values.yaml

allowedUsers: null

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 5
  targetCPUUtilizationPercentage: 80
  targetMemoryUtilizationPercentage: 80

appConfig:
  OPENHANDS_CONFIG_CLS: "server.config.SaaSServerConfig"
  OPENHANDS_CONVERSATION_VALIDATOR_CLS: "storage.saas_conversation_validator.SaasConversationValidator"
  OPENHANDS_GITHUB_SERVICE_CLS: "integrations.github.github_service.SaaSGitHubService"
  OPENHANDS_GITLAB_SERVICE_CLS: "integrations.gitlab.gitlab_service.SaaSGitLabService"
  OPENHANDS_BITBUCKET_SERVICE_CLS: "integrations.bitbucket.bitbucket_service.SaaSBitBucketService"
  OPENHANDS_BITBUCKET_DATA_CENTER_SERVICE_CLS: "integrations.bitbucket_data_center.bitbucket_dc_service.SaaSBitbucketDCService"
  OPENHANDS_MCP_CONFIG_CLS: "server.mcp.mcp_config.SaaSOpenHandsMCPConfig"
  OPENHANDS_EXPERIMENT_MANAGER_CLS: "experiments.experiment_manager.SaaSExperimentManager"
  POSTHOG_CLIENT_KEY: "1234abcd"

datadog:
  enabled: false
  env: "dev" # Default environment, can be overridden
  service: "openhands"
  agentHost: "datadog-agent"

debuggingRoutes:
  enabled: false

deployment:
  replicas: 1
  resources:
    requests:
      memory: 3Gi
      cpu: 1
    limits:
      memory: 3Gi

# Security context settings for all pods
securityContext:
  runAsUser: 42420
  runAsGroup: 42420
  fsGroup: 42420 # optional, if the pod needs to write to mounted volumes
  fsGroupChangePolicy: Always
  runAsNonRoot: true

env:
  DISABLE_WAITLIST: "true"
  SANDBOX_REMOTE_RUNTIME_API_TIMEOUT: "60"
  RUNTIME_URL_PATTERN: "https://{runtime_id}.runtime.app.example.com"
  # replace prod/claude-3-7-sonnet-20250219 with your LLM model and uncomment or override this variable
  # LITELLM_DEFAULT_MODEL: "litellm_proxy/prod/claude-3-7-sonnet-20250219"

filestore:
  ephemeral: false
  bucket: openhands-sessions

github:
  enabled: false

enrichUserInteractionData:
  enabled: false
  schedule: "*/10 * * * *" # Run every 10 minutes
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  successfulJobsHistoryLimit: 3
  backoffLimit: 3
  resources:
    requests:
      memory: "512Mi"
      cpu: "200m"
    limits:
      memory: "512Mi"
      cpu: "200m"

githubProxy:
  enabled: false
  endpointsEnabled: false

gitlab:
  enabled: false

bitbucket:
  enabled: false
  auth:
    existingSecret: bitbucket-app

enterpriseSSO:
  enabled: false

bitbucketDataCenter:
  enabled: false
  host: ""

gitlabWebhookInstallation:
  enabled: false
  schedule: "* * * * *"
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  successfulJobsHistoryLimit: 3
  backoffLimit: 3
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi
      cpu: 200m

image:
  repository: ghcr.io/openhands/enterprise-server
  tag: sha-3c5023a

ingress:
  enabled: false
  # REQUIRED: Update to a hostname in a DNS domain you own
  # host: "app.example.com"
  class: traefik
  # Legacy annotations field - kept for backward compatibility
  annotations: {}
    # UPDATE: if you use cert-manager, enter your clusterIssuer may not match.
    # cert-manager.io/cluster-issuer: letsencrypt-production

  # Separate annotations for each ingress
  root:
    annotations: {}
      # Example: Add specific annotations for the root ingress
      # nginx.ingress.kubernetes.io/proxy-body-size: "100m"

  integrations:
    annotations: {}
      # Example: Add specific annotations for integrations ingress
      # nginx.ingress.kubernetes.io/rate-limit: "100"

  mcp:
    annotations: {}
      # Example: Add specific annotations for MCP ingress
      # nginx.ingress.kubernetes.io/auth-type: basic

integrationEvents:
  deployment:
    replicas: 2
    resources:
      requests:
        memory: 1.5Gi
        cpu: 1000m
      limits:
        memory: 1.5Gi
        cpu: 1000m
  uvicorn:
    workers: 2

litellm:
  enabled: true
  # NOTE: to set the LLM model, set the LITELLM_DEFAULT_MODEL variable in the env section above.
  # REQUIRED: Update to match the hostname set in the litellm-helm ingress section
  url: "https://llm-proxy.example.com"
  # Team ID for LiteLLM. If the team ID doesn't exist, it will automatically be created.
  # Set this to use an existing team.
  teamId: "openhands"
  auth:
    existingSecret: lite-llm-api-key

mcpEvents:
  deployment:
    replicas: 2
  uvicorn:
    workers: 2

migrationJob:
  enabled: true
  initContainer:
    enabled: true

proactiveConvoClean:
  enabled: false
  schedule: "0 2 * * *" # Daily at 2 AM
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  successfulJobsHistoryLimit: 1
  backoffLimit: 3
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi
      cpu: 200m

resendSync:
  enabled: false
  schedule: "0 1 * * *" # Daily at 1 AM
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  successfulJobsHistoryLimit: 1
  backoffLimit: 3
  audienceId: ""
  batchSize: "100"
  maxRetries: "3"
  initialBackoffSeconds: "1"
  maxBackoffSeconds: "60"
  backoffFactor: "2"
  rateLimit: "10"
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi
      cpu: 200m

runtime:
  image:
    repository: ghcr.io/openhands/runtime
    tag: 3c5023ac021cfc075f2d6b5ff7f345f375bded47-nikolaik
  runAsRoot: true

sandbox:
  # REQUIRED: Update so this matches what you have set in the runtime api ingress
  # apiHostname: https://runtime-api.example.com
  apiHostname: "https://dummy-runtime-api.example.com"

serviceAccount:
  create: true
  name: openhands-sa

sessions:
  existingSecret: jwt-secret

slack:
  enabled: false

stripe:
  enabled: false
  requirePayment: false
  auth:
    existingSecret: stripe-secret

resend:
  enabled: false
  auth:
    existingSecret: resend-api-key

tavily:
  enabled: false
  auth:
    existingSecret: tavily-api-key

tls:
  enabled: false

certificate:
  enabled: false
  name: runtime-wildcard
  secretName: runtime-wildcard-tls
  issuer: google-clouddns
  domains: []
  # Example domains configuration:
  # domains:
  #   - "*.prod-runtime.all-hands.dev"
  # commonName: "*.prod-runtime.all-hands.dev"

tlsStore:
  enabled: false
  name: default
  secretName: runtime-wildcard-tls

uvicorn:
  workers: 3

## Chart dependency configurations

clickhouse:
  # Enable this if you enable langfuse, as it will use clickhouse for storage
  enabled: false
  shards: 2
  replicaCount: 1
  keeper:
    enabled: true
  auth:
    username: default
    existingSecret: clickhouse-password
    existingSecretKey: password
  image:
    repository: bitnamilegacy/clickhouse

keycloak:
  enabled: false
  url: "http://keycloak"
  fullnameOverride: keycloak
  replicaCount: 1
  production: true
  proxyHeaders: forwarded
  ingress:
    enabled: false
    # REQUIRED: Update to a hostname in a DNS domain you own
    # hostname: auth.app.example.com
    servicePort: 80
    tls: true
    annotations: {}
      # UPDATE: if you use cert-manager, enter your clusterIssuer may not match.
      # cert-manager.io/cluster-issuer: letsencrypt-production
    ingressClassName: traefik
  auth:
    adminUser: tmpadmin
    existingSecret: keycloak-admin
    passwordSecretKey: admin-password
  service:
    type: ClusterIP
  serviceAccount:
    name: "keycloak-sa"
  postgresql:
    enabled: false
  externalDatabase:
    host: oh-main-postgresql
    existingSecret: postgres-password
    existingSecretUserKey: username
    existingSecretPasswordKey: password
  extraEnvVars:
    - name: KC_FEATURES
      value: token-exchange,admin-fine-grained-authz
    - name: KC_HTTP_ENABLED
      value: "true"
    - name: KC_PROXY_HEADERS
      value: "xforwarded"
    - name: KC_SPI_LOGIN_PROTOCOL_OPENID_CONNECT_LEGACY_LOGOUT_REDIRECT_URI
      value: "true"
  image:
    repository: bitnamilegacy/keycloak

langfuse:
  # Enable this if you want to use langfuse for tracing
  enabled: false
  langfuse:
    salt:
      secretKeyRef:
        name: langfuse-salt
        key: salt
    nextauth:
      secret:
        secretKeyRef:
          name: langfuse-nextauth
          key: nextauth-secret
  clickhouse:
    deploy: false
    host: oh-main-clickhouse
    auth:
      username: default
      existingSecret: clickhouse-password
      existingSecretKey: password
  postgresql:
    deploy: false
    host: oh-main-postgresql
    auth:
      username: postgres
      existingSecret: postgres-password
      existingSecretKey: password
  redis:
    deploy: false
    host: oh-main-redis
    auth:
      existingSecret: redis
      existingSecretPasswordKey: redis-password

litellm-helm:
  # Set this to false if you are using your own litellm instance
  # NOTE: We recommend using the provided LiteLLM instance (enabled: true) for simplicity
  # and because it is the most extensively tested scenario. Our automation uses an admin key
  # to do user management for the LiteLLM instance.
  enabled: false
  masterkeySecretName: lite-llm-api-key
  masterkeySecretKey: lite-llm-api-key
  environmentSecrets: [litellm-env-secrets]
  # Uncomment this if you want to use langfuse for tracing (and enable langfuse below)
  # envVars:
  #   LANGFUSE_HOST: "http://oh-main-langfuse"
  db:
    deployStandalone: false
    useExisting: true
    database: litellm
    endpoint: "oh-main-postgresql"
    secret:
      name: postgres-password
      usernameKey: username
      passwordKey: password
  ingress:
    enabled: false
    className: traefik
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-production
    hosts:
    # REQUIRED: Update to a hostname in a DNS domain you own
    # - host: llm-proxy.example.com
    #   paths:
    #   - path: /
    #     pathType: Prefix
    tls:
      - secretName: llm-proxy-tls
        # REQUIRED: Update to match the hostname you set above
        hosts:
          - llm-proxy.example.com
  proxy_config:
    environment_variables:
      {
        "OR_APP_NAME": "OpenHands",
        "OR_SITE_URL": "https://docs.all-hands.dev",
      }
    model_list:
    # UPDATE to use models that you have access to and have an API key stored in the litellm-env-secrets secret
    # - model_name: "prod/claude-3-5-sonnet-20241022"
    #   litellm_params:
    #     model: "anthropic/claude-3-5-sonnet-20241022"
    #     api_key: os.environ/ANTHROPIC_API_KEY
    # - model_name: "prod/claude-3-7-sonnet-20250219"
    #   litellm_params:
    #     model: "anthropic/claude-3-7-sonnet-20250219"
    #     api_key: os.environ/ANTHROPIC_API_KEY
    litellm_settings:
      num_retries: 3
      request_timeout: 600
      # Uncomment this if you want to use langfuse for tracing (and enable langfuse below)
      # success_callback: ["langfuse"]
      # failure_callback: ["langfuse"]
      # langfuse_default_tags: ["cache_hit", "cache_key", "proxy_base_url", "user_api_key_alias", "user_api_key_user_id", "user_api_key_team_alias"]
      context_window_fallbacks: []
      allowed_fails: 3

minio:
  replicas: 1
  mode: standalone
  persistence:
    enabled: false
  buckets:
    - name: openhands-sessions
      policy: none
      purge: true
  svcaccts:
    - accessKey: "default"
      secretKey: "notasecret"
      user: root
  rootUser: "root"
  resources:
    requests:
      memory: 512Mi
      cpu: 100m
    limits:
      memory: 512Mi
      cpu: 100m

postgresql:
  enabled: true
  auth:
    username: postgres
    existingSecret: postgres-password
  primary:
    initdb:
      scriptsConfigMap: oh-psql-scripts-configmap
    persistence:
      enabled: false
    # Add the following if using Karpenter with persistence
    # podAnnotations:
    #   karpenter.sh/do-not-evict: "true"
  service:
    ports:
      postgresql: 5432
  image:
    repository: bitnamilegacy/postgresql

externalDatabase:
  enabled: false
  existingSecret: postgres-password

redis:
  enabled: true
  architecture: standalone
  auth:
    enabled: true
    existingSecret: "redis"
  master:
    persistence:
      enabled: false
  replica:
    replicaCount: 0
  resources:
    requests:
      memory: 512Mi
      cpu: 100m
    limits:
      memory: 512Mi
      cpu: 100m
  image:
    repository: bitnamilegacy/redis

maintenanceTasks:
  enabled: true
  schedule: "0 6 * * *" # Run daily at 1AM Eastern Time (6AM UTC)
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  successfulJobsHistoryLimit: 3
  backoffLimit: 3
  resources:
    requests:
      memory: "512Mi"
      cpu: "200m"
    limits:
      memory: "1Gi"
      cpu: "500m"

runtime-api:
  enabled: true
  replicaCount: 1
  runtimeInSameCluster: true
  image:
    tag: sha-ad2657f
  imagePullSecrets: []
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    fsGroupChangePolicy: Always
    runAsNonRoot: true
  resources:
    requests:
      cpu: 500m
      memory: 1.5Gi
    limits:
      cpu: null
      memory: 1.5Gi
  warmRuntimes:
    enabled: true
    count: 1
    configs:
      - name: default
        image: "ghcr.io/openhands/runtime:3c5023ac021cfc075f2d6b5ff7f345f375bded47-nikolaik"
        working_dir: "/openhands/code/"
        environment: {}
        command:
          - /openhands/micromamba/bin/micromamba
          - run
          - -n
          - openhands
          - poetry
          - run
          - python
          - -u
          - -m
          - openhands.runtime.action_execution_server
          - "60000"
          - --working-dir
          - /workspace
          - --plugins
          - agent_skills
          - jupyter
          - vscode
          - --username
          - root
          - --user-id
          - "0"
  postgresql:
    postMigrate: true
    auth:
      username: postgres
      existingSecret: postgres-password
  externalDatabase:
    enabled: false
    existingSecret: postgres-password
  ingress:
    enabled: false
    # REQUIRED: Update to a hostname in a DNS domain you own
    # host: runtime-api.example.com
    className: traefik
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-production
    tls: true
  env:
    DB_HOST: oh-main-postgresql
    DB_USER: postgres
    DB_NAME: runtime_api_db
    K8S_NAMESPACE: "openhands"
    RUNTIME_CLASS: ""
    # REQUIRED: Update to match the host set in the ingress section above
    # RUNTIME_BASE_URL: "runtime.example.com"
    RUNTIME_DISABLE_SSL: "true"
    MEMORY_REQUEST: "3072Mi"
    MEMORY_LIMIT: "3072Mi"
    CPU_REQUEST: "500m"
    EPHEMERAL_STORAGE_SIZE: "10Gi"

jira:
  enabled: false

jiraDc:
  enabled: false

linear:
  enabled: false

replicated:
  enabled: false

global:
  security:
    # This allows using the bitnamilegacy image repo.
    # See: https://github.com/bitnami/containers/issues/83267
    allowInsecureImages: true

vertexAI:
  enabled: false
  project: ""
  location: ""