secrets:
  databaseSecretRef: op://ci/uv-db
  oidcSecretRef: op://ci/uv-oidc

ingress:
  domain: uv.ci.local
  # clusterIssuer is strictly required (no default); the Ingress just has to
  # apply - there is no cert-manager in the CI cluster.
  clusterIssuer: ci

# The egress cap of this chart's NetworkPolicy (Gitea #5) allows the STANDARD
# ports of its dependencies. The CI OIDC provider does not: fixtures.yaml runs dex on 5556 rather than on 443 - and this application has no login path besides OIDC.
#
# So this is not a workaround for the test: it is the chart's documented escape
# hatch, used for exactly the case values.yaml names. The fixtures are the one
# place in the repository where that case is exercised, and removing this entry
# shows what the cap costs a dependency on a non-standard port.
networkPolicy:
  egress:
    extraPorts:
      - 5556