## Default values for vmware-api-simulator.
## Image: https://hub.docker.com/r/inecs/vmware-api-simulator

replicaCount: 1

image:
  repository: inecs/vmware-api-simulator
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  create: true
  annotations: {}
  name: ""

podAnnotations: {}
podLabels: {}

podSecurityContext:
  fsGroup: 10001

securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  runAsGroup: 10001
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
  readOnlyRootFilesystem: true

service:
  type: ClusterIP
  # Internal app port. Publish VMware service ports via Ingress/Service separately.
  port: 8080

## Application environment (non-secret).
config:
  logLevel: INFO
  enablePveStub: "false"
  # Optional cold-start contract path (vSphere majors use evidence + UI hot-swap).
  contractSnapshot: ""
  contractFallback: error
  taskWorkerConcurrency: 2
  taskLeaseSeconds: "30"
  simulationTimeScale: "10"
  requestIdHeader: X-Request-ID
  compatibilityEvidence: /app/evidence/vsphere-8.0.2.json

## Secrets. Prefer existingSecret in production.
secret:
  # Create a Secret from the values below when existingSecret is empty.
  create: true
  existingSecret: ""
  # Keys expected in an existing secret (when existingSecret is set):
  #   DATABASE_URL, TICKET_SIGNING_KEY
  ticketSigningKey: "change-me-to-a-long-random-secret"
  # Used only when postgresql.enabled=true and databaseUrl is empty.
  # The chart builds postgresql://USER:PASSWORD@HOST:5432/DB
  databaseUrl: ""

## Bundled PostgreSQL (official image — same major as docker-compose.release.yml).
postgresql:
  enabled: true
  image:
    repository: postgres
    tag: "17.5-bookworm"
    pullPolicy: IfNotPresent
  auth:
    username: vmware
    password: vmware
    database: vmware_simulator
  persistence:
    enabled: true
    size: 8Gi
    storageClass: ""
  resources:
    requests:
      cpu: 50m
      memory: 128Mi
    limits:
      memory: 512Mi

## External database when postgresql.enabled=false.
## Provide either full URL (secret.databaseUrl / existingSecret) or discrete fields.
externalDatabase:
  host: ""
  port: 5432
  user: vmware
  password: ""
  database: vmware_simulator
  # Optional existing secret with key database-password (or set password above).
  existingSecret: ""
  existingSecretPasswordKey: database-password

## Database migrations.
## Default: idempotent initContainer on the Deployment (recommended).
## Set asJob=true to run a standalone Job instead.
migrate:
  enabled: true
  asJob: false
  backoffLimit: 20
  activeDeadlineSeconds: 600
  resources: {}

## Optional post-install seed Job (lab data).
seed:
  enabled: false
  profile: small
  backoffLimit: 3
  resources: {}

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: "1"
    memory: 1Gi

livenessProbe:
  httpGet:
    path: /health/live
    port: http
  initialDelaySeconds: 10
  periodSeconds: 10
  timeoutSeconds: 3
  failureThreshold: 3

readinessProbe:
  httpGet:
    path: /health/ready
    port: http
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 3
  failureThreshold: 8

nodeSelector: {}
tolerations: []
affinity: {}

## Ingress + TLS via cert-manager (Let's Encrypt).
ingress:
  enabled: false
  className: nginx
  annotations: {}
  # Extra annotations merged after cert-manager ones when certManager.enabled.
  hosts:
    - host: vmware-sim.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: vmware-api-simulator-tls
      hosts:
        - vmware-sim.example.com

## cert-manager ClusterIssuers for Let's Encrypt.
## Requires cert-manager already installed in the cluster.
certManager:
  enabled: false
  # Create ClusterIssuer resources from this chart.
  createClusterIssuer: true
  email: admin@example.com
  # Production issuer (used by Ingress by default).
  issuerName: letsencrypt-prod
  server: https://acme-v02.api.letsencrypt.org/directory
  # Staging issuer (optional; useful for dry-runs).
  createStagingIssuer: true
  stagingIssuerName: letsencrypt-staging
  stagingServer: https://acme-staging-v02.api.letsencrypt.org/directory
  # Which issuer the Ingress annotation should reference.
  useStaging: false
  # ACME HTTP-01 solver ingress class (usually same as ingress.className).
  solverIngressClassName: ""