# Laboratory defaults — rotate secrets before any non-lab use.

nameOverride: ""
fullnameOverride: "simulators"

# Target Kubernetes namespace (also used by make helm up/down).
namespace: simulators
# Create the Namespace resource from this chart.
namespaceCreate: true

imagePullSecrets: []
ticketSigningKey: development-only-signing-key-change-me
logLevel: INFO
imageTag: latest

postgres:
  enabled: true
  image:
    repository: postgres
    tag: 17.5-bookworm
    pullPolicy: IfNotPresent
  auth:
    username: lab
    password: lab
    database: postgres
  persistence:
    enabled: true
    size: 5Gi
    storageClass: ""
  resources: {}
  # users/databases created on first start (empty volume only)
  initDatabases:
    - user: proxmox
      password: proxmox
      database: proxmox_simulator
    - user: ovirt
      password: ovirt
      database: ovirt_simulator
    - user: vmware
      password: vmware
      database: vmware_simulator
    - user: openstack
      password: openstack
      database: openstack_simulator

simulators:
  proxmox:
    enabled: true
    image:
      repository: inecs/proxmox-api-simulator
      pullPolicy: IfNotPresent
    port: 8006
    healthPath: /health/ready
    replicas: 1
    db:
      user: proxmox
      password: proxmox
      name: proxmox_simulator
    env:
      CONTRACT_SNAPSHOT: /app/contracts/pve-9.2.3.json
      COMPATIBILITY_EVIDENCE: /app/evidence/pve-9.2.3.json
      TASK_WORKER_CONCURRENCY: "2"
      SIMULATION_TIME_SCALE: "10"
    migrate:
      enabled: true
      command: ["python", "-m", "app.db.migrate_cli"]
    seed:
      enabled: true
      # Skip seed Job when this query returns a row (already seeded).
      skipIfSql: "SELECT 1 FROM nodes LIMIT 1"
      command: ["python", "-m", "app.simulation.seed_cli"]
      env:
        SEED_PROFILE: small
    resources: {}

  ovirt:
    enabled: true
    image:
      repository: inecs/ovirt-api-simulator
      pullPolicy: IfNotPresent
    port: 8080
    healthPath: /health/ready
    replicas: 1
    db:
      user: ovirt
      password: ovirt
      name: ovirt_simulator
    env:
      OVIRT_SERIES: "4.5"
      APP_PORT: "8080"
    migrate:
      enabled: true
      command: ["python", "-m", "app.db.migrate_cli"]
    seed:
      enabled: true
      skipIfSql: "SELECT 1 FROM ov_datacenters LIMIT 1"
      command: ["python", "-m", "app.ovirt.seed_cli", "--profile", "minimal"]
    resources: {}

  vmware:
    enabled: true
    image:
      repository: inecs/vmware-api-simulator
      pullPolicy: IfNotPresent
    port: 8080
    healthPath: /health/ready
    replicas: 1
    db:
      user: vmware
      password: vmware
      name: vmware_simulator
    env:
      ENABLE_PVE_STUB: "false"
      SEED_VSPHERE_PROFILE: small
      APP_PORT: "8080"
      TASK_WORKER_CONCURRENCY: "2"
      SIMULATION_TIME_SCALE: "10"
    migrate:
      enabled: true
      command: ["python", "-m", "app.db.migrate_cli"]
    seed:
      enabled: true
      skipIfSql: "SELECT 1 FROM vsphere_objects LIMIT 1"
      command: ["python", "-m", "app.simulation.seed_cli"]
      env:
        SEED_PROFILE: small
        SEED_VSPHERE_PROFILE: small
    resources: {}

  openstack:
    enabled: true
    image:
      repository: inecs/openstack-api-simulator
      pullPolicy: IfNotPresent
    port: 8080
    healthPath: /health/ready
    replicas: 1
    db:
      user: openstack
      password: openstack
      name: openstack_simulator
    env:
      APP_PORT: "8080"
      TASK_WORKER_CONCURRENCY: "2"
      SIMULATION_TIME_SCALE: "10"
    migrate:
      enabled: true
      command: ["python", "-m", "app.db.migrate_cli"]
    seed:
      enabled: true
      skipIfSql: "SELECT 1 FROM os_projects LIMIT 1"
      command: ["python", "-m", "app.openstack.seed_cli", "--profile", "minimal"]
    resources: {}

# Ingress hosts — edit here. Each enabled entry creates one Ingress.
# Default hosts: <name>.lab.local — for Let's Encrypt use a public DNS name.
ingressClassName: nginx

ingresses:
  proxmox:
    enabled: true
    className: ""  # falls back to ingressClassName
    host: proxmox.lab.local
    path: /
    pathType: Prefix
    service: proxmox
    port: 8006
    tls:
      - secretName: simulators-proxmox-tls
        hosts: [proxmox.lab.local]
    annotations:
      # Keep API JSON/XML bodies (404/405/401). Do not list 404/405 here —
      # cluster custom-http-errors would otherwise replace them with branded HTML.
      nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
      nginx.ingress.kubernetes.io/custom-http-errors: "502,503"

  ovirt:
    enabled: true
    className: ""
    host: ovirt.lab.local
    path: /
    pathType: Prefix
    service: ovirt
    port: 8080
    tls:
      - secretName: simulators-ovirt-tls
        hosts: [ovirt.lab.local]
    annotations:
      nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
      nginx.ingress.kubernetes.io/custom-http-errors: "502,503"

  vmware:
    enabled: true
    className: ""
    host: vmware.lab.local
    path: /
    pathType: Prefix
    service: vmware
    port: 8080
    tls:
      - secretName: simulators-vmware-tls
        hosts: [vmware.lab.local]
    annotations:
      nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
      nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
      nginx.ingress.kubernetes.io/configuration-snippet: |
        proxy_set_header X-VMware-Service "vcenter";
        proxy_set_header X-Forwarded-Port "443";

  openstack:
    enabled: true
    className: ""
    host: openstack.lab.local
    path: /
    pathType: Prefix
    service: openstack
    port: 8080
    tls:
      - secretName: simulators-openstack-tls
        hosts: [openstack.lab.local]
    annotations:
      nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
      nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
      nginx.ingress.kubernetes.io/configuration-snippet: |
        proxy_set_header X-OpenStack-Service "https";
        proxy_set_header X-Forwarded-Port "443";

  # Optional extras — same shape as above, e.g.:
  # ovirt-ui:
  #   enabled: true
  #   host: ovirt-ui.lab.local
  #   service: ovirt
  #   port: 8080
  #   tls:
  #     - secretName: simulators-ovirt-ui-tls
  #       hosts: [ovirt-ui.lab.local]
  #   annotations:
  #     nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
  #     nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
  # openstack-keystone:
  #   enabled: true
  #   host: keystone.lab.local
  #   service: openstack
  #   port: 8080
  #   tls:
  #     - secretName: simulators-keystone-tls
  #       hosts: [keystone.lab.local]
  #   annotations:
  #     nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
  #     nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
  #     nginx.ingress.kubernetes.io/configuration-snippet: |
  #       proxy_set_header X-OpenStack-Service "keystone";

# TLS via cert-manager + Let's Encrypt (HTTP-01).
# Requires cert-manager in the cluster. Hosts must resolve publicly for ACME.
certManager:
  enabled: true
  # Create ClusterIssuer resources from this chart (false = use existing letsencrypt-prod).
  createClusterIssuer: false
  createStagingIssuer: true
  email: ""  # required when createClusterIssuer=true
  issuerName: letsencrypt-prod
  server: https://acme-v02.api.letsencrypt.org/directory
  stagingIssuerName: letsencrypt-staging
  stagingServer: https://acme-staging-v02.api.letsencrypt.org/directory
  useStaging: false
  solverIngressClassName: nginx

seedJobs:
  # post-install / post-upgrade Jobs; skipIfSql avoids re-seeding when data exists
  enabled: true
  backoffLimit: 3
  ttlSecondsAfterFinished: 600