image:
  repository: forgejo.coulomb.social/coulomb/coulomb-social
  tag: ""
  pullPolicy: IfNotPresent

replicaCount: 1

service:
  type: ClusterIP
  port: 80
  targetPort: 8000

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: 1000m
    memory: 1Gi

# Secrets (SECRET_KEY, DATABASE_URL, OIDC_*, USER_ENGINE_PROXY_SECRET, …)
envSecretName: coulomb-social-env

env:
  DJANGO_SETTINGS_MODULE: coulomb_social.settings.prod
  ALLOWED_HOSTS: coulomb.social,localhost
  CSRF_TRUSTED_ORIGINS: https://coulomb.social
  DEFAULT_TENANT_ID: "tenant:coulomb"
  OIDC_ENABLED: "true"
  OIDC_ISSUER: https://kc.coulomb.social
  OIDC_CLIENT_ID: coulomb-social
  OIDC_REDIRECT_URI: https://coulomb.social/auth/callback/
  OIDC_SCOPES: "openid profile email groups"
  USER_ENGINE_APPLICATION_ID: coulomb-social
  USER_ENGINE_EXPECTED_AUDIENCE: user-engine-portal
  # USER_ENGINE_BASE_URL set via secret or here when stable
  USER_ENGINE_BASE_URL: https://users.92-205-62-239.nip.io

probes:
  enabled: true
  path: /healthz
  port: 8000
  hostHeader: coulomb.social
  liveness:
    initialDelaySeconds: 30
    periodSeconds: 30
    timeoutSeconds: 5
    failureThreshold: 3
  readiness:
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3

persistence:
  media:
    enabled: false

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 10001
  runAsGroup: 10001
  fsGroup: 10001

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: false
  capabilities:
    drop: ["ALL"]

nodeSelector: {}
tolerations: []
affinity: {}