Gophish

Gophish is an open-source phishing awareness platform for authorized security training and simulation programs. The HelmForge chart installs Gophish 0.12.1 with separate admin and phishing Services, private-by-default access, SQLite persistence, optional HelmForge MySQL, external MySQL support, NetworkPolicy, and SQLite backup.

Key Features

• Separated traffic — dedicated admin and phishing Services and ingresses
• Safe defaults — admin ingress disabled, phishing ingress disabled, one replica, PVC-backed SQLite
• Secret-backed config — generated config.json is rendered as a Secret with an existing Secret override
• Database choices — SQLite default, HelmForge MySQL dependency, or external MySQL DSN Secret
• NetworkPolicy — separate admin, phishing, database, DNS, and SMTP egress controls
• Gateway API — optional HTTPRoutes for admin and phishing listeners with separate parentRefs
• Dual-stack Services — optional IP family policy and families for admin and phishing Services
• SQLite backup — optional CronJob uploads archive and checksum to S3-compatible storage

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install gophish helmforge/gophish --namespace gophish --create-namespace

OCI registry:

helm install gophish oci://ghcr.io/helmforgedev/helm/gophish --namespace gophish --create-namespace

Access

The admin UI is private by default:

kubectl port-forward svc/gophish-gophish-admin 3333:3333 -n gophish

Open http://127.0.0.1:3333.

The generated initial admin password is written to first-start logs:

kubectl logs deploy/gophish-gophish -n gophish | grep "Please login with the username admin"

Change the password immediately after the first login and avoid copying it into tickets, values files, or PRs.

Deployment Examples

replicaCount: 1

persistence:
  enabled: true
  size: 5Gi

phishIngress:
  enabled: true
  hosts:
    - host: training.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: gophish-phish-tls
      hosts:
        - training.example.com

database:
  mode: external
  external:
    host: mysql.database.svc.cluster.local
    port: 3306
    name: gophish
    username: gophish
    existingSecret: gophish-db
    existingSecretDsnKey: dsn

database:
  mode: external
  external:
    host: mysql.database.svc.cluster.local
    name: gophish
    username: gophish
    existingSecret: gophish-db
    existingSecretDsnKey: dsn

phishIngress:
  enabled: true
  hosts:
    - host: training.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: gophish-phish-tls
      hosts:
        - training.example.com

networkPolicy:
  enabled: true
  admin:
    ipBlocks:
      - cidr: 10.10.0.0/16
  phish:
    namespaceSelectors:
      - matchLabels:
          kubernetes.io/metadata.name: ingress-system
  egress:
    externalDatabase:
      enabled: true
      cidrs:
        - 10.0.0.0/8

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: gophish-backups
    prefix: gophish
    existingSecret: gophish-backup

gateway:
  enabled: true
  admin:
    enabled: true
    parentRefs:
      - name: internal-gateway
        namespace: gateway-system
        sectionName: https
    hostnames:
      - gophish-admin.example.com
  phish:
    enabled: true
    parentRefs:
      - name: public-gateway
        namespace: gateway-system
        sectionName: https
    hostnames:
      - training.example.com

Admin Ingress

Admin ingress is disabled by default and requires TLS when enabled:

adminIngress:
  enabled: true
  tls:
    - secretName: gophish-admin-tls
      hosts:
        - gophish-admin.example.com
  hosts:
    - host: gophish-admin.example.com
      paths:
        - path: /
          pathType: Prefix

Use gophish.adminServer.trustedOrigins when a proxy or ingress terminates TLS and Gophish must trust the external origin.

Gateway API

Use Gateway API when an existing Gateway controller owns ingress and the chart should create HTTPRoutes instead of classic Ingress objects. Admin and phishing routes are configured independently so the admin UI can stay on an internal listener while the phishing listener uses a public Gateway.

gateway:
  enabled: true
  admin:
    enabled: true
    parentRefs:
      - name: internal-gateway
        namespace: gateway-system
    hostnames:
      - gophish-admin.example.com
  phish:
    enabled: true
    parentRefs:
      - name: public-gateway
        namespace: gateway-system
    hostnames:
      - training.example.com

Database Notes

SQLite is the default and requires replicaCount: 1. Embedded MySQL uses the HelmForge MySQL dependency and sets mysql.config.myCnf to sql_mode=NO_ENGINE_SUBSTITUTION because Gophish 0.12.1 bootstraps zero-date values that MySQL 8.4 rejects under strict zero-date modes.

External MySQL should use database.external.existingSecret with a complete DSN. Inline external passwords are blocked unless database.external.allowInlinePassword=true, which is intended only for local tests.

Backup Notes

Chart-managed backup covers SQLite mode only. It archives the chart-managed PVC path containing the SQLite database, writes a SHA256 checksum, and uploads both files with docker.io/helmforge/mc:1.0.0.

Embedded MySQL and external MySQL backup are delegated to MySQL-specific backup tooling.

Values Reference

Troubleshooting

• Admin UI not reachable — check the admin Service, port-forward command, ingress host, and TLS Secret.
• Phishing endpoint not reachable — check phishIngress, DNS, ingress controller namespace policy, and the phish Service.
• SQLite PVC permission problems — confirm the PVC is bound and the pod runs with the default fsGroup.
• MySQL DSN errors — confirm the DSN Secret key and MySQL sql_mode compatibility.
• Ingress TLS mismatch — align ingress TLS termination with native Gophish TLS settings.
• Trusted origins or CSRF errors — add the external admin origin to gophish.adminServer.trustedOrigins.
• Backup failures — inspect backup Job logs, S3 endpoint reachability, and the S3 credential Secret.
• Image pull errors — confirm access to docker.io/gophish/gophish:0.12.1 and the HelmForge uploader image.

More Information

• Gophish upstream
• Gophish source
• Chart source