# Default values for gitdata.
nameOverride: ""
fullnameOverride: ""

image:
  repository: gitdata
  # 留空则用 Chart.appVersion 作为 tag
  tag: ""
  pullPolicy: IfNotPresent
imagePullSecrets: []

serviceAccount:
  create: true
  name: ""
  annotations: {}

# ---------------------------------------------------------------------------
# 运行时配置。全部通过 Figment 的 APP_* 环境变量注入（见 docs/技术架构.md §12）。
# config.env   -> ConfigMap（非敏感）
# secret.env   -> Secret（敏感）；生产建议改用 existingSecret + 外部密钥管理
# ---------------------------------------------------------------------------

# 非敏感配置（string->string，值会被转成 APP_* 环境变量）
config:
  env:
    APP_REDIS__URL: "redis://redis-master:6379"
    APP_S3__ENDPOINT: ""
    APP_S3__BUCKET: ""
    APP_S3__REGION: "us-east-1"
    APP_S3__PATH_STYLE: "true"
    # 读写库/副本、邮件、配额等其余段均可在此覆盖，例如：
    # APP_DATABASE__REPLICAS: '[{url="postgres://readonly@pg:5432/gitdata"}]'
    APP_EMAIL__ENABLED: "false"
    APP_EMAIL_QUEUE__ENABLED: "false"
    APP_SEARCH__ENABLED: "false"
    APP_SEARCH__URL: "http://meilisearch:7700"
    APP_SEARCH__INDEX_PREFIX: "gitdata"
    APP_IMPORT__ENABLED: "false"
    # Web Push：默认关闭；开启前必须同时提供 APP_PUSH__VAPID_PUBLIC_KEY（此处）
    # 与 APP_PUSH__VAPID_PRIVATE_KEY（secret.env）。密钥生成见 config/default.toml。
    APP_PUSH__ENABLED: "false"
    APP_PUSH__VAPID_PUBLIC_KEY: ""
    APP_PUSH__VAPID_SUBJECT: "mailto:ops@example.com"
    # 自建 forge 的内网地址需显式加白，例如：
    # APP_IMPORT__ALLOWED_HOSTS: '["gitea.internal","gitlab.svc.cluster.local"]'
    # 多副本必须置 0：axum_session 默认在每个 pod 内存缓存会话最长 60 分钟，
    # 副本间内存快照互不可见，会导致跨副本丢失 pow challenge / 2FA / 登录态。
    APP_SESSION__MEMORY_LIFESPAN_SECS: "0"
    # 上面的 0 会让无会话请求（/healthz、扫描器）产生一条无害的 warn 噪音，压掉它。
    RUST_LOG: "info,session::session_store=error"

# 敏感配置（渲染为 Secret）。注意 AppConfig 的 Debug 会带出密钥，
# 切勿在任何日志里 {:?} 打印配置。
secret:
  # 留空则不创建 Secret，仅使用 existingSecret
  create: true
  existingSecret: ""
  env:
    APP_DATABASE__URL: "postgres://postgres:CHANGE_ME@postgres:5432/gitdata"
    APP_SESSION__KEY: ""            # >=64 字节随机串
    APP_POW__MAC_KEY: ""            # base64 >=32 字节
    APP_AUTH__TOTP_ENCRYPTION_KEY: ""  # base64 >=32 字节（实测必填）
    APP_S3__ACCESS_KEY_ID: ""
    APP_S3__SECRET_ACCESS_KEY: ""
    APP_EMAIL__SMTP_PASSWORD: ""
    APP_AUTH__CHAT_JWT_SEC: ""    # >=32 字节，chat WS 握手 JWT 密钥
    APP_SEARCH__API_KEY: ""
    APP_IMPORT__TOKEN_SECRET: ""   # >=32 字节，加密导入任务里的源站令牌
    APP_ADMIN__SEED_USERNAME: ""      # 首次启动种子管理员账号（admin_user 为空时创建）
    APP_ADMIN__SEED_PASSWORD: ""      # 种子管理员口令，首次登录强制修改
    APP_CI__SECRET_ENCRYPTION_KEY: "" # base64 >=32 字节，CI secrets / webhook 加密密钥
    APP_PUSH__VAPID_PRIVATE_KEY: ""   # base64url 32 字节 P-256 标量，Web Push 签名私钥

podSecurityContext:
  fsGroup: 10001
securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]

nodeSelector: {}
tolerations: []
affinity: {}
podAnnotations: {}
podLabels: {}

# ---------------------------------------------------------------------------
# 组件
# ---------------------------------------------------------------------------

migrate:
  enabled: true          # pre-install / pre-upgrade hook Job
  resources:
    requests: { cpu: 100m, memory: 128Mi }
    limits: { memory: 512Mi }
  extraEnv: []

apihost:
  enabled: true
  replicaCount: 2
  port: 3000
  resources:
    requests: { cpu: 250m, memory: 256Mi }
    limits: { memory: 1Gi }
  autoscaling:
    enabled: false
    minReplicas: 2
    maxReplicas: 8
    targetCPUUtilizationPercentage: 70
    targetMemoryUtilizationPercentage: 0
    # Empty map renders no `behavior:` block (k8s default scaling policy).
    behavior: {}
  maxSurge: 1
  maxUnavailable: 0
  podAntiAffinity: soft   # soft | hard | ""
  topologySpreadConstraints: []
  extraEnv: []
  pdb:
    enabled: true
    minAvailable: 1

adminhost:
  enabled: true
  replicaCount: 1
  port: 3004
  resources:
    requests: { cpu: 100m, memory: 128Mi }
    limits: { memory: 512Mi }
  extraEnv: []
  # 管理端独立域名 Ingress（同源提供 SPA + /api/v1/admin）
  ingress:
    enabled: false
    host: admin.gitdata.example.com
    className: ""
    tls:
      enabled: false
      secretName: ""
      clusterIssuer: ""

githost:
  enabled: true
  # SSH host key 落在共享 PVC 上；多副本前请预先放入同一把 key，
  # 否则每个 Pod 各自生成会导致客户端 known_hosts 抖动
  replicaCount: 1
  httpPort: 9418
  ssh:
    enabled: true
    # 非 root 进程绑不了 22，容器内监听 2222，Service 映射 22->2222
    containerPort: 2222
    service:
      type: LoadBalancer
      port: 22
      nodePort: ""        # type=NodePort 时可选
      annotations: {}
      externalIPs: []
      # clone URL（对外展示/拼接用），一般填 LB 域名或 IP
      cloneHost: ""
      clonePort: 22
  resources:
    requests: { cpu: 250m, memory: 256Mi }
    limits: { memory: 1Gi }
  extraEnv: []
  pdb:
    enabled: false
    minAvailable: 1

synchost:
  enabled: true
  replicaCount: 2
  resources:
    requests: { cpu: 200m, memory: 192Mi }
    limits: { memory: 768Mi }
  extraEnv: []

mails:
  enabled: true
  replicaCount: 1
  resources:
    requests: { cpu: 50m, memory: 64Mi }
    limits: { memory: 256Mi }
  extraEnv: []

# worker 类程序的独立健康端点（apihost/githost/im 挂在自己业务端口上）
health:
  enabled: true
  synchostPort: 3002
  mailsPort: 3003
  aihostPort: 3006

im:
  enabled: true
  replicaCount: 2
  port: 3001
  resources:
    requests: { cpu: 100m, memory: 128Mi }
    limits: { memory: 512Mi }
  autoscaling:
    enabled: false
    minReplicas: 2
    maxReplicas: 6
    targetCPUUtilizationPercentage: 70
    # 0 disables the memory metric. Against the 128Mi request this is the
    # connection-count guard: each live socket costs buffers plus its own
    # pubsub pump, and the limit (512Mi) is far above where a pod should be.
    targetMemoryUtilizationPercentage: 0
    behavior: {}
  maxSurge: 1
  maxUnavailable: 0
  podAntiAffinity: soft   # soft | hard | ""
  extraEnv: []
  pdb:
    enabled: true
    minAvailable: 1

# ---------------------------------------------------------------------------
# AI：评审 / 仓库总结 / release 文案。启用前必须提供 OpenAI 兼容端点。
# 密钥走 secret.env（APP_AI__API_KEY），不要写在这里。
# ---------------------------------------------------------------------------
ai:
  # 非敏感默认值；enabled/base_url/model 等按需在 values 覆盖
  enabled: false
  reviewEnabled: true
  summaryEnabled: true
  releaseNotesEnabled: true
  queueTopic: "gitdata:ai"
  dlqTopic: "gitdata:ai:dlq"
  maxAttempts: 3
  requestTimeoutSecs: 120
  contextMaxBytes: 524288
  maxFindings: 20
  maxOutputTokens: 4096
  thinkingBudget: 0
  temperature: "0.2"
  summaryCommitLimit: 50
  botUsername: "ai-reviewer"
  botDisplayName: "AI Reviewer"
  outputLanguage: "zh-CN"

aihost:
  enabled: true
  replicaCount: 1
  port: 3006
  concurrency: 2
  pollIntervalSecs: 5
  retryBackoffBaseSecs: 2
  resources:
    requests: { cpu: 100m, memory: 256Mi }
    limits: { memory: 1Gi }
  extraEnv: []

# ---------------------------------------------------------------------------
# 存储：githost 与 synchost 共享 bare 仓库，需要 RWX
# ---------------------------------------------------------------------------
persistence:
  repos:
    enabled: true
    size: 50Gi
    storageClassName: ""      # "" = 默认 StorageClass
    accessModes: ["ReadWriteMany"]
    existingClaim: ""
    mountPath: /opt/gitdata

# ---------------------------------------------------------------------------
# Ingress：同源 TLS 终结；*.git -> githost，/ws/v1 -> im，其余 -> apihost
#
# controller 决定路由怎么写：
#   nginx   —— 主 Ingress 用 regex path + ImplementationSpecific（配 use-regex 注解）
#   traefik —— 主 Ingress 只写前缀路由；*.git 由 templates/ingressroute-githost.yaml
#              的 IngressRoute（PathRegexp）接管 —— traefik 的 Ingress provider 不支持
#              正则 path，ImplementationSpecific 会被当字面前缀处理。
# 其它控制器请把 controller 设成非 nginx 值，并按需在 className/annotations 里给出自己的语义。
# ---------------------------------------------------------------------------
ingress:
  enabled: true
  controller: nginx
  className: nginx
  host: gitdata.example.com
  # githost 路由匹配（仅 controller=nginx 使用）
  githostPath: "^/(.*\\.git)(/|$)|^/[^/]+/[^/]+/(HEAD$|info/|objects/|git-upload-pack|git-receive-pack)"
  # traefik 用的正则（覆盖 owner/repo.git 与多级 group）；同时放行省略 .git 的 git
  # 协议端点 —— actions/checkout 用 GITHUB_SERVER_URL + GITHUB_REPOSITORY 拼远程地址，
  # 不带 .git 后缀，只按 *.git 匹配会把它打到 apihost 的 SPA 上。
  githostPathRegexp: "^/.+\\.git(/|$)|^/[^/]+/[^/]+/(HEAD$|info/|objects/|git-upload-pack|git-receive-pack)"
  annotations: {}
  tls:
    enabled: true
    secretName: ""            # 留空 = <fullname>-tls
    clusterIssuer: ""         # 填 cert-manager ClusterIssuer 自动签发
  # 大文件 push / 长 RPC
  proxyBodySize: "0"          # 0 = 不限制
  proxyReadTimeout: 3600
  proxySendTimeout: 3600
  proxyConnectTimeout: 60

metrics:
  # OTLP 推送（无 scrape 端点，见 §13）
  otlpEndpoint: ""

webhook:
  enabled: true
  replicaCount: 1
  port: 3005
  resources:
    requests: { cpu: 100m, memory: 128Mi }
    limits: { memory: 512Mi }
  extraEnv: []
  # 外部 runner 通过该域名接入调度中心；留空则仅集群内 Service 可达
  ingress:
    enabled: true
    className: nginx
    host: hooks.gitdata.example.com
    annotations: {}
    tls:
      enabled: false
      secretName: ""

runner:
  # 默认关闭：多数部署在自有机器上运行 runner 二进制
  enabled: false
  actionsImage:
    repository: gitdata-act
    tag: ""
    pullPolicy: IfNotPresent
  replicaCount: 1
  labels: ["self-hosted", "docker"]
  capacity: 1
  dockerEnabled: false
  serverUrl: ""
  resources:
    requests: { cpu: 500m, memory: 512Mi }
    limits: { memory: 4Gi }
  extraEnv: []