#@ load("@ytt:data", "data")
#@ host = data.values.application.subdomain + "." + data.values.cluster.domain
---
externalDomain: #@ host

insecure:
  oidcIdpInsecure: #@ data.values.ocis.insecure
  ocisHttpApiInsecure: #@ data.values.ocis.insecure
  ocmInsecure: #@ data.values.ocis.insecure

ingress:
  enabled: true
  ingressClassName: #@ data.values.cluster.ingress.className
  annotations:
    cert-manager.io/cluster-issuer: #@ data.values.cluster.tls.issuer
  tls:
    - secretName: ocis-tls
      hosts:
        - #@ host

features:
  emailNotifications:
    enabled: false

resources:
  requests:
    memory: 64Mi
    cpu: 10m

secretRefs:
  adminUserSecretRef: ocis-admin-user
  idpSecretRef: ocis-idp-secrets
  jwtSecretRef: ocis-jwt-secret
  ldapSecretRef: ocis-ldap-bind-secrets
  ldapCaRef: ocis-ldap-ca
  ldapCertRef: ocis-ldap-cert
  machineAuthApiKeySecretRef: ocis-machine-auth-api-key
  storagesystemJwtSecretRef: ocis-storage-system-jwt-secret
  storagesystemSecretRef: ocis-storage-system
  thumbnailsSecretRef: ocis-thumbnails-transfer-secret
  transferSecretSecretRef: ocis-transfer-secret
  serviceAccountSecretRef: ocis-service-account-secret
  collaborationWopiSecret: ocis-collaboration-wopi-secret
  s3CredentialsSecretRef: ocis-s3-credentials

services:
  storageusers:
    maintenance:
      cleanUpExpiredUploads:
        enabled: true
    resources:
      requests:
        memory: 512Mi
        cpu: 10m
      limits:
        memory: 1536Mi
    storageBackend:
      driver: s3ng
      driverConfig:
        s3ng:
          endpoint: #@ data.values.ocis.s3.endpoint
          region: #@ data.values.ocis.s3.region
          bucket: #@ data.values.ocis.s3.bucket
    persistence:
      enabled: true
      storageClassName: #@ data.values.cluster.storageClass.block
      size: 10Gi
      accessModes:
        - ReadWriteOnce

  storagesystem:
    persistence:
      enabled: true
      storageClassName: #@ data.values.cluster.storageClass.block
      size: 10Gi
      accessModes:
        - ReadWriteOnce

  idm:
    resources:
      requests:
        memory: 256Mi
        cpu: 10m
    persistence:
      enabled: true
      storageClassName: #@ data.values.cluster.storageClass.block
      size: 10Gi
      accessModes:
        - ReadWriteOnce

  nats:
    resources:
      requests:
        memory: 192Mi
        cpu: 10m
    persistence:
      enabled: true
      storageClassName: #@ data.values.cluster.storageClass.local
      size: 1Gi
      accessModes:
        - ReadWriteOnce

  search:
    persistence:
      enabled: true
      storageClassName: #@ data.values.cluster.storageClass.local
      size: 5Gi
      accessModes:
        - ReadWriteOnce

  web:
    #! GOTCHA: if this PVC is recreated, /branding/logo POST/DELETE will
    #! 500 with "permission denied". The chart mounts an `apps` emptyDir
    #! at /var/lib/ocis/web/assets/apps; kubelet auto-creates the parent
    #! dirs as root:root 0755 *after* fsGroup runs, and local-path's
    #! hostPath PV doesn't get fsGroup recursion — so user 1000 can't
    #! mkdir themes/ to store the uploaded logo. Was masked while ocis
    #! ran as PSS=privileged (root); surfaced after PSS=restricted.
    #! Remediation: one-shot privileged Job in kube-system, hostPath-
    #! mount the local-path PV directory, `chown -R 1000:1000` it.
    #! Permanent fix: switch to a CSI storageClass (hcloud-volumes).
    persistence:
      enabled: true
      storageClassName: #@ data.values.cluster.storageClass.local
      size: 1Gi
      accessModes:
        - ReadWriteOnce

  proxy:
    resources:
      requests:
        memory: 96Mi
        cpu: 10m
  thumbnails:
    resources:
      requests:
        memory: 96Mi
        cpu: 10m
    persistence:
      enabled: true
      storageClassName: #@ data.values.cluster.storageClass.local
      size: 2Gi
      accessModes:
        - ReadWriteOnce
