# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

secrets:
  voucherVaultSecretRef: null
  oidcSecretRef: null
  databaseSecretRef: null

voucherVault:
  # Replica count for this workload; 0 is allowed and scales it down.
  # The chart-global scaleDown flag takes precedence.
  replicas: 1
  resources:
    # Limits are optional: memory and ephemeral-storage limits default to
    # limitFactor x the request, an explicitly set limit always wins, and a
    # CPU limit is only set when configured explicitly under "limits".
    limitFactor: 3
    requests:
      cpu: 0.1
      memory: 256Mi
      # The static-files emptyDir (~90Mi of static assets, see the
      # securityContext comment) counts toward the pod's ephemeral-storage
      # usage, so the request must cover it.
      ephemeral-storage: 128Mi
  # "/" answers with a redirect for anonymous users, which httpGet treats as
  # success. The Host header must be set to 127.0.0.1 because Django's
  # ALLOWED_HOSTS only accepts 127.0.0.1 and the configured DOMAIN — probing
  # with the default Host (the pod IP) would always return 400.
  livenessProbe:
    httpGet:
      path: /
      port: http
      httpHeaders:
        - name: Host
          value: 127.0.0.1
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  readinessProbe:
    httpGet:
      path: /
      port: http
      httpHeaders:
        - name: Host
          value: 127.0.0.1
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
  startupProbe:
    httpGet:
      path: /
      port: http
      httpHeaders:
        - name: Host
          value: 127.0.0.1
    periodSeconds: 5
    timeoutSeconds: 5
    failureThreshold: 30
  # The upstream image (l4rm4nd/vouchervault) runs as www-data (uid/gid 33).
  # With readOnlyRootFilesystem the chart mounts emptyDirs over the paths the
  # image writes at runtime: /tmp (upload/PDF scratch files), /opt/app/logs
  # and STATIC_ROOT /opt/app/myapp/static (the entrypoint runs collectstatic
  # at every start; an init container seeds the volume with the static files
  # shipped in the image, because the directory doubles as the app's static
  # source). Uploads and the database live on the PVC at /opt/app/database.
  securityContext:
    pod:
      runAsNonRoot: true
      runAsUser: 33
      runAsGroup: 33
      fsGroup: 33
      fsGroupChangePolicy: Always
      # RuntimeDefault applies the container runtime's default seccomp filter,
      # which blocks the syscalls a normal workload never makes. It sits in the
      # pod context on purpose: from here it covers every container in the pod
      # including init containers, while a container-level seccompProfile would
      # have to be repeated for each one (and silently missed on the next one
      # added). A container that genuinely needs a different filter can still
      # override it under securityContext.container, which wins over this value.
      seccompProfile:
        type: RuntimeDefault
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL
  ports:
    - containerPort: 8000
      protocol: TCP
      name: http
  env:
    # ingress.domain is not a pure Ingress value: Django's ALLOWED_HOSTS only
    # accepts 127.0.0.1 and this DOMAIN, so an empty value makes the app answer
    # 400 to every real request. It therefore stays required even when the
    # Ingress is switched off via ingress.enabled.
    - name: DOMAIN
      value: '{{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}'
    - name: SECURE_COOKIES
      value: "True"
    - name: SESSION_COOKIE_AGE
      value: "30"
    - name: SESSION_EXPIRE_AT_BROWSER_CLOSE
      value: "True"
    - name: EXPIRY_THRESHOLD_DAYS
      value: "90"
    - name: EXPIRY_LAST_NOTIFICATION_DAYS
      value: "7"
    - name: TZ
      value: "UTC"
    - name: PORT
      value: "8000"
    - name: SECRET_KEY
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-secret"
          key: "secretKey"
    - name: REDIS_URL
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-secret"
          key: "redis-url"
    - name: CELERY_WORKER_CONCURRENCY
      value: "1"
    - name: CELERY_WORKER_PREFETCH_MULTIPLIER
      value: "1"
    - name: OIDC_ENABLED
      value: "True"
    - name: OIDC_AUTOLOGIN
      value: "True"
    - name: OIDC_CREATE_USER
      value: "True"
    - name: OIDC_RP_SIGN_ALGO
      value: "RS256"
    - name: OIDC_OP_JWKS_ENDPOINT
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
          key: "oidc-jwks-endpoint"
    - name: OIDC_RP_CLIENT_ID
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
          key: "client-id"
    - name: OIDC_RP_CLIENT_SECRET
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
          key: "client-secret"
    - name: OIDC_OP_AUTHORIZATION_ENDPOINT
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
          key: "authorization-endpoint"
    - name: OIDC_OP_TOKEN_ENDPOINT
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
          key: "token-endpoint"
    - name: OIDC_OP_USER_ENDPOINT
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
          key: "user-endpoint"
    - name: DB_ENGINE
      value: "postgres"
    - name: POSTGRES_HOST
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
          key: "host"
    - name: POSTGRES_PORT
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
          key: "port"
    - name: POSTGRES_USER
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
          key: "user"
    - name: POSTGRES_PASSWORD
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
          key: "password"
    - name: POSTGRES_DB
      valueFrom:
        secretKeyRef:
          name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
          key: "database"
  storage:
    volumes:
      - name: voucher-vault-data
        persistentVolumeClaim:
          claimName: "{{ .Release.Name }}-{{ .Chart.Name }}-pvc"
    volumeMounts:
      - name: voucher-vault-data
        mountPath: /opt/app/database
        subPath: voucher-vault-data

storage:
  amount: 10Gi
  storageClass: null

ingress:
  # Set to false to omit the Ingress entirely. Note that ingress.domain stays
  # required even then: it is also Django's ALLOWED_HOSTS entry (the DOMAIN env
  # above), not just the Ingress host. Only clusterIssuer becomes unnecessary.
  enabled: true
  clusterIssuer: null
  domain: null
  className: nginx
  # Extra annotations for the Ingress; merged with the cert-manager
  # cluster-issuer annotation the chart always sets.
  annotations: {}