action-setup-kube-tools@v0.8.2
+        with:
+          setup-tools: |
+            helmv3
+          helm: "3.10.3"
+      - uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.3.1
+      - name: Create k3d cluster
+        uses: nolar/setup-k3d-k3s@v1
+        with:
+          version: v1.21
+      - name: Remove node taints
+        run: |
+          kubectl taint --all=true nodes node.cloudprovider.kubernetes.io/uninitialized- || true
+      - name: Run chart-testing (install)
+        run: ct install --config helm/ct.yaml
+
+      # Install the chart using helm directly and test with create-account
+      - name: Install chart
+        run: |
+          helm install --values helm/dendrite/ci/ct-postgres-sharedsecret-values.yaml dendrite helm/dendrite
+      - name: Wait for Postgres and Dendrite to be up
+        run: |
+          kubectl wait --for=condition=ready --timeout=90s pod -l app.kubernetes.io/name=postgresql || kubectl get pods -A
+          kubectl wait --for=condition=ready --timeout=90s pod -l app.kubernetes.io/name=dendrite || kubectl get pods -A
+          kubectl get pods -A
+          kubectl get services
+          kubectl get ingress
+      - name: Run create account
+        run: |
+          podName=$(kubectl get pods -l app.kubernetes.io/name=dendrite -o name)
+          kubectl exec "${podName}" -- /usr/bin/create-account -username alice -password somerandompassword
\ No newline at end of file
diff --git a/helm/cr.yaml b/helm/cr.yaml
new file mode 100644
index 000000000..f895ab8d6
--- /dev/null
+++ b/helm/cr.yaml
@@ -0,0 +1 @@
+release-name-template: "helm-{{ .Name }}-{{ .Version }}"
\ No newline at end of file
diff --git a/helm/ct.yaml b/helm/ct.yaml
new file mode 100644
index 000000000..af706fa3d
--- /dev/null
+++ b/helm/ct.yaml
@@ -0,0 +1,7 @@
+remote: origin
+target-branch: main
+chart-repos:
+  - bitnami=https://charts.bitnami.com/bitnami
+chart-dirs:
+  - helm
+validate-maintainers: false
\ No newline at end of file
diff --git a/helm/dendrite/.helm-docs/about.gotmpl b/helm/dendrite/.helm-docs/about.gotmpl
new file mode 100644
index 000000000..a92c6be42
--- /dev/null
+++ b/helm/dendrite/.helm-docs/about.gotmpl
@@ -0,0 +1,5 @@
+{{ define "chart.about" }}
+## About
+
+This chart creates a monolith deployment, including an optionally enabled PostgreSQL dependency to connect to.
+{{ end }}
\ No newline at end of file
diff --git a/helm/dendrite/.helm-docs/appservices.gotmpl b/helm/dendrite/.helm-docs/appservices.gotmpl
new file mode 100644
index 000000000..8a79a0780
--- /dev/null
+++ b/helm/dendrite/.helm-docs/appservices.gotmpl
@@ -0,0 +1,5 @@
+{{ define "chart.appservices" }}
+## Usage with appservices
+
+Create a folder `appservices` and place your configurations in there.  The configurations will be read and placed in a secret `dendrite-appservices-conf`.
+{{ end }}
\ No newline at end of file
diff --git a/helm/dendrite/.helm-docs/database.gotmpl b/helm/dendrite/.helm-docs/database.gotmpl
new file mode 100644
index 000000000..85ef01ecc
--- /dev/null
+++ b/helm/dendrite/.helm-docs/database.gotmpl
@@ -0,0 +1,18 @@
+{{ define "chart.dbCreation" }}
+## Manual database creation
+
+(You can skip this, if you're deploying the PostgreSQL dependency)
+
+You'll need to create the following database before starting Dendrite (see [installation](https://matrix-org.github.io/dendrite/installation/database#single-database-creation)):
+
+```postgres
+create database dendrite
+```
+
+or
+
+```bash
+sudo -u postgres createdb -O dendrite -E UTF-8 dendrite
+```
+
+{{ end }}
\ No newline at end of file
diff --git a/helm/dendrite/.helm-docs/state.gotmpl b/helm/dendrite/.helm-docs/state.gotmpl
new file mode 100644
index 000000000..2fe987ddd
--- /dev/null
+++ b/helm/dendrite/.helm-docs/state.gotmpl
@@ -0,0 +1,3 @@
+{{ define "chart.state" }} 
+Status: **NOT PRODUCTION READY**
+{{ end }}
\ No newline at end of file
diff --git a/helm/dendrite/Chart.yaml b/helm/dendrite/Chart.yaml
new file mode 100644
index 000000000..15d1e6d19
--- /dev/null
+++ b/helm/dendrite/Chart.yaml
@@ -0,0 +1,19 @@
+apiVersion: v2
+name: dendrite
+version: "0.10.8"
+appVersion: "0.10.8"
+description: Dendrite Matrix Homeserver
+type: application
+keywords:
+  - matrix
+  - chat
+  - homeserver
+  - dendrite
+home: https://github.com/matrix-org/dendrite
+sources:
+  - https://github.com/matrix-org/dendrite
+dependencies:
+- name: postgresql
+  version: 12.1.7
+  repository: https://charts.bitnami.com/bitnami
+  condition: postgresql.enabled
diff --git a/helm/dendrite/README.md b/helm/dendrite/README.md
new file mode 100644
index 000000000..cb850d655
--- /dev/null
+++ b/helm/dendrite/README.md
@@ -0,0 +1,147 @@
+# dendrite
+
+![Version: 0.10.8](https://img.shields.io/badge/Version-0.10.8-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.10.8](https://img.shields.io/badge/AppVersion-0.10.8-informational?style=flat-square)
+Dendrite Matrix Homeserver
+
+Status: **NOT PRODUCTION READY**
+
+## About
+
+This chart creates a monolith deployment, including an optionally enabled PostgreSQL dependency to connect to.
+
+## Manual database creation
+
+(You can skip this, if you're deploying the PostgreSQL dependency)
+
+You'll need to create the following database before starting Dendrite (see [installation](https://matrix-org.github.io/dendrite/installation/database#single-database-creation)):
+
+```postgres
+create database dendrite
+```
+
+or
+
+```bash
+sudo -u postgres createdb -O dendrite -E UTF-8 dendrite
+```
+
+## Usage with appservices
+
+Create a folder `appservices` and place your configurations in there.  The configurations will be read and placed in a secret `dendrite-appservices-conf`.
+
+## Source Code
+
+* <https://github.com/matrix-org/dendrite>
+## Requirements
+
+| Repository | Name | Version |
+|------------|------|---------|
+| https://charts.bitnami.com/bitnami | postgresql | 12.1.7 |
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| image.name | string | `"ghcr.io/matrix-org/dendrite-monolith:v0.10.8"` | Docker repository/image to use |
+| image.pullPolicy | string | `"IfNotPresent"` | Kubernetes pullPolicy |
+| signing_key.create | bool | `true` | Create a new signing key, if not exists |
+| signing_key.existingSecret | string | `""` | Use an existing secret |
+| resources | object | sets some sane default values | Default resource requests/limits. |
+| persistence.storageClass | string | `""` | The storage class to use for volume claims. Defaults to the cluster default storage class. |
+| persistence.jetstream.existingClaim | string | `""` | Use an existing volume claim for jetstream |
+| persistence.jetstream.capacity | string | `"1Gi"` | PVC Storage Request for the jetstream volume |
+| persistence.media.existingClaim | string | `""` | Use an existing volume claim for media files |
+| persistence.media.capacity | string | `"1Gi"` | PVC Storage Request for the media volume |
+| persistence.search.existingClaim | string | `""` | Use an existing volume claim for the fulltext search index |
+| persistence.search.capacity | string | `"1Gi"` | PVC Storage Request for the search volume |
+| dendrite_config.version | int | `2` |  |
+| dendrite_config.global.server_name | string | `""` | **REQUIRED** Servername for this Dendrite deployment. |
+| dendrite_config.global.private_key | string | `"/etc/dendrite/secrets/signing.key"` | The private key to use. (**NOTE**: This is overriden in Helm) |
+| dendrite_config.global.well_known_server_name | string | `""` | The server name to delegate server-server communications to, with optional port e.g. localhost:443 |
+| dendrite_config.global.well_known_client_name | string | `""` | The server name to delegate client-server communications to, with optional port e.g. localhost:443 |
+| dendrite_config.global.trusted_third_party_id_servers | list | `["matrix.org","vector.im"]` | Lists of domains that the server will trust as identity servers to verify third party identifiers such as phone numbers and email addresses. |
+| dendrite_config.global.old_private_keys | string | `nil` | The paths and expiry timestamps (as a UNIX timestamp in millisecond precision) to old signing keys that were formerly in use on this domain name. These keys will not be used for federation request or event signing, but will be provided to any other homeserver that asks when trying to verify old events. |
+| dendrite_config.global.disable_federation | bool | `false` | Disable federation. Dendrite will not be able to make any outbound HTTP requests to other servers and the federation API will not be exposed. |
+| dendrite_config.global.key_validity_period | string | `"168h0m0s"` |  |
+| dendrite_config.global.database.connection_string | string | `""` | The connection string for connections to Postgres. This will be set automatically if using the Postgres dependency |
+| dendrite_config.global.database.max_open_conns | int | `90` | Default database maximum open connections |
+| dendrite_config.global.database.max_idle_conns | int | `5` | Default database maximum idle connections |
+| dendrite_config.global.database.conn_max_lifetime | int | `-1` | Default database maximum lifetime |
+| dendrite_config.global.jetstream.storage_path | string | `"/data/jetstream"` | Persistent directory to store JetStream streams in. |
+| dendrite_config.global.jetstream.addresses | list | `[]` | NATS JetStream server addresses if not using internal NATS. |
+| dendrite_config.global.jetstream.topic_prefix | string | `"Dendrite"` | The prefix for JetStream streams |
+| dendrite_config.global.jetstream.in_memory | bool | `false` | Keep all data in memory. (**NOTE**: This is overriden in Helm to `false`) |
+| dendrite_config.global.jetstream.disable_tls_validation | bool | `true` | Disables TLS validation. This should **NOT** be used in production. |
+| dendrite_config.global.cache.max_size_estimated | string | `"1gb"` | The estimated maximum size for the global cache in bytes, or in terabytes, gigabytes, megabytes or kilobytes when the appropriate 'tb', 'gb', 'mb' or 'kb' suffix is specified. Note that this is not a hard limit, nor is it a memory limit for the entire process. A cache that is too small may ultimately provide little or no benefit. |
+| dendrite_config.global.cache.max_age | string | `"1h"` | The maximum amount of time that a cache entry can live for in memory before it will be evicted and/or refreshed from the database. Lower values result in easier admission of new cache entries but may also increase database load in comparison to higher values, so adjust conservatively. Higher values may make it harder for new items to make it into the cache, e.g. if new rooms suddenly become popular. |
+| dendrite_config.global.report_stats.enabled | bool | `false` | Configures phone-home statistics reporting. These statistics contain the server name, number of active users and some information on your deployment config. We use this information to understand how Dendrite is being used in the wild. |
+| dendrite_config.global.report_stats.endpoint | string | `"https://matrix.org/report-usage-stats/push"` | Endpoint to report statistics to. |
+| dendrite_config.global.presence.enable_inbound | bool | `false` | Controls whether we receive presence events from other servers |
+| dendrite_config.global.presence.enable_outbound | bool | `false` | Controls whether we send presence events for our local users to other servers. (_May increase CPU/memory usage_) |
+| dendrite_config.global.server_notices.enabled | bool | `false` | Server notices allows server admins to send messages to all users on the server. |
+| dendrite_config.global.server_notices.local_part | string | `"_server"` | The local part for the user sending server notices. |
+| dendrite_config.global.server_notices.display_name | string | `"Server Alerts"` | The display name for the user sending server notices. |
+| dendrite_config.global.server_notices.avatar_url | string | `""` | The avatar URL (as a mxc:// URL) name for the user sending server notices. |
+| dendrite_config.global.server_notices.room_name | string | `"Server Alerts"` |  |
+| dendrite_config.global.metrics.enabled | bool | `false` | Whether or not Prometheus metrics are enabled. |
+| dendrite_config.global.metrics.basic_auth.user | string | `"metrics"` | HTTP basic authentication username |
+| dendrite_config.global.metrics.basic_auth.password | string | `"metrics"` | HTTP basic authentication password |
+| dendrite_config.global.dns_cache.enabled | bool | `false` | Whether or not the DNS cache is enabled. |
+| dendrite_config.global.dns_cache.cache_size | int | `256` | Maximum number of entries to hold in the DNS cache |
+| dendrite_config.global.dns_cache.cache_lifetime | string | `"10m"` | Duration for how long DNS cache items should be considered valid ([see time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more) |
+| dendrite_config.global.profiling.enabled | bool | `false` | Enable pprof. You will need to manually create a port forwarding to the deployment to access PPROF, as it will only listen on localhost and the defined port. e.g. `kubectl port-forward deployments/dendrite 65432:65432` |
+| dendrite_config.global.profiling.port | int | `65432` | pprof port, if enabled |
+| dendrite_config.mscs | object | `{"mscs":["msc2946"]}` | Configuration for experimental MSC's. (Valid values are: msc2836 and msc2946) |
+| dendrite_config.app_service_api.disable_tls_validation | bool | `false` | Disable the validation of TLS certificates of appservices. This is not recommended in production since it may allow appservice traffic to be sent to an insecure endpoint. |
+| dendrite_config.app_service_api.config_files | list | `[]` | Appservice config files to load on startup. (**NOTE**: This is overriden by Helm, if a folder `./appservices/` exists) |
+| dendrite_config.client_api.registration_disabled | bool | `true` | Prevents new users from being able to register on this homeserver, except when using the registration shared secret below. |
+| dendrite_config.client_api.guests_disabled | bool | `true` |  |
+| dendrite_config.client_api.registration_shared_secret | string | `""` | If set, allows registration by anyone who knows the shared secret, regardless of whether registration is otherwise disabled. |
+| dendrite_config.client_api.enable_registration_captcha | bool | `false` | enable reCAPTCHA registration |
+| dendrite_config.client_api.recaptcha_public_key | string | `""` | reCAPTCHA public key |
+| dendrite_config.client_api.recaptcha_private_key | string | `""` | reCAPTCHA private key |
+| dendrite_config.client_api.recaptcha_bypass_secret | string | `""` | reCAPTCHA bypass secret |
+| dendrite_config.client_api.recaptcha_siteverify_api | string | `""` |  |
+| dendrite_config.client_api.turn.turn_user_lifetime | string | `"24h"` | Duration for how long users should be considered valid ([see time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more) |
+| dendrite_config.client_api.turn.turn_uris | list | `[]` |  |
+| dendrite_config.client_api.turn.turn_shared_secret | string | `""` |  |
+| dendrite_config.client_api.turn.turn_username | string | `""` | The TURN username |
+| dendrite_config.client_api.turn.turn_password | string | `""` | The TURN password |
+| dendrite_config.client_api.rate_limiting.enabled | bool | `true` | Enable rate limiting |
+| dendrite_config.client_api.rate_limiting.threshold | int | `20` | After how many requests a rate limit should be activated |
+| dendrite_config.client_api.rate_limiting.cooloff_ms | int | `500` | Cooloff time in milliseconds |
+| dendrite_config.client_api.rate_limiting.exempt_user_ids | string | `nil` | Users which should be exempt from rate limiting |
+| dendrite_config.federation_api.send_max_retries | int | `16` | Federation failure threshold. How many consecutive failures that we should tolerate when sending federation requests to a specific server. The backoff is 2**x seconds, so 1 = 2 seconds, 2 = 4 seconds, 3 = 8 seconds, etc. The default value is 16 if not specified, which is circa 18 hours. |
+| dendrite_config.federation_api.disable_tls_validation | bool | `false` | Disable TLS validation. This should **NOT** be used in production. |
+| dendrite_config.federation_api.prefer_direct_fetch | bool | `false` |  |
+| dendrite_config.federation_api.disable_http_keepalives | bool | `false` | Prevents Dendrite from keeping HTTP connections open for reuse for future requests. Connections will be closed quicker but we may spend more time on TLS handshakes instead. |
+| dendrite_config.federation_api.key_perspectives | list | See value.yaml | Perspective keyservers, to use as a backup when direct key fetch requests don't succeed. |
+| dendrite_config.media_api.base_path | string | `"/data/media_store"` | The path to store media files (e.g. avatars) in |
+| dendrite_config.media_api.max_file_size_bytes | int | `10485760` | The max file size for uploaded media files |
+| dendrite_config.media_api.dynamic_thumbnails | bool | `false` |  |
+| dendrite_config.media_api.max_thumbnail_generators | int | `10` | The maximum number of simultaneous thumbnail generators to run. |
+| dendrite_config.media_api.thumbnail_sizes | list | See value.yaml | A list of thumbnail sizes to be generated for media content. |
+| dendrite_config.sync_api.real_ip_header | string | `"X-Real-IP"` | This option controls which HTTP header to inspect to find the real remote IP address of the client. This is likely required if Dendrite is running behind a reverse proxy server. |
+| dendrite_config.sync_api.search | object | `{"enabled":true,"index_path":"/data/search","language":"en"}` | Configuration for the full-text search engine. |
+| dendrite_config.sync_api.search.enabled | bool | `true` | Whether fulltext search is enabled. |
+| dendrite_config.sync_api.search.index_path | string | `"/data/search"` | The path to store the search index in. |
+| dendrite_config.sync_api.search.language | string | `"en"` | The language most likely to be used on the server - used when indexing, to ensure the returned results match expectations. A full list of possible languages can be found [here](https://github.com/matrix-org/dendrite/blob/76db8e90defdfb9e61f6caea8a312c5d60bcc005/internal/fulltext/bleve.go#L25-L46) |
+| dendrite_config.user_api.bcrypt_cost | int | `10` | bcrypt cost to use when hashing passwords. (ranges from 4-31; 4 being least secure, 31 being most secure; _NOTE: Using a too high value can cause clients to timeout and uses more CPU._) |
+| dendrite_config.user_api.openid_token_lifetime_ms | int | `3600000` | OpenID Token lifetime in milliseconds. |
+| dendrite_config.user_api.push_gateway_disable_tls_validation | bool | `false` |  |
+| dendrite_config.user_api.auto_join_rooms | list | `[]` | Rooms to join users to after registration |
+| dendrite_config.logging | list | `[{"level":"info","type":"std"}]` | Default logging configuration |
+| postgresql.enabled | bool | See value.yaml | Enable and configure postgres as the database for dendrite. |
+| postgresql.image.repository | string | `"bitnami/postgresql"` |  |
+| postgresql.image.tag | string | `"15.1.0"` |  |
+| postgresql.auth.username | string | `"dendrite"` |  |
+| postgresql.auth.password | string | `"changeme"` |  |
+| postgresql.auth.database | string | `"dendrite"` |  |
+| postgresql.persistence.enabled | bool | `false` |  |
+| ingress.enabled | bool | `false` | Create an ingress for a monolith deployment |
+| ingress.hosts | list | `[]` |  |
+| ingress.className | string | `""` |  |
+| ingress.hostName | string | `""` |  |
+| ingress.annotations | object | `{}` | Extra, custom annotations |
+| ingress.tls | list | `[]` |  |
+| service.type | string | `"ClusterIP"` |  |
+| service.port | int | `80` |  |
diff --git a/helm/dendrite/README.md.gotmpl b/helm/dendrite/README.md.gotmpl
new file mode 100644
index 000000000..7c32f7b02
--- /dev/null
+++ b/helm/dendrite/README.md.gotmpl
@@ -0,0 +1,13 @@
+{{ template "chart.header" . }}
+{{ template "chart.deprecationWarning" . }}
+{{ template "chart.badgesSection" . }}
+{{ template "chart.description" . }}
+{{ template "chart.state" . }}
+{{ template "chart.about" . }}
+{{ template "chart.dbCreation" . }}
+{{ template "chart.appservices" . }}
+{{ template "chart.maintainersSection" . }}
+{{ template "chart.sourcesSection" . }}
+{{ template "chart.requirementsSection" . }}
+{{ template "chart.valuesSection" . }}
+{{ template "helm-docs.versionFooter" . }}
\ No newline at end of file
diff --git a/helm/dendrite/ci/ct-ingress-values.yaml b/helm/dendrite/ci/ct-ingress-values.yaml
new file mode 100644
index 000000000..28311d33e
--- /dev/null
+++ b/helm/dendrite/ci/ct-ingress-values.yaml
@@ -0,0 +1,13 @@
+---
+postgresql:
+  enabled: true
+  primary:
+    persistence:
+      size: 1Gi
+
+dendrite_config:
+  global:
+    server_name: "localhost"
+
+ingress:
+  enabled: true
diff --git a/helm/dendrite/ci/ct-postgres-sharedsecret-values.yaml b/helm/dendrite/ci/ct-postgres-sharedsecret-values.yaml
new file mode 100644
index 000000000..55e652c63
--- /dev/null
+++ b/helm/dendrite/ci/ct-postgres-sharedsecret-values.yaml
@@ -0,0 +1,16 @@
+---
+postgresql:
+  enabled: true
+  primary:
+    persistence:
+      size: 1Gi
+
+dendrite_config:
+  global:
+    server_name: "localhost"
+
+  client_api:
+    registration_shared_secret: "d233f2fcb0470845a8e150a20ef594ddbe0b4cf7fe482fb9d5120c198557acbf"  # echo "dendrite" | sha256sum
+
+ingress:
+  enabled: true
diff --git a/helm/dendrite/templates/_helpers.tpl b/helm/dendrite/templates/_helpers.tpl
new file mode 100644
index 000000000..291f351bc
--- /dev/null
+++ b/helm/dendrite/templates/_helpers.tpl
@@ -0,0 +1,72 @@
+{{- define "validate.config" }}
+{{- if not .Values.signing_key.create -}}
+{{-  fail "You must create a signing key for configuration.signing_key. (see https://github.com/matrix-org/dendrite/blob/master/docs/INSTALL.md#server-key-generation)" -}}
+{{- end -}}
+{{- if not (or .Values.dendrite_config.global.database.host .Values.postgresql.enabled) -}}
+{{-  fail "Database server must be set." -}}
+{{- end -}}
+{{- if not (or .Values.dendrite_config.global.database.user .Values.postgresql.enabled) -}}
+{{-  fail "Database user must be set." -}}
+{{- end -}}
+{{- if not (or .Values.dendrite_config.global.database.password .Values.postgresql.enabled) -}}
+{{-  fail "Database password must be set." -}}
+{{- end -}}
+{{- end -}}
+
+
+{{- define "image.name" -}}
+image: {{ .name }}
+imagePullPolicy: {{ .pullPolicy }}
+{{- end -}}
+
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "dendrite.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "dendrite.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "dendrite.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "dendrite.labels" -}}
+helm.sh/chart: {{ include "dendrite.chart" . }}
+{{ include "dendrite.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "dendrite.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "dendrite.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
\ No newline at end of file
diff --git a/helm/dendrite/templates/_overrides.yaml b/helm/dendrite/templates/_overrides.yaml
new file mode 100644
index 000000000..edb8ba83a
--- /dev/null
+++ b/helm/dendrite/templates/_overrides.yaml
@@ -0,0 +1,16 @@
+{{- define "override.config" }}
+{{- if .Values.postgresql.enabled }}
+{{- $_ := set .Values.dendrite_config.global.database "connection_string" (print "postgresql://" .Values.postgresql.auth.username ":" .Values.postgresql.auth.password "@" .Release.Name "-postgresql/dendrite?sslmode=disable") -}}
+{{ end }}
+global:
+  private_key: /etc/dendrite/secrets/signing.key
+  jetstream:
+    in_memory: false
+{{ if (gt (len (.Files.Glob "appservices/*")) 0) }}
+app_service_api:
+  config_files:
+    {{- range $x, $y := .Files.Glob "appservices/*" }}
+    - /etc/dendrite/appservices/{{ base $x }}
+    {{ end }}
+{{ end }}
+{{ end }}
diff --git a/helm/dendrite/templates/deployment.yaml b/helm/dendrite/templates/deployment.yaml
new file mode 100644
index 000000000..629ffe528
--- /dev/null
+++ b/helm/dendrite/templates/deployment.yaml
@@ -0,0 +1,103 @@
+{{ template "validate.config" . }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: {{ $.Release.Namespace }}
+  name: {{ include "dendrite.fullname" . }}
+  labels:
+    {{- include "dendrite.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "dendrite.selectorLabels" . | nindent 6 }}
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        {{- include "dendrite.selectorLabels" . | nindent 8 }}
+      annotations:
+        confighash-global: secret-{{ .Values.global | toYaml | sha256sum | trunc 32 }}
+        confighash-clientapi: clientapi-{{ .Values.clientapi | toYaml | sha256sum | trunc 32 }}
+        confighash-federationapi: federationapi-{{ .Values.federationapi | toYaml | sha256sum | trunc 32 }}
+        confighash-mediaapi: mediaapi-{{ .Values.mediaapi | toYaml | sha256sum | trunc 32 }}
+        confighash-syncapi: syncapi-{{ .Values.syncapi | toYaml | sha256sum | trunc 32 }}
+    spec:
+      volumes:
+      - name: {{ include "dendrite.fullname" . }}-conf-vol
+        secret:
+          secretName: {{ include "dendrite.fullname" . }}-conf
+      - name: {{ include "dendrite.fullname" . }}-signing-key
+        secret:
+          secretName: {{ default (print ( include "dendrite.fullname" . ) "-signing-key") $.Values.signing_key.existingSecret | quote }}
+      {{- if (gt (len ($.Files.Glob "appservices/*")) 0) }}
+      - name: {{ include "dendrite.fullname" . }}-appservices
+        secret:
+          secretName: {{ include "dendrite.fullname" . }}-appservices-conf
+      {{- end }}
+      - name: {{ include "dendrite.fullname" . }}-jetstream
+        persistentVolumeClaim:
+          claimName: {{ default (print ( include "dendrite.fullname" . ) "-jetstream-pvc") $.Values.persistence.jetstream.existingClaim | quote }}
+      - name: {{ include "dendrite.fullname" . }}-media
+        persistentVolumeClaim:
+          claimName: {{ default (print ( include "dendrite.fullname" . ) "-media-pvc") $.Values.persistence.media.existingClaim | quote }}
+      - name: {{ include "dendrite.fullname" . }}-search
+        persistentVolumeClaim:
+          claimName: {{ default (print ( include "dendrite.fullname" . ) "-search-pvc") $.Values.persistence.search.existingClaim | quote }}
+      containers:
+      - name: {{ $.Chart.Name }}
+        {{- include "image.name" $.Values.image | nindent 8 }}
+        args:
+          - '--config'
+          - '/etc/dendrite/dendrite.yaml'
+        ports:
+          - name: http
+            containerPort: 8008
+            protocol: TCP
+        {{- if $.Values.dendrite_config.global.profiling.enabled }}
+        env:
+          - name: PPROFLISTEN
+            value: "localhost:{{- $.Values.global.profiling.port -}}"
+        {{- end }}
+        resources:
+        {{- toYaml $.Values.resources | nindent 10 }}
+        volumeMounts:
+        - mountPath: /etc/dendrite/
+          name: {{ include "dendrite.fullname" . }}-conf-vol
+        - mountPath: /etc/dendrite/secrets/
+          name: {{ include "dendrite.fullname" . }}-signing-key
+        {{- if (gt (len ($.Files.Glob "appservices/*")) 0) }}
+        - mountPath: /etc/dendrite/appservices
+          name: {{ include "dendrite.fullname" . }}-appservices
+          readOnly: true
+        {{ end }}
+        - mountPath: {{ .Values.dendrite_config.media_api.base_path }}
+          name: {{ include "dendrite.fullname" . }}-media
+        - mountPath: {{ .Values.dendrite_config.global.jetstream.storage_path }}
+          name: {{ include "dendrite.fullname" . }}-jetstream
+        - mountPath: {{ .Values.dendrite_config.sync_api.search.index_path }}
+          name: {{ include "dendrite.fullname" . }}-search
+        livenessProbe:
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 10
+          httpGet:
+            path: /_dendrite/monitor/health
+            port: http
+        readinessProbe:
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 10
+          httpGet:
+            path: /_dendrite/monitor/health
+            port: http
+        startupProbe:
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 10
+          httpGet:
+            path: /_dendrite/monitor/up
+            port: http
\ No newline at end of file
diff --git a/helm/dendrite/templates/ingress.yaml b/helm/dendrite/templates/ingress.yaml
new file mode 100644
index 000000000..8f86ad723
--- /dev/null
+++ b/helm/dendrite/templates/ingress.yaml
@@ -0,0 +1,55 @@
+{{- if .Values.ingress.enabled -}}
+  {{- $fullName := include "dendrite.fullname" . -}}
+  {{- $svcPort := .Values.service.port -}}
+  {{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
+  {{- end }}
+  {{- end }}
+  {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+  {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+  {{- else -}}
+apiVersion: extensions/v1beta1
+  {{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "dendrite.labels" . | nindent 4 }}
+  annotations:
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.hostName | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+  {{- end }}
\ No newline at end of file
diff --git a/helm/dendrite/templates/jobs.yaml b/helm/dendrite/templates/jobs.yaml
new file mode 100644
index 000000000..76915694d
--- /dev/null
+++ b/helm/dendrite/templates/jobs.yaml
@@ -0,0 +1,99 @@
+{{ if and .Values.signing_key.create (not .Values.signing_key.existingSecret ) }}
+{{ $name := (print ( include "dendrite.fullname" . ) "-signing-key") }}
+{{ $secretName := (print ( include "dendrite.fullname" . ) "-signing-key") }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ $name }}
+  labels:
+    app.kubernetes.io/component: signingkey-job
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ $name }}
+  labels:
+    app.kubernetes.io/component: signingkey-job
+    {{- include "dendrite.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    resourceNames:
+      - {{ $secretName }}
+    verbs:
+      - get
+      - update
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ $name }}
+  labels:
+    app.kubernetes.io/component: signingkey-job
+    {{- include "dendrite.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ $name }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $name }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: generate-signing-key
+  labels:
+    {{- include "dendrite.labels" . | nindent 4 }}
+spec:
+  template:
+    spec:
+      restartPolicy: "Never"
+      serviceAccount: {{ $name }}
+      containers:
+      - name: upload-key
+        image: bitnami/kubectl
+        command:
+        - sh
+        - -c
+        - | 
+          # check if key already exists
+          key=$(kubectl get secret {{ $secretName }} -o jsonpath="{.data['signing\.key']}" 2> /dev/null)
+          [ $? -ne 0 ] && echo "Failed to get existing secret" && exit 1
+          [ -n "$key" ] && echo "Key already created, exiting." && exit 0
+          # wait for signing key
+          while [ ! -f /etc/dendrite/signing-key.pem ]; do
+            echo "Waiting for signing key.."
+            sleep 5;
+          done
+          # update secret
+          kubectl patch secret {{ $secretName }} -p "{\"data\":{\"signing.key\":\"$(base64 /etc/dendrite/signing-key.pem | tr -d '\n')\"}}"
+          [ $? -ne 0 ] && echo "Failed to update secret." && exit 1
+          echo "Signing key successfully created."
+        volumeMounts:
+        - mountPath: /etc/dendrite/
+          name: signing-key
+          readOnly: true
+      - name: generate-key
+        {{- include "image.name" $.Values.image | nindent 8 }}
+        command:
+        - sh 
+        - -c
+        - |
+          /usr/bin/generate-keys -private-key /etc/dendrite/signing-key.pem
+          chown 1001:1001 /etc/dendrite/signing-key.pem
+        volumeMounts:
+        - mountPath: /etc/dendrite/
+          name: signing-key
+      volumes:
+      - name: signing-key
+        emptyDir: {}
+  parallelism: 1
+  completions: 1
+  backoffLimit: 1
+{{ end }}
\ No newline at end of file
diff --git a/helm/dendrite/templates/pvc.yaml b/helm/dendrite/templates/pvc.yaml
new file mode 100644
index 000000000..897957e60
--- /dev/null
+++ b/helm/dendrite/templates/pvc.yaml
@@ -0,0 +1,48 @@
+{{ if not .Values.persistence.media.existingClaim }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    helm.sh/resource-policy: keep
+  name: {{ include "dendrite.fullname" . }}-media-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.media.capacity }}
+  storageClassName: {{ .Values.persistence.storageClass }}
+{{ end }}
+{{ if not .Values.persistence.jetstream.existingClaim }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    helm.sh/resource-policy: keep
+  name: {{ include "dendrite.fullname" . }}-jetstream-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.jetstream.capacity }}
+  storageClassName: {{ .Values.persistence.storageClass }}
+{{ end }}
+{{ if not .Values.persistence.search.existingClaim }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    helm.sh/resource-policy: keep
+  name: {{ include "dendrite.fullname" . }}-search-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.search.capacity }}
+  storageClassName: {{ .Values.persistence.storageClass }}
+{{ end }}
\ No newline at end of file
diff --git a/helm/dendrite/templates/secrets.yaml b/helm/dendrite/templates/secrets.yaml
new file mode 100644
index 000000000..d4b8ecbf2
--- /dev/null
+++ b/helm/dendrite/templates/secrets.yaml
@@ -0,0 +1,33 @@
+{{ if (gt (len (.Files.Glob "appservices/*")) 0) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "dendrite.fullname" . }}-appservices-conf
+  namespace: {{ .Release.Namespace }}
+type: Opaque
+data:
+{{ (.Files.Glob "appservices/*").AsSecrets | indent 2 }}
+{{ end }}
+{{ if and .Values.signing_key.create (not .Values.signing_key.existingSecret) }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  annotations:
+    helm.sh/resource-policy: keep
+  name: {{ include "dendrite.fullname" . }}-signing-key
+  namespace: {{ .Release.Namespace }}
+type: Opaque
+{{ end }}
+
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "dendrite.fullname" . }}-conf
+  namespace: {{ .Release.Namespace }}
+stringData:
+  dendrite.yaml: |
+    {{ toYaml ( mustMergeOverwrite .Values.dendrite_config  ( fromYaml (include "override.config" .) ) .Values.dendrite_config ) | nindent 4 }}
\ No newline at end of file
diff --git a/helm/dendrite/templates/service.yaml b/helm/dendrite/templates/service.yaml
new file mode 100644
index 000000000..365a43f04
--- /dev/null
+++ b/helm/dendrite/templates/service.yaml
@@ -0,0 +1,17 @@
+{{ template "validate.config" . }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ $.Release.Namespace }}
+  name: {{ include "dendrite.fullname" . }}
+  labels:
+    {{- include "dendrite.labels" . | nindent 4 }}
+spec:
+  selector:
+    {{- include "dendrite.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8008
+      targetPort: 8008
\ No newline at end of file
diff --git a/helm/dendrite/templates/tests/test-version.yaml b/helm/dendrite/templates/tests/test-version.yaml
new file mode 100644
index 000000000..d88751325
--- /dev/null
+++ b/helm/dendrite/templates/tests/test-version.yaml
@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "dendrite.fullname" . }}-test-version"
+  labels:
+    {{- include "dendrite.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: curl
+      image: curlimages/curl
+      imagePullPolicy: IfNotPresent
+      args:
+        - 'http://{{- include "dendrite.fullname" . -}}:8008/_matrix/client/versions'
+  restartPolicy: Never
diff --git a/helm/dendrite/values.yaml b/helm/dendrite/values.yaml
new file mode 100644
index 000000000..2c6e80942
--- /dev/null
+++ b/helm/dendrite/values.yaml
@@ -0,0 +1,348 @@
+image:
+  # -- Docker repository/image to use
+  name: "ghcr.io/matrix-org/dendrite-monolith:v0.10.8"
+  # -- Kubernetes pullPolicy
+  pullPolicy: IfNotPresent
+
+
+# signing key to use
+signing_key:
+  # -- Create a new signing key, if not exists
+  create: true
+  # -- Use an existing secret
+  existingSecret: ""
+
+# -- Default resource requests/limits.
+# @default -- sets some sane default values
+resources:
+  requests:
+    memory: "512Mi"
+
+  limits:
+    memory: "4096Mi"
+
+persistence:
+  # -- The storage class to use for volume claims. Defaults to the
+  # cluster default storage class.
+  storageClass: ""
+  jetstream:
+    # -- Use an existing volume claim for jetstream
+    existingClaim: ""
+    # -- PVC Storage Request for the jetstream volume
+    capacity: "1Gi"
+  media:
+    # -- Use an existing volume claim for media files
+    existingClaim: ""
+    # -- PVC Storage Request for the media volume
+    capacity: "1Gi"
+  search:
+    # -- Use an existing volume claim for the fulltext search index
+    existingClaim: ""
+    # -- PVC Storage Request for the search volume
+    capacity: "1Gi"
+
+dendrite_config:
+  version: 2
+  global:
+    # -- **REQUIRED** Servername for this Dendrite deployment.
+    server_name: ""
+
+    # -- The private key to use. (**NOTE**: This is overriden in Helm)
+    private_key: /etc/dendrite/secrets/signing.key
+
+    # -- The server name to delegate server-server communications to, with optional port
+    # e.g. localhost:443
+    well_known_server_name: ""
+
+    # -- The server name to delegate client-server communications to, with optional port
+    # e.g. localhost:443
+    well_known_client_name: ""
+
+    # -- Lists of domains that the server will trust as identity servers to verify third
+    # party identifiers such as phone numbers and email addresses.
+    trusted_third_party_id_servers:
+      - matrix.org
+      - vector.im
+
+    # -- The paths and expiry timestamps (as a UNIX timestamp in millisecond precision)
+    # to old signing keys that were formerly in use on this domain name. These
+    # keys will not be used for federation request or event signing, but will be
+    # provided to any other homeserver that asks when trying to verify old events.
+    old_private_keys:
+    #  If the old private key file is available:
+    #  - private_key: old_matrix_key.pem
+    #    expired_at: 1601024554498
+    #  If only the public key (in base64 format) and key ID are known:
+    #  - public_key: mn59Kxfdq9VziYHSBzI7+EDPDcBS2Xl7jeUdiiQcOnM=
+    #    key_id: ed25519:mykeyid
+    #    expired_at: 1601024554498
+
+    # -- Disable federation. Dendrite will not be able to make any outbound HTTP requests
+    # to other servers and the federation API will not be exposed.
+    disable_federation: false
+
+    key_validity_period: 168h0m0s
+
+    database:
+      # -- The connection string for connections to Postgres.
+      # This will be set automatically if using the Postgres dependency
+      connection_string: ""
+
+      # -- Default database maximum open connections
+      max_open_conns: 90
+      # -- Default database maximum idle connections
+      max_idle_conns: 5
+      # -- Default database maximum lifetime
+      conn_max_lifetime: -1
+
+    jetstream:
+      # -- Persistent directory to store JetStream streams in.
+      storage_path: "/data/jetstream"
+      # -- NATS JetStream server addresses if not using internal NATS.
+      addresses: []
+      # -- The prefix for JetStream streams
+      topic_prefix: "Dendrite"
+      # -- Keep all data in memory. (**NOTE**: This is overriden in Helm to `false`)
+      in_memory: false
+      # -- Disables TLS validation. This should **NOT** be used in production.
+      disable_tls_validation: true
+
+    cache:
+      # -- The estimated maximum size for the global cache in bytes, or in terabytes,
+      # gigabytes, megabytes or kilobytes when the appropriate 'tb', 'gb', 'mb' or
+      # 'kb' suffix is specified. Note that this is not a hard limit, nor is it a
+      # memory limit for the entire process. A cache that is too small may ultimately
+      # provide little or no benefit.
+      max_size_estimated: 1gb
+      # -- The maximum amount of time that a cache entry can live for in memory before
+      # it will be evicted and/or refreshed from the database. Lower values result in
+      # easier admission of new cache entries but may also increase database load in
+      # comparison to higher values, so adjust conservatively. Higher values may make
+      # it harder for new items to make it into the cache, e.g. if new rooms suddenly
+      # become popular.
+      max_age: 1h
+
+    report_stats:
+      # -- Configures phone-home statistics reporting. These statistics contain the server
+      # name, number of active users and some information on your deployment config.
+      # We use this information to understand how Dendrite is being used in the wild.
+      enabled: false
+      # -- Endpoint to report statistics to.
+      endpoint: https://matrix.org/report-usage-stats/push
+
+    presence:
+      # -- Controls whether we receive presence events from other servers
+      enable_inbound: false
+      # -- Controls whether we send presence events for our local users to other servers.
+      # (_May increase CPU/memory usage_)
+      enable_outbound: false
+
+    server_notices:
+      # -- Server notices allows server admins to send messages to all users on the server.
+      enabled: false
+      # -- The local part for the user sending server notices.
+      local_part: "_server"
+      # -- The display name for the user sending server notices.
+      display_name: "Server Alerts"
+      # -- The avatar URL (as a mxc:// URL) name for the user sending server notices.
+      avatar_url: ""
+      # The room name to be used when sending server notices. This room name will
+      # appear in user clients.
+      room_name: "Server Alerts"
+
+    # prometheus metrics
+    metrics:
+      # -- Whether or not Prometheus metrics are enabled.
+      enabled: false
+      # HTTP basic authentication to protect access to monitoring.
+      basic_auth:
+        # -- HTTP basic authentication username
+        user: "metrics"
+        # -- HTTP basic authentication password
+        password: metrics
+
+    dns_cache:
+      # -- Whether or not the DNS cache is enabled.
+      enabled: false
+      # -- Maximum number of entries to hold in the DNS cache
+      cache_size: 256
+      # -- Duration for how long DNS cache items should be considered valid ([see time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more)
+      cache_lifetime: "10m"
+
+    profiling:
+      # -- Enable pprof. You will need to manually create a port forwarding to the deployment to access PPROF,
+      # as it will only listen on localhost and the defined port.
+      # e.g. `kubectl port-forward deployments/dendrite 65432:65432`
+      enabled: false
+      # -- pprof port, if enabled
+      port: 65432
+
+  # -- Configuration for experimental MSC's. (Valid values are: msc2836 and msc2946)
+  mscs:
+    mscs:
+      - msc2946
+      # A list of enabled MSC's
+      # Currently valid values are:
+      # - msc2836    (Threading, see https://github.com/matrix-org/matrix-doc/pull/2836)
+      # - msc2946    (Spaces Summary, see https://github.com/matrix-org/matrix-doc/pull/2946)
+
+
+  app_service_api:
+    # -- Disable the validation of TLS certificates of appservices. This is
+    # not recommended in production since it may allow appservice traffic
+    # to be sent to an insecure endpoint.
+    disable_tls_validation: false
+    # -- Appservice config files to load on startup. (**NOTE**: This is overriden by Helm, if a folder `./appservices/` exists)
+    config_files: []
+
+  client_api:
+    # -- Prevents new users from being able to register on this homeserver, except when
+    # using the registration shared secret below.
+    registration_disabled: true
+
+    # Prevents new guest accounts from being created. Guest registration is also
+    # disabled implicitly by setting 'registration_disabled' above.
+    guests_disabled: true
+
+    # -- If set, allows registration by anyone who knows the shared secret, regardless of
+    # whether registration is otherwise disabled.
+    registration_shared_secret: ""
+
+    # -- enable reCAPTCHA registration
+    enable_registration_captcha: false
+    # -- reCAPTCHA public key
+    recaptcha_public_key: ""
+    # -- reCAPTCHA private key
+    recaptcha_private_key: ""
+    # -- reCAPTCHA bypass secret
+    recaptcha_bypass_secret: ""
+    recaptcha_siteverify_api: ""
+
+    # TURN server information that this homeserver should send to clients.
+    turn:
+      # -- Duration for how long users should be considered valid ([see time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more)
+      turn_user_lifetime: "24h"
+      turn_uris: []
+      turn_shared_secret: ""
+      # -- The TURN username
+      turn_username: ""
+      # -- The TURN password
+      turn_password: ""
+
+    rate_limiting:
+      # -- Enable rate limiting
+      enabled: true
+      # -- After how many requests a rate limit should be activated
+      threshold: 20
+      # -- Cooloff time in milliseconds
+      cooloff_ms: 500
+      # -- Users which should be exempt from rate limiting
+      exempt_user_ids:
+
+  federation_api:
+    # -- Federation failure threshold. How many consecutive failures that we should
+    # tolerate when sending federation requests to a specific server. The backoff
+    # is 2**x seconds, so 1 = 2 seconds, 2 = 4 seconds, 3 = 8 seconds, etc.
+    # The default value is 16 if not specified, which is circa 18 hours.
+    send_max_retries: 16
+    # -- Disable TLS validation. This should **NOT** be used in production.
+    disable_tls_validation: false
+    prefer_direct_fetch: false
+    # -- Prevents Dendrite from keeping HTTP connections
+    # open for reuse for future requests. Connections will be closed quicker
+    # but we may spend more time on TLS handshakes instead.
+    disable_http_keepalives: false
+    # -- Perspective keyservers, to use as a backup when direct key fetch
+    # requests don't succeed.
+    # @default -- See value.yaml
+    key_perspectives:
+      - server_name: matrix.org
+        keys:
+          - key_id: ed25519:auto
+            public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw
+          - key_id: ed25519:a_RXGa
+            public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ
+
+  media_api:
+    # -- The path to store media files (e.g. avatars) in
+    base_path: "/data/media_store"
+    # -- The max file size for uploaded media files
+    max_file_size_bytes: 10485760
+    # Whether to dynamically generate thumbnails if needed.
+    dynamic_thumbnails: false
+    # -- The maximum number of simultaneous thumbnail generators to run.
+    max_thumbnail_generators: 10
+    # -- A list of thumbnail sizes to be generated for media content.
+    # @default -- See value.yaml
+    thumbnail_sizes:
+      - width: 32
+        height: 32
+        method: crop
+      - width: 96
+        height: 96
+        method: crop
+      - width: 640
+        height: 480
+        method: scale
+
+  sync_api:
+    # -- This option controls which HTTP header to inspect to find the real remote IP
+    # address of the client. This is likely required if Dendrite is running behind
+    # a reverse proxy server.
+    real_ip_header: X-Real-IP
+    # -- Configuration for the full-text search engine.
+    search:
+      # -- Whether fulltext search is enabled.
+      enabled: true
+      # -- The path to store the search index in.
+      index_path: "/data/search"
+      # -- The language most likely to be used on the server - used when indexing, to
+      # ensure the returned results match expectations. A full list of possible languages
+      # can be found [here](https://github.com/matrix-org/dendrite/blob/76db8e90defdfb9e61f6caea8a312c5d60bcc005/internal/fulltext/bleve.go#L25-L46)
+      language: "en"
+
+  user_api:
+    # -- bcrypt cost to use when hashing passwords.
+    # (ranges from 4-31; 4 being least secure, 31 being most secure; _NOTE: Using a too high value can cause clients to timeout and uses more CPU._)
+    bcrypt_cost: 10
+    # -- OpenID Token lifetime in milliseconds.
+    openid_token_lifetime_ms: 3600000
+    # - Disable TLS validation when hitting push gateways. This should **NOT** be used in production.
+    push_gateway_disable_tls_validation: false
+    # -- Rooms to join users to after registration
+    auto_join_rooms: []
+
+  # -- Default logging configuration
+  logging:
+  - type: std
+    level: info
+
+postgresql:
+  # -- Enable and configure postgres as the database for dendrite.
+  # @default -- See value.yaml
+  enabled: false
+  image:
+    repository: bitnami/postgresql
+    tag: "15.1.0"
+  auth:
+    username: dendrite
+    password: changeme
+    database: dendrite
+
+  persistence:
+    enabled: false
+
+ingress:
+  # -- Create an ingress for a monolith deployment
+  enabled: false
+  hosts: []
+  className: ""
+  hostName: ""
+  # -- Extra, custom annotations
+  annotations: {}
+
+  tls: []
+
+service:
+  type: ClusterIP
+  port: 80
diff --git a/setup/config/config.go b/setup/config/config.go
index 6523a2452..41d2b6674 100644
--- a/setup/config/config.go
+++ b/setup/config/config.go
@@ -228,7 +228,7 @@ func loadConfig(
 
 	privateKeyPath := absPath(basePath, c.Global.PrivateKeyPath)
 	if c.Global.KeyID, c.Global.PrivateKey, err = LoadMatrixKey(privateKeyPath, readFile); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to load private_key: %w", err)
 	}
 
 	for _, v := range c.Global.VirtualHosts {
@@ -242,7 +242,7 @@ func loadConfig(
 		}
 		privateKeyPath := absPath(basePath, v.PrivateKeyPath)
 		if v.KeyID, v.PrivateKey, err = LoadMatrixKey(privateKeyPath, readFile); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to load private_key for virtualhost %s: %w", v.ServerName, err)
 		}
 	}