# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

secrets:
  # REQUIRED - op:// item path carrying "jdbc-url", "username" and "password".
  # This chart deploys NO database; all state lives in the external one, and
  # three datasource environment variables read these keys unconditionally.
  # Without the value the render aborts - required() in
  # urlaubsverwaltung-db.secret.yaml is the whole enforcement, and
  # values.schema.json cannot help here (README, guideline 12).
  databaseSecretRef: null
  # REQUIRED - op:// item path carrying "client-id", "client-secret",
  # "issuer-name", "issuer-uri", "jwt-issuer-uri" and "redirect-uri". This chart
  # offers no login path besides OIDC, and the identity provider is required at
  # boot, not at login: the application resolves <issuer-uri>/.well-known/
  # openid-configuration while building its security beans, before the HTTP port
  # opens, and exits when it cannot. Without the value the render aborts -
  # required() in urlaubsverwaltung-oidc.secret.yaml is the whole enforcement,
  # and values.schema.json cannot help here (README, guideline 12).
  oidcSecretRef: null

ingress:
  # Gates the whole Ingress template. Mutually exclusive with
  # httpRoute.enabled below (Gitea #114): with both true the render aborts,
  # naming both values.
  #
  # Guideline 1, checked in both directions for this chart: NOTHING outside the
  # two routing templates reads ingress.domain - no environment variable of the
  # application is derived from it, and UV_MAIL_APPLICATIONURL (the host in the
  # links inside notification mails) is a hardcoded placeholder, deliberately
  # not derived from it. So clusterIssuer AND domain are both free while both
  # routing modes are off; with either one on, domain is required and its
  # required() fires in whichever template renders. clusterIssuer is only ever
  # read by the Ingress - Gateway mode renders no Certificate.
  enabled: true
  clusterIssuer: null
  # The public hostname of this release. Read by the Ingress and - when
  # httpRoute.hostnames is empty - by the HTTPRoute.
  domain: null
  className: nginx
  # Extra annotations for the Ingress; merged with the cert-manager
  # cluster-issuer annotation the chart always sets.
  #
  # THESE HAVE NO COUNTERPART IN GATEWAY MODE. The Gateway API has no
  # annotation channel for controller behaviour, so anything configured here is
  # simply gone when httpRoute.enabled is used instead - it is then the
  # Gateway's business, or that of an implementation-specific policy object
  # this chart deliberately does not render. Nothing this chart needs lives
  # here by default.
  annotations: {}

# Gateway-API alternative to the Ingress above (Gitea #114). Off by default, so
# an existing release is unaffected; exactly one of ingress.enabled and
# httpRoute.enabled may be true.
#
# The chart renders ONLY an HTTPRoute with parentRefs - no Gateway, no
# gatewayClassName, no Certificate and no implementation-specific policy
# object. Class and certificate belong to the Gateway and therefore to the
# platform, which is what keeps this chart independent of whether the cluster
# runs nginx-gateway-fabric, Cilium, Envoy Gateway or Istio.
#
# The Gateway-API CRDs must be installed in the cluster: the chart does not and
# cannot detect them (.Capabilities.APIVersions is unreliable at template
# time), so with httpRoute.enabled: true and no CRDs the INSTALL fails.
httpRoute:
  enabled: false
  # The Gateway(s) this route attaches to - a platform object, usually in
  # another namespace, which must allow this namespace in its listener's
  # allowedRoutes. One entry per parent, the fields are the Gateway API's
  # ParentReference (name, and optionally namespace, sectionName, port, group,
  # kind), passed through unchanged:
  #
  #   parentRefs:
  #     - name: public
  #       namespace: gateway
  #       sectionName: https
  #
  # REQUIRED while httpRoute.enabled is true - the render aborts on an empty
  # list, because a route without a parent is created, is valid and routes
  # nothing, with no event to say so.
  parentRefs: []
  # Empty means [ingress.domain], so the hostname has one source of truth. Set
  # explicitly only to publish under a different or an additional name - which
  # is how a migration from the Ingress runs: the HTTPRoute takes a second
  # hostname while the Ingress keeps ingress.domain.
  #
  # For THIS chart, mind that the OIDC redirect URI is a field of the 1Password
  # item and is registered at the identity provider - it does not follow the
  # hostname by itself, so publishing under a new name means updating both or
  # login fails on a redirect-uri mismatch while the pod stays green.
  hostnames: []

urlaubsverwaltung:
  # Replica count for this workload; 0 is allowed and scales it down.
  # The chart-global scaleDown flag takes precedence.
  replicas: 1
  # The official image is built with Cloud Native Buildpacks and runs as the
  # non-root cnb user (uid 1002, gid 1001). /tmp is a writable emptyDir for
  # the JVM's temp/work files.
  securityContext:
    pod:
      runAsNonRoot: true
      runAsUser: 1002
      runAsGroup: 1001
      # RuntimeDefault applies the container runtime's default seccomp filter,
      # which blocks the syscalls a normal workload never makes. It sits in the
      # pod context on purpose: from here it covers every container in the pod
      # including init containers, while a container-level seccompProfile would
      # have to be repeated for each one (and silently missed on the next one
      # added). A container that genuinely needs a different filter can still
      # override it under securityContext.container, which wins over this value.
      seccompProfile:
        type: RuntimeDefault
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL
  # HEALTH INDICATORS — TWO SETTINGS THE CHART FIXES IN THE TEMPLATE
  #
  # The chart sets these two as plain environment variables, not as values,
  # because urlaubsverwaltung.env below already overrides anything:
  #
  #   MANAGEMENT_ENDPOINT_HEALTH_GROUP_READINESS_INCLUDE=readinessState,db
  #     puts the datasource into the readiness group, so a database outage
  #     takes the pod out of Ready instead of leaving it serving errors (#218).
  #     The liveness group stays untouched on purpose — an outage must keep
  #     traffic away, not restart the pod in a loop.
  #   MANAGEMENT_HEALTH_MAIL_ENABLED=false
  #     removes the mail indicator, which otherwise pins the aggregate
  #     /actuator/health at 503 DOWN forever, because the chart's mail wiring
  #     points at localhost:1025 where nothing listens (#217).
  #
  # THE CONSEQUENCE TO KNOW BEFORE IT BITES: whoever later configures real mail
  # delivery (SPRING_MAIL_HOST/SPRING_MAIL_PORT via urlaubsverwaltung.env) MUST
  # switch the indicator back on in the same change:
  #
  #   env:
  #     - name: MANAGEMENT_HEALTH_MAIL_ENABLED
  #       value: "true"
  #
  # Left at false, /actuator/health keeps answering 200 while the configured
  # mail server is unreachable and no notification mail is delivered. The
  # setting trades a permanently false alarm for silence, and silence is only
  # correct as long as there is nothing to report about.
  #
  # That override repeats a name the chart already sets, and env is additive, so
  # it renders the variable twice. At INSTALL time both entries reach the pod and
  # the later one — yours — wins in the container. Added to an ALREADY INSTALLED
  # release it is lost instead: Kubernetes merges env by name, the pair collapses
  # to the chart's own entry, and helm still reports a successful upgrade. The
  # override does not fail loudly, it fails silently. See the "env IS ADDITIVE
  # ONLY" section of NOTES.txt — the switch has to go in at install time, and
  # after any such change the result belongs verified on the live Deployment.
  livenessProbe:
    httpGet:
      port: 8080
      path: /actuator/health/liveness
    periodSeconds: 10
    failureThreshold: 3
    successThreshold: 1
    timeoutSeconds: 5
  readinessProbe:
    httpGet:
      port: 8080
      path: /actuator/health/readiness
    periodSeconds: 5
    failureThreshold: 3
    successThreshold: 1
    timeoutSeconds: 5
  # The startup probe gates liveness/readiness. Spring Boot startup
  # (JVM + Liquibase migrations) gets a budget of 10s * 30 = 300s.
  startupProbe:
    httpGet:
      port: 8080
      path: /actuator/health/liveness
    periodSeconds: 10
    failureThreshold: 30
    timeoutSeconds: 5
  # Extra environment variables, appended to the ones the chart always sets.
  # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
  # forms are supported.
  env: []
  resources:
    # Limits are optional: memory and ephemeral-storage limits default to
    # limitFactor x the request, an explicitly set limit always wins, and a
    # CPU limit is only set when configured explicitly under "limits".
    limitFactor: 3
    requests:
      cpu: 0.1
      memory: 768Mi
      ephemeralStorage: 10Mi