# SPDX-FileCopyrightText: SUSE LLC
# SPDX-License-Identifier: Apache-2.0

### Global Values ###
global:
  clusterDomain: cluster.local
  logLevel: info
  trentoWeb:
    name: web
    servicePort: 4000
    origin: ""
  trentoWanda:
    name: wanda
    servicePort: 4000
  trentoMcpServer:
    name: mcp-server
    servicePort: 5000
  postgresql:
    name: postgresql
    servicePort: 5432
    postgresqlUsername: "postgres"
    postgresqlPassword: "postgres"
    image:
      registry: registry.suse.com
      repository: suse/postgres
      tag: "14"
  prometheus:
    name: prometheus-server
    pathPrefix: /prometheus
  rabbitmq:
    name: rabbitmq
    servicePort: 5672
    ports:
      amqp: 5672
      amqpTls: 5671
    auth:
      username: trento
      password: trento
    tls:
      mtls:
        enabled: false
        certManager:
          enabled: true
          issuerName: rabbitmq-ca-issuer
          issuerKind: Issuer

### Sub Charts Specific Values ###
trento-web:
  nameOverride: web
  enabled: true
  image:
    repository: %%REGISTRY%%/%%IMG_REPOSITORY_PREFIX%%/trento-web

trento-wanda:
  nameOverride: wanda
  enabled: true
  image:
    repository: %%REGISTRY%%/%%IMG_REPOSITORY_PREFIX%%/trento-wanda
  checks:
    image:
      repository: %%REGISTRY%%/%%IMG_REPOSITORY_PREFIX%%/checks

trento-mcp-server:
  nameOverride: mcp-server
  enabled: false
  image:
    repository: %%REGISTRY%%/%%IMG_REPOSITORY_PREFIX%%/mcp-server-trento

postgresql:
  enabled: true
  persistence:
    mountPath: /var/lib/postgresql/data
  postgresqlDataDir: /var/lib/postgresql/data/trento
  securityContext:
    fsGroup: 0
  containerSecurityContext:
    runAsUser: 0

prometheus:
  enabled: true
  server:
    enabled: true
    image:
      tag: v2.53.1
    configMapOverrideName: prometheus-configmap
    prefixURL: "/prometheus"
    baseURL: "/prometheus"
    extraFlags:
      - web.enable-lifecycle
      - web.enable-remote-write-receiver
    auth:
      # type must be explicitly set to 'none' or 'basic'
      type: ""
      basic:
        username: ""
        password: ""
    sidecarContainers:
      auth-proxy:
        image: registry.suse.com/suse/nginx:1.27
        ports:
          - containerPort: 8081
        volumeMounts:
          - name: auth-proxy-config
            mountPath: /etc/nginx/nginx.conf
            subPath: nginx.conf
          - name: auth-proxy-htpasswd
            mountPath: /etc/nginx/auth
            readOnly: true
          - name: nginx-log
            mountPath: /var/log/nginx
    extraVolumes:
      - name: auth-proxy-config
        configMap:
          name: trento-prometheus-auth-config
      - name: auth-proxy-htpasswd
        secret:
          secretName: trento-prometheus-auth-htpasswd
          optional: true
      - name: nginx-log
        emptyDir: {}
    service:
      additionalPorts:
        - name: auth-proxy
          port: 8081
          protocol: TCP
          targetPort: 8081

    ingress:
      enabled: true
      ingressClassName: ""
      annotations: {}
      hosts:
        - ""
      path: /prometheus
      pathType: Prefix
      tls: []
      # Route ingress traffic through the auth sidecar
      servicePort: 8081

  alertmanager:
    enabled: false
  prometheus-pushgateway:
    enabled: false
  configmapReload:
    prometheus:
      enabled: false
  kube-state-metrics:
    enabled: false
  prometheus-node-exporter:
    enabled: false

  migrationHook:
    image:
      registry: registry.k8s.io
      repository: kubectl
      tag: v1.33.3

rabbitmq:
  enabled: true
  persistence:
    enabled: true
  service:
    type: LoadBalancer

  extraConfiguration: |
    {{- if .Values.global.rabbitmq.tls.mtls.enabled }}
    listeners.ssl.default = 5671
    listeners.tcp = none

    ssl_options.cacertfile = /etc/rabbitmq-tls/ca.crt
    ssl_options.certfile = /etc/rabbitmq-tls/tls.crt
    ssl_options.keyfile = /etc/rabbitmq-tls/tls.key
    ssl_options.verify = verify_peer
    ssl_options.fail_if_no_peer_cert = true
    ssl_options.versions.1 = tlsv1.3
    ssl_options.versions.2 = tlsv1.2
    {{- else }}
    listeners.tcp.default = 5672
    {{- end }}
