image:
  repository: gitea.coulomb.social/coulomb/vergabe-teilnahme
  tag: ""             # required; pinned via helm/vergabe-teilnahme-values.yaml
  pullPolicy: IfNotPresent

replicaCount: 1       # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes)

service:
  type: ClusterIP
  port: 80
  targetPort: 8000

resources:
  requests:
    cpu: 100m
    memory: 256Mi
  limits:
    cpu: 1000m
    memory: 1Gi

# Env from the K8s Secret created out-of-band (vergabe-teilnahme-env).
# Holds SECRET_KEY + DATABASE_URL. Created by the operator with kubectl
# create secret generic vergabe-teilnahme-env --from-literal=...
envSecretName: vergabe-teilnahme-env

# Non-secret env injected directly into the Deployment.
env:
  DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
  ALLOWED_HOSTS: vergabe-teilnahme.whywhynot.de,localhost
  CSRF_TRUSTED_ORIGINS: https://vergabe-teilnahme.whywhynot.de

probes:
  enabled: true
  path: /health/
  port: 8000
  hostHeader: vergabe-teilnahme.whywhynot.de   # must be in ALLOWED_HOSTS
  liveness:
    initialDelaySeconds: 30
    periodSeconds: 30
    timeoutSeconds: 5
    failureThreshold: 3
  readiness:
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3

# PVC for media uploads is deferred — Django MEDIA is in-pod ephemeral
# for v1. Switch to true + a storageClass once media uploads land.
persistence:
  media:
    enabled: false
    storageClass: local-path
    size: 5Gi
    accessMode: ReadWriteOnce

podSecurityContext:
  runAsNonRoot: true
  runAsUser: 999     # matches the 'app' user in the Dockerfile
  runAsGroup: 999
  fsGroup: 999

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: false   # whitenoise + collectstatic write to /app
  capabilities:
    drop: ["ALL"]

nodeSelector: {}
tolerations: []
affinity: {}