values.yaml

# === THE TOUCHPOINT ===
# Flip `cluster` to target a different cluster overlay. All other values
# are injected by scripts/apply-root-app.sh from tofu outputs at install time.
# ======================

cluster: aks

repoURL: https://github.com/trakrf/infra.git
targetRevision: main

destination:
  server: https://kubernetes.default.svc

namespaces:
  argocd: argocd
  certManager: cert-manager
  traefik: traefik
  trakrfSystem: trakrf-system
  trakrfPreview: trakrf-preview
  trakrfProd: trakrf-prod

# Per-env workload config consumed by trakrf-backend.yaml, trakrf-mosquitto.yaml,
# AND trakrf-db.yaml (which ranges over this and emits one CNPG Cluster
# Application per env). Adding a third env (whitelabel tenant, etc.) is a
# values addition only — no template edits.
#
# dbHost                       — backend/ingester DSN host (`<service>.<ns>`).
#                                Each env resolves to its own dedicated Cluster
#                                in its own namespace.
# ingressEnabled               — gates the preview-style ingress + IPAllowList.
# mqttIp                       — MQTT broker LB IP (Tofu-injected on GKE).
# mqttEnabled                  — TRA-920: wires MQTT_URL onto the backend so the
#                                in-backend Go subscriber starts ingesting from
#                                mqtt.<env>.gke.trakrf.id. preview=true; prod=false
#                                until cutover (see TRA-920 prod checklist). GKE-only
#                                (broker host is .gke.); harmless if ever set on a
#                                cluster whose backend image predates TRA-900.
# emailGuardEnabled            — TRA-972: renders the RESEND_API_KEY PreSync guard
#                                Job, which fails the sync loudly if the email key
#                                is empty/missing in this env. preview=true; prod
#                                stays false until its key is injected (an active
#                                guard blocks live prod syncs). Default off.
# orgCreateNotifyAddr          — TRA-1040: backend ORG_CREATE_NOTIFY_ADDR. Routes
#                                org signup/create/delete notices to this single
#                                address and skips the all-superadmins fan-out.
#                                preview=one operator address; prod omits it (the
#                                fan-out is the intended prod behavior).
# imageTag                     — trakrf-backend image tag override. Empty falls
#                                back to chart default (helm/trakrf-backend/values-<cluster>.yaml).
#                                On GKE BOTH envs are image-updater-tracked
#                                (TRA-351 option b): preview tracks the
#                                continuously-rebuilt `:preview`, prod tracks the
#                                promote-gated `:prod` — each ImageUpdater CR pins
#                                the resolved DIGEST into its Application. Leave
#                                empty on GKE; the CRs own the live image.
# environmentLabel             — frontend banner label (TRA-853). Backend reads
#                                ENVIRONMENT_LABEL at serve time and stamps it into
#                                index.html. Empty / "prod" / "production" → no
#                                banner. Same main image everywhere; the banner is
#                                purely this runtime value.
# jwtExpirationSeconds         — access-token TTL (seconds) → backend JWT_EXPIRATION
#                                (TRA-843). Per-env so the short-TTL half of the
#                                refresh design can land on preview ahead of prod.
#                                Empty falls back to the chart default
#                                (helm/trakrf-backend/values.yaml: "3600").
#                                preview="900" (refresh live + soaked). prod also
#                                "900" (Mike's call, 2026-05-30 cutover) — assumes
#                                PR #416's refresh endpoint is on the :prod image;
#                                if not, prod users hit 15-min re-logins. Takes
#                                effect only on the next apply-root-app.sh.
# appTrakrfIdHost              — public customer host for the CF-orange route
#                                (cloudflare-allow origin lock + CF Origin CA cert,
#                                cert.issue=false). Explicit per-env, NOT derived
#                                from the env slug: preview=app.preview.trakrf.id
#                                (two-label), prod=app.trakrf.id (apex product host).
#                                Empty/unset skips the route. TRA-856 / TRA-375.
# dbCluster.enabled            — false skips emitting the CNPG Cluster
#                                Application entirely.
# dbCluster.fullnameOverride   — drives CNPG Cluster name + Argo App name.
# dbCluster.namespace          — where the Cluster Application installs.
# dbCluster.createRetainClass  — true on exactly one release (creates the
#                                cluster-scoped premium-rwo-retain SC).
# dbCluster.externalIp         — non-empty enables the external LB Service for
#                                external psql clients (FDW dev endpoint).
#                                Tofu-injected on GKE for envs that have one.
envs:
  preview:
    dbHost: trakrf-db-preview-rw.trakrf-preview
    ingressEnabled: true
    appTrakrfIdHost: app.preview.trakrf.id
    mqttIp: ""
    mqttEnabled: true
    emailGuardEnabled: true
    imageTag: ""
    environmentLabel: preview
    jwtExpirationSeconds: "900"
    # Preview detects as EnvDev → the backend logger defaults to debug, a 24/7
    # per-message ingest firehose into Cloud Logging. Pin info (TRA-974); prod
    # omits this and keeps its APP_ENV→warn default.
    logLevel: info
    # TRA-1040: preview's e2e org-creation firehose notified every active
    # superadmin. Routing all three org-lifecycle notices to one address silences
    # the churn for everyone else. Prod omits this key → default fan-out.
    orgCreateNotifyAddr: mike@kwyk.net
    dbCluster:
      enabled: true
      fullnameOverride: trakrf-db-preview
      namespace: trakrf-preview
      createRetainClass: true
      externalIp: ""
  prod:
    dbHost: trakrf-db-prod-rw.trakrf-prod
    ingressEnabled: true
    appTrakrfIdHost: app.trakrf.id
    mqttIp: ""
    mqttEnabled: false  # flip to true at prod cutover — see TRA-920 prod checklist
    emailGuardEnabled: true  # prod RESEND_API_KEY injected 2026-06-10, so the PreSync guard passes (TRA-972)
    # imageTag="" — prod is image-updater-tracked (TRA-351 option b): the
    # trakrf-backend-prod ImageUpdater CR pins the resolved :prod DIGEST into
    # the Application (immutable ref → kubelet pulls the exact build, fixing
    # the :prod-tag + imagePullPolicy=IfNotPresent deploy gap caught in the
    # 2026-05-30 v1.2.0 dry run). promote-prod (imagetools re-tag, no rebuild)
    # stays the sole audited publish-:prod gate; cutover = promote :prod →
    # image-updater rolls the digest, no infra PR. Bootstrap falls back to
    # values-gke.yaml's sha tag until the first pin. environmentLabel stays
    # "GKE pre-prod" through the dry-run window; flips to empty at cutover.
    imageTag: ""
    environmentLabel: ""
    # TRA-843: held at "3600" so preview=900 can apply alone NOW (the GKE apply
    # is cluster-wide — one render materializes both envs). The running :prod
    # image is still pre-#416 (v1.1.1, /auth/refresh → 404), so prod=900 would
    # mean 15-min tokens with no refresh. Returns to "900" at the cutover roll-
    # forward (after the next soak), once prod is on a ≥#416 image — verified by
    # kubectl digest check before that apply.
    jwtExpirationSeconds: "900"
    dbCluster:
      enabled: true
      fullnameOverride: trakrf-db-prod
      namespace: trakrf-prod
      createRetainClass: false
      externalIp: ""

# Tofu output placeholders (populated by scripts/apply-root-app.sh at install time)
certManagerIdentityClientId: ""
tenantId: ""
subscriptionId: ""
dnsZoneResourceGroup: ""
traefikLbIp: ""
mainResourceGroupName: ""

# GKE tofu output placeholders (populated by scripts/apply-root-app.sh at install time)
gcpProjectId: ""
certManagerGcpServiceAccountEmail: ""
cloudDnsZoneNameApp: ""
cloudDnsZoneNameId: ""
# Note: traefikLbIp (above) is shared — both AKS and GKE use it for their static LB IPs.

# CNPG Phase 1 logical backups — populated by scripts/apply-root-app.sh
# from terraform/gcp outputs. Blank on non-GKE clusters; consumed by
# argocd/root/templates/trakrf-db.yaml to set backups.* in the
# trakrf-db chart.
cnpgBackupBucket: ""
cnpgBackupsGcpServiceAccountEmail: ""


# Preview ingress origin-lock — populated by scripts/apply-root-app.sh.
# breakglassSourceCidr: resolved at apply time from a dyn DNS hostname
#   (currently opsumo-austin.asuscomm.com); formatted as <ip>/32.
# cloudflareIpv{4,6}Cidrs: pulled from terraform/cloudflare outputs that wrap
#   the cloudflare_ip_ranges data source.
breakglassSourceCidr: ""
cloudflareIpv4Cidrs: []
cloudflareIpv6Cidrs: []