# GitData 生产 values（非敏感部分，入库）
# 域名策略: 主站/业务服务 *.gitdata.ai；内部服务 *.gitdata.me
#
# 敏感值（secret.env）不在此文件：由 CI 从 Gitea Secret `PROD_SECRET_VALUES`
# 拼接注入，见 .gitea/workflows/deploy.yaml 与 deploy/README.md。
# image.tag 由 CI 按本次提交的 sha 覆盖。

image:
  repository: harbor.gitdata.me/app/gitdata
  tag: ""
  pullPolicy: IfNotPresent

serviceAccount:
  create: true

config:
  env:
    # ---- Redis: valkey cluster (3主3从) ----
    # 注意：APP_REDIS__URL / APP_CACHE__REDIS__URL 不能留空占位。
    # config.env 走容器 env:，secret.env 走 envFrom:，而 env: 的优先级更高
    # （同名时 env: 胜出），留个空串就会把 Secret 里的真实连接串覆盖掉。
    # 因此这两项只出现在 PROD_SECRET_VALUES 中，此处完全不声明。
    APP_REDIS__MODE: "cluster"
    APP_REDIS__POOL_SIZE: "8"
    # oxcache 的 L2 不支持 cluster 客户端（会 MOVED 报错），故用独立 standalone 实例
    APP_CACHE__REDIS__MODE: "standalone"

    # ---- S3: RustFS ----
    APP_S3__ENDPOINT: "http://rustfs-svc.rustfs.svc.cluster.local:9000"
    # presign URL 的对外 host：必须填客户端可达的地址，否则签名 URL 会带内网 svc 名
    APP_S3__PUBLIC_ENDPOINT: "https://s3.gitdata.ai"
    APP_S3__BUCKET: "gitdata"
    APP_S3__REGION: "us-east-1"
    APP_S3__PATH_STYLE: "true"

    # ---- Search: Meilisearch (内部服务, *.gitdata.me) ----
    APP_SEARCH__ENABLED: "true"
    APP_SEARCH__URL: "http://meili-meilisearch.gitdata.svc.cluster.local:7700"
    APP_SEARCH__INDEX_PREFIX: "gitdata"

    # ---- LiveKit (业务服务, *.gitdata.ai) ----
    APP_LIVEKIT__ENABLED: "true"
    APP_LIVEKIT__URL: "wss://livekit.gitdata.ai"
    APP_LIVEKIT__API_URL: "https://livekit.gitdata.ai"

    # ---- 对外地址（主站 gitdata.ai）----
    APP_WEB__WEB_BASE_URL: "https://gitdata.ai"
    APP_WEB__CORS_ALLOW_ORIGINS: '["https://gitdata.ai"]'
    # 生产走 TLS，session cookie 强制 Secure
    APP_SESSION__COOKIE_SECURE: "true"
    # 多副本必须：会话不驻留 pod 内存，每请求从 Redis 回读；否则跨副本会丢失 pow challenge / 2FA / 登录态
    APP_SESSION__MEMORY_LIFESPAN_SECS: "0"
    APP_GIT__BASE_URL: "https://gitdata.ai"
    APP_LIVEKIT__RECORDING_ENABLED: "false"

    # ---- 邮件 ----
    APP_EMAIL__ENABLED: "true"
    APP_EMAIL__SMTP_HOST: "smtpdm.aliyun.com"
    APP_EMAIL__SMTP_PORT: "465"
    APP_EMAIL__SMTP_USERNAME: "bot@mail.gitdata.ai"
    APP_EMAIL__FROM_ADDRESS: "bot@mail.gitdata.ai"
    APP_EMAIL__FROM_NAME: "GitData"
    APP_EMAIL_QUEUE__ENABLED: "true"

    RUST_LOG: "info,axum_session::session_store=error"

ingress:
  enabled: true
  className: nginx
  host: gitdata.ai
  tls:
    enabled: true
    secretName: ""
    clusterIssuer: cloudflare-acme-cluster-issuer
  proxyBodySize: "0"
  proxyReadTimeout: 3600
  proxySendTimeout: 3600
  proxyConnectTimeout: 60

githost:
  enabled: true
  # 多副本：SSH host key 已预置在共享 PVC，replica 间共用同一把
  replicaCount: 2
  httpPort: 9418
  ssh:
    enabled: true
    containerPort: 2222
    # clone URL 对外统一 ssh.gitdata.ai:22；22 由外部 nginx 反代到 LB 的 31838
    # （云边缘封禁集群公网 IP 的 22，报文到不了集群；31838 安全组已放行、实测全球可达）
    cloneHost: "ssh.gitdata.ai"
    clonePort: 22
    service:
      type: LoadBalancer
      port: 22
      annotations:
        # 固定 MetalLB 分配的 SSH LB IP，与 cloneHost 保持一致
        metallb.universe.tf/loadBalancerIPs: "47.239.98.8"

adminhost:
  enabled: true
  ingress:
    enabled: true
    host: admin.gitdata.ai
    className: nginx
    tls:
      enabled: true
      secretName: ""
      clusterIssuer: cloudflare-acme-cluster-issuer

webhook:
  enabled: true
  ingress:
    enabled: true
    host: hooks.gitdata.ai
    className: nginx
    tls:
      enabled: true
      secretName: ""
      clusterIssuer: cloudflare-acme-cluster-issuer

# ---------------------------------------------------------------------------
# AI：评审 / 仓库总结 / release 文案（值对齐 config/local.toml）
# api_key 走 secret.env -> APP_AI__API_KEY
# ---------------------------------------------------------------------------
ai:
  enabled: true
  baseUrl: "https://llm-g0x83i22nyj4pub7.cn-beijing.maas.aliyuncs.com/compatible-mode/v1"
  model: "qwen3.8-flash"
  reviewEnabled: true
  summaryEnabled: true
  releaseNotesEnabled: true
  queueTopic: "gitdata:ai"
  dlqTopic: "gitdata:ai:dlq"
  maxAttempts: 3
  requestTimeoutSecs: 600
  contextMaxBytes: 524288
  maxFindings: 20
  maxOutputTokens: 4096
  thinkingBudget: 2048
  temperature: "0.2"
  summaryCommitLimit: 50
  botUsername: "ai-reviewer"
  botDisplayName: "AI Reviewer"
  outputLanguage: "zh-CN"

aihost:
  enabled: true
  replicaCount: 1
  port: 3006
  concurrency: 2
  pollIntervalSecs: 5
  retryBackoffBaseSecs: 2
  resources:
    requests: { cpu: 100m, memory: 256Mi }
    limits: { memory: 1Gi }
  extraEnv: []

persistence:
  repos:
    enabled: true
    # 预创建的独立 PVC（2Ti, aliyun-nfs-pro, Retain+archiveOnDelete）
    # 由 kubectl 管理而非 helm，卸载/删除 release 都不会回收
    existingClaim: gitdata-repos
    size: 2Ti
    storageClassName: aliyun-nfs-pro
    accessModes: ["ReadWriteMany"]
    mountPath: /opt/gitdata

migrate:
  enabled: true

synchost:
  enabled: true
  replicaCount: 2

mails:
  enabled: true

im:
  enabled: true

runner:
  enabled: false