# ────────────────────────────────────────────────────────────
# CloudHost Platform — Helm values
# Deploy: helm upgrade --install cloudhost ./backend/helm/cloudhost-platform -n cloudhost --create-namespace
# ────────────────────────────────────────────────────────────

nameOverride: ""
fullnameOverride: ""

namespace: cloudhost
createNamespace: true

global:
  storageClass: ""

# For clusters without direct docker.io access, point these at your mirror,
# e.g. registry.abrban.com/abrban/postgres:16-alpine, and set
# postgres.imagePullSecrets / redis.imagePullSecrets accordingly.
images:
  postgres: postgres:16-alpine
  redis: redis:7-alpine
  busybox: busybox:1.36
  backend:
    repository: cloudhost-backend
    tag: "1.0.0"
    pullPolicy: IfNotPresent
  frontend:
    repository: cloudhost-frontend
    tag: "1.0.0"
    pullPolicy: IfNotPresent

# Kaniko push credentials — harbor_registry_user for harbor-registry:5000 (Harbor production).
registry:
  credentialsSecret: ""
  credentialsPasswordKey: REGISTRY_CREDENTIAL_PASSWORD
  username: harbor_registry_user

# Kaniko job images — defaults pull from Harbor proxy-cache.
# Override any line for a different registry/tag.
build:
  images:
    # Seeded into abrban/ via gitops/jobs/seed-ci-images.yaml — avoid flaky proxy-gcr pulls.
    kaniko: registry.abrban.com/abrban/kaniko-executor:v1.27.6-debug
    alpine: registry.abrban.com/abrban/alpine:3.19
    alpineGit: registry.abrban.com/abrban/alpine-git:2.43.0
  # Seeded base images (gitops/jobs/seed-ci-images.yaml) — proxy-dockerhub cache can be corrupt on first pull.
  baseImageRegistry: registry.abrban.com/abrban
  # Secret with HTTP_PROXY/HTTPS_PROXY for Kaniko build jobs (npm, apk, git clone).
  # Set to registry-egress-proxy in production; leave empty when nodes have direct egress.
  egressProxySecret: ""

postgres:
  enabled: true
  database: cloudhost
  username: cloudhost
  # Leave empty to auto-generate on first install (stored in Secret)
  password: ""
  storage: 10Gi
  # Needed when images.postgres points at a private mirror
  imagePullSecrets: []
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: "2"
      memory: 2Gi

redis:
  enabled: true
  storage: 1Gi
  # Leave empty to auto-generate on first install (stored in Secret as redis-password).
  # With secrets.existingSecret, that Secret must also contain a redis-password key.
  password: ""
  # Needed when images.redis points at a private mirror
  imagePullSecrets: []
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 500m
      memory: 512Mi

backend:
  enabled: true
  replicas: 1
  imagePullSecrets:
    - name: registry-pull-secret
  uploads:
    size: 20Gi
  sourceStorage:
    enabled: false
    existingSecret: ceph-app-sources-credentials
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: "2"
      memory: 2Gi
  extraEnv: {}
  # OTP SMS — credentials live in the platform Secret (mizbansms-username/password).
  sms:
    enabled: false
    provider: mizbansms
    from: "5000467254"
    api: "2016"
    userType: "2"
  env:
    NODE_ENV: production
    PORT: "4000"
    JWT_EXPIRES_IN: 15m
    JWT_REFRESH_EXPIRES_IN: 7d
    PLATFORM_DOMAIN: apps.cloudhost.local
    REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
    REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
    BUILD_NAMESPACE: cloudhost-builds
    BUILD_SERVICE_ACCOUNT: kaniko-builder
    UPLOAD_DIR: /app/uploads
    PLATFORM_CREATE_STORAGE_CLASS: "true"
    PLATFORM_STORAGE_CLASS: cloudhost-expandable
    PLATFORM_STORAGE_PROVISIONER: rancher.io/local-path
    ELASTICSEARCH_HOST: elasticsearch.logging.svc.cluster.local
    ELASTICSEARCH_AUTO_PORT_FORWARD: "false"

frontend:
  enabled: true
  replicas: 1
  imagePullSecrets:
    - name: registry-pull-secret
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "1"
      memory: 1Gi

# JWT secrets — set in production (values-production.example.yaml)
secrets:
  # Use a pre-created Secret instead of chart-managed one. Required for GitOps
  # (Argo CD renders with `helm template`, so lookup/randAlphaNum regenerate on
  # every sync). Secret must contain keys: postgres-password, jwt-secret,
  # jwt-refresh-secret, cluster-kubeconfig-key, redis-password, elastic-password.
  existingSecret: ""
  jwtSecret: ""
  jwtRefreshSecret: ""
  # AES key for encrypting stored kubeconfigs (64 hex chars or any passphrase)
  clusterKubeconfigKey: ""

ingress:
  enabled: true
  className: nginx
  frontend:
    host: platform.cloudhost.local
  # Optional dedicated host for the authenticated panel. Empty = disabled
  # (single-origin, dev). Production (abrban): panel.abrban.com
  panel:
    host: ""
  api:
    host: api.cloudhost.local
  singleHost:
    enabled: false
    host: platform.cloudhost.local
    apiPath: /api
  annotations: {}
  tls:
    enabled: true
    clusterIssuer: letsencrypt-prod
    secretName: ""

migrations:
  enabled: true
  image: postgres:16-alpine

monitoring:
  enabled: false

backups:
  postgres:
    enabled: true
    schedule: "0 3 * * *"
    storageSize: 10Gi
    retentionDays: 7