# Catalyst Blueprint wrapper metadata — read by the bootstrap-kit installer.
# The installer combines the upstream chart reference below with the values
# overlay also in this file when running 'helm install'.

catalystBlueprint:
  upstream: { chart: cert-manager, version: "1.16.2", repo: "https://charts.jetstack.io" }

# Catalyst-curated cert-manager values per platform/cert-manager/README.md.
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.

crds:
  enabled: true
prometheus:
  enabled: true
  servicemonitor:
    enabled: true
resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    memory: 256Mi
webhook:
  resources:
    requests:
      cpu: 50m
      memory: 64Mi

# ── Catalyst-managed ClusterIssuers (templates/clusterissuer-letsencrypt-dns01.yaml) ──
# The Catalyst-curated wrapper ships TWO ClusterIssuers and lets the
# operator pick the active one via these values:
#
#   - letsencrypt-dns01-prod  (TARGET STATE: wildcard-capable, requires the
#                              cert-manager-dynadot-webhook image — disabled
#                              by default until that webhook is built)
#   - letsencrypt-http01-prod (INTERIM: explicit hostnames only, no
#                              wildcards, works today via Cilium ingress)
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 ("never hardcode") all knobs are
# runtime-configurable; cluster overlays in clusters/<sovereign>/ may set
# certManager.issuers.* to flip between issuers without rebuilding the
# Blueprint OCI artifact.
certManager:
  issuers:
    # ACME account email used for renewal notifications. Per Sovereign
    # convention this is ops@<pool-domain>.
    email: ops@openova.io
    # Production Let's Encrypt directory. Set to the staging URL during
    # bring-up to avoid Let's Encrypt rate limits:
    #   https://acme-staging-v02.api.letsencrypt.org/directory
    acmeServer: https://acme-v02.api.letsencrypt.org/directory
    dns01:
      # Disabled until cmd/cert-manager-dynadot-webhook ships. See the
      # runbook in templates/clusterissuer-letsencrypt-dns01.yaml.
      enabled: false
      webhookGroupName: acme.dynadot.openova.io
      webhookSolverName: dynadot
    http01:
      enabled: true
      ingressClassName: cilium
