# Production overrides for reuse-surface federation hub.
# Runtime secrets: ExternalSecret reuse-surface-runtime -> Secret reuse-surface-env
# (OpenBao path platform/workloads/reuse/reuse-surface/runtime-secrets, CCR-2026-0005).
# See docs/reuse-surface-on-railiance01.md#runtime-secrets

image:
  # Was "e3ae22e" — a Gitea-era tag that does NOT exist in the Forgejo registry
  # (tags/list: latest, main-b035664, main-bca7165, main-f9d957a). The pinned
  # value could not be pulled, so any restart risked ImagePullBackOff.
  # main-b035664 is a CI build of reuse-surface main and includes the compose
  # hardening that keeps one malformed member index from 500-ing the federated
  # endpoint. See REUSE-WP-0020-T05.
  tag: "main-6cbc862"
  # Founder-approved CUST81 phase A: digest takes precedence over the legacy tag.
  repository: forgejo.coulomb.social/coulomb/reuse-surface
  digest: sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0

# Wave-2 right-sizing (REUSE-WP-0026-T01, 2026-10-21 node budget): pod
# aggregate 110m/288Mi -> 10m/80Mi; 7d p95 2.1m CPU; split by
# per-pod p95 x1.15 (main ~51Mi -> 64Mi, landing ~5Mi -> 16Mi). Limits unchanged.
resources:
  requests:
    cpu: 5m
    memory: 64Mi
  limits:
    cpu: 500m
    memory: 512Mi

landing:
  enabled: true
  resources:
    requests:
      cpu: 5m
      memory: 16Mi
    limits:
      cpu: 50m
      memory: 64Mi
  title: "REUSE federation endpoint"
  eyebrow: "reuse.coulomb.social"
  body: "This is the Railiance REUSE capability federation service. It is an API endpoint for automated clients and operators; there is no browser login for this service."
  buttonLabel: "Open federated index"
  primaryUrl: "/v1/federated"
  links:
    - label: "Health check"
      url: "/health"
    - label: "Federated capability index"
      url: "/v1/federated"
    - label: "Operator runbook"
      url: "https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/main/docs/reuse-surface-on-railiance01.md"

ingress:
  redirectHttp:
    enabled: true

# Exact founder-approved private metadata routing; credential delivery is separate.
authSourceAllowlist:
  REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN:
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738
  - https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738