# Production overrides for coulomb-social.
# Non-secret values only. Secrets live in K8s Secret coulomb-social-env.

image:
  repository: forgejo.coulomb.social/coulomb/coulomb-social
  tag: "1139a6d30eee"
  digest: "sha256:7906f461bc8d2d5204fd4fde67a251850f725b914452a66172919d6853672ed5"

# Public host: app.coulomb.social (parallel to Bubble on apex coulomb.social).
# Apex cutover is deferred until data + self-registration are ready.
env:
  DJANGO_SETTINGS_MODULE: coulomb_social.settings.prod
  ALLOWED_HOSTS: app.coulomb.social,localhost
  CSRF_TRUSTED_ORIGINS: https://app.coulomb.social
  CONTENT_ROOT: /app/var/content
  DEFAULT_TENANT_ID: "tenant:coulomb"
  OIDC_ENABLED: "true"
  OIDC_ISSUER: https://kc.coulomb.social
  OIDC_CLIENT_ID: coulomb-social
  OIDC_REDIRECT_URI: https://app.coulomb.social/auth/callback/
  OIDC_SCOPES: "openid profile email groups"
  USER_ENGINE_BASE_URL: https://users.coulomb.social
  USER_ENGINE_APPLICATION_ID: coulomb-social
  USER_ENGINE_EXPECTED_AUDIENCE: user-engine-portal
  NETKINGDOM_REGISTRATION_URL: https://users.92-205-62-239.nip.io/register

probes:
  hostHeader: app.coulomb.social
  path: /healthz

# One writable local-path volume; Recreate prevents concurrent old/new writers.
replicaCount: 1
deploymentStrategy: Recreate
persistence:
  content:
    enabled: true
    storageClass: local-path
    size: 2Gi
    mountPath: /app/var/content
    retain: true

# Wave-2 right-sizing (CSOC-WP-0017-T01, 2026-10-21 node budget): 7d p95
# 0.4m CPU / 146Mi. Limits stay at the chart defaults (1000m/1Gi).
resources:
  requests:
    cpu: 15m
    memory: 176Mi
  limits:
    cpu: 1000m
    memory: 1Gi