patchmon:
  storage:
    size: 10Gi
    storageClass: null
  frontend:
    # The frontend image is based on nginx-unprivileged; the pod runs as its
    # nginx user (uid 101). The image's root-only init script (it would chown
    # the shared assets volume) is replaced by fsGroup 1000: the same group
    # the backend runs with, so both can read/write the shared assets.
    securityContext:
      pod:
        runAsNonRoot: true
        runAsUser: 101
        runAsGroup: 101
        fsGroup: 1000
        fsGroupChangePolicy: Always
      container:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        capabilities:
          drop:
            - ALL
    resources:
      # Limits are optional: memory and ephemeral-storage limits default to
      # limitFactor x the request, an explicitly set limit always wins, and a
      # CPU limit is only set when configured explicitly under "limits".
      limitFactor: 3
      requests:
        cpu: 0.1
        memory: 128Mi
        ephemeral-storage: 10Mi
  backend:
    resources:
      # Limits are optional: memory and ephemeral-storage limits default to
      # limitFactor x the request, an explicitly set limit always wins, and a
      # CPU limit is only set when configured explicitly under "limits".
      limitFactor: 3
      requests:
        cpu: 0.1
        memory: 512Mi
        ephemeral-storage: 10Mi

ingress:
  clusterIssuer: null
  domain: null

secrets:
  redisSecretRef: null
  postgresSecretRef: null
  oidcSecretRef: null
  patchmonSecretRef: null