# Production values template — copy and customize for YOUR environment.
#
# Full step-by-step (from zero, any cluster):
#   See RUNBOOK-DEPLOY.fa.md — Phase 2 (values) and Phase 3 (secrets)
#
# Example for abrban.com:
#   cp values-abrban.example.yaml ../cloud-host-gitops/platform/values-abrban.yaml
#
# CI only updates images.backend.tag and images.frontend.tag on each deploy.

namespace: cloudhost
createNamespace: false

global:
  storageClass: local-path

images:
  # Harbor proxy-cache — first pull is slow, no manual seed needed (see gitops/README.md)
  postgres: registry.abrban.com/proxy-dockerhub/library/postgres:16-alpine
  redis: registry.abrban.com/proxy-dockerhub/library/redis:7-alpine
  busybox: registry.abrban.com/proxy-dockerhub/library/busybox:1.36
  backend:
    repository: registry.abrban.com/abrban/cloudhost-backend
    tag: "1.0.0"   # ← CI overwrites on each deploy
    pullPolicy: IfNotPresent
  frontend:
    repository: registry.abrban.com/abrban/cloudhost-frontend
    tag: "1.0.0"   # ← CI overwrites on each deploy
    pullPolicy: IfNotPresent

# Kaniko job images — Harbor proxy-cache (first pull is slow, no manual seed needed).
build:
  images:
    kaniko: registry.abrban.com/abrban/kaniko-executor:v1.27.6-debug
    alpine: registry.abrban.com/abrban/alpine:3.19
    alpineGit: registry.abrban.com/abrban/alpine-git:2.43.0
  baseImageRegistry: registry.abrban.com/abrban
  # Kaniko + init containers (npm/apk/composer/pip/git clone) on restricted egress.
  egressProxySecret: registry-egress-proxy

postgres:
  enabled: true
  database: cloudhost
  username: cloudhost
  password: ""   # managed in abrban-platform-secrets (postgres-password)
  storage: 10Gi
  imagePullSecrets:
    - name: registry-pull-secret
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: "2"
      memory: 2Gi

redis:
  enabled: true
  storage: 1Gi
  password: ""   # managed in abrban-platform-secrets (redis-password)
  imagePullSecrets:
    - name: registry-pull-secret
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 500m
      memory: 512Mi

# GitOps: never let Helm generate random JWT/redis passwords on each sync.
# Create once with kubeseal — see gitops/sealed-secrets/abrban-platform-secrets.example.yaml
secrets:
  existingSecret: abrban-platform-secrets

backend:
  enabled: true
  replicas: 1
  imagePullSecrets:
    - name: registry-pull-secret
  uploads:
    size: 20Gi
  sourceStorage:
    enabled: false
    existingSecret: ceph-app-sources-credentials
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: "2"
      memory: 2Gi
  env:
    NODE_ENV: production
    PORT: "4000"
    JWT_EXPIRES_IN: 15m
    JWT_REFRESH_EXPIRES_IN: 7d
    PLATFORM_DOMAIN: apps.abrban.com
    PREVIEW_BASE_DOMAIN: apps.abrban.com
    FRONTEND_URL: https://panel.abrban.com,https://abrban.com
    REGISTRY_URL: harbor-registry.cloudhost.svc.cluster.local:5000/abrban
    REGISTRY_PULL_URL: registry.abrban.com/abrban
    BUILD_NAMESPACE: cloudhost-builds
    BUILD_SERVICE_ACCOUNT: kaniko-builder
    UPLOAD_DIR: /app/uploads
    PLATFORM_CREATE_STORAGE_CLASS: "true"
    PLATFORM_STORAGE_CLASS: cloudhost-expandable
    PLATFORM_STORAGE_PROVISIONER: rancher.io/local-path
    ELASTICSEARCH_HOST: elasticsearch.logging.svc.cluster.local
    ELASTICSEARCH_AUTO_PORT_FORWARD: "false"
    # Must match elasticsearch-credentials Secret in logging namespace (not in Helm chart)
    ELASTIC_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
    FLUENTBIT_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
    KIBANA_SYSTEM_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
    # Swagger disabled in production unless explicitly enabled
    # SWAGGER_ENABLED: "true"
  # OTP SMS — username/password in abrban-platform-secrets (SealedSecret).
  sms:
    enabled: true
    provider: mizbansms
    from: "5000467254"
    api: "2016"
    userType: "2"

frontend:
  enabled: true
  replicas: 1
  imagePullSecrets:
    - name: registry-pull-secret
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "1"
      memory: 1Gi

ingress:
  enabled: true
  className: traefik
  frontend:
    host: abrban.com
  panel:
    host: panel.abrban.com
  api:
    host: api.abrban.com
  tls:
    enabled: true
    clusterIssuer: letsencrypt-prod

migrations:
  enabled: true
  image: registry.abrban.com/proxy-dockerhub/library/postgres:16-alpine

backups:
  postgres:
    enabled: true
    schedule: "0 3 * * *"
    storageSize: 10Gi
    retentionDays: 7

monitoring:
  enabled: false