# Default values for erp.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# ----------------------------------------------------------------------------
# Multi-environment coordinates (default = prod, elision rule applies).
# Override in values-<env>.yaml for any non-prod instance — see SKILL.md
# of the factory runbook (doc/runbooks/new-web-app/conventions.md).
# By the elision rule, env=prod produces names identical to single-env apps;
# env=sandbox produces "<app>-sandbox" everywhere except the Postgres owner
# role which uses snake-case "<app>_sandbox_role".
# ----------------------------------------------------------------------------
env:      prod
instance: erp                          # derived id: env=prod → erp, else <app>-<env>
host:     erp.arcodange.lab            # internal hostname for this instance

db:
  name: erp                            # PostgreSQL database name (matches factory tfvars)
  ownerRole: erp_role                  # Postgres owner role; snake-case <app>_role for prod / <app>_<env>_role for non-prod (matches factory/postgres/iac)

vault:
  k8sRole:     erp                     # VaultAuth role (postgres/iac issues this per instance)
  dynamicPath: creds/erp               # path under postgres/ mount for short-lived DB creds
  staticPath:  erp/config              # path under kvv2/ mount for the static admin config

replicaCount: 1

image:
  repository: dolibarr/dolibarr
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Automatically mount a ServiceAccount's API credentials?
  automount: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

podAnnotations: {}
podLabels: {}

podSecurityContext: {}
  # fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: true
  className: ""
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
    traefik.ingress.kubernetes.io/router.tls.domains.0.main: arcodange.lab
    traefik.ingress.kubernetes.io/router.tls.domains.0.sans: erp.arcodange.lab
    traefik.ingress.kubernetes.io/router.middlewares: localIp@file
  hosts:
    - host: erp.arcodange.lab
      paths:
        - path: /
          pathType: Prefix
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

# livenessProbe:
#   exec:
#     command: [timeout, '10', ls, /var/www/]
#   initialDelaySeconds: 5
#   periodSeconds: 5

# readinessProbe:
  # httpGet:
  #   path: /
  #   port: http

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 100
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

# Additional volumes on the output Deployment definition.
volumes: []
# - name: foo
#   secret:
#     secretName: mysecret
#     optional: false

# Additional volumeMounts on the output Deployment definition.
volumeMounts: []
# - name: foo
#   mountPath: "/etc/foo"
#   readOnly: true

nodeSelector: {}

tolerations: []

affinity: {}

# Dedicated offsite backup of the Dolibarr DB + documents (see ops/backup/README.md).
# DISABLED by default — enable once the S3 creds VaultStaticSecret resolves (the
# `auth` Vault role must be granted read on kvv2/<vaultS3Path>). The manual
# orchestrator ops/backup/dolibarr-backup.sh works today without this.
backup:
  enabled: true
  schedule: "0 3 * * *"        # daily 03:00 UTC
  bucket: arcodange-backup
  pgHost: "192.168.1.202"      # direct Postgres host (matches ops/sandbox + ops/backup)
  image: postgres:16-alpine
  # Shared GCS HMAC creds; the erp prod Vault policy was granted read on this path
  # (tools#5: kv_read_paths). VSO reads kvv2/data/longhorn/gcs-backup.
  vaultS3Path: longhorn/gcs-backup
