root-at-skic
5c43b90ef8
Rust server (axum, yrs, sqlx/PostgreSQL): live shared models over the y-websocket protocol, versions, browser sign-in with PKCE, invites, single sign-on through OIDC, metrics. Docker image on distroless, compose file, and a Helm chart with one pod, optional bundled PostgreSQL and secrets from existing Secrets.
106 lines
3.3 KiB
YAML
106 lines
3.3 KiB
YAML
# Archify Sync runs as exactly one pod: the live copy of each space is held by
|
|
# one server (decision 0002). Updates are Recreate, so two never overlap; the
|
|
# extension works offline for the few seconds in between and catches up.
|
|
|
|
image:
|
|
repository: archify-sync
|
|
tag: "" # defaults to the chart's appVersion
|
|
pullPolicy: IfNotPresent
|
|
imagePullSecrets: []
|
|
|
|
# The address people open in the browser; invite links point here.
|
|
publicUrl: http://localhost:8080
|
|
|
|
database:
|
|
# postgres://user:password@host:5432/db. Ignored when existingSecret is set
|
|
# or the bundled postgresql is enabled.
|
|
url: ""
|
|
existingSecret: "" # a Secret with the URL under existingSecretKey
|
|
existingSecretKey: url
|
|
maxConnections: 10
|
|
|
|
# A single PostgreSQL in this release, for trying out and small installs.
|
|
# For anything you care about, point database at a managed or operator-run one.
|
|
postgresql:
|
|
enabled: false
|
|
image: postgres:17-alpine
|
|
password: "" # generated once and kept when empty (helm install/upgrade only)
|
|
# A Secret with `password` and `url` (postgres://archify:<password>@<release>-postgresql:5432/archify),
|
|
# e.g. from an ExternalSecret. Use it under Argo CD: it renders charts without
|
|
# cluster access, so a generated password would change on every sync.
|
|
existingSecret: ""
|
|
storage: 5Gi
|
|
storageClass: ""
|
|
resources: {}
|
|
|
|
config:
|
|
name: Archify Sync
|
|
snapshotIdleSecs: 30
|
|
snapshotMaxSecs: 600
|
|
snapshotMaxEdits: 2000
|
|
inviteHours: 168
|
|
membersCanInvite: false
|
|
accessTtlSecs: 900
|
|
refreshTtlDays: 30
|
|
refreshGraceSecs: 30
|
|
redirectSchemes: vscode,vscode-insiders,vscodium,cursor,windsurf
|
|
maxMessageBytes: 8388608
|
|
logJson: true
|
|
logLevel: info,tower_http=warn,sqlx=warn
|
|
|
|
# Single sign-on through an OpenID Connect provider (Keycloak, …). Register
|
|
# <publicUrl>/oidc/callback as a redirect URI of the provider's client; one
|
|
# client can list the callbacks of every place the server runs.
|
|
oidc:
|
|
enabled: false
|
|
issuer: "" # https://keycloak.example.com/realms/home
|
|
clientId: archify-sync
|
|
# The client secret, from a Secret (an ExternalSecret, for example).
|
|
existingSecret: ""
|
|
existingSecretKey: client-secret
|
|
label: Keycloak # "Sign in with Keycloak"
|
|
scopes: openid profile email
|
|
groupsClaim: groups
|
|
# Members of these groups get an account on first sign-in; others are
|
|
# refused. Empty: anyone the provider signs in, but new people need an invite.
|
|
allowedGroups: []
|
|
adminGroups: []
|
|
|
|
# Prometheus /metrics on a port of its own, never through the ingress.
|
|
metrics:
|
|
enabled: true
|
|
port: 9090
|
|
serviceMonitor:
|
|
enabled: false # needs the Prometheus Operator's CRDs
|
|
interval: 30s
|
|
|
|
extraEnv: []
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
# Edits travel over a WebSocket that stays open for hours; raise the proxy's
|
|
# timeouts. For ingress-nginx:
|
|
# nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
# nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
# nginx.ingress.kubernetes.io/proxy-body-size: 8m
|
|
annotations: {}
|
|
host: archify-sync.example.com
|
|
tls: [] # [{ secretName: archify-sync-tls, hosts: [archify-sync.example.com] }]
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 512Mi
|
|
|
|
podAnnotations: {}
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|