secrets:
  configSecretRef: op://ci/outline-config
  redisSecretRef: op://ci/outline-redis
  dbSecretRef: op://ci/outline-db

ingress:
  domain: outline.ci.local
  # clusterIssuer is strictly required (no default); the Ingress just has to
  # apply - there is no cert-manager in the CI cluster.
  clusterIssuer: ci

# The egress cap of the chart's NetworkPolicy (Gitea #5) allows 443 for the
# OIDC provider, because that is where an OIDC provider normally listens. The
# CI one does not: fixtures.yaml runs dex at
# http://dex.default.svc.cluster.local:5556/dex, and Outline fetches the
# issuer's discovery document at boot.
#
# So this entry is not a workaround for the test - it is the chart's documented
# escape hatch, used for exactly the case values.yaml names, and the fixture is
# the one place in the repository where that case is actually exercised. Remove
# it and the install-test shows what the cap does to a dependency on a
# non-standard port, which is the risk this convention carries into every
# release.
networkPolicy:
  egress:
    extraPorts:
      - 5556