secrets:
  ralllySecretRef: op://ci/rallly
  oidcSecretRef: op://ci/rallly-oidc
  databaseSecretRef: op://ci/rallly-db
  # smtp stays disabled (default), so no smtpSecretRef is needed.

rallly:
  supportEmail: ci@example.org

ingress:
  clusterIssuer: ci
  domain: rallly.ci.local

# The egress cap of this chart's NetworkPolicy (Gitea #5) allows the STANDARD
# ports of its dependencies. The CI OIDC provider does not: fixtures.yaml runs dex on 5556 rather than on 443.
#
# So this is not a workaround for the test: it is the chart's documented escape
# hatch, used for exactly the case values.yaml names. The fixtures are the one
# place in the repository where that case is exercised, and removing this entry
# shows what the cap costs a dependency on a non-standard port.
networkPolicy:
  egress:
    extraPorts:
      - 5556