# More than one replica requires config.data.database on Postgres and
# deploymentStrategy: RollingUpdate. Storage can be object storage (with
# persistence disabled) or a file:// URL on a ReadWriteMany volume
# (persistence.accessModes: [ReadWriteMany]). With upstream.git, each
# replica also needs its own git.cache_dir.
replicaCount: 1

nameOverride: ""
fullnameOverride: ""

image:
  repository: ghcr.io/git-pkgs/proxy
  # An empty tag uses the chart appVersion.
  tag: ""
  # When set, digest takes precedence over tag.
  digest: ""
  pullPolicy: IfNotPresent

imagePullSecrets: []

service:
  type: ClusterIP
  port: 8080
  # Keep this aligned with config.data.listen (or the listen address in an
  # existing ConfigMap).
  containerPort: 8080

# The generated configuration is ignored when existingConfigMap is set.
config:
  existingConfigMap: ""
  existingConfigMapKey: config.yaml
  data:
    listen: ":8080"
    # Set this to the URL package-manager clients use to reach the proxy.
    base_url: "http://localhost:8080"
    storage:
      url: "file:///data/artifacts"
    database:
      driver: sqlite
      path: "/data/proxy.db"
    log:
      level: info
      format: json

# Environment variables override values from the configuration file. This is
# also the recommended way to supply secret values such as database passwords
# and object-storage credentials.
extraEnv: []
#  - name: PROXY_DATABASE_URL
#    valueFrom:
#      secretKeyRef:
#        name: proxy-database
#        key: url

extraEnvFrom: []
#  - secretRef:
#      name: proxy-object-storage

# Additional volumes for the pod and mounts for the proxy container, for
# example a ConfigMap holding a private CA certificate. Go adds certificates
# from the directories in SSL_CERT_DIR to its trusted roots (set it with
# extraEnv); SSL_CERT_FILE replaces the system bundle instead. All upstream
# TLS, including Git fetches, goes through the proxy process.
extraVolumes: []
#  - name: corp-ca
#    configMap:
#      name: corp-ca

extraVolumeMounts: []
#  - name: corp-ca
#    mountPath: /etc/proxy/ca
#    readOnly: true

# Init containers run before the proxy starts. They can use extraVolumes, but
# extraVolumeMounts applies only to the proxy container, so each init container
# needs its own volumeMounts.
extraInitContainers: []
#  - name: wait-for-db
#    image: busybox:1.37
#    command: ["sh", "-c", "until nc -z postgres 5432; do sleep 2; done"]

# With SQLite, the database file needs a local disk or block-backed volume,
# even with one replica. ReadWriteOnce doesn't guarantee that: pick a
# storageClass that isn't NFS or another network filesystem. If only network
# filesystem storage is available, set config.data.database to Postgres.
# Artifact storage can stay on NFS on a separate volume (extraVolumes and
# extraVolumeMounts, with config.data.storage.url pointing at it).
persistence:
  enabled: true
  # Keep this aligned with config.data.storage.url and config.data.database.path
  # (or the equivalent paths in an existing ConfigMap).
  mountPath: /data
  existingClaim: ""
  annotations: {}
  accessModes:
    - ReadWriteOnce
  size: 10Gi
  storageClass: ""

deploymentStrategy:
  type: Recreate

ingress:
  enabled: false
  className: ""
  annotations: {}
  hosts: []
  #  - host: proxy.example.com
  #    paths:
  #      - path: /
  #        pathType: Prefix
  tls: []
  #  - secretName: proxy-tls
  #    hosts:
  #      - proxy.example.com

podAnnotations: {}
podLabels: {}

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
      - ALL

# /tmp is an emptyDir, since the root filesystem is read-only.
tmpDir:
  sizeLimit: ""

resources: {}
#  requests:
#    cpu: 100m
#    memory: 128Mi
#  limits:
#    memory: 512Mi

startupProbe:
  tcpSocket:
    port: http
  failureThreshold: 30
  periodSeconds: 2

# /health checks both the database and storage backends and can take up to ten
# seconds. It is intentionally a readiness check rather than a liveness check.
readinessProbe:
  httpGet:
    path: /health
    port: http
  timeoutSeconds: 11
  periodSeconds: 15
  failureThreshold: 2

livenessProbe:
  tcpSocket:
    port: http
  periodSeconds: 20
  failureThreshold: 3

terminationGracePeriodSeconds: 30

nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []