# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

secrets:
  redisRef: null
  databaseRef: null
  paperlessRef: null
  smbConnectionSecretRef: null
  oidcSecretRef: null

ingress:
  clusterIssuer: "letsencrypt-issuer"
  domain: null

paperless:
  # Replica count for this workload; 0 is allowed and scales it down.
  # The chart-global scaleDown flag takes precedence.
  replicas: 1
  ocr:
    languages: "eng"
    mode: "skip"
    rotate_pages: "true"
    output_type: "pdfa"
  files:
    filenameFormat: "{{ created_year }}/{{ correspondent }}/{{ title }}"
    storage: 20Gi
    maxUploadFileSize: 10m
    barcodes:
      enabled: true
      barcodeString: "PATCHT"
      retainBarcodePage: false
      asn:
        enabled: true
      scanner: PYZBAR
    tikaGotenberg:
      enabled: false
      tikaEndpoint: null
      gotenbergEndpoint: null
  scripts:
    postConsumptionScripts: []
    preConsumptionScripts: []
  resources:
    # Limits are optional: memory and ephemeral-storage limits default to
    # limitFactor x the request, an explicitly set limit always wins, and a
    # CPU limit is only set when configured explicitly under "limits".
    limitFactor: 3
    requests:
      cpu: 0.2
      memory: 1024Mi
      ephemeralStorage: 200Mi
  # Paperless-ngx supports rootless operation: the pod runs as uid/gid 1000
  # (the image's default paperless user), fsGroup makes the PVCs writable and
  # /tmp + /run are emptyDirs so the root filesystem stays read-only.
  # Documented deviation: s6-overlay requires /run to be OWNED by the runtime
  # uid (group-write is not enough), so a minimal root init container chowns
  # the /run emptyDir to runAsUser/runAsGroup before the hardened main
  # container starts.
  securityContext:
    pod:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
      fsGroupChangePolicy: Always
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL
smbConnection:
  enabled: false
  server: null
  cronJob: "0 0,12 * * *"
  cron:
    # The consume mover only shuffles files between the SMB share (mounted
    # with 0777 modes) and the consume PVC, so it runs as the same non-root
    # uid/gid as paperless itself with a fully hardened context.
    securityContext:
      pod:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: Always
      container:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        capabilities:
          drop:
            - ALL
    resources:
      # Limits are optional: memory and ephemeral-storage limits default to
      # limitFactor x the request, an explicitly set limit always wins, and a
      # CPU limit is only set when configured explicitly under "limits".
      limitFactor: 3
      requests:
        cpu: 10m
        memory: 16Mi
        ephemeralStorage: 10Mi
oidc:
  enabled: false
  autoLoginWithProvider: false
  disableRegularLogin: false
  provider:
    id: null
    name: null
    clientId: null
    discoveryUrl: null