# CleverAgents Server Helm Chart - Default Values
# See k8s/README.md for deployment instructions.

# -- Number of server pod replicas
replicaCount: 1

image:
  # -- Container image repository
  repository: cleveragents/server
  # -- Image pull policy
  pullPolicy: IfNotPresent
  # -- Image tag (defaults to Chart appVersion)
  tag: ""

# -- Image pull secrets for private registries
imagePullSecrets: []
# -- Override the chart name
nameOverride: ""
# -- Override the full release name
fullnameOverride: ""

serviceAccount:
  # -- Create a ServiceAccount
  create: true
  # -- Annotations for the ServiceAccount
  annotations: {}
  # -- ServiceAccount name (generated if not set)
  name: ""

# -- Pod-level annotations
podAnnotations: {}

# -- Pod-level security context
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000
  fsGroup: 1000

# -- Container-level security context
securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  seccompProfile:
    type: RuntimeDefault
  capabilities:
    drop:
      - ALL

service:
  # -- Kubernetes Service type
  type: ClusterIP
  # -- Service port
  port: 8000

ingress:
  # -- Enable Ingress resource
  enabled: false
  # -- Allow insecure HTTP ingress without TLS (dev-only opt-out)
  # When false (default), enabling ingress without tls causes template failure.
  allowInsecure: false
  # -- Ingress class name (e.g. nginx, traefik)
  className: ""
  # -- Ingress annotations
  # When TLS is configured, ssl-redirect is automatically enabled.
  # Add additional annotations here as needed.
  annotations: {}
    # cert-manager.io/cluster-issuer: "letsencrypt-prod"
  hosts:
    - host: cleveragents.example.com
      paths:
        - path: /
          pathType: Prefix
  # -- TLS configuration for Ingress
  # HTTPS is required for all production deployments (spec requirement).
  # Each entry specifies a TLS certificate and the hosts it covers.
  # TLS termination happens at the Ingress controller level.
  tls: []
    # - secretName: cleveragents-tls
    #   hosts:
    #     - cleveragents.example.com

resources:
  # -- Resource limits for the server container
  limits:
    cpu: 500m
    memory: 512Mi
  # -- Resource requests for the server container
  requests:
    cpu: 100m
    memory: 128Mi

# -- Node selector constraints
nodeSelector: {}

# -- Pod tolerations
tolerations: []

# -- Pod affinity rules
affinity: {}

# -- Liveness probe configuration
livenessProbe:
  httpGet:
    path: /live
    port: http
  initialDelaySeconds: 15
  periodSeconds: 20
  timeoutSeconds: 5
  failureThreshold: 3

# -- Readiness probe configuration
readinessProbe:
  httpGet:
    path: /ready
    port: http
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 3
  failureThreshold: 3

# -- Server configuration
# NOTE: The default port (8000) differs from the settings.py default
# (8080).  This is intentional: Kubernetes deployments use 8000 as a
# common convention, and the Deployment template passes the port via
# CLI args which override the Settings model default.
server:
  # -- ASGI server host binding
  host: "0.0.0.0"
  # -- ASGI server port
  port: 8000
  # -- Number of uvicorn worker processes
  workers: 1
  # -- Log level for the server
  logLevel: "info"

# -- Database configuration (PostgreSQL)
database:
  # -- PostgreSQL connection URL
  # Uses the format: postgresql+asyncpg://user:password@host:port/dbname
  # WARNING: For production, use existingSecret instead of url to avoid
  # storing credentials in Helm values. When url is set without
  # existingSecret, a Kubernetes Secret is auto-generated.
  url: ""
  # -- Use existing secret for database URL
  existingSecret: ""
  # -- Key in existing secret containing the database URL
  existingSecretKey: "database-url"

# -- Redis configuration (optional, for multi-instance session affinity)
redis:
  # -- Enable Redis for session affinity and rate limiting
  enabled: false
  # -- Redis architecture (standalone or replication)
  architecture: standalone
  auth:
    # -- Enable Redis authentication
    enabled: true
    # -- Redis password (use existingSecret in production)
    # WARNING: For production, use existingSecret instead of password to
    # avoid storing credentials in Helm values. When password is set
    # without existingSecret, a Kubernetes Secret is auto-generated.
    password: ""
    # -- Use existing secret for Redis password
    existingSecret: ""
    existingSecretPasswordKey: "redis-password"
  master:
    persistence:
      # -- Enable Redis persistence
      enabled: false
      # -- Redis persistence storage size
      size: 1Gi

# -- Extra environment variables for the server container
extraEnv: []
  # - name: CLEVERAGENTS_LOG_FORMAT
  #   value: "json"

# -- Extra volume mounts for the server container
extraVolumeMounts: []

# -- Extra volumes for the pod
extraVolumes: []