# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

secrets:
  # users.conf is mounted into the samba container from the Secret the 1Password
  # operator materializes from this item.
  #
  # Known limitation (#82): changing the item in the vault does NOT restart
  # samba, so added, removed or re-passworded users stay invisible to the
  # running smbd. Helm cannot hash the content (it never sees it - the operator
  # fills the Secret in-cluster after rendering), so the checksum/config
  # mechanism used for smb.conf does not apply here. The operator's own
  # "operator.1password.io/auto-restart" annotation is no help either: it only
  # ever restarts Deployments, and this workload is a StatefulSet (verified
  # against onepassword-operator 1.12.0). After changing the users item,
  # restart samba by hand:
  #   kubectl rollout restart statefulset <release>-samba-sfs
  sambaUsersSecretRef: null

samba:
  # Replica count for this workload; 0 is allowed and scales it down.
  # The chart-global scaleDown flag takes precedence.
  replicas: 1
  # NodePorts the SMB service is published on (service type NodePort).
  smbNodePort: 30445
  netbiosNodePort: 30139
  shares:
    - name: null
      validUsers: null
      description: null
      size: null
  # Extra environment variables for the samba container. Values are rendered
  # through tpl; value, secretKeyRef and configMapKeyRef forms are supported.
  env: []
  # SMB is not an HTTP protocol, so probe the main SMB TCP port.
  livenessProbe:
    tcpSocket:
      port: 445
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  readinessProbe:
    tcpSocket:
      port: 445
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
  startupProbe:
    tcpSocket:
      port: 445
    periodSeconds: 5
    timeoutSeconds: 5
    failureThreshold: 30
  resources:
    # Limits are optional: memory and ephemeral-storage limits default to
    # limitFactor x the request, an explicitly set limit always wins, and a
    # CPU limit is only set when configured explicitly under "limits".
    limitFactor: 3
    requests:
      memory: 50Mi
      cpu: 0.1
      ephemeralStorage: 50Mi

  # Deviations from the repo's hardening baseline, forced by the
  # ghcr.io/dockur/samba image (its entrypoint samba.sh):
  # - no runAsNonRoot: the entrypoint creates the Unix users from users.conf
  #   (groupadd/adduser/usermod) and smbd impersonates the authenticated
  #   share user per session, both of which require starting as root.
  # - readOnlyRootFilesystem: false: the entrypoint writes to the root
  #   filesystem at startup (/etc/passwd + /etc/group for user creation,
  #   the /etc/samba.conf healthcheck symlink, mkdir /shared and the Samba
  #   TDB databases under /var/lib/samba).
  # - capabilities: ALL dropped except what a multi-user root file server
  #   needs: NET_BIND_SERVICE (ports 445/139), SETUID/SETGID (per-session
  #   user impersonation), CHOWN/FOWNER/DAC_OVERRIDE (managing share files
  #   on behalf of the users).
  securityContext:
    pod:
      fsGroup: 1000
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: false
      capabilities:
        drop:
          - ALL
        add:
          - CHOWN
          - DAC_OVERRIDE
          - FOWNER
          - NET_BIND_SERVICE
          - SETGID
          - SETUID

  storageClass: longhorn