# Helm values for a self-hosted deployment on AWS EKS.
#
# Complete every REPLACE_ME before you install; a value you cannot fill in is
# a prerequisite that is not ready yet. Keep this file: you reuse it for
# upgrades. Everything not set here is a chart default, tuned for the
# supported 32 vCPU / 128 GiB node.

# The Kubernetes service account that gives the application access to AWS
# resources. Create it in the application namespace and bind it through EKS
# Pod Identity to the IAM role for the bucket and the KMS key.
serviceAccount:
  create: false
  name: REPLACE_ME

# The application database and its three roles, created before the install
# (see "Create the database and its roles" in the EKS guide).
postgres:
  host: REPLACE_ME
  database: REPLACE_ME
  appRole: REPLACE_ME
  appPassword: REPLACE_ME
  definerRole: REPLACE_ME
  migratorRole: REPLACE_ME
  migratorPassword: REPLACE_ME

# The AWS resources from the bill of materials, in one block. From these the
# chart derives everything AWS-shaped:
#   - object storage at s3://<bucket>[/<prefix>], reached through the service
#     account's IAM role (no static keys);
#   - a gp3 StorageClass on the EBS CSI driver, encrypted with your KMS key,
#     and the data root claimed from it as a raw block volume on the node
#     (100 GiB by default; raise vfs.dataRoot.size later and upgrade, the
#     filesystem grows without a restart);
#   - the AWS region for SDK calls (the IAM role supplies credentials, not a
#     region);
#   - the sandbox wiring for EKS: the Kata runtime you installed before the
#     platform, reached through the node's containerd, with the release
#     installing no Kata of its own.
# Anything set explicitly elsewhere in this file wins over a derived value.
infrastructure:
  platform: aws
  aws:
    region: REPLACE_ME
    # The bucket name only. The optional key prefix keeps several
    # deployments apart in one bucket.
    s3BucketName: REPLACE_ME
    # s3KeyPrefix: ""
    # Full ARN of the KMS key that encrypts the data root volumes. The EBS
    # CSI driver's IAM identity must be granted use of this key (see the KMS
    # grant callout in the EKS guide) or the volume never provisions.
    kmsKeyArn: REPLACE_ME

api:
  config:
    # Encryption keys, yours to generate and to keep. Generate a long random
    # string for each, for example with `openssl rand -hex 32`.
    # secretsKeys encrypts the credentials the platform stores in its
    # database: model platform keys, integration and OAuth tokens. The
    # database outlives the cluster, and without the exact key its encrypted
    # contents cannot be decrypted — the database may become unusable.
    # projectPortabilityKeys protects exported project archives the same
    # way. Keep this file backed up somewhere safe outside the cluster.
    secretsKeys: '{"v1":"REPLACE_ME"}'
    projectPortabilityKeys: '{"active":"REPLACE_ME"}'

    # Your hostname as https://<hostname>, and the OIDC application you
    # registered against it.
    auth:
      allowedOrigins: '["https://REPLACE_ME"]'
      webAppUrl: https://REPLACE_ME
      oidc:
        server: REPLACE_ME # your provider's discovery URL; the bare issuer URL also works
        clientId: REPLACE_ME
        clientSecret: REPLACE_ME
        redirectUri: https://REPLACE_ME/api/v1/auth/callback
    realtime:
      webhookPublicBaseUrl: https://REPLACE_ME

# Ingress for the AWS Load Balancer Controller, with the ACM certificate
# auto-discovered from the host; adapt the class and annotations to your
# controller. 'scheme: internal' keeps the load balancer private; the health
# check must accept 200-404, and the idle timeout keeps websocket and
# streaming connections open for the length of an agent run.
ingress:
  className: alb
  host: REPLACE_ME
  annotations:
    alb.ingress.kubernetes.io/scheme: internal
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/success-codes: 200-404
    alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=3600