#@ load("@ytt:data", "data")
#@ host = data.values.application.subdomain + "." + data.values.cluster.domain
---
argoCD: true

serverName: #@ host
publicServerName: #@ host

image:
  repository: ghcr.io/element-hq/synapse

config:
  reportStats: false
  enableRegistration: false
  publicBaseurl: #@ "https://" + host
  #! Placeholders kept stable across renders so the chart-managed Secret
  #! does not drift in ArgoCD. The real values live in `synapse-secrets`
  #! (mittwald-generated) and are written to conf.d/zz-overrides.yaml at
  #! pod startup via synapse.extraCommands, overriding these.
  registrationSharedSecret: overridden-by-zz-overrides
  macaroonSecretKey: overridden-by-zz-overrides

signingkey:
  job:
    enabled: false
  existingSecret: synapse-signing-key
  existingSecretKey: signing.key

postgresql:
  enabled: false

externalPostgresql:
  host: synapse-cnpg-rw.matrix.svc
  port: 5432
  username: synapse
  database: synapse
  existingSecret: synapse-cnpg-app
  existingSecretPasswordKey: password
  sslmode: disable

redis:
  enabled: false
  usePassword: false
  password: ~
  auth:
    enabled: false
    password: ~

externalRedis:
  host: redis.matrix.svc
  port: 6379
  password: ~

persistence:
  enabled: true
  storageClass: #@ data.values.cluster.storageClass.block
  accessMode: ReadWriteOnce
  size: 10Gi

service:
  type: ClusterIP
  port: 8008

ingress:
  enabled: true
  className: #@ data.values.cluster.ingress.className
  annotations:
    cert-manager.io/cluster-issuer: #@ data.values.cluster.tls.issuer
  tls:
    - secretName: matrix-tls
      hosts:
        - #@ host

wellknown:
  enabled: false

synapse:
  strategy:
    type: Recreate
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 512Mi
  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 991
    runAsGroup: 991
    fsGroup: 991
    seccompProfile:
      type: RuntimeDefault
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
  extraVolumes:
    - name: synapse-secrets
      secret:
        secretName: synapse-secrets
  extraVolumeMounts:
    - name: synapse-secrets
      mountPath: /synapse/extra-secrets
      readOnly: true
  extraCommands:
    - 'i=0; while [ ! -s /synapse/extra-secrets/registration_shared_secret ] && [ $i -lt 60 ]; do echo "waiting for synapse-secrets"; sleep 2; i=$((i+1)); done'
    - 'printf ''registration_shared_secret: "%s"\nmacaroon_secret_key: "%s"\nform_secret: "%s"\n'' "$(cat /synapse/extra-secrets/registration_shared_secret)" "$(cat /synapse/extra-secrets/macaroon_secret_key)" "$(cat /synapse/extra-secrets/form_secret)" > /synapse/config/conf.d/zz-overrides.yaml'

serviceAccount:
  create: true
