override-values.example.yaml

# Example values for s3proxy Helm chart
# This demonstrates a typical configuration using filesystem backend with authentication

# Custom image configuration (optional)
# image:
#   repository: andrewgaul/s3proxy
#   tag: "latest"
#   pullPolicy: Always

# Custom config merge container image configuration (optional)
# configMergeImage:
#   repository: busybox
#   tag: "1.36"
#   pullPolicy: IfNotPresent

# S3Proxy configuration
config:
  # Log level for S3Proxy (DEBUG, INFO, WARN, ERROR)
  logLevel: "INFO"

  auth:
    # Authentication type for clients connecting to S3Proxy
    # Options: none, aws-v2, aws-v4, aws-v2-or-v4
    type: "aws-v4"
    # Credentials for clients to authenticate to S3Proxy
    # These should be changed to secure values
    identity: "admin"
    secret: "changeme123"

  # Native in-pod HTTPS (S3Proxy secure-endpoint). When enabled, S3Proxy serves
  # HTTPS only on service.targetPort; TLS is terminated in the pod rather than at
  # the ingress. Requires a PKCS12 (or JKS) keystore + password. Disabled by default.
  # tls:
  #   enabled: true
  #   keystore:
  #     # Option A: reference an existing Secret (recommended; cert-manager path)
  #     existingSecret: "my-tls"
  #     secretKey: "keystore.p12"
  #     # Option B: inline base64-encoded keystore (testing)
  #     # value: "<base64 PKCS12>"
  #   keystorePassword:
  #     existingSecret: "my-tls"
  #     secretKey: "keystore-password"
  #     # value: "changeit"

  # Enable CORS for web applications
  cors:
    enabled: true
    allowOrigins:
      - "https://myapp.example.com"
    allowMethods:
      - "GET"
      - "PUT"
      - "POST"
      - "HEAD"
      - "DELETE"
    allowHeaders:
      - "Accept"
      - "Content-Type"
      - "Authorization"
    allowCredential: true

  # Storage backend configuration
  # Multiple backends can be enabled simultaneously
  # Properties files will be loaded in order: main properties first, then each backend's properties
  # Later properties can override earlier ones if there are conflicts
  backends:
    # Filesystem backend for local storage
    filesystem:
      enabled: true  # Set to true to use filesystem backend
      nio2: true  # Set to true for NIO2 implementation (filesystem-nio2), false for standard (filesystem)
      basedir: "/data/s3proxy"

    # Transient (in-memory) backend - useful for testing
    transient:
      enabled: false  # Set to true to use transient backend
      nio2: true  # Set to true for NIO2 implementation (transient-nio2), false for standard (transient)

    # S3 backend (AWS S3 or S3-compatible storage)
    s3:
      enabled: false  # Set to true to use S3 backend
      aws: true  # Set to true for AWS S3 (aws-s3 provider), false for generic S3
      region: "us-west-2"
      # endpoint: "https://s3.amazonaws.com"  # Optional custom endpoint (e.g., MinIO, Ceph)
      accessKeyID: "AKIAIOSFODNN7EXAMPLE"
      secretAccessKey:
        value: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
        # existingSecret: "my-s3-secret"
        # secretKey: "secretAccessKey"

    # Azure Blob Storage backend
    azureblob:
      enabled: false  # Set to true to use Azure Blob backend
      provider: "azureblob"  # Can be "azureblob" or "azureblob-sdk"
      account: "mystorageaccount"
      key:
        value: "base64encodedkey=="
        # existingSecret: "my-azure-secret"
        # secretKey: "accountKey"
      # endpoint: "https://mystorageaccount.blob.core.windows.net"  # Optional
      sasToken:
        value: ""  # Optional SAS token
        # existingSecret: "my-azure-sas-secret"
        # secretKey: "sasToken"

    # Google Cloud Storage backend
    googleCloudStorage:
      enabled: false  # Set to true to use GCS backend
      projectID: "my-project"

      # Service account email or user email
      clientEmail: "service-account@my-project.iam.gserviceaccount.com"

      # Private key configuration
      privateKey:
        # Option 1: Provide private key directly
        # value: |-
        #   -----BEGIN RSA PRIVATE KEY-----
        #   ...
        #   -----END RSA PRIVATE KEY-----

        # Option 2: Reference an existing secret containing the private key
        # existingSecret: "my-gcs-privatekey-secret"
        # secretKey: "privateKey"

    # Backblaze B2 backend
    b2:
      enabled: false  # Set to true to use B2 backend
      account: "account-id"
      applicationKey:
        value: "application-key"
        # existingSecret: "my-b2-secret"
        # secretKey: "applicationKey"

    # OpenStack Swift backend
    openstackSwift:
      enabled: false  # Set to true to use Swift backend
      authURL: "https://auth.cloud.com/v2.0"
      tenantName: "my-tenant"
      userName: "my-user"
      password:
        value: "my-password"
        # existingSecret: "my-swift-secret"
        # secretKey: "password"
      region: "RegionOne"

    # Rackspace Cloud Files backend
    rackspaceCloudfiles:
      enabled: false  # Set to true to use Rackspace Cloud Files backend
      region: "us"  # Region: "us" or "uk"
      userName: "my-user"
      apiKey:
        value: "my-api-key"
        # existingSecret: "my-rackspace-secret"
        # secretKey: "apiKey"

# Persistence settings for filesystem backend
persistence:
  enabled: true
  accessMode: ReadWriteOnce
  size: 100Gi
  # Specify a storageClass if needed
  # storageClass: "fast-ssd"

  # Use an existing PVC instead of creating a new one
  # existingClaim: "my-existing-pvc"

# Service configuration
service:
  type: ClusterIP
  port: 8080
  targetPort: 8080
  # For LoadBalancer type, you may want to specify additional annotations
  # annotations:
  #   service.beta.kubernetes.io/aws-load-balancer-type: "nlb"

# Ingress configuration
ingress:
  enabled: true
  className: "nginx"
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
  hosts:
    - host: s3.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: s3proxy-tls
      hosts:
        - s3.example.com

# Resource limits and requests
resources:
  limits:
    cpu: 1000m
    memory: 2Gi
  requests:
    cpu: 100m
    memory: 128Mi

# Horizontal Pod Autoscaler
autoscaling:
  enabled: false
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80
  targetMemoryUtilizationPercentage: 80

# Pod security context
podSecurityContext:
  fsGroup: 1000
  runAsNonRoot: true
  runAsUser: 1000

# Container security context
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: false
  runAsNonRoot: true
  runAsUser: 1000

# Additional environment variables
extraEnvVars:
  - name: JAVA_OPTS
    value: "-Xmx1g -Xms256m"

# Node selector for pod placement
# nodeSelector:
#   disktype: ssd

# Tolerations for pod scheduling
# tolerations:
#   - key: "dedicated"
#     operator: "Equal"
#     value: "storage"
#     effect: "NoSchedule"

# Affinity rules
# affinity:
#   podAntiAffinity:
#     requiredDuringSchedulingIgnoredDuringExecution:
#       - labelSelector:
#           matchExpressions:
#             - key: app.kubernetes.io/name
#               operator: In
#               values:
#                 - s3proxy
#         topologyKey: kubernetes.io/hostname