# Example production overrides for cloudhost-platform
# cp values-production.example.yaml values-production.yaml && edit secrets/hosts

namespace: cloudhost
createNamespace: true

global:
  storageClass: local-path   # k3s example

images:
  # Mirror Docker Hub images through your private registry so cluster nodes
  # never pull from docker.io directly (matches the kaniko/Harbor setup).
  postgres: registry.example.com/mirror/postgres:16-alpine
  redis: registry.example.com/mirror/redis:7-alpine
  busybox: registry.example.com/mirror/busybox:1.36
  backend:
    repository: registry.example.com/cloudhost-backend
    tag: "1.0.0"
    pullPolicy: Always
  frontend:
    repository: registry.example.com/cloudhost-frontend
    tag: "1.0.0"
    pullPolicy: Always

postgres:
  password: "CHANGE_ME_STRONG_POSTGRES_PASSWORD"
  # Pull secret for the mirrored postgres image
  imagePullSecrets:
    - name: registry-pull-secret

redis:
  # Auto-generated and persisted in the platform Secret when left empty.
  password: ""
  imagePullSecrets:
    - name: registry-pull-secret

secrets:
  jwtSecret: "CHANGE_ME_LONG_JWT_SECRET"
  jwtRefreshSecret: "CHANGE_ME_LONG_REFRESH_SECRET"

ingress:
  enabled: true
  className: nginx
  frontend:
    host: platform.example.com
  api:
    host: api.platform.example.com
  tls:
    enabled: true
    clusterIssuer: letsencrypt-prod

backend:
  # Enable after copying ceph-app-sources-credentials secret into the cloudhost namespace
  sourceStorage:
    enabled: false
    existingSecret: ceph-app-sources-credentials
  env:
    PLATFORM_DOMAIN: apps.example.com
    REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
    REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
    # Mirror prefix for base images in generated Dockerfiles + managed services
    BASE_IMAGE_REGISTRY: registry.example.com/mirror
    # Elastic log-stack credentials (must match the logging namespace Secret)
    ELASTIC_PASSWORD: "CHANGE_ME_ELASTIC_PASSWORD"
    FLUENTBIT_PASSWORD: "CHANGE_ME_FLUENTBIT_PASSWORD"
    KIBANA_SYSTEM_PASSWORD: "CHANGE_ME_KIBANA_PASSWORD"
    # Swagger stays off in production; set SWAGGER_ENABLED: "true" to expose it

migrations:
  enabled: true

backups:
  postgres:
    enabled: true
    schedule: "0 3 * * *"
    storageSize: 10Gi
    retentionDays: 7