image:
  repository: harbor.gitdata.me/app/gitdata
  tag: "9da24e1"
  pullPolicy: IfNotPresent

serviceAccount:
  create: true

config:
  env:
    APP_REDIS__MODE: "cluster"
    APP_REDIS__POOL_SIZE: "8"
    APP_S3__ENDPOINT: "http://rustfs-svc.rustfs.svc.cluster.local:9000"
    APP_S3__PUBLIC_ENDPOINT: "https://object.gitdata.ai"
    APP_S3__BUCKET: "gitdata"
    APP_S3__REGION: "us-east-1"
    APP_S3__PATH_STYLE: "true"
    APP_SEARCH__ENABLED: "true"
    APP_SEARCH__URL: "http://meilisearch.meilisearch.svc.cluster.local:7700"
    APP_SEARCH__INDEX_PREFIX: "gitdata"
    APP_LIVEKIT__ENABLED: "true"
    APP_LIVEKIT__URL: "wss://livekit.gitdata.ai"
    APP_LIVEKIT__API_URL: "https://livekit.gitdata.ai"
    APP_PUSH__ENABLED: "true"
    APP_PUSH__VAPID_PUBLIC_KEY: "BG4X_BUPF-hgTX7xCzpRw9B1y3RO3y6lEBcuh0A62S4A1sjs79C54gUOzp3h8zy0oFsjVFM7A2OVM_6crzhLhMw"
    APP_PUSH__VAPID_SUBJECT: "mailto:bot@mail.gitdata.ai"
    APP_WEB__WEB_BASE_URL: "https://gitdata.ai"
    APP_WEB__CORS_ALLOW_ORIGINS: '["https://gitdata.ai"]'
    APP_SESSION__COOKIE_SECURE: "true"
    APP_SESSION__MEMORY_LIFESPAN_SECS: "0"
    APP_GIT__BASE_URL: "https://gitdata.ai"
    APP_LIVEKIT__RECORDING_ENABLED: "false"
    APP_EMAIL__ENABLED: "true"
    APP_EMAIL__SMTP_HOST: "smtpdm.aliyun.com"
    APP_EMAIL__SMTP_PORT: "465"
    APP_EMAIL__SMTP_USERNAME: "bot@mail.gitdata.ai"
    APP_EMAIL__FROM_ADDRESS: "bot@mail.gitdata.ai"
    APP_EMAIL__FROM_NAME: "GitData"
    APP_EMAIL_QUEUE__ENABLED: "true"
    # CI 开关：runner 注册走 /api/v1/runner/register，该处理函数第一件事就是
    # ensure_enabled()（lib/ci/src/service.rs:46），关闭时直接返回 403 Forbidden。
    # 开启后必须同时提供 APP_CI__SECRET_ENCRYPTION_KEY（已在 gitdata-env Secret 中）。
    APP_CI__ENABLED: "true"
    # 必须是纯 origin（无路径前缀）：lib/ci/src/actions_runtime.rs:158 actions_runtime_url()
    # 会用 reqwest::Url::parse 校验，带路径就报 "must be a URL origin without a path prefix"。
    # 用跨命名空间 FQDN：runner 池在 gitdata-runners 命名空间，这个 URL 会随 claim
    # 响应下发（lib/ci/src/actions_payload.rs:87 runtime_url），必须两边都能解析。
    APP_CI__RUNTIME_BASE_URL: "http://gitdata-webhook.gitdata.svc.cluster.local:3005"
    RUST_LOG: "info,session::session_store=error"
    OTEL_TRACES_SAMPLER: "parentbased_traceidratio"
    OTEL_TRACES_SAMPLER_ARG: "0.2"


metrics:
  otlpEndpoint: "http://otel-collector.monitoring.svc.cluster.local:4318"

ingress:
  enabled: true
  controller: traefik
  className: traefik
  host: gitdata.ai
  annotations:
    traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
    traefik.ingress.kubernetes.io/service.sticky.cookie.name: "GD-AFFINITY"
    traefik.ingress.kubernetes.io/service.sticky.cookie.httpOnly: "true"
    traefik.ingress.kubernetes.io/service.sticky.cookie.secure: "true"
    traefik.ingress.kubernetes.io/service.sticky.cookie.sameSite: "Lax"
  tls:
    enabled: true
    secretName: ""
    clusterIssuer: cloudflare-acme-cluster-issuer
apihost:
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits: { memory: 1Gi }
  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 6
    targetCPUUtilizationPercentage: 65
    targetMemoryUtilizationPercentage: 80
    behavior:
      scaleUp:
        stabilizationWindowSeconds: 20
        policies:
          - type: Percent
            value: 100
            periodSeconds: 30
          - type: Pods
            value: 4
            periodSeconds: 30
        selectPolicy: Max
      scaleDown:
        stabilizationWindowSeconds: 300
        policies:
          - type: Pods
            value: 1
            periodSeconds: 60


githost:
  enabled: true
  replicaCount: 1
  httpPort: 9418
  ssh:
    enabled: true
    containerPort: 2222
    cloneHost: "ssh.gitdata.ai"
    clonePort: 22
    service:
      type: LoadBalancer
      port: 22
      annotations:
        metallb.universe.tf/loadBalancerIPs: "47.239.98.8"

adminhost:
  enabled: true
  ingress:
    enabled: true
    host: admin.gitdata.ai
    className: traefik
    tls:
      enabled: true
      secretName: ""
      clusterIssuer: cloudflare-acme-cluster-issuer

webhook:
  enabled: true
  ingress:
    enabled: true
    host: hooks.gitdata.ai
    className: traefik
    tls:
      enabled: true
      secretName: ""
      clusterIssuer: cloudflare-acme-cluster-issuer

ai:
  enabled: true
  baseUrl: "https://api.deepseek.com"
  model: "deepseek-flash"
  reviewEnabled: true
  summaryEnabled: true
  releaseNotesEnabled: true
  queueTopic: "gitdata:ai"
  dlqTopic: "gitdata:ai:dlq"
  maxAttempts: 3
  requestTimeoutSecs: 600
  contextMaxBytes: 524288
  maxFindings: 20
  maxOutputTokens: 4096
  thinkingBudget: 2048
  temperature: "0.2"
  summaryCommitLimit: 50
  botUsername: "ai-reviewer"
  botDisplayName: "AI Reviewer"
  outputLanguage: "zh-CN"


aihost:
  enabled: true
  replicaCount: 1
  port: 3006
  concurrency: 2
  pollIntervalSecs: 5
  retryBackoffBaseSecs: 2
  resources:
    requests: { cpu: 100m, memory: 256Mi }
    limits: { memory: 1Gi }
  extraEnv: []

persistence:
  repos:
    enabled: true
    existingClaim: gitdata-repos
    size: 2Ti
    storageClassName: aliyun-nfs-pro
    accessModes: ["ReadWriteMany"]
    mountPath: /opt/gitdata

migrate:
  enabled: true

synchost:
  enabled: true
  replicaCount: 2

mails:
  enabled: true

im:
  enabled: true
  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 6
    targetCPUUtilizationPercentage: 70
    targetMemoryUtilizationPercentage: 80
    behavior:
      scaleUp:
        stabilizationWindowSeconds: 30
        policies:
          - type: Percent
            value: 100
            periodSeconds: 60
          - type: Pods
            value: 2
            periodSeconds: 60
        selectPolicy: Max
      scaleDown:
        stabilizationWindowSeconds: 600
        policies:
          - type: Pods
            value: 1
            periodSeconds: 120

runner:
  enabled: false
  actionsImage:
    repository: harbor.gitdata.me/app/gitdata-act
    tag: ""
    pullPolicy: IfNotPresent