> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thoras.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# FIPS mode

> Run Thoras with images whose cryptography uses FIPS 140-3 validated modules.

FIPS mode runs the FIPS variants of every Thoras image. It needs chart 5.11.0 or
newer with `thorasVersion` 4.132.0 or newer, which is the first release that
publishes `-fips` images.

## What changes

* Every Thoras image tag gets a `-fips` suffix: `thorasVersion` `4.132.0` pulls
  `services:4.132.0-fips`. A per-component `imageTag` override gets the same
  suffix. A tag that already ends in `-fips` is used as is, and a tag with a
  digest fails the render, because a digest cannot take the suffix.
* The Go binaries (the `services` image and oauth2-proxy) run with
  `GODEBUG=fips140=on` and use the Go Cryptographic Module v1.0.0
  ([CMVP certificate 5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247)).
* The forecast worker image uses the UBI 9 system OpenSSL with the Red Hat FIPS
  provider enforced.
* The oauth2-proxy sidecar uses `thorasDashboard.auth.fipsImageTag`.

FIPS mode on the nodes themselves (kernel and operating system) is configured on
your side; the images carry their own validated modules either way.

## Requirements

The chart refuses to render unless all of these are set:

* **An external database.** The bundled TimescaleDB has no FIPS build. Set
  `externalTimescale` and run the database on your own FIPS platform. The DSN
  must contain `sslmode=verify-full` exactly once, and the database password
  must be at least 14 bytes, because FIPS mode rejects shorter HMAC keys. See
  [External TimescaleDB](https://docs.thoras.ai/installation/persistent-storage.md#external-timescaledb-byodb).
* **No htpasswd dashboard sign-in.** It checks a bcrypt hash, which is not FIPS
  approved. Use OIDC (`thorasDashboard.auth.mode: oidc`), turn dashboard auth
  off and put your own in front, or turn the dashboard off. See
  [Dashboard authentication](https://docs.thoras.ai/guides/dashboard-auth).
* **cert-manager for the webhook certificates**
  (`thorasOperator.webhookCertGen.certManager.enabled: true`). The
  kube-webhook-certgen Jobs are not used.

With these settings no third-party image except oauth2-proxy runs: no
TimescaleDB, `alpine`, `httpd` or `kube-webhook-certgen`.

## Example values

```yaml theme={null}
fips:
  enabled: true
externalTimescale:
  secretRefName: thoras-timescale-dsn
  secretRefKey: dsn # postgres://...?sslmode=verify-full
thorasOperator:
  webhookCertGen:
    certManager:
      enabled: true
thorasDashboard:
  auth:
    mode: oidc
    oidc:
      issuerURL: https://idp.example.com
      redirectURL: https://thoras.example.com/oauth2/callback
      existingSecret:
        secretName: oauth2-proxy-secrets
```

Do not override `GODEBUG` with `fips140=only`: oauth2-proxy does not start in
that mode. A `GODEBUG` you set in `env` is applied after the chart's, so the
container keeps yours.

## Further reading

* [FIPS mode in the chart README](https://github.com/thoras-ai/helm-charts/tree/main/charts/thoras#fips-mode)
  for the exact render-time checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.