values.yaml

# Default values for trakrf-backend.

# Drop the doubled `<release>-<chart>` pod/resource name.
fullnameOverride: trakrf-backend

replicaCount: 1

image:
  repository: ghcr.io/trakrf/backend
  # tag MUST be set in values-<cluster>.yaml — templates use {{ required ... }} to enforce
  tag: ""
  pullPolicy: IfNotPresent

imagePullSecrets: []

service:
  type: ClusterIP
  port: 8080

# Prometheus /metrics is exposed on the same chi router as the API (port 8080),
# so no separate metrics port — the ServiceMonitor scrapes the `http` port.
metrics:
  enabled: true

serviceMonitor:
  enabled: true
  interval: 30s
  scrapeTimeout: 10s

# Public ingress (Traefik IngressRoute CRDs).
#
# `routes` is a list — each entry produces one IngressRoute (TLS secretName
# is per-IngressRoute, not per-rule, so multi-host needs multiple
# IngressRoutes). Optional per-route Certificate is rendered via
# templates/certificate.yaml when `cert.issue: true`.
#
# `middlewares.{breakglass,cloudflare}` render IPAllowList Middleware
# resources in the release namespace. Routes reference them by name.
ingress:
  enabled: false
  routes: []
  # Example route shape (see argocd/root/templates/_helpers.tpl for live values):
  #   - name: gke-direct
  #     host: app.preview.gke.trakrf.id
  #     secretName: app-preview-gke-trakrf-id-tls
  #     cert:
  #       issue: true
  #       issuer: letsencrypt-prod
  #     middlewares:
  #       - name: default-chain
  #         namespace: traefik
  #       - name: breakglass-allow
  middlewares:
    breakglass:
      enabled: false
      sourceRange: []
    cloudflare:
      enabled: false
      sourceRange: []

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

# HPA stub — disabled for M1 demo. See TRA-351.
autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 3
  targetCPUUtilizationPercentage: 70

# Pod security. Backend Dockerfile does not yet run as non-root (TRA-84).
# Once Dockerfile is fixed, flip runAsNonRoot: true and set runAsUser.
podSecurityContext: {}
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true

# Database (CNPG). PG_URL is assembled from the CNPG-managed role secret.
database:
  # Name of CNPG managed.roles passwordSecret (password key)
  credentialsSecret: trakrf-app-credentials
  user: trakrf-app
  host: trakrf-db-rw
  port: 5432
  name: trakrf
  sslmode: require
  # Session search_path baked into PG_URL via libpq `options=-c search_path=...`.
  # Required because the trakrf-app role has no per-role default and trigger
  # functions resolve unqualified `nextval(seq_name::text)` through the session
  # search_path.
  #
  # Order is `public,trakrf` (NOT `trakrf,public`) so `current_schema()=public`,
  # which lets golang-migrate's startup runner short-circuit on the existing
  # `public.schema_migrations` (trakrf-app has no CREATE on `trakrf`). Triggers
  # still find `trakrf.user_seq` etc. via the search_path fallback.
  # Schema name itself is still hardcoded across migrations + Go — TRA-278.
  searchPath: "public,trakrf"

# MQTT ingestion (TRA-920 / TRA-900). The in-backend Go subscriber starts only
# when MQTT_URL is non-empty (serve.go gate). Empty `host` here => no MQTT env
# rendered => subscriber inert. Preview turns this on via the root chart
# inlineValues (argocd/root/templates/trakrf-backend.yaml); prod/AKS/EKS stay
# off. Credentials come from the broker auth Secret (trakrf-mosquitto-auth,
# Reflector-mirrored into the env namespace, shared with the ingester) and are
# composed into MQTT_URL via k8s $(VAR) interpolation — no creds in git.
# See feedback_k8s_dsn_composition + feedback_mqtt_clientid_per_cluster.
#
# Keep the backend at 1 replica (replicaCount: 1, autoscaling.enabled: false)
# while MQTT is on: non-shared subscriptions fan out every message to every
# connected client, so extra replicas double-write asset_scans until $share/...
# shared subscriptions land (TRA-907).
mqtt:
  # Broker LB hostname. Empty = MQTT disabled. Set per-env by the root chart.
  host: ""
  port: 8883
  # mqtts (TLS): the backend is a separate pod from the broker, reaching it over
  # the public LB hostname (Let's Encrypt cert SAN), not the ingester's loopback.
  scheme: mqtts
  # NOTE: no `topic` here. As of TRA-922 (platform PR #475) the backend ignores
  # MQTT_TOPIC entirely — the ingest subscriber is data-driven, subscribing to
  # exactly the registered publish_topics ({org_slug}/.../reads) via an in-memory
  # registry. The old trakrf.id/+/reads filter is retired.
  # Distinct base clientId (overridden per-env by the root chart). Must differ
  # from the RC ingester's clientId so the broker doesn't evict one while both
  # are connected; the subscriber also appends the pod hostname at runtime.
  clientId: trakrf-backend
  # Broker auth Secret (username/password keys). Created by `just
  # mosquitto-secrets`, mirrored into the env namespace by Reflector.
  authSecret: trakrf-mosquitto-auth

# Non-secret config (ConfigMap)
config:
  appEnv: production
  logLevel: info
  # runtimeLogLevel → the LOG_LEVEL env the Go backend logger actually reads
  # (logger/config.go). Empty = inherit the backend's APP_ENV-based default
  # (production→warn, dev/preview→debug). Set per-env (preview→info) to pin a
  # level. NOTE: logLevel above feeds the legacy BACKEND_LOG_LEVEL key, which the
  # current backend does NOT read — dead-key cleanup tracked in TRA-974.
  runtimeLogLevel: ""
  serviceName: trakrf-backend
  corsOrigin: ""
  jwtExpirationSeconds: "3600"
  # Display label for the frontend environment banner. The Go backend reads
  # ENVIRONMENT_LABEL at serve time and stamps window.__APP_CONFIG__ into
  # index.html (TRA-853). Empty / unset / "prod" / "production" → no banner.
  environmentLabel: ""

# Secrets. Values here land in a K8s Secret created by this chart.
# For real deployments, override via values.secret.yaml (gitignored):
#   helm upgrade ... -f values.secret.yaml
secrets:
  jwtSecret: "change-me"
  resendApiKey: ""
  sentryDsn: ""

# RESEND_API_KEY PreSync guard (TRA-972). When enabled, a pre-install/pre-upgrade
# hook Job fails the sync (loudly, in the ArgoCD UI) if RESEND_API_KEY is empty or
# missing in this env's Secret — so a missed out-of-band injection can't silently
# ship broken transactional email. Default off; the root chart flips it true for
# deployed envs (preview + prod) only, so local/eks/aks render nothing.
# Checks presence, not validity (see templates/email-guard-job.yaml). busybox is
# pinned + multi-arch because GKE nodes are arm64 and the backend image is
# shell-less.
emailGuard:
  enabled: false
  image: busybox:1.37.0

nodeSelector: {}
tolerations: []
affinity: {}

# Schema migration Job — runs `./server migrate` from the backend image (TRA-367).
# Uses the same image as the deployment, so a tag bump migrates + serves consistently.
migrate:
  enabled: true
  credentialsSecret: trakrf-migrate-credentials
  # Connection target — separate from `database:` because `database:` is the app role (trakrf-app),
  # while migrations run as trakrf-migrate.
  user: trakrf-migrate
  host: trakrf-db-rw
  port: 5432
  database: trakrf
  sslmode: require
  # Match the backend ordering so the existing `public.schema_migrations` is
  # reused; `trakrf,public` would create a second table in the trakrf schema
  # and try to re-apply every migration from version 0.
  searchPath: "public,trakrf"