Gophish

Gophish is an open-source phishing awareness platform for authorized security training and simulation programs. The HelmForge chart installs Gophish 0.12.1 with separate admin and phishing Services, private-by-default access, SQLite persistence, optional HelmForge MySQL, external MySQL support, NetworkPolicy, and SQLite backup.

Key Features

• Separated traffic — dedicated admin and phishing Services and ingresses
• Safe defaults — admin ingress disabled, phishing ingress disabled, one replica, PVC-backed SQLite
• Secret-backed config — generated config.json is rendered as a Secret with an existing Secret override
• Database choices — SQLite default, HelmForge MySQL dependency, or external MySQL DSN Secret
• NetworkPolicy — separate admin, phishing, database, DNS, and SMTP egress controls
• SQLite backup — optional CronJob uploads archive and checksum to S3-compatible storage

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install gophish helmforge/gophish --namespace gophish --create-namespace

OCI registry:

helm install gophish oci://ghcr.io/helmforgedev/helm/gophish --namespace gophish --create-namespace

Access

The admin UI is private by default:

kubectl port-forward svc/gophish-gophish-admin 3333:3333 -n gophish

Open http://127.0.0.1:3333.

The generated initial admin password is written to first-start logs:

kubectl logs deploy/gophish-gophish -n gophish | grep "Please login with the username admin"

Change the password immediately after the first login and avoid copying it into tickets, values files, or PRs.

Deployment Examples

replicaCount: 1

persistence:
  enabled: true
  size: 5Gi

phishIngress:
  enabled: true
  hosts:
    - host: training.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: gophish-phish-tls
      hosts:
        - training.example.com

database:
  mode: external
  external:
    host: mysql.database.svc.cluster.local
    port: 3306
    name: gophish
    username: gophish
    existingSecret: gophish-db
    existingSecretDsnKey: dsn

database:
  mode: external
  external:
    host: mysql.database.svc.cluster.local
    name: gophish
    username: gophish
    existingSecret: gophish-db
    existingSecretDsnKey: dsn

phishIngress:
  enabled: true
  hosts:
    - host: training.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: gophish-phish-tls
      hosts:
        - training.example.com

networkPolicy:
  enabled: true
  admin:
    ipBlocks:
      - cidr: 10.10.0.0/16
  phish:
    namespaceSelectors:
      - matchLabels:
          kubernetes.io/metadata.name: ingress-system
  egress:
    externalDatabase:
      enabled: true
      cidrs:
        - 10.0.0.0/8

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: gophish-backups
    prefix: gophish
    existingSecret: gophish-backup

Admin Ingress

Admin ingress is disabled by default and requires TLS when enabled:

adminIngress:
  enabled: true
  tls:
    - secretName: gophish-admin-tls
      hosts:
        - gophish-admin.example.com
  hosts:
    - host: gophish-admin.example.com
      paths:
        - path: /
          pathType: Prefix

Use gophish.adminServer.trustedOrigins when a proxy or ingress terminates TLS and Gophish must trust the external origin.

Database Notes

SQLite is the default and requires replicaCount: 1. Embedded MySQL uses the HelmForge MySQL dependency and sets mysql.config.myCnf to sql_mode=NO_ENGINE_SUBSTITUTION because Gophish 0.12.1 bootstraps zero-date values that MySQL 8.4 rejects under strict zero-date modes.

External MySQL should use database.external.existingSecret with a complete DSN. Inline external passwords are blocked unless database.external.allowInlinePassword=true, which is intended only for local tests.

Backup Notes

Chart-managed backup covers SQLite mode only. It archives the chart-managed PVC path containing the SQLite database, writes a SHA256 checksum, and uploads both files with docker.io/helmforge/mc:1.0.0.

Embedded MySQL and external MySQL backup are delegated to MySQL-specific backup tooling.

Values Reference

Troubleshooting

• Admin UI not reachable — check the admin Service, port-forward command, ingress host, and TLS Secret.
• Phishing endpoint not reachable — check phishIngress, DNS, ingress controller namespace policy, and the phish Service.
• SQLite PVC permission problems — confirm the PVC is bound and the pod runs with the default fsGroup.
• MySQL DSN errors — confirm the DSN Secret key and MySQL sql_mode compatibility.
• Ingress TLS mismatch — align ingress TLS termination with native Gophish TLS settings.
• Trusted origins or CSRF errors — add the external admin origin to gophish.adminServer.trustedOrigins.
• Backup failures — inspect backup Job logs, S3 endpoint reachability, and the S3 credential Secret.
• Image pull errors — confirm access to docker.io/gophish/gophish:0.12.1 and the HelmForge uploader image.

More Information

• Gophish upstream
• Gophish source
• Chart source