# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

secrets:
  # users.conf is mounted into the samba container from the Secret the 1Password
  # operator materializes from this item.
  #
  # Known limitation (#82): changing the item in the vault does NOT restart
  # samba, so added, removed or re-passworded users stay invisible to the
  # running smbd. Helm cannot hash the content (it never sees it - the operator
  # fills the Secret in-cluster after rendering), so the checksum/config
  # mechanism used for smb.conf does not apply here. The operator's own
  # "operator.1password.io/auto-restart" annotation is no help either: it only
  # ever restarts Deployments, and this workload is a StatefulSet (verified
  # against onepassword-operator 1.12.0). After changing the users item,
  # restart samba by hand:
  #   kubectl rollout restart statefulset <release>-samba-sfs
  sambaUsersSecretRef: null

samba:
  # Replica count for this workload; 0 is allowed and scales it down.
  # The chart-global scaleDown flag takes precedence.
  replicas: 1
  # NodePorts the SMB service is published on (service type NodePort).
  smbNodePort: 30445
  netbiosNodePort: 30139
  shares:
    - name: null
      validUsers: null
      description: null
      size: null
  # Extra environment variables for the samba container. Values are rendered
  # through tpl; value, secretKeyRef and configMapKeyRef forms are supported.
  env: []
  # SMB is not an HTTP protocol, so probe the main SMB TCP port.
  livenessProbe:
    tcpSocket:
      port: 445
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  readinessProbe:
    tcpSocket:
      port: 445
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
  startupProbe:
    tcpSocket:
      port: 445
    periodSeconds: 5
    timeoutSeconds: 5
    failureThreshold: 30
  resources:
    # Limits are optional: memory and ephemeral-storage limits default to
    # limitFactor x the request, an explicitly set limit always wins, and a
    # CPU limit is only set when configured explicitly under "limits".
    limitFactor: 3
    requests:
      memory: 50Mi
      cpu: 0.1
      ephemeralStorage: 50Mi

  # Deviations from the repo's hardening baseline, forced by the
  # ghcr.io/dockur/samba image (its entrypoint samba.sh):
  # - no runAsNonRoot: the entrypoint creates the Unix users from users.conf
  #   (groupadd/adduser/usermod) and smbd impersonates the authenticated
  #   share user per session, both of which require starting as root.
  # - readOnlyRootFilesystem: false: the entrypoint writes to the root
  #   filesystem at startup (/etc/passwd + /etc/group for user creation,
  #   the /etc/samba.conf healthcheck symlink, mkdir /shared and the Samba
  #   TDB databases under /var/lib/samba).
  # - capabilities: ALL dropped except what a multi-user root file server
  #   needs: NET_BIND_SERVICE (ports 445/139), SETUID/SETGID (per-session
  #   user impersonation), CHOWN/FOWNER/DAC_OVERRIDE (managing share files
  #   on behalf of the users).
  securityContext:
    pod:
      fsGroup: 1000
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: false
      capabilities:
        drop:
          - ALL
        add:
          - CHOWN
          - DAC_OVERRIDE
          - FOWNER
          - NET_BIND_SERVICE
          - SETGID
          - SETUID

  storageClass: longhorn

# ---------------------------------------------------------------------------
# NetworkPolicy (Gitea #5). On by default. The reference implementation with
# the full reasoning is template-chart; the convention is in README, "Chart
# style guidelines", and the operator's view on this chart's wiki page.
# ---------------------------------------------------------------------------
networkPolicy:
  # THERE IS ONLY ONE VALUE HERE BESIDES enabled, AND THAT IS DELIBERATE.
  # Both of this chart's inbound rules are open to any source (see below), so
  # neither allowedNamespaces nor probeSources would reach a rule - and a value
  # that silently does nothing is worse than a value that is absent: it reads
  # as a control. If a source restriction is ever wanted here it needs a rule
  # to attach to first.
  #
  # WHAT THIS POLICY ALLOWS: inbound 445 and 139 - the POD ports - open to any
  # source, and outbound nothing but DNS.
  #
  # BOTH INBOUND RULES ARE OPEN ON PURPOSE. The ports are published as
  # NodePorts and the clients are machines on the LAN; after NodePort
  # masquerading the source address is a cluster node, so a source selector
  # could only be a list of node IPs - a restriction in appearance and a
  # maintenance trap in fact. 445 is also the probe port.
  #
  # AND THE NUMBERS ARE 445 AND 139, NOT samba.smbNodePort AND
  # samba.netbiosNodePort. A NetworkPolicy is evaluated at the pod's interface
  # after kube-proxy has translated the NodePort, so the NodePort numbers would
  # match nothing while looking strict - and would block every client.
  #
  # Not covered, and it does not matter here: the NetBIOS name-service
  # broadcasts on 137/138 UDP are not published by this chart's Service at all,
  # and clients reach the share by address rather than by browse list.
  enabled: true
  egress:
    # Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and
    # has no switch - a knob whose only other setting breaks every name lookup
    # in the pod is a trap, not a feature.
    #
    # PORTS, NOT DESTINATIONS, and that is a limit of the object rather than
    # laziness: a NetworkPolicy matches CIDRs and selectors and never hostnames,
    # so "only to the database host" cannot be written at all. Each entry
    # permits its port to ANY destination. What the cap still buys is real: a
    # compromised pod cannot open arbitrary outbound connections.
    #
    # A domain-joined Samba needs Kerberos (88) and LDAP (389 or 636) here. A
    # standalone one needs nothing.
    extraPorts: []