563bb99
# GitData 生产 values（非敏感部分，入库）
# 域名策略: 主站/业务服务 *.gitdata.ai；内部服务 *.gitdata.me
#
# 敏感值（secret.env）不在此文件：由 CI 从 Gitea Secret `PROD_SECRET_VALUES`
# 拼接注入，见 .gitea/workflows/deploy.yaml 与 deploy/README.md。
# image.tag 由 CI 按本次提交的 sha 覆盖。
image:
repository: harbor.gitdata.me/app/gitdata
tag: ""
pullPolicy: IfNotPresent
serviceAccount:
create: true
config:
env:
# ---- Redis: valkey cluster (3主3从) ----
# 注意：APP_REDIS__URL / APP_CACHE__REDIS__URL 不能留空占位。
# config.env 走容器 env:，secret.env 走 envFrom:，而 env: 的优先级更高
# （同名时 env: 胜出），留个空串就会把 Secret 里的真实连接串覆盖掉。
# 因此这两项只出现在 PROD_SECRET_VALUES 中，此处完全不声明。
APP_REDIS__MODE: "cluster"
APP_REDIS__POOL_SIZE: "8"
# oxcache 的 L2 不支持 cluster 客户端（会 MOVED 报错），故用独立 standalone 实例
APP_CACHE__REDIS__MODE: "standalone"
# ---- S3: RustFS ----
APP_S3__ENDPOINT: "http://rustfs-svc.rustfs.svc.cluster.local:9000"
# presign URL 的对外 host：必须填客户端可达的地址，否则签名 URL 会带内网 svc 名
APP_S3__PUBLIC_ENDPOINT: "https://s3.gitdata.ai"
APP_S3__BUCKET: "gitdata"
APP_S3__REGION: "us-east-1"
APP_S3__PATH_STYLE: "true"
# ---- Search: Meilisearch (内部服务, *.gitdata.me) ----
APP_SEARCH__ENABLED: "true"
APP_SEARCH__URL: "http://meili-meilisearch.gitdata.svc.cluster.local:7700"
APP_SEARCH__INDEX_PREFIX: "gitdata"
# ---- LiveKit (业务服务, *.gitdata.ai) ----
APP_LIVEKIT__ENABLED: "true"
APP_LIVEKIT__URL: "wss://livekit.gitdata.ai"
APP_LIVEKIT__API_URL: "https://livekit.gitdata.ai"
# ---- 对外地址（主站 gitdata.ai）----
APP_WEB__WEB_BASE_URL: "https://gitdata.ai"
APP_WEB__CORS_ALLOW_ORIGINS: '["https://gitdata.ai"]'
# 生产走 TLS，session cookie 强制 Secure
APP_SESSION__COOKIE_SECURE: "true"
# 多副本必须：会话不驻留 pod 内存，每请求从 Redis 回读；否则跨副本会丢失 pow challenge / 2FA / 登录态
APP_SESSION__MEMORY_LIFESPAN_SECS: "0"
APP_GIT__BASE_URL: "https://gitdata.ai"
APP_LIVEKIT__RECORDING_ENABLED: "false"
# ---- 邮件 ----
APP_EMAIL__ENABLED: "true"
APP_EMAIL__SMTP_HOST: "smtpdm.aliyun.com"
APP_EMAIL__SMTP_PORT: "465"
APP_EMAIL__SMTP_USERNAME: "bot@mail.gitdata.ai"
APP_EMAIL__FROM_ADDRESS: "bot@mail.gitdata.ai"
APP_EMAIL__FROM_NAME: "GitData"
APP_EMAIL_QUEUE__ENABLED: "true"
RUST_LOG: "info,axum_session::session_store=error"
ingress:
enabled: true
className: nginx
host: gitdata.ai
tls:
enabled: true
secretName: ""
clusterIssuer: cloudflare-acme-cluster-issuer
proxyBodySize: "0"
proxyReadTimeout: 3600
proxySendTimeout: 3600
proxyConnectTimeout: 60
githost:
enabled: true
# 多副本：SSH host key 已预置在共享 PVC，replica 间共用同一把
replicaCount: 2
httpPort: 9418
ssh:
enabled: true
containerPort: 2222
# clone URL 对外统一 ssh.gitdata.ai:22；22 由外部 nginx 反代到 LB 的 31838
# （云边缘封禁集群公网 IP 的 22，报文到不了集群；31838 安全组已放行、实测全球可达）
cloneHost: "ssh.gitdata.ai"
clonePort: 22
service:
type: LoadBalancer
port: 22
annotations:
# 固定 MetalLB 分配的 SSH LB IP，与 cloneHost 保持一致
metallb.universe.tf/loadBalancerIPs: "47.239.98.8"
adminhost:
enabled: true
ingress:
enabled: true
host: admin.gitdata.ai
className: nginx
tls:
enabled: true
secretName: ""
clusterIssuer: cloudflare-acme-cluster-issuer
webhook:
enabled: true
ingress:
enabled: true
host: hooks.gitdata.ai
className: nginx
tls:
enabled: true
secretName: ""
clusterIssuer: cloudflare-acme-cluster-issuer
# ---------------------------------------------------------------------------
# AI：评审 / 仓库总结 / release 文案（值对齐 config/local.toml）
# api_key 走 secret.env -> APP_AI__API_KEY
# ---------------------------------------------------------------------------
ai:
enabled: true
baseUrl: "https://llm-g0x83i22nyj4pub7.cn-beijing.maas.aliyuncs.com/compatible-mode/v1"
model: "qwen3.8-flash"
reviewEnabled: true
summaryEnabled: true
releaseNotesEnabled: true
queueTopic: "gitdata:ai"
dlqTopic: "gitdata:ai:dlq"
maxAttempts: 3
requestTimeoutSecs: 600
contextMaxBytes: 524288
maxFindings: 20
maxOutputTokens: 4096
thinkingBudget: 2048
temperature: "0.2"
summaryCommitLimit: 50
botUsername: "ai-reviewer"
botDisplayName: "AI Reviewer"
outputLanguage: "zh-CN"
aihost:
enabled: true
replicaCount: 1
port: 3006
concurrency: 2
pollIntervalSecs: 5
retryBackoffBaseSecs: 2
resources:
requests: { cpu: 100m, memory: 256Mi }
limits: { memory: 1Gi }
extraEnv: []
persistence:
repos:
enabled: true
# 预创建的独立 PVC（2Ti, aliyun-nfs-pro, Retain+archiveOnDelete）
# 由 kubectl 管理而非 helm，卸载/删除 release 都不会回收
existingClaim: gitdata-repos
size: 2Ti
storageClassName: aliyun-nfs-pro
accessModes: ["ReadWriteMany"]
mountPath: /opt/gitdata
migrate:
enabled: true
synchost:
enabled: true
replicaCount: 2
mails:
enabled: true
im:
enabled: true
runner:
enabled: false