core/chart/values.yaml

# Armature — Helm values
# helm install armature ./chart

# ── Images ─────────────────────────────────
backend:
  image:
    repository: git.gobha.me/armature/core
    tag: ""  # defaults to Chart.appVersion
    pullPolicy: IfNotPresent
  replicaCount: 2  # v0.32.0: multi-replica HA
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "1"
      memory: 1Gi
  port: 8080

frontend:
  image:
    repository: git.gobha.me/armature/core
    tag: ""  # defaults to Chart.appVersion
    pullPolicy: IfNotPresent
  replicaCount: 1
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 500m
      memory: 256Mi
  port: 80

# ── Database ───────────────────────────────
database:
  # "postgres" or "sqlite"
  driver: postgres
  # For postgres: full DSN or assembled from postgres.* below
  url: ""
  postgres:
    host: postgresql
    port: 5432
    user: armature
    password: ""  # set via secret
    database: armature
    sslmode: disable
  # For sqlite: path inside the container (requires persistence)
  sqlitePath: /data/armature.db

# ── Core ───────────────────────────────────
basePath: ""  # URL prefix, e.g. "/dev"
environment: production
jwtSecret: ""  # REQUIRED — set via secret or --set
encryptionKey: ""  # REQUIRED for BYOK — set via secret

# ── Admin bootstrap ────────────────────────
admin:
  username: admin
  password: ""  # set via secret
  email: ""

# ── Storage ────────────────────────────────
storage:
  backend: pvc  # "pvc" or "s3"
  path: /data/storage
  s3:
    endpoint: ""
    bucket: ""
    region: us-east-1
    accessKey: ""
    secretKey: ""
    prefix: ""
    forcePathStyle: true

# ── Persistence (PVC) ─────────────────────
persistence:
  enabled: true
  storageClass: ""  # use cluster default
  size: 10Gi
  accessMode: ReadWriteOnce

# ── Ingress ────────────────────────────────
ingress:
  enabled: true
  className: traefik
  annotations: {}
  host: armature.local
  tls:
    enabled: false
    secretName: ""
  # Traefik retry middleware (auto-applied when className=traefik).
  # The Middleware CRD is always created. Set annotateIngress: true to wire
  # it to the ingress. Only enable after confirming the middleware CRD exists
  # (Traefik invalidates the entire router if a referenced middleware is missing).
  retry:
    attempts: 2
    initialInterval: 100ms
    annotateIngress: false

# ── Auth ───────────────────────────────────
auth:
  mode: builtin  # builtin | mtls | oidc
  oidc:
    issuerURL: ""
    externalIssuerURL: ""
    clientID: ""
    clientSecret: ""
    redirectURL: ""
    autoActivate: true
    defaultTeam: ""
    defaultRole: user
    rolesClaim: "realm_access.roles"
    groupsClaim: groups
    adminRole: admin
  mtls:
    headerDN: X-SSL-Client-DN
    headerVerify: X-SSL-Client-Verify
    headerFingerprint: X-SSL-Client-Fingerprint
    autoActivate: true
    defaultTeam: ""
    defaultRole: user

# ── Tuning ─────────────────────────────────
sessionExpiryDays: 30
workflowStaleHours: 72
providerAutoDisableThreshold: 3
extraction:
  mode: inline
  concurrency: 3
workspace:
  indexingEnabled: true
  indexConcurrency: 2

# ── Logging (v0.33.0) ─────────────────────
logging:
  format: text   # "text" (human-readable) or "json" (structured)
  level: info    # "debug", "info", "warn", "error"

# ── Monitoring (v0.33.0) ──────────────────
# All monitoring resources are opt-in (disabled by default).
monitoring:
  # ServiceMonitor for Prometheus Operator (kube-prometheus-stack)
  serviceMonitor:
    enabled: false
    interval: 30s
    path: /metrics
    labels: {}  # match your Prometheus Operator selector
  # Grafana dashboard ConfigMap (auto-discovered by Grafana sidecar)
  grafanaDashboard:
    enabled: false
    labels:
      grafana_dashboard: "1"  # default sidecar label
  # PrometheusRule alerts
  prometheusRule:
    enabled: false
    labels:
      release: prometheus  # match kube-prometheus-stack

# ── Backup (v0.34.0) ─────────────────────────
# Scheduled pg_dump backups (postgres only, ignored for sqlite).
backup:
  enabled: false
  schedule: "0 2 * * *"  # daily at 02:00 UTC
  retention: 7            # keep last N local backups
  historyLimit: 3
  failedHistoryLimit: 1
  activeDeadlineSeconds: 3600
  persistence:
    enabled: true
    storageClass: ""      # use cluster default
    size: 5Gi
    accessMode: ReadWriteOnce
  s3:
    enabled: false
    endpoint: ""
    bucket: ""
    region: us-east-1
    prefix: "backups/"
    forcePathStyle: true
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi

# ── CORS ───────────────────────────────────
corsAllowedOrigins: "*"

# ── Existing secret reference ──────────────
# If set, skips creating a Secret and mounts this one instead.
existingSecret: ""

# ── Image pull secrets ─────────────────────
imagePullSecrets: []