# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `gitea:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace; the upstream chart's own internal `gitea:`
#      section appears as `gitea.gitea` here, which is correct).

global:
  # When set, ALL image pulls in this chart route through this registry.
  # Used post-handover when the Sovereign's own Harbor takes over the
  # proxy_cache role from contabo's central Harbor. Empty = no rewrite
  # (image references use upstream defaults). The upstream Gitea subchart
  # exposes `gitea.image.registry` for registry override.
  # Per-Sovereign overlays wire that alongside this value. Tracked under #560.
  imageRegistry: ""

catalystBlueprint:
  upstream: { chart: gitea, version: "10.5.0", repo: "https://dl.gitea.com/charts" }

# ─── Upstream chart values (subchart key: gitea) ──────────────────────────
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.
gitea:
  gitea:
    admin:
      username: gitea_admin
      email: gitea-admin@catalyst.local
      # existingSecret — point the upstream chart at the Catalyst-curated
      # `gitea-admin-secret` (templates/admin-secret.yaml). The upstream
      # chart reads `username` + `password` keys from this Secret to seed
      # the admin user (init.yaml's `gitea admin user create`).
      #
      # Without this, the upstream chart falls back to its baked-in default
      # password `r8sA8CPHD9!bt6d` on values:gitea.gitea.admin.password —
      # every fresh Sovereign would ship the same admin credentials,
      # which is a credential-hygiene catastrophe.
      #
      # The contract Secret shape (`username` + `password`) is also what
      # bp-self-sovereign-cutover Step 1 (gitea-mirror) reads to push the
      # upstream openova/openova mirror into the local Gitea (issue #830
      # Bug 2). Sharing the contract here means there is exactly ONE
      # source of truth for the admin credentials on the Sovereign.
      existingSecret: gitea-admin-secret
    config:
      APP_NAME: Catalyst Gitea
      server:
        DOMAIN: gitea.catalyst.local
        ROOT_URL: https://gitea.catalyst.local
      # Wire CNPG-managed Postgres (replaces bitnami subchart).
      # Password is injected at runtime via additionalConfigFromEnvs below.
      database:
        DB_TYPE: postgres
        HOST: gitea-pg-rw.gitea.svc.cluster.local:5432
        NAME: gitea
        USER: gitea
        SSL_MODE: disable
    # Gitea built-in metrics + ServiceMonitor — DEFAULT OFF.
    #
    # Per docs/INVIOLABLE-PRINCIPLES.md #4 and
    # docs/BLUEPRINT-AUTHORING.md §11.2 (Observability toggles must
    # default false). The upstream gitea chart's
    # `gitea.gitea.metrics.serviceMonitor.enabled` renders a
    # monitoring.coreos.com/v1 ServiceMonitor which the apiserver rejects
    # on a fresh Sovereign before bp-kube-prometheus-stack ships the CRD.
    # Upstream already defaults to false — set explicitly so a future
    # upstream bump cannot regress this. Operator opts in via per-cluster
    # overlay (issue #182).
    metrics:
      enabled: false
      serviceMonitor:
        enabled: false
    # Inject DB password from the reflector-managed gitea-database-secret.
    # Reflector copies `gitea-pg-app` (CNPG-generated) into
    # `gitea-database-secret`; the `password` key holds the postgres user
    # password. GITEA__database__PASSWD overrides the empty value in
    # gitea.config.database above.
    additionalConfigFromEnvs:
      - name: GITEA__database__PASSWD
        valueFrom:
          secretKeyRef:
            name: gitea-database-secret
            key: password
  # Bitnami postgresql subchart DISABLED — bitnami/* and bitnamilegacy/*
  # images are unavailable via the Harbor proxy_cache (DockerHub returns
  # text/html for these namespaces — image pull fails with "unexpected media
  # type text/html"). Replaced by bp-cnpg-managed Cluster
  # (templates/cnpg-cluster.yaml + templates/database-secret.yaml), the
  # same pattern used by bp-harbor. Fixes ImagePullBackOff on otech22.
  postgresql-ha:
    enabled: false
  postgresql:
    enabled: false
  redis-cluster:
    enabled: false
  valkey-cluster:
    enabled: false
  persistence:
    enabled: true
    size: 20Gi
  # Upstream chart Ingress — DISABLED. Catalyst routes via Cilium Gateway
  # API (see top-level `gateway:` block below). Issue #387.
  ingress:
    enabled: false

# ─── Catalyst-curated admin Secret (issue #830 Bug 2) ────────────────────
# Templated `gitea-admin-secret` lives in templates/admin-secret.yaml.
# Created on first install with a randAlphaNum 32-char password; preserved
# across reconciles via Helm `lookup`. Consumed by:
#   - upstream gitea subchart via gitea.gitea.admin.existingSecret above
#     (init container reads GITEA_ADMIN_USERNAME / GITEA_ADMIN_PASSWORD
#     from this Secret to seed the Gitea admin user).
#   - bp-self-sovereign-cutover Step 1 (gitea-mirror) via the per-step
#     PodSpec ConfigMap (cutover-step-01-gitea-mirror) — the Job pushes
#     the upstream openova/openova mirror into the local Gitea using
#     these credentials.
#
# Per-Sovereign overrides are operationally meaningful only when the
# operator has a documented reason to fork the username (default
# gitea_admin matches the upstream chart's expected admin login).
giteaAdmin:
  secretName: "gitea-admin-secret"
  username: "gitea_admin"

# ─── CNPG-managed Postgres cluster for Gitea ──────────────────────────────
# Per the Harbor pattern (templates/cnpg-cluster.yaml in bp-harbor), Gitea's
# postgres is provisioned by CNPG rather than the Bitnami subchart. The
# CNPG Cluster creates a `gitea-pg-app` Secret; database-secret.yaml uses
# reflector to mirror it into `gitea-database-secret`, which the Gitea
# deployment reads via a secretKeyRef for GITEA__database__PASSWD.
postgres:
  cluster:
    name: gitea-pg
    # namespace defaults to .Release.Namespace (gitea)
    namespace: ""
    instances: 1
    pgVersion: "16"
    database: gitea
    owner: gitea
    storageSize: 5Gi
    storageClass: local-path
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        cpu: 500m
        memory: 512Mi

# ─── Catalyst HTTPRoute (Cilium Gateway API, issue #387) ──────────────────
# Replaces the upstream chart's networking.k8s.io/v1.Ingress on Sovereigns.
# Per-Sovereign overlay supplies `gateway.host` (e.g. git.<sovereign-fqdn>).
# parentRef defaults to cilium-gateway/kube-system, the per-Sovereign
# Gateway shipped by clusters/_template/bootstrap-kit/01-cilium.yaml.
gateway:
  enabled: true
  # host: git.<sovereign-fqdn> — REQUIRED, no default per Inviolable Principle #4
  host: ""
  path: "/"
  # Backend Service — defaults to <release>-gitea-http (gitea subchart Service)
  backendService: ""
  backendPort: 3000
  parentRef:
    name: cilium-gateway
    namespace: kube-system
    # sectionName intentionally empty — multi-zone Sovereigns rename HTTPS
    # listeners to https-<sanitised-zone> (e.g. https-omani-works), so
    # pinning sectionName: https breaks NoMatchingListener. Cilium Gateway
    # matches by hostname filter. See PR #1888 / TBD-A40 / issue #1902.
    sectionName: ""
