# Chat Switchboard — Helm values
# helm install switchboard ./chart

# ── Images ─────────────────────────────────
backend:
  image:
    repository: git.gobha.me/xcaliber/chat-switchboard
    tag: ""  # defaults to Chart.appVersion
    pullPolicy: IfNotPresent
  replicaCount: 2  # v0.32.0: multi-replica HA
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "1"
      memory: 1Gi
  port: 8080

frontend:
  image:
    repository: git.gobha.me/xcaliber/chat-switchboard-frontend
    tag: ""  # defaults to Chart.appVersion
    pullPolicy: IfNotPresent
  replicaCount: 1
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 500m
      memory: 256Mi
  port: 80

# ── Database ───────────────────────────────
database:
  # "postgres" or "sqlite"
  driver: postgres
  # For postgres: full DSN or assembled from postgres.* below
  url: ""
  postgres:
    host: postgresql
    port: 5432
    user: switchboard
    password: ""  # set via secret
    database: switchboard
    sslmode: disable
  # For sqlite: path inside the container (requires persistence)
  sqlitePath: /data/switchboard.db

# ── Core ───────────────────────────────────
basePath: ""  # URL prefix, e.g. "/dev"
environment: production
jwtSecret: ""  # REQUIRED — set via secret or --set
encryptionKey: ""  # REQUIRED for BYOK — set via secret

# ── Admin bootstrap ────────────────────────
admin:
  username: admin
  password: ""  # set via secret
  email: ""

# ── Storage ────────────────────────────────
storage:
  backend: pvc  # "pvc" or "s3"
  path: /data/storage
  s3:
    endpoint: ""
    bucket: ""
    region: us-east-1
    accessKey: ""
    secretKey: ""
    prefix: ""
    forcePathStyle: true

# ── Persistence (PVC) ─────────────────────
persistence:
  enabled: true
  storageClass: ""  # use cluster default
  size: 10Gi
  accessMode: ReadWriteOnce

# ── Ingress ────────────────────────────────
ingress:
  enabled: true
  className: traefik
  annotations: {}
  host: switchboard.local
  tls:
    enabled: false
    secretName: ""
  # Traefik retry middleware (auto-applied when className=traefik).
  # The Middleware CRD is always created. Set annotateIngress: true to wire
  # it to the ingress. Only enable after confirming the middleware CRD exists
  # (Traefik invalidates the entire router if a referenced middleware is missing).
  retry:
    attempts: 2
    initialInterval: 100ms
    annotateIngress: false

# ── Auth ───────────────────────────────────
auth:
  mode: builtin  # builtin | mtls | oidc
  oidc:
    issuerURL: ""
    externalIssuerURL: ""
    clientID: ""
    clientSecret: ""
    redirectURL: ""
    autoActivate: true
    defaultTeam: ""
    defaultRole: user
    rolesClaim: "realm_access.roles"
    groupsClaim: groups
    adminRole: admin
  mtls:
    headerDN: X-SSL-Client-DN
    headerVerify: X-SSL-Client-Verify
    headerFingerprint: X-SSL-Client-Fingerprint
    autoActivate: true
    defaultTeam: ""
    defaultRole: user

# ── Tuning ─────────────────────────────────
sessionExpiryDays: 30
workflowStaleHours: 72
providerAutoDisableThreshold: 3
extraction:
  mode: inline
  concurrency: 3
workspace:
  indexingEnabled: true
  indexConcurrency: 2

# ── CORS ───────────────────────────────────
corsAllowedOrigins: "*"

# ── Existing secret reference ──────────────
# If set, skips creating a Secret and mounts this one instead.
existingSecret: ""

# ── Image pull secrets ─────────────────────
imagePullSecrets: []