# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `valkey:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode), every operationally-
# meaningful value is configurable; cluster overlays in clusters/<sovereign>/
# may override any of these without rebuilding the Blueprint OCI artifact.

global:
  # When set, ALL image pulls in this chart route through this registry.
  # Used post-handover when the Sovereign's own Harbor takes over the
  # proxy_cache role from contabo's central Harbor. Empty = no rewrite
  # (image references use upstream defaults). The upstream valkey subchart
  # (Bitnami-style) exposes `valkey.image.registry` for registry override.
  # Per-Sovereign overlays wire that alongside this value. Tracked under #560.
  imageRegistry: ""

catalystBlueprint:
  upstream: { chart: valkey, version: "5.5.1", repo: "https://charts.bitnami.com/bitnami" }

# ─── Upstream chart values (subchart key: valkey) ─────────────────────────
# `helm dependency build` resolves the upstream as a subchart; values here
# under the `valkey:` key flow into that subchart unchanged.
valkey:
  # Replication architecture (one primary + N replicas). Solo Sovereigns
  # use replicaCount: 0 to keep the StatefulSet shape stable while
  # paying for only one pod. Multi-node host clusters bump replicaCount
  # via cluster overlay.
  architecture: replication

  primary:
    replicaCount: 1
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        memory: 512Mi
    # 1Gi PVC — adequate for session/state caches on solo Sovereigns;
    # cluster overlays bump for higher-volume Applications.
    persistence:
      enabled: true
      size: 1Gi

  replica:
    # Default 0 replicas for solo Sovereigns. Cluster overlays bump to
    # 2-3 for HA on multi-node host clusters.
    replicaCount: 0
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        memory: 512Mi
    persistence:
      enabled: true
      size: 1Gi

  # Password auth OFF by default (TBD-V12 #2003, 2026-05-20).
  #
  # ROOT CAUSE (caught on t38 walk 2026-05-20):
  #   The bp-newapi chart's REDIS_CONN_STRING default is the
  #   passwordless URL `redis://valkey-primary.valkey.svc.cluster.local:
  #   6379` (platform/newapi/chart/values.yaml `valkey.url`). On every
  #   freshly franchised Sovereign the newapi Pod CrashLoopBackOff'd 45×
  #   on the Redis ping probe with `NOAUTH Authentication required`,
  #   blocking every Sandbox session (qwen-code + MCP) — the
  #   Pillar-4 verifier-killing bug.
  #
  # CONTRACT MATCH:
  #   The auth contract is set by the CONSUMER (bp-newapi). bp-newapi
  #   ships a passwordless connection string by default; the only way
  #   to make that work without churning every consumer chart is to
  #   flip bp-valkey's default to allow empty password. Other consumers
  #   that DO supply a password tolerate the change:
  #     - products/catalyst sme-services (auth.yaml + gateway.yaml)
  #       read VALKEY_PASSWORD via secretKeyRef `optional: true` and
  #       fall back to the no-auth connect path in
  #       core/services/shared/db/valkey.go when the value is empty.
  #     - products/catalyst projector wraps the password Secret mount
  #       in `{{- with .Values.services.projector.valkey.passwordSecret
  #       }}` so an absent Secret just disables the password env var.
  #
  # FOLLOW-UP (deferred, scope of #1986 Pillar 4):
  #   Make bp-newapi read the bp-valkey-generated password via Secret
  #   reflection (mirror of the bp-valkey password Secret into the
  #   newapi namespace, env-var REDIS_PASSWORD wired into the
  #   conn-string template). At that point flip this back to
  #   `auth.enabled: true`. Tracked under issue #2003.
  #
  # Cluster overlays MAY still re-enable auth by setting
  # `valkey.auth.enabled: true` (and supplying matching consumer
  # password wiring) on per-Sovereign installs.
  auth:
    enabled: false

  # NetworkPolicy from upstream chart — already enabled by default;
  # restate to make the Catalyst posture explicit. (Default-deny is
  # appropriate for a cache that should only be consumed in-cluster.)
  networkPolicy:
    enabled: true

  # Prometheus exporter sidecar + ServiceMonitor — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 and docs/BLUEPRINT-AUTHORING.md
  # §11.2 (Observability toggles must default false): the
  # `monitoring.coreos.com/v1` CRDs that back ServiceMonitor /
  # PrometheusRule ship with kube-prometheus-stack — an Application
  # Blueprint installed AFTER the bootstrap-kit. Defaulting any of these
  # toggles `true` would render a CR on a fresh Sovereign before the CRD
  # exists, and the apiserver would reject it. Operator opts in via
  # per-cluster overlay (issue #182).
  metrics:
    enabled: false
    serviceMonitor:
      enabled: false
    prometheusRule:
      enabled: false

# ─── Catalyst-managed overlay values consumed by templates/ ───────────────
# (None today — the wrapper currently ships no Catalyst-authored
# templates. Reserved for future NetworkPolicy / RBAC overlays once the
# bootstrap-kit security tier (W2.K3) is fully reconciled.)
