# Archify Sync runs as exactly one pod: the live copy of each space is held by
# one server (decision 0002). Updates are Recreate, so two never overlap; the
# extension works offline for the few seconds in between and catches up.

image:
  repository: archify-sync
  tag: ""              # defaults to the chart's appVersion
  pullPolicy: IfNotPresent
imagePullSecrets: []

# The address people open in the browser; invite links point here.
publicUrl: http://localhost:8080

database:
  # postgres://user:password@host:5432/db. Ignored when existingSecret is set
  # or the bundled postgresql is enabled.
  url: ""
  existingSecret: ""   # a Secret with the URL under existingSecretKey
  existingSecretKey: url
  maxConnections: 10

# A single PostgreSQL in this release, for trying out and small installs.
# For anything you care about, point database at a managed or operator-run one.
postgresql:
  enabled: false
  image: postgres:17-alpine
  password: ""         # generated once and kept when empty (helm install/upgrade only)
  # A Secret with `password` and `url` (postgres://archify:<password>@<release>-postgresql:5432/archify),
  # e.g. from an ExternalSecret. Use it under Argo CD: it renders charts without
  # cluster access, so a generated password would change on every sync.
  existingSecret: ""
  storage: 5Gi
  storageClass: ""
  resources: {}

config:
  name: Archify Sync
  snapshotIdleSecs: 30
  snapshotMaxSecs: 600
  snapshotMaxEdits: 2000
  inviteHours: 168
  membersCanInvite: false
  accessTtlSecs: 900
  refreshTtlDays: 30
  refreshGraceSecs: 30
  redirectSchemes: vscode,vscode-insiders,vscodium,cursor,windsurf
  maxMessageBytes: 8388608
  logJson: true
  logLevel: info,tower_http=warn,sqlx=warn

# Single sign-on through an OpenID Connect provider (Keycloak, …). Register
# <publicUrl>/oidc/callback as a redirect URI of the provider's client; one
# client can list the callbacks of every place the server runs.
oidc:
  enabled: false
  issuer: ""           # https://keycloak.example.com/realms/home
  clientId: archify-sync
  # The client secret, from a Secret (an ExternalSecret, for example).
  existingSecret: ""
  existingSecretKey: client-secret
  label: Keycloak      # "Sign in with Keycloak"
  scopes: openid profile email
  groupsClaim: groups
  # Members of these groups get an account on first sign-in; others are
  # refused. Empty: anyone the provider signs in, but new people need an invite.
  allowedGroups: []
  adminGroups: []

# Prometheus /metrics on a port of its own, never through the ingress.
metrics:
  enabled: true
  port: 9090
  serviceMonitor:
    enabled: false     # needs the Prometheus Operator's CRDs
    interval: 30s

extraEnv: []

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: false
  className: ""
  # Edits travel over a WebSocket that stays open for hours; raise the proxy's
  # timeouts. For ingress-nginx:
  #   nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
  #   nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
  #   nginx.ingress.kubernetes.io/proxy-body-size: 8m
  annotations: {}
  host: archify-sync.example.com
  tls: []              # [{ secretName: archify-sync-tls, hosts: [archify-sync.example.com] }]

resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    memory: 512Mi

podAnnotations: {}
nodeSelector: {}
tolerations: []
affinity: {}