# bp-openova-flow-server — Catalyst Blueprint chart values.
#
# Per docs/INVIOLABLE-PRINCIPLES.md:
#   #4   never hardcode — image tag, replicas, ring capacity, hostname
#   #4a  SHA-pinned image tag; the chart fails fast on empty tag
#
# Per MIRROR-EVERYTHING the image reference goes through the mothership
# Harbor proxy at harbor.openova.io/proxy-ghcr/...

catalystBlueprint:
  upstream:
    chart: ""
    version: ""
    repo: ""

flowServer:
  enabled: true
  # Canonical workload name. Override only when running >1 server in
  # the same namespace (rare; one per primary cluster per ADR-0001 §11).
  workloadName: openova-flow-server
  replicas: 1
  image:
    # Mothership Harbor pull-through proxy. The Sovereign-local Harbor
    # rewrites this prefix to its own proxy at registry-pivot time per
    # platform/self-sovereign-cutover/chart/.
    # Direct ghcr.io path mirrors the catalyst-api/catalyst-ui pattern:
    # kubelet auths with the ghcr-pull imagePullSecret (reflected by
    # bp-reflector into every namespace that needs it), and the
    # node's containerd registries.yaml transparently rewrites
    # ghcr.io → harbor.openova.io/proxy-ghcr/ on the wire so the
    # mothership Harbor still caches the bytes (MIRROR-EVERYTHING
    # preserved at the containerd layer). Using `harbor.openova.io/
    # proxy-ghcr/...` here directly bypassed that rewrite AND Harbor
    # doesn't currently carry ghcr.io auth for private packages —
    # pods CrashLoopped on `not found` (live regression on prov #34,
    # 2026-05-11).
    repository: ghcr.io/openova-io/openova/openova-flow-server
    # SHA-pinned by CI's build-openova-flow-server.yaml (seds this
    # value with the short-SHA). Default `latest` lets Blueprint
    # Release smoke-render the chart with default values before the
    # first CI run has populated a SHA. Bootstrap-kit HR overrides at
    # install time so runtime always pulls a deterministic image.
    tag: "fab091f"
    pullPolicy: IfNotPresent
  port: 8080
  # Per-flow ring buffer capacity (FlowMessage envelopes). The server
  # folds the ring to a snapshot on demand; FIFO drop on overflow.
  ringCapacity: 4096

  service:
    type: ClusterIP
    port: 80
    targetPort: 8080

  # Cilium Gateway HTTPRoute. Disabled by default; per-Sovereign
  # overlay flips on with hostname `openova-flow.<sov-fqdn>`. Server
  # is reachable cross-cluster via this gateway over public HTTPS.
  httproute:
    enabled: false
    hostname: ""
    gatewayRef:
      name: ""
      namespace: kube-system

  resources:
    requests:
      cpu: 25m
      memory: 64Mi
    limits:
      cpu: 500m
      memory: 256Mi

  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    seccompProfile:
      type: RuntimeDefault

  containerSecurityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop: [ALL]

  imagePullSecrets:
    - name: ghcr-pull

  serviceAccount:
    create: true
    name: ""

  nodeSelector:
    kubernetes.io/os: linux
  tolerations: []

  # Persistence backend — "pg" (default, CNPG-backed) or "memory"
  # (dev only, lost on restart). The default is overridden ONLY when
  # an operator explicitly wants a stateless dev mode; production
  # MUST be pg.
  backend: pg

# CNPG-managed Postgres cluster for the flow server. Provisioned by
# templates/cnpg-cluster.yaml when bp-cnpg's CRDs are present. Mirrors
# the bp-gitea + bp-harbor pattern of one Cluster CR per blueprint.
postgres:
  enabled: true
  cluster:
    name: openova-flow-pg
    namespace: ""    # defaults to .Release.Namespace
    instances: 1
    pgVersion: "16"
    database: openova_flow
    owner: openova_flow
    storageSize: "5Gi"
    storageClass: local-path
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 1
        memory: 512Mi
