# Default values for rise
replicaCount: 1

image:
  repository: ghcr.io/niklasrosenstein/rise
  pullPolicy: IfNotPresent
  tag: ""  # Overrides the image tag whose default is the chart appVersion

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  create: true
  annotations: {}
  name: ""
  # IAM role ARN for IRSA (IAM Roles for Service Accounts) on EKS
  # When set, adds eks.amazonaws.com/role-arn annotation to the ServiceAccount
  # Example: "arn:aws:iam::123456789012:role/rise-backend"
  iamRoleArn: ""

podAnnotations: {}

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000
  fsGroup: 1000

securityContext:
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false

# Additional environment variables (key-value pairs)
env: []
  # - name: RUST_LOG
  #   value: "info"
  # - name: AWS_REGION
  #   value: "us-east-1"

# Environment variables from ConfigMaps and Secrets
envFrom: []
  # - secretRef:
  #     name: rise-env-secrets
  # - configMapRef:
  #     name: rise-env-config

service:
  type: ClusterIP
  port: 3000
  targetPort: 3000

ingress:
  enabled: false
  className: "nginx"
  annotations: {}
    # cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: rise.example.com
      paths:
        - path: /
          pathType: Prefix
  tls: []
  #  - secretName: rise-tls
  #    hosts:
  #      - rise.example.com

# Server container resources
server:
  resources:
    limits:
      cpu: 1000m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 128Mi

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

nodeSelector: {}

tolerations: []

affinity: {}

# Rise backend configuration overrides
# Converted to YAML and mounted as /etc/rise/local.yaml
# The backend supports both TOML and YAML - this chart outputs YAML by default
config:
  server:
    host: "0.0.0.0"
    port: 3000
    public_url: "http://rise.example.com"
    # cookie_domain: ""  # Optional: Cookie domain for session cookies (e.g., ".rise.dev" for subdomain sharing)
    # cookie_secure: true  # Optional: Set Secure flag on cookies (default: true, set false for HTTP development)

  auth:
    issuer: "http://dex:5556/dex"
    client_id: "rise-backend"
    client_secret: ""  # Override with Secret or environment variable
    # admin_users: []  # Optional: List of admin user emails with full permissions
    # Optional: Custom OAuth2 endpoints (autodiscovered from issuer/.well-known/openid-configuration if not set)
    # For Entra ID/Azure AD:
    # authorize_url: "https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize"
    # token_url: "https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token"

  database: {}
    # url is typically set via DATABASE_URL environment variable from a Secret
    # url: "postgres://user:pass@host:5432/dbname"

  # Optional: Controller timing configuration
  # controller:
  #   reconcile_interval_secs: 5
  #   health_check_interval_secs: 5
  #   termination_interval_secs: 5
  #   cancellation_interval_secs: 5
  #   expiration_interval_secs: 60
  #   secret_refresh_interval_secs: 3600

  # Container registry configuration (required)
  registry:
    type: "oci-client-auth"
    registry_url: "registry.example.com"
    namespace: "rise-apps"
    # Alternative: AWS ECR registry
    # type: "ecr"
    # region: "us-east-1"
    # account_id: "123456789012"
    # repo_prefix: "rise/"
    # role_arn: "arn:aws:iam::123456789012:role/rise-backend"
    # push_role_arn: "arn:aws:iam::123456789012:role/rise-backend-ecr-push"
    # auto_remove: false

  # Optional: Kubernetes deployment controller configuration
  # IMPORTANT: namespace_format should use a consistent prefix for security.
  # Rise requires ClusterRole permissions (Kubernetes RBAC doesn't support namespace wildcards).
  # Use a consistent prefix (e.g., "rise-") and enforce it with admission controllers or policies.
  # kubernetes:
  #   kubeconfig: ""  # Optional: Path to kubeconfig (defaults to in-cluster config)
  #   ingress_class: "nginx"
  #   production_ingress_url_template: "{project_name}.apps.rise.dev"  # Must contain {project_name}
  #   staging_ingress_url_template: "{project_name}-{deployment_group}.preview.rise.dev"  # Optional, must contain {project_name} and {deployment_group}
  #   # Or for sub-path routing:
  #   # production_ingress_url_template: "rise.dev/{project_name}"
  #   # staging_ingress_url_template: "rise.dev/{project_name}/{deployment_group}"
  #   auth_backend_url: "http://rise-backend.default.svc.cluster.local:3000"  # Internal cluster URL for Nginx auth
  #   auth_signin_url: "https://rise.dev"  # Public URL for browser redirects
  #   namespace_format: "rise-{project_name}"  # Must use consistent prefix and contain {project_name}
  #   namespace_labels: {}  # Optional: Labels for managed namespaces
  #   namespace_annotations: {}  # Optional: Annotations for managed namespaces
  #   ingress_annotations: {}  # Optional: Additional annotations (e.g., cert-manager)
  #   ingress_tls_secret_name: ""  # Optional: TLS secret name for ingresses

# PostgreSQL (optional, can use external database)
# When enabled, DATABASE_URL is automatically injected into all containers
postgresql:
  enabled: false

  image:
    repository: postgres
    tag: "18-alpine"
    pullPolicy: IfNotPresent

  auth:
    username: rise
    password: rise123  # CHANGE IN PRODUCTION: Override via Secret
    database: rise

  persistence:
    enabled: true
    size: 8Gi
    storageClass: ""  # Use cluster default

  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi

# Dex OIDC provider (optional)
dex:
  enabled: false
  replicaCount: 1

  image:
    repository: ghcr.io/dexidp/dex
    tag: v2.45.1
    pullPolicy: IfNotPresent

  imagePullSecrets: []

  podAnnotations: {}

  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 1001
    fsGroup: 1001

  securityContext:
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false

  service:
    type: ClusterIP
    port: 5556
    grpcPort: 5557

  resources:
    limits:
      cpu: 500m
      memory: 256Mi
    requests:
      cpu: 100m
      memory: 64Mi

  nodeSelector: {}
  tolerations: []
  affinity: {}

  # Dex configuration
  # Converted to YAML and mounted as /etc/dex/config.yaml
  # See https://dexidp.io/docs/ for full configuration options
  config:
    issuer: "http://dex:5556/dex"

    storage:
      type: memory

    web:
      http: "0.0.0.0:5556"

    staticClients:
      - id: rise-backend
        redirectURIs:
          # Frontend JavaScript OAuth flow (update based on your actual public_url)
          - "http://rise.example.com/"
          # Backend OAuth2 Proxy flow for ingress auth
          - "http://rise.example.com/api/v1/auth/callback"
          # CLI callback URLs
          - "http://localhost:8765/callback"
          - "http://localhost:8766/callback"
          - "http://localhost:8767/callback"
        name: "Rise Backend"
        secret: "rise-backend-secret"

    enablePasswordDB: true
    staticPasswords:
      - email: "admin@example.com"
        hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"  # password
        username: "admin"
        userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
      - email: "dev@example.com"
        hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"  # password
        username: "dev"
        userID: "f4d1c5e1-3c6e-4d2a-9f4b-2e5d7c8e9f01"
      - email: "user@example.com"
        hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"  # password
        username: "user"
        userID: "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"

    oauth2:
      skipApprovalScreen: true
      passwordConnector: local
