# CI values for the paperless-ngx install-test.
#
# THE SUBCHART IS ON, AND THAT IS THE POINT OF THIS FILE. Gitea #65 added the
# same valkey dependency to stalwart but covered it by a local RENDER only -
# deliberately, because Stalwart's in-memory store is an object in its database,
# so a Valkey in that namespace would have been reachable and unused and the
# test would have looked like it covered the clustering path while covering
# nothing of it. Here it is the opposite: paperless-ngx reads PAPERLESS_REDIS
# from the vault item, so pointing that url at the subchart's Service makes the
# bundled Valkey the broker this release actually uses. So this is the first
# install of the valkey-subchart path anywhere, and what it proves is:
#
#   1. The dependency resolves from the published index on a real runner with no
#      credentials, and lint/package/render/install all survive it.
#   2. The subchart's objects are accepted inside a parent release: its
#      StatefulSet becomes Ready, which means its init container found a
#      "requirepass " line in the mounted auth file and its three exec probes
#      authenticated and got PONG back.
#   3. The PVC path of the subchart works under a parent release name
#      (ci-valkey-*), i.e. the names really are <release>-valkey-<kind>.
#   4. paperless-ngx talks to it: the url in the fixture Secret names
#      ci-valkey-service, so a wrong Service name or a password mismatch between
#      the two fields of the "item" shows up as a failing run instead of as a
#      quietly idle Valkey.
#
# What it still CANNOT prove is that documents are processed - that needs a real
# consume run and is out of scope here, as before.
secrets:
  # One item for both, which is the configuration the chart is designed around:
  # redis-connection-url, key-prefix AND auth-conf live in the same 1Password
  # item. In CI the operator does not exist, so ci/paperless-ngx/fixtures.yaml
  # stands in for it - and it stands in TWICE, because a OnePasswordItem
  # materializes every field of the item it names. See the fixture.
  redisSecretRef: op://ci/paperless-redis
  databaseSecretRef: op://ci/paperless-db
  paperlessSecretRef: op://ci/paperless

ingress:
  domain: paperless.ci.local
  # clusterIssuer is strictly required (no default); the Ingress just has to
  # apply - there is no cert-manager in the CI cluster.
  clusterIssuer: ci

paperless:
  files:
    # Regression guard for issue #61: a childless "barcodes:" key is YAML null.
    # It must fall back to the chart defaults (barcodes enabled, "PATCHT") and
    # neither erase them nor break rendering.
    barcodes:

valkeySubchart:
  enabled: true

valkey:
  secrets:
    # The SAME op:// path as secrets.redisSecretRef above, typed out again
    # because Helm cannot default one value from another (Gitea #78). Typing it
    # here is also what exercises the parent's guard in the "satisfied"
    # direction; the failing direction is covered by a local render, since the
    # harness installs one configuration per chart.
    authSecretRef: op://ci/paperless-redis

  persistence:
    # QUEUE, the chart's and the subchart's default - and the risky half, which
    # is why it is not switched off here: a provisioned PVC, the pod's fsGroup
    # against a volume it did not create, and an append-only file written and
    # replayed on it.
    enabled: true
    appendonly: true
    # k3d's dynamic provisioner. The subchart's default, longhorn-encrypted-ns,
    # does not exist on the runner, and the no-provisioner "longhorn" class the
    # paperless fixtures define is pre-bound to hostPath PVs for paperless' own
    # claims - a hostPath volume gets no fsGroup from the kubelet at all, so
    # reusing it here would silently stop testing the ownership path.
    storageClass: local-path
    size: 128Mi

  valkey:
    resources:
      # Small, to stay inside the runner's budget, while still exercising the
      # subchart's derivation: 64Mi x limitFactor 3 = 192Mi limit, maxmemory =
      # 0.75 x that = 144Mi.
      requests:
        cpu: 50m
        memory: 64Mi
        ephemeral-storage: 32Mi

# smbConnection and oidc stay disabled (defaults): the SMB CSI driver and a
# real OIDC login flow are out of scope for the CI install-test.