diff --git a/oci/charts/apps/accounts/Chart.lock b/oci/charts/apps/accounts/Chart.lock
new file mode 100644
index 0000000..d50b60a
--- /dev/null
+++ b/oci/charts/apps/accounts/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: app-service
+  repository: file://../app-service
+  version: 0.1.0
+digest: sha256:29102607dbddc890cc60258ec869b75fd9e5f995fc8c5ee1f1a31b046b80e407
+generated: "2026-04-02T17:55:26.238504+08:00"
diff --git a/oci/charts/apps/accounts/Chart.yaml b/oci/charts/apps/accounts/Chart.yaml
new file mode 100644
index 0000000..fee99d0
--- /dev/null
+++ b/oci/charts/apps/accounts/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: accounts-chart
+description: Accounts service chart backed by the shared app-service subchart
+type: application
+version: 0.1.0
+appVersion: "1.0.0"
+dependencies:
+  - name: app-service
+    version: 0.1.0
+    repository: file://../app-service
+    alias: service
diff --git a/oci/charts/apps/accounts/charts/app-service-0.1.0.tgz b/oci/charts/apps/accounts/charts/app-service-0.1.0.tgz
new file mode 100644
index 0000000..1d6f738
Binary files /dev/null and b/oci/charts/apps/accounts/charts/app-service-0.1.0.tgz differ
diff --git a/oci/charts/apps/accounts/values.yaml b/oci/charts/apps/accounts/values.yaml
new file mode 100644
index 0000000..82a48a1
--- /dev/null
+++ b/oci/charts/apps/accounts/values.yaml
@@ -0,0 +1,25 @@
+service:
+  nameOverride: accounts
+  containerPort: 8080
+  service:
+    port: 80
+  global:
+    existingSecretName: accounts-env
+    repository: ghcr.io/x-evor/accounts
+    tag: latest
+    env:
+      PORT: "8080"
+      SERVICE_NAME: accounts
+      HEALTHCHECK_PATH: /healthz
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 10
+    periodSeconds: 10
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 30
+    periodSeconds: 20
diff --git a/oci/charts/apps/app-service/templates/deployment.yaml b/oci/charts/apps/app-service/templates/deployment.yaml
index 28b0850..0f5fadd 100644
--- a/oci/charts/apps/app-service/templates/deployment.yaml
+++ b/oci/charts/apps/app-service/templates/deployment.yaml
@@ -1,3 +1,22 @@
+{{- $global := .Values.global | default dict -}}
+{{- $globalRepository := $global.repository | default "" -}}
+{{- $globalTag := $global.tag | default "" -}}
+{{- $globalEnv := $global.env | default dict -}}
+{{- $localEnv := .Values.env | default dict -}}
+{{- $env := mergeOverwrite (deepCopy $globalEnv) $localEnv -}}
+{{- $existingSecretName := .Values.existingSecretName | default ($global.existingSecretName | default "") -}}
+{{- $imageRepository := default $globalRepository .Values.image.repository -}}
+{{- $imageTag := default $globalTag .Values.image.tag -}}
+{{- $globalEnvFromSecretRefs := $global.envFromSecretRefs | default list -}}
+{{- $localEnvFromSecretRefs := .Values.envFromSecretRefs | default list -}}
+{{- $envFromSecretRefs := concat $globalEnvFromSecretRefs $localEnvFromSecretRefs -}}
+{{- $globalExternalServices := index $global "external-service" | default list -}}
+{{- $localExternalServices := index .Values "external-service" | default list -}}
+{{- $externalServices := concat $globalExternalServices $localExternalServices -}}
+{{- if $externalServices -}}
+{{- $_ := set $env "EXTERNAL_SERVICES" (join "," $externalServices) -}}
+{{- end -}}
+
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -24,8 +43,8 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       annotations:
-        {{- if and .Values.reloader.enabled .Values.existingSecretName }}
-        secret.reloader.stakater.com/reload: {{ default .Values.existingSecretName .Values.reloader.secretMatch | quote }}
+        {{- if and .Values.reloader.enabled $existingSecretName }}
+        secret.reloader.stakater.com/reload: {{ default $existingSecretName .Values.reloader.secretMatch | quote }}
         {{- end }}
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
@@ -50,34 +69,60 @@ spec:
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: app
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          image: "{{ $imageRepository }}:{{ $imageTag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- with .Values.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if .Values.workingDir }}
+          workingDir: {{ .Values.workingDir | quote }}
+          {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.containerPort }}
-          {{- if .Values.env }}
+          {{- if $env }}
           env:
-            {{- range $key, $value := .Values.env }}
+            {{- range $key := keys $env | sortAlpha }}
             - name: {{ $key }}
-              value: {{ $value | quote }}
+              value: {{ index $env $key | quote }}
             {{- end }}
           {{- end }}
-          {{- if or .Values.existingSecretName .Values.envFromSecretRefs }}
+          {{- if or $existingSecretName $envFromSecretRefs }}
           envFrom:
-            {{- if .Values.existingSecretName }}
+            {{- if $existingSecretName }}
             - secretRef:
-                name: {{ .Values.existingSecretName }}
+                name: {{ $existingSecretName }}
             {{- end }}
-            {{- range .Values.envFromSecretRefs }}
+            {{- range $envFromSecretRefs }}
             - secretRef:
                 name: {{ . }}
             {{- end }}
           {{- end }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           readinessProbe:
             {{- toYaml .Values.readinessProbe | nindent 12 }}
           livenessProbe:
             {{- toYaml .Values.livenessProbe | nindent 12 }}
+        {{- with .Values.extraContainers }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/oci/charts/apps/app-service/values.yaml b/oci/charts/apps/app-service/values.yaml
index a715d44..d81f0ce 100644
--- a/oci/charts/apps/app-service/values.yaml
+++ b/oci/charts/apps/app-service/values.yaml
@@ -4,11 +4,15 @@ fullnameOverride: ""
 replicaCount: 1
 
 image:
-  repository: ghcr.io/example/app
-  tag: latest
+  repository: ""
+  tag: ""
   pullPolicy: IfNotPresent
   pullSecrets: []
 
+command: []
+args: []
+workingDir: ""
+
 containerPort: 8080
 
 service:
@@ -30,9 +34,23 @@ serviceAccount:
   name: ""
   annotations: {}
 
+global:
+  repository: ""
+  tag: ""
+  env: {}
+  existingSecretName: ""
+  external-service: []
+  envFromSecretRefs: []
+
+# Local overrides remain available for backwards compatibility.
 env: {}
 existingSecretName: ""
+external-service: []
 envFromSecretRefs: []
+initContainers: []
+extraContainers: []
+volumeMounts: []
+volumes: []
 
 resources:
   requests:
diff --git a/oci/charts/apps/console/Chart.lock b/oci/charts/apps/console/Chart.lock
new file mode 100644
index 0000000..9765ae1
--- /dev/null
+++ b/oci/charts/apps/console/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: app-service
+  repository: file://../app-service
+  version: 0.1.0
+digest: sha256:29102607dbddc890cc60258ec869b75fd9e5f995fc8c5ee1f1a31b046b80e407
+generated: "2026-04-02T17:55:26.213216+08:00"
diff --git a/oci/charts/apps/console/Chart.yaml b/oci/charts/apps/console/Chart.yaml
new file mode 100644
index 0000000..1837f1f
--- /dev/null
+++ b/oci/charts/apps/console/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: console-chart
+description: Console service chart backed by the shared app-service subchart
+type: application
+version: 0.1.0
+appVersion: "1.0.0"
+dependencies:
+  - name: app-service
+    version: 0.1.0
+    repository: file://../app-service
+    alias: service
diff --git a/oci/charts/apps/console/charts/app-service-0.1.0.tgz b/oci/charts/apps/console/charts/app-service-0.1.0.tgz
new file mode 100644
index 0000000..1d6f738
Binary files /dev/null and b/oci/charts/apps/console/charts/app-service-0.1.0.tgz differ
diff --git a/oci/charts/apps/console/values.yaml b/oci/charts/apps/console/values.yaml
new file mode 100644
index 0000000..cbddb07
--- /dev/null
+++ b/oci/charts/apps/console/values.yaml
@@ -0,0 +1,31 @@
+service:
+  nameOverride: console
+  containerPort: 3000
+  service:
+    port: 80
+  global:
+    existingSecretName: console-env
+    repository: ghcr.io/x-evor/console
+    tag: latest
+    env:
+      PORT: "3000"
+      SERVICE_NAME: console
+      HEALTHCHECK_PATH: /
+      DOCS_SERVICE_URL: https://docs.svc.plus
+      NEXT_PUBLIC_DOCS_BASE_URL: https://docs.svc.plus
+    external-service:
+      - docs.svc.plus
+      - xworkmate.svc.plus
+      - openclaw-gateway.svc.plus
+  readinessProbe:
+    httpGet:
+      path: /
+      port: http
+    initialDelaySeconds: 10
+    periodSeconds: 10
+  livenessProbe:
+    httpGet:
+      path: /
+      port: http
+    initialDelaySeconds: 30
+    periodSeconds: 20
diff --git a/oci/charts/apps/rag-server/Chart.lock b/oci/charts/apps/rag-server/Chart.lock
new file mode 100644
index 0000000..cbd3bf2
--- /dev/null
+++ b/oci/charts/apps/rag-server/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: app-service
+  repository: file://../app-service
+  version: 0.1.0
+digest: sha256:29102607dbddc890cc60258ec869b75fd9e5f995fc8c5ee1f1a31b046b80e407
+generated: "2026-04-02T17:55:26.26398+08:00"
diff --git a/oci/charts/apps/rag-server/Chart.yaml b/oci/charts/apps/rag-server/Chart.yaml
new file mode 100644
index 0000000..0b23eca
--- /dev/null
+++ b/oci/charts/apps/rag-server/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: rag-server-chart
+description: RAG server chart backed by the shared app-service subchart
+type: application
+version: 0.1.0
+appVersion: "1.0.0"
+dependencies:
+  - name: app-service
+    version: 0.1.0
+    repository: file://../app-service
+    alias: service
diff --git a/oci/charts/apps/rag-server/charts/app-service-0.1.0.tgz b/oci/charts/apps/rag-server/charts/app-service-0.1.0.tgz
new file mode 100644
index 0000000..1d6f738
Binary files /dev/null and b/oci/charts/apps/rag-server/charts/app-service-0.1.0.tgz differ
diff --git a/oci/charts/apps/rag-server/values.yaml b/oci/charts/apps/rag-server/values.yaml
new file mode 100644
index 0000000..1205208
--- /dev/null
+++ b/oci/charts/apps/rag-server/values.yaml
@@ -0,0 +1,25 @@
+service:
+  nameOverride: rag-server
+  containerPort: 8080
+  service:
+    port: 80
+  global:
+    existingSecretName: rag-server-env
+    repository: ghcr.io/x-evor/rag-server
+    tag: latest
+    env:
+      PORT: "8080"
+      SERVICE_NAME: rag-server
+      HEALTHCHECK_PATH: /healthz
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 10
+    periodSeconds: 10
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 30
+    periodSeconds: 20